Related: Consumer privacy notice
Privacy is important to Aero Payments, Inc. (“Aeropay” or “we” or “us”), and we want you to be familiar with how we collect, use, and disclose information. This Privacy Policy describes our practices in connection with the information collected through the Aeropay platform (the “Platform”).
By using the Platform, you agree to the following terms of this Privacy Policy. You should read this Policy carefully; it contains important information about your privacy rights and choices.
You may contact us about this Privacy Policy, to ask a question, or to exercise any of the choices or rights described below, using any of the methods listed here. Unless a different method is stated for a specific request, an instruction elsewhere in this Policy to “contact us” or “contact Aeropay” means via:
For certain requests (e.g. requests to access, correct, or delete your Personal Information) we will need to verify your identity before we can act on your request, as described in the applicable section below.
Personal Information Provided by You. You are responsible for providing accurate and complete personal information to us, and for promptly updating it if it changes. The Platform may collect information you choose to provide, including, but not limited to your name, date of birth, social security number, address, phone number, e-mail address and information from documents such as identification documents and billing statements. It may also collect or reflect information about the activities for which you are using the Platform (e.g., depositing/withdrawing funds in another application or typical retail/service transactions) (the “Activities”).
Note that in order to function properly – and in some cases, in order to meet regulatory requirements – the Platform requires the collection, use, and/or sharing of at least certain information provided by you; so, Aeropay’s Services may not be available for your use if you opt out of sharing your information under this Policy.
Information Collected Automatically. When you use the Platform, we and our service providers automatically collect certain technical and usage information, including device and browser identifiers (such as your IP address, GPS, WiFi, satellite, or cell-phone tower signals) and information about how you interact with and use the Platform. We use cookies and similar technologies to recognize you as you use or return to the Platform so that we can personalize and enhance your experience, ensure the Platform functions properly, identify and prevent fraud, understand Platform usage, and improve the Platform. Some of this information — including your IP address and the precise location described above — can identify you or be linked to you, and we treat that as personal/sensitive information under applicable law. You may be able to control such collection and/or use through your device settings. Where we separately use information in aggregate or de-identified form, we do so consistent with the safeguards described in the “Aggregate Data” and “De-Identified Data” definitions below, and we do not attempt to re-identify de-identified information.
Information Collected from Third Parties. We may combine the information we receive automatically and that you provide with information we receive about you from other sources, such as (by way of example only) the operator and/or developer(s) of the app(s)/service(s) you are using, public databases, providers of demographic information, social-media platforms, people with whom you are connected on social-media platforms, and other third parties. This information could include information related to your use of our Services, including which of our Services you use, the dates and times of your use, and which financial institution(s) and app(s)/service(s) you connect/use via Aeropay and/or Aerosync. This information may negatively affect, restrict, or prevent you from using the Platform. If you do not want Aeropay to use or have access to third-party information, please review your privacy settings with other third parties to disable the sharing of information with us.
Note that in order to function properly – and in some cases, in order to meet regulatory requirements – the Platform requires the collection, use, and/or sharing of at least certain information provided by third parties, so Aeropay’s Services may not be available for your use if you opt out of third parties sharing your information under this Policy.
Information on our Collection of Cookies. We use cookies, or similar technologies like single-pixel gifs and web beacons, to record and log data on our website. A cookie is a text file that is placed on your local storage by a Web page server. Cookies are useful to personalize your online experience. We use both session-based and persistent cookies. Session-based cookies last only while your browser is open and are automatically deleted when you close your browser. Persistent cookies last until you or your browser delete them or until they expire. They are unique and allow us to do site analytics and customization, among other similar things. If you access our website through your browser, you can manage your cookie settings.
Disabling Cookies. Most web browsers automatically accept cookies, but if you prefer, you can edit and manage your browser options to block them in the future. The “Help” portion of the toolbar on most browsers will tell you how to disable and manage your cookies settings. If you disable cookies you may still browse public areas of the website, but some features and services may not function.
How We May Use Data & Information. We may use the data and information we collect to, among other purposes, (i) Provide the Services to you; (ii) enhance the Services; (iii) develop new services; (iii) provide you with customer service and respond to your inquiries and fulfill your requests; (iv) communicate with you and send administrative information to you; (v) share information with third parties whose products or services you request or as required by law (for example, as required by a subpoena, government agency inquiry or investigation, or court order); (vi) Investigate misuse and misconduct (vii) help prevent fraud (viii) Verify your identity, or protect privacy (xi) for other purposes, with your consent or at your direction.
