- What we are
- A lead generation company. Not a lender, funder, broker or ISO. We make no credit decision of any kind.
- What we sell
- Merchant cash advance applications, to established business brokerages, for money.
- Is that a sale
- Yes. Cal. Civ. Code 1798.140(ad)(1) makes a transfer for valuable consideration a sale, and no small business exemption reaches it. This page says sale, not sharing.
- How many buyers
- One. A merchant record goes to exactly one buyer and is not resold afterwards.
- What this site collects
- Nothing you type. This website has no forms, no analytics, no advertising pixels, no session recording and no third party JavaScript of any kind.
- How to opt out
- By email or by post, using the Do Not Sell or Share My Personal Information page. Global Privacy Control signals are not processed yet and that page says so.
1. Who we are, and what this policy covers
This policy explains how Pay Per Merchant LLC, doing business as PayPerMerchant (we, us, our), collects, uses, discloses and sells personal information. Our place of business is Brooklyn, NY, and legal and privacy notice is served at 633 Pierce Ave, Linden, NJ 07036.
This policy covers this website, paypermerchant.io. It also describes what we do with the personal information contained in the merchant applications we sell, because that is the whole of our business and a privacy policy that left it out would be describing somebody else.
It does not cover the properties where merchants actually apply, or the separate site where buyers book a call. Each of those displays its own notice at collection next to the fields, as 11 CCR 7012(c)(2) and 7012(d) require, and each discloses the trackers running on it. This website runs none, so nothing written here would describe them.
Where the collection notice lives. Personal information is collected on our application funnel, not on this website. That property carries its own notice at collection and its own privacy notice, presented before any information is entered, as 11 CCR 7012(d) requires.
2. What this website collects, and why there is no cookie banner
This website has no forms and collects nothing you type. There is no quote form, no newsletter box, no chat widget and no account. The only record of your visit is the standard server log our hosting provider keeps: IP address, browser user agent, the URL requested and the time it was requested. Those logs exist to serve the page and to keep the site up.
This site loads zero third party JavaScript. No analytics, no advertising pixel, no conversion tag, no session recording, no heat map, no font content delivery network, no embedded video. Nothing on this page sends your visit to another company. That is unusual for a site in this category and it is a deliberate choice, not an oversight.
So there is no cookie banner, and there should not be one. Nothing here sets an advertising, analytics or session recording cookie. No United States law requires a banner, and 11 CCR 7026(a)(4) states that a cookie banner is not by itself an acceptable method for submitting a request to opt out of sale or sharing. A banner on this page would collect consent we do not need, for tracking we do not run, through a mechanism the regulator has already said does not work.
Cross site collection by others. Because this website loads no third party code, no third party collects personally identifiable information about your online activities over time and across different websites through this site. Cal. Bus. and Prof. Code 22575(b)(6) requires that statement either way.
3. What a merchant application contains
A merchant application is the record we sell. The categories below use the statutory names in Cal. Civ. Code 1798.140(v)(1), because 11 CCR 7011(e)(1)(A) requires them. Categories we do not collect are not listed: over disclosing is not the safe option, it is an inaccurate policy.
| Statutory category | What is in it | Sold to a buyer |
|---|---|---|
| A. Identifiers | Owner name, business name, business postal address, email address, telephone number, and the IP address the application was submitted from. | Yes, except the IP address |
| B. Customer records, Cal. Civ. Code 1798.80(e) | Name, address and telephone number together with business financial information: the amount of capital requested, average monthly sales, whether the last 4 months of bank statements are accessible, whether the owner has ever defaulted on a business loan or advance, and the credit band the owner reports. | Yes |
| D. Commercial information | The financing the merchant asked about and the use of funds described. | Yes |
| F. Internet or network activity | The page the application was submitted from, the campaign and click identifiers attached to it, the browser user agent, and the timestamp. | No. Retained as part of the consent record |
| G. Geolocation data | The state the business operates in, and approximate location derived from the IP address. We do not collect precise geolocation. | The state, yes. The IP derived location, no |
| I. Professional or employment information | Role in the business, industry, time in business, number of open financing positions, and whether the file carries defaults, liens or bankruptcies. | Yes |
Where it comes from. Two sources and no others. The merchant gives it to us directly on one of our own advertising properties, and the rest is captured automatically from the submission itself. We do not buy, append, enrich, co-register or otherwise acquire lead data from third party data providers. Every record we sell was typed by the person it describes, on a form we ran the ads for.