How We May Use De-Identified Data. We may combine the information you provide with information we receive about you from other sources. We may also use the information you provide for certain business purposes, including, but not limited to, data analysis; audits; fraud-monitoring and prevention; developing new products; enhancing, improving, or modifying our products and Services; marketing; identifying usage trends; determining the effectiveness of our promotional campaigns; auditing consumer interactions on our site (e.g., measuring ad impressions); bug detection and error reporting; customizing content we or our service providers display on the Platform (e.g., contextual advertising); developing new services through consumer research; helping us or our customers assess the speed, accuracy, performance, and/or security of our services; and operating and expanding our business activities.
Use of Artificial Intelligence and Automated Decision-Making Technology; Your Rights.
Subject to applicable law, we use artificial intelligence, third-party automated machine learning software, and fixed rules (collectively, “Automated Decision-Making” or “ADMT”) to assess whether each transaction performed on the Aeropay Platform is likely to be successfully processed, or potentially be fraudulent, and correspondingly approve or reject the transaction. The ADMT evaluates specific categories of your personal information, including your past payment history, banking transaction data, and network behavior, to output a real-time risk score. If these metrics signal a high likelihood of fraud or an un-processable return, the transaction is rejected automatically. The ADMT we use may have different versions depending on the type of merchant or industry involved, and is developed, trained, tested, and deployed using your data. This helps Aeropay prevent fraud and other inappropriate use of the Aeropay Platform and may negatively affect, restrict, or prevent a user from using the Platform to process a transaction.
Your Rights Regarding Automated Decision-Making. Depending on where you live, applicable law may give you the right to: (a) receive advance notice before we use ADMT to make a decision that produces legal or similarly significant effects concerning you (such as declining a transaction); (b) opt out of our use of ADMT to make such a decision about you; and (c) access information about how ADMT was used in a specific decision concerning you. If you believe such a right applies to you and you wish to exercise it, please contact us as described in “How to Contact Us” above. We will not retaliate against you for exercising any of these rights, as described in “Non-Discrimination; Reconsideration” below.
Note that the Platform requires the use of at least certain artificial intelligence and/or automated decision-making software in order to function properly – and in some cases, in order to meet regulatory requirements – so Aeropay’s Services may not be available for your use if you opt out of such artificial intelligence or automated decision-making under this Policy.
Subject to applicable laws, we may use, disclose, and share the information you provide for, among other purposes, to (a) respond to requests from (i) public and government authorities, including courts and authorities outside your country of residence and (ii) law enforcement, if requested or mandated; (b) enforce our terms and conditions; (c) protect our operations; (d) protect our rights, privacy, safety, or property; and (e) allow us to pursue available remedies or limit the damages that we may sustain.
Reasons We Share Your Personal Information (GLBA Notice). Because Aeropay is treated as a “financial institution” for purposes of the Gramm-Leach-Bliley Act (“GLBA”), federal law gives you the right to limit some, but not all, sharing of your nonpublic personal information (“NPI”). The list below explains the reasons we may share NPI and whether you can limit that sharing.
We do not disclose your account numbers or access codes to any nonaffiliated third party for use in telemarketing, direct mail marketing, or marketing through e-mail, except with your consent or as otherwise permitted by law.
To protect your Personal Information from unauthorized access and use, we maintain physical, electronic, and procedural safeguards that comply with applicable federal standards, as described further in the “Security” section below.
Third party providers. We may share data to third-party providers that supply services related to your use of the Platform, including:
In all cases, sharing with third parties does not involve sharing data for purposes of those parties' own marketing or broader use. By using Aeropay’s Platform, you grant us — and anyone acting on our behalf — the right, power, and authority to access, transmit, and store your personal and financial information from the relevant financial institution on your behalf. That information includes, but is not limited to: (a) identifiers and information about the account owner(s), such as name, email address, phone number, date of birth, and address; and (b) account information, such as the financial institution’s name, account name, account type, account ownership, account and routing numbers, account balance, and transaction history. We may also provide your information to a third party in the event of any reorganization, merger, sale, joint venture, assignment, transfer, or other disposition of all or any portion of our business, assets, or stock (including in connection with any bankruptcy or similar proceedings).
Additional Limits on sharing for marketing. Consistent with the above, the following limits apply to how we share your information. The second and third points apply only if you live in the state named:
We may aggregate the information that you and other Platform users provide. If we do, we may use and disclose such aggregated information for any purpose. Aggregated information is treated as Aggregate Data or De-Identified Data as described in the “Definitions” section below, and we do not attempt to re-identify de-identified information except to test whether our de-identification methods are effective.