4. Why we collect it
- To sell it to an established business brokerage. This is the primary purpose and it is the entire source of our revenue.
- To check that the contact details entered are reachable, including email deliverability and telephone line type, at the moment of submission.
- To communicate with the merchant about the application submitted.
- To detect and prevent fraudulent, duplicated and automated submissions.
- To keep the consent, do not call and opt out records the law requires.
- To operate, secure and measure our own advertising and our own systems.
Why we sell it: to connect the merchant with a funder who may advance capital, and to be paid a fee by that funder for the introduction.
5. We sell personal information. That is the business.
We sell the personal information described in section 3, and we are paid for it. Under Cal. Civ. Code 1798.140(ad)(1) a sale is the transfer of a consumer's personal information to a third party for monetary or other valuable consideration. Lead buyers set their own purposes and are not bound by service provider restrictions, which makes them third parties under 1798.140(ai). The California Privacy Protection Agency's own regulations use a marketing company delivering consumer records to its clients as the worked example of a sale, at 11 CCR 7026(f)(3)(B).
No small business exemption helps here. Cal. Civ. Code 1798.140(d)(1)(C) covers any for profit business deriving 50 percent or more of its revenue from selling personal information, with no revenue threshold and no consumer count threshold. We are covered from the first dollar.
Terms of the sale, plainly. The buyer pays us $60 per lead. The merchant pays nothing, and nothing we are paid depends on whether the merchant is approved or funded. One merchant record goes to exactly one buyer, and it is not resold to a second buyer afterwards.
| Category sold | Categories of third parties |
|---|---|
| A. Identifiers | Established business brokerages |
| B. Customer records | The same |
| D. Commercial information | The same |
| I. Professional or employment information | The same |
The buyers, by name. R.I. Gen. Laws 6-48.1-3(a)(2) requires us to identify every third party we have sold to or may sell to, with no volume threshold. Oregon and Connecticut give a consumer the right to the specific third parties, not just the categories. The Federal Trade Commission's MediaAlpha order defines informed consent as requiring the names of all entities to whom the information is disclosed.
Who we have sold to. No personal information has been sold to any buyer yet. When the first sale happens, every buyer will be listed here by exact legal entity name, and the list will be current before that buyer receives anything.
What we do not do. We do not share personal information for cross context behavioral advertising from this website, because this website runs no advertising technology. We do not sell personal information to data brokers, list brokers, aggregators or ping trees.
6. Service providers, and other disclosures
Separately from the sale described above, we disclose personal information to service providers under written contracts that restrict what they may do with it. The categories are: hosting and infrastructure, email delivery, telephone and text message delivery, contact verification, calendar and scheduling, and professional advisors including counsel and accountants.
We also disclose personal information where we are required to by law or legal process, to protect our rights, safety or property, and in connection with a merger, acquisition, financing or sale of assets.
7. How long we keep it, and how we protect it
Cal. Civ. Code 1798.100(a)(3) and 11 CCR 7012(e)(4) require a retention period stated per category, or the criteria used to set it. Two of these periods are fixed by federal rule and cannot be shortened by preference. The rest are not yet set.
| Record | How long |
|---|---|
| Consent records, including the consent text as it was displayed | At least 5 years. 16 CFR 310.5(a) sets the minimum, and 310.5(a)(8)(ii) requires a copy of the consent request in the same manner and format in which it was presented |
| Do not call records and opt out records | At least 5 years. 47 CFR 64.1200(d)(6) |
| Identifiers, customer records, commercial and professional information | 24 months from collection |
| Server logs and network activity | As long as needed for security, abuse prevention and diagnostics, and no longer |
Why two of these are longer. The consent and do not call rows above outlast the lead itself, and that is deliberate rather than an inconsistency. A lead record is the merchant's business information and we delete it at 24 months. A consent record is the evidence that permission was given, and 16 CFR 310.5(a) and 47 CFR 64.1200(d)(6) require us to keep that evidence for at least five years whether or not we still hold the lead it belongs to. After 24 months what survives is the proof of permission and the suppression entry, kept for those two purposes only, and not the merchant profile.
Security. We maintain administrative, technical and physical safeguards designed to protect personal information. No method of transmission or storage is completely secure and we cannot guarantee absolute security.
8. Sensitive personal information
We do not sell sensitive personal information. Bank statements do not travel with a lead. We do not collect, transfer or sell financial account numbers, and no document containing one forms part of a record we sell.
We also do not ask a merchant for a Social Security number and we do not pull a consumer credit report. The credit figure in a lead is a band the owner reports about themselves, not a credit file we obtained.
This matters beyond our own practices, because several statutes turn on it. Md. Com. Law 14-4607(a)(2) bans the sale of sensitive data outright, with no consent exception. Connecticut treats a financial account number as sensitive and bars its sale without consent. Tex. Bus. and Com. Code 541.102(b) requires any controller that sells sensitive personal data to post a prescribed notice, and 541.107 applies that duty even to businesses otherwise exempt as small businesses. None of the three is triggered by what we sell. We do not use the categories of sensitive personal information for any purpose beyond those permitted by 11 CCR 7027(m), and we do not offer a limit-the-use right because we have no such use to limit.
9. Your privacy rights
Depending on where you live, you may have the right to do each of the following. These rights are subject to verification and to the exceptions in the applicable statute.
- Know and access what personal information we collect, use, disclose and sell.
- Delete personal information we collected from you.
- Correct personal information that is inaccurate.
- Opt out of the sale or sharing of your personal information. This is the right most people are looking for and it has its own page: Do Not Sell or Share My Personal Information.
- Limit the use and disclosure of sensitive personal information, where we process any. See section 8.
- Obtain the specific third parties to whom we disclosed your personal information, if you live in Oregon, Connecticut or another state that grants that right.
- Appeal a denial of any request.
- Not be discriminated against for exercising any of these. We will not deny you service, charge a different price or provide a different quality of service because you exercised a privacy right.
10. How to exercise your rights
11 CCR 7026(a)(1) and Tex. Bus. and Com. Code 541.055(a) both require at least two ways to submit a request. Ours are below.
| Method | Where |
|---|---|
| Opt out of the sale of your information | The Do Not Sell or Share page, or a Global Privacy Control signal from your browser |
| Know, delete, correct, appeal | By email or post, using the addresses in this table. If we refuse a request you may appeal by replying to that refusal, and we will answer the appeal in writing with our reasons. |
| privacy@paypermerchant.io | |
| Post | 633 Pierce Ave, Linden, NJ 07036 |
Verification. We will ask for information that lets us reasonably confirm you are the person the record describes, normally the email address and telephone number on the application. We will not use it for anything else.
Timing. We confirm receipt within 10 business days and respond within 45 calendar days, extendable once by a further 45 days with notice. A request to opt out of sale or sharing is honored as soon as feasibly possible and no later than 15 business days, under 11 CCR 7026(f)(1). Where we can stop instantly we must, so the 15 days is a ceiling and not a schedule.
Downstream notification. When you opt out, 11 CCR 7026(f)(2) requires us to notify every third party we sold your information to between the moment you asked and the moment we complied, direct them to comply, and direct them to forward the request onward. We do that.