If we are required to treat this information as “personal information” or “personally identifiable information” as defined under any applicable law, then we may use it for the purposes for which we use and disclose Personal Information as detailed in this Policy.
If you are a California resident, California law may provide you with additional rights regarding our use of your Personal Information. To learn more about your California privacy rights, visit https://oag.ca.gov/privacy.
If you consent to receive text messages from Aeropay, message and data rates may apply, and message frequency may vary. You can opt out of marketing text messages at any time by replying “STOP,” and you can request help by replying “HELP.” Opting out of marketing text messages will not affect your ability to use the Platform, except that certain text messages — such as one-time passcodes used to verify your account — are required for you to complete specific actions on the Platform and are not marketing messages you can opt out of.
Additionally, we employ a written information security program and have built privacy protection into our technology, business processes, and operational procedures. This includes technical controls such as encryption, to protect data while it resides on Aeropay’s system, and to further ensure the protection of consumer anonymity. We also require multi-factor authentication to verify new accounts.
The safety and security of your information also depends on you. Where we have given you (or where you have chosen) a password for access to certain parts of the Platform, you are responsible for keeping this password confidential. We ask you not to share your password with anyone.
Unfortunately, the transmission of information via the internet is not completely secure. Although we use commercially reasonable efforts to protect your information, we cannot guarantee the security of your information transmitted to or through the Platform. Any transmission of information is at your own risk. We are not responsible for circumvention of any privacy settings or security measures contained on the Platform.
If you have reason to believe that your interaction with us is no longer secure, please immediately notify us as described in “How to Contact Us” above.
Our website includes links to other websites whose privacy practices may differ from ours. If you submit information to any of those sites, your information is governed by their privacy policies. We are not responsible for the use of that information by others or the privacy statements or other content on third party websites.
Choices and Access. If you would like to review, correct, update, suppress, or delete information that you have provided to us through the Platform, you may contact us as described in “How to Contact Us” above. We will endeavor to comply with your request(s), as required by applicable law, as soon as reasonably commercially practicable. We may need to retain certain information pursuant to applicable law, for record-keeping purposes, and/or to complete any transactions that you began prior to requesting a change, deletion, etc. There may also be residual information that will remain within our databases and other records, which cannot and/or will not be removed.
Non-Discrimination; Reconsideration. We will not discriminate against you for exercising a privacy choice or right described in this Policy — for example, by denying you access to the Platform, charging you a different price, or providing you a different level of service, except as permitted by applicable law. If we decline to act on a request you submit under this Policy, you may ask us to reconsider by contacting us as described in “How to Contact Us” above.
Use of Services by Minors and Others. The Platform may not be accessed or used by anyone under the age of 18; anyone seeking to participate in one of the Activities who is under the minimum age set by applicable law to participate in that activity in the relevant jurisdiction; and/or anyone seeking to participate in one of the Activities in a jurisdiction where that activity is not permitted. Aeropay does not knowingly direct the Platform to, or collect personal information from, children under the age of 13 (see the Children’s Online Privacy Protection Act, or “COPPA”). Should a minor somehow access the Services, a parent may review the minor’s data, request deletion of that data, and/or revoke the minor’s consent at any time by contacting us as described in “How to Contact Us” above.
Jurisdiction. The Platform is intended for use only by residents of the United States, and by using the Platform, you represent that you reside in the United States. The Platform is controlled and operated by us from the United States and is not intended to subject us to the laws or jurisdiction of any state, country, or territory other than that of the United States. In the event of a dispute of Aeropay’s Privacy Policy, the laws of the State of Illinois will apply, excluding the conflicts of law principles thereof. This choice of law does not limit any non-waivable statutory rights or remedies available to you under the privacy laws of your state of residence. Any dispute coming or arising out of this Privacy Policy shall be brought and maintained exclusively in state court in Chicago, Cook County, Illinois. Notwithstanding the foregoing, if applicable law does not permit enforcement of an exclusive Illinois forum-selection clause for your claim, you may instead bring that claim in a court of competent jurisdiction in your state of residence.
Cross-Border Transfer. Although the Platform is intended for U.S. residents, some of the personal information we collect may be transferred to and processed outside the United States; for example, by customer support vendors located outside the United States. As with our other Service Providers, we require these vendors to handle your information under contractual confidentiality and data-security obligations consistent with this Policy. By using the Platform, you consent to this processing, which may be subject to data protection rules that differ from those of the United States.