The part most people misunderstand. A funder that already received your application holds its own copy. Opting out with us stops future sales; it does not erase that copy or stop that company contacting you. Contact them directly, using the buyer roster referenced in section 5.
Authorized agents. You may appoint an agent to submit a request for you. We will ask for written permission signed by you and may ask you to verify your own identity.
11. Opt out preference signals
We do not process Global Privacy Control signals yet. A GPC signal sent to this site currently has no effect. Opting out works by email or post, through the Do Not Sell or Share My Personal Information page.
We state this rather than stay silent because it is an obligation, not an option. 11 CCR 7025(b) makes processing the signal mandatory for any business that sells personal information, and 7025(e) forecloses the argument that posting a Do Not Sell link is an alternative to it. A link and a signal are both required, not either. The server side handling is being built.
12. Telephone calls and text messages
A merchant who submits an application gives consent to be contacted at the point of submission, on the property where the application was submitted, in a disclosure displayed next to the button that submits it. That consent is what allows us and the buyer to call or text. Consent is never a condition of obtaining any financing.
What we keep as the consent record. For each lead we retain the exact consent sentence as it was displayed to you, word for word, together with the date and time you submitted it. We keep the wording itself and not merely a record that a box was ticked, because 16 CFR 310.5(a)(8)(ii) requires the request in the same manner and format in which it was presented.
Revoking consent. 47 CFR 64.1200(a)(10) lets you revoke by any reasonable method. In reply to a text, the words stop, quit, end, revoke, opt out, cancel or unsubscribe are all effective, and so is any other wording a reasonable person would read as a request to stop. You can also tell any caller to put you on the do not call list. We do not designate an exclusive means of revoking, because the rule forbids it. We honor a revocation within 10 business days and keep our internal do not call list for at least 5 years, as 47 CFR 64.1200(d)(6) requires.
We do not record calls. Neither calls with merchants nor calls with buyers are recorded, so no recording of you exists, none is retained, and none is transferred to a buyer. If that ever changes, this policy will say so before it does, and any recorded call will carry the announcement that two party consent states require.
13. Minors
Our properties are business to business and are not directed to anyone under 18. A merchant application requires an owner of an operating business. We do not have actual knowledge that we sell or share the personal information of consumers under 16 years of age. That sentence is required by 11 CCR 7011(e)(1)(G). Connecticut separately bans the sale of the data of anyone aged 13 to 17 with no consent cure, so our forms are gated at 18.
14. State disclosures
We build to the strictest common standard nationwide rather than rendering a different policy per state. The items below are the ones that differ enough to name.
- California. The rights in section 9 and the opt out in section 11 are the CCPA and CPRA rights. We are a business under Cal. Civ. Code 1798.140(d)(1)(C).
- Nevada. A Nevada resident may submit a verified request to opt out of the sale of covered information under NRS 603A.345. We respond within 60 days, extendable by 30.
- Texas. Two request methods, an appeal right, and, if section 8 resolves that we sell sensitive data, the notice Tex. Bus. and Com. Code 541.102(b) prescribes word for word.
- Rhode Island. The third parties we have sold or may sell personal information to are identified on the buyer roster referenced in section 5, under R.I. Gen. Laws 6-48.1-3(a)(2).
- Oregon and Connecticut. You may request the specific third parties we disclosed your personal data to, not merely the categories.
15. Changes to this policy, and how to reach us
We may update this policy. The revised version is posted here with a new last updated date, which is the effective date of the change. Cal. Bus. and Prof. Code 22575(b)(3) requires us to describe how we notify you of a material change, and we will post the revised policy on this page at least 10 days before a material change takes effect. We review this policy at least once every 12 months, as Cal. Civ. Code 1798.130(a)(5) requires.
Pay Per Merchant LLC, doing business as PayPerMerchant. Place of business Brooklyn, NY.
privacy@paypermerchant.io
633 Pierce Ave, Linden, NJ 07036