To determine whether the data is needed, we consider the reason your data was collected and used and any legal requirements to hold onto your data. We retain personal information for as long as reasonably necessary to provide the Platform, comply with our legal, tax, and regulatory obligations (including recordkeeping obligations under the Gramm-Leach-Bliley Act and applicable anti-money-laundering rules), resolve disputes, provide support and enforce our agreements. When information is no longer needed for these purposes, we securely delete or de-identify it.
We may retain information for longer than we otherwise would if:
We may revise this Privacy Policy from time to time. If a change to our information-sharing or collection practices is materially adverse to you, we will send you electronic notice of the change at least 30 days before it takes effect. For all other changes, we will post the revised Policy at https://www.aeropay.com/legal/privacy-policy with an updated "Last Updated" date, and the change takes effect as soon as it is posted. Continuing to use the Platform after a change takes effect means you accept the revised Policy.
Contact Us: For questions about this Privacy Policy, see “How to Contact Us” above.
This Supplemental Notice supplements the information in this Privacy Policy, and applies solely to California residents. It applies to “Personal Data” we collect as a business or data controller; it does not apply to Personal Data we collect or otherwise process as a service provider or data processor.
Aeropay as a “Business” and a “Service Provider”. California law makes a distinction between organizations that process Personal Data for their own purposes (known as "businesses") and organizations that process Personal Data on behalf of other organizations (known as "service providers"). Depending on the circumstances, Aeropay may act as either a business or service provider with respect to your Personal Data.
For example, if you visit our site and contact us through an online web form, Aeropay will be a “business” with respect to the Personal Data that you provide about yourself. We will also be a “business” as to the Personal Data that we have obtained from you as a customer/user of our Services. We use this information to provide you with, among other items, requested services and marketing materials, as well as all of the items set forth above. If you have a question or a complaint about how your Personal Data is handled, please contact us as described in “How to Contact Us” above.
Summary of Information We Collect. The categories of personal information we collect, the purposes for which we use it, and the categories of third parties with whom we share it are described above under “Data we may collect” and “How we use data,” including the “Reasons We Share Your Personal Information (GLBA Notice)” list. Those sections, together with this Supplemental Notice, are intended to satisfy the disclosures the CCPA requires of us as a “business.” We may combine information we collect (“aggregate”) or remove pieces of information (“de-identify”) to limit or prevent identification of any particular user or device.
Rights. If you are a California resident, you may have certain rights. California law may permit you to request that we:
See “Non-Discrimination; Reconsideration” below for your right to be free from discrimination for exercising these rights, and “Retention” below for how long we keep your personal information. Certain information may be exempt from such requests under applicable law. For example, we need certain types of information so that we can provide the Services to you. If you ask us to delete it, you may no longer be able to access or use the Platform or our Services.
If you would like to exercise any of your California consumer rights, please contact us as described in “How to Contact Us” above. You will be required to verify your identity and residency before we fulfill your request. To do so, you will need to provide us with certain account information, such as the full name and e-mail address you used to create your account and your account user id. You can also designate an authorized agent to make a request on your behalf. To do so, you must provide us with written authorization for the agent to act on your behalf. You will still need to verify your identity directly with us.
Sensitive Personal Information. We may collect certain categories of “sensitive personal information” as defined under the CCPA, such as your government-issued identification number/document (see “Identity Verification” above) and precise geolocation (see “Information Collected Automatically” above). We use this information only for the purposes described in this Policy — such as verifying your identity, providing location-based services, and, where applicable, informing the risk-assessment models described in “Use of Artificial Intelligence and Automated Decision-Making Technology” above — and not to build a profile of your personal characteristics beyond those purposes. Because we do not use sensitive personal information beyond these purposes, no additional action is needed to exercise your right to limit its use; you may still contact us as described in “How to Contact Us” above with questions.
The CCPA sets forth certain obligations for businesses that “sell” Personal Data. Based on the definition of “sell” under the CCPA and under current regulatory guidance, we do not believe we engage in such activity. We do disclose certain information as set forth in this Privacy Policy and allow third parties to collect certain information about your activity, for example through cookies, except as explained in our “Information on our Collection of Cookies” section of this Privacy Policy.
Automated Decision-Making. See “Use of Artificial Intelligence and Automated Decision-Making Technology; Your Rights” above for rights specific to Aeropay's use of automated decision-making.
Global Privacy Control. We do not sell or share personal information for cross-context behavioral advertising — that is, targeting ads to you based on your activity across other companies’ websites and apps — so there is currently no sale or sharing for you to opt out of. Nevertheless, Aeropay does honor the Global Privacy Control or other opt-out preference signals your browser sends.
Your California Privacy Rights under the “Shine the Light Law”: California residents who have an established business relationship with Aeropay may submit a written inquiry to Aeropay about whether Aeropay has disclosed any Personal Information to any third parties for the third-parties’ direct marketing purposes during the prior calendar year. To make such a request, please contact us as described in “How to Contact Us” above.
This Supplemental Notice applies solely to Minnesota residents and supplements the information in this Privacy Policy, consistent with the Minnesota Consumer Data Privacy Act (“MCDPA”).
If you are a Minnesota resident, you may have the right to: (a) confirm whether we process your personal data and access that data; (b) correct inaccuracies in your personal data; (c) request deletion of your personal data; (d) obtain a copy of your personal data in a portable format; (e) opt out of the processing of your personal data for purposes of targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects; (f) receive a list of the specific third parties to which we have disclosed your personal data or any personal data; and (g) if we use profiling to make a decision that produces a legal or similarly significant effect concerning you, request that we explain the reasons for that decision and, where feasible, reevaluate the decision based on corrected or additional personal data you provide.
To exercise these rights, contact us as described in “How to Contact Us” above. We will take reasonable steps to verify your identity before responding. If we decline to take action on your request, you may appeal our decision by contacting us using the same methods; if your appeal is denied, you may contact the Minnesota Attorney General.
Where required by the MCDPA, we will recognize a universal opt-out mechanism (such as an opt-out preference signal) if and when you enable one through your browser or device.
This Supplemental Notice applies solely to Nevada residents and supplements the information in this Privacy Policy, consistent with Nevada Revised Statutes Chapter 603A.
Under Nevada law, certain Nevada consumers may opt out of the sale of “personally identifiable information” for monetary consideration to a person for that person to license or sell such information to additional persons. “Personally identifiable information” includes first and last name, address, e-mail address, phone number, Social Security Number, or an identifier that allows a specific person to be contacted either physically or online.
We do not believe that we engage in such activity; however, if you are a Nevada resident who has used our Platform, you may submit a request to opt out of any potential future sales under Nevada law using the methods in “How to Contact Us” above. Please note we will take reasonable steps to verify your identity and the authenticity of the request. Once verified, we will maintain your request in the event our practices change.
This Supplemental Notice applies solely to Oregon residents and supplements the information in this Privacy Policy, consistent with the Oregon Consumer Privacy Act (“OCPA”).
If you are an Oregon resident, you may have the right to: (a) confirm whether we process your personal data and access that data; (b) correct inaccuracies in your personal data; (c) request deletion of your personal data; (d) obtain a copy of your personal data in a portable format; (e) opt out of the processing of your personal data for purposes of targeted advertising, the sale of personal data, or certain profiling; and (f) receive a list of the specific third parties to which we have disclosed your personal data or any personal data.
To exercise these rights, contact us as described in “How to Contact Us” above. We will take reasonable steps to verify your identity before responding. If we decline to take action on your request, you may appeal our decision by contacting us using the same methods; if your appeal is denied, you may contact the Oregon Attorney General.
Where required by the OCPA, we will recognize a universal opt-out mechanism (such as an opt-out preference signal) if and when you enable one through your browser or device.
This Supplemental Notice applies solely to residents of Colorado, Connecticut, and Montana and supplements the information in this Privacy Policy, consistent with the Colorado Privacy Act ("CPA"), the Connecticut Data Privacy Act ("CTDPA"), and the Montana Consumer Data Privacy Act ("MCDPA"), as applicable to your state of residence.
If you are a resident of Colorado, Connecticut, or Montana, you may have the right to: (a) confirm whether we process your personal data and access that data; (b) correct inaccuracies in your personal data; (c) request deletion of your personal data; (d) obtain a copy of your personal data in a portable format; and (e) opt out of the processing of your personal data for purposes of targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects.
To exercise these rights, contact us as described in "How to Contact Us" above. We will take reasonable steps to verify your identity before responding. If we decline to take action on your request, you may appeal our decision by contacting us using the same methods; if your appeal is denied, you may contact the Colorado Attorney General (Colorado residents), the Connecticut Attorney General (Connecticut residents), or the Montana Attorney General (Montana residents), as applicable.
Where required by the CPA, CTDPA, or MCDPA, we will recognize a universal opt-out mechanism (such as an opt-out preference signal) if and when you enable one through your browser or device.
Use of Personal Data to Train Large Language Models (Connecticut residents). Consistent with the CTDPA, we disclose that we do not use your personal data to train large language models.
As used in this Privacy Policy, the following terms have the meanings below. Other terms are defined where they first appear.