Privacy Policy

The FinLinks stablecoin payment integration, merchant portal at portal.finlinks.io and API at api.finlinks.io are operated by Finlinks Global Solutions LLC. The product website is www.finlinksglobal.com. Use of finlinks.io for technical services or business email does not change the operator identified here. Merchant services remain subject to the accepted Master Merchant Services Agreement and applicable third-party terms.

1. Scope, identity, and data roles

Finlinks Global Solutions LLC operates this website and the B2B Payment Orchestration & API Routing Middleware. This notice covers visitors, business representatives, authorized operators, and individuals whose information is supplied for a lawful business workflow. Business information can include personal information about employees, owners, signatories, or counterparties.

FinLinks acts as controller for its own business communications, software administration, billing, security, and legal compliance. Where it processes personal data solely on a merchant's documented instructions, the merchant is controller and FinLinks acts as processor under an applicable data processing agreement. Independent financial providers act under their own notices and applicable roles.

All transaction principal and settlement funds are processed by independent, appropriately licensed or authorized financial institutions, or, for lawful supported on-chain transfers, by smart contracts controlled by the merchant or an independent third party. A smart contract is not itself a licensed institution and does not replace any required authorization. FinLinks does not control those contracts or their administrative keys and has no authority to sign, redirect, freeze, or retain transaction principal. FinLinks does not provide merchant or end-user financial accounts, pooled balances, stored value, deposit products, yield, or personal remittance or retail currency-exchange services.

2. Information and sources

Depending on the interaction and enabled service, information may include business contact names and details; entity registration, ownership and signatory-authority records; software workspace identifiers and permission settings; commercial invoice, beneficiary, instruction-reference and provider-status metadata; software-fee billing records; and IP addresses, browser/device information, access timestamps, error reports, and security logs.

Sources include the individual, their business or merchant, independent execution or verification providers, lawful public business registers, and technical requests to the website or software. FinLinks processes instruction data, not the principal represented by it. Do not provide private keys, seed phrases, raw card security codes, or unrestricted financial credentials.

3. Purposes and lawful bases

Business contacts and inquiries are used to respond and arrange requested demonstrations. Software and instruction metadata support integration, routing of authorized messages, reconciliation, support, and merchant-directed processing. Verification information supports business-access risk review; technical logs support security, reliability, and abuse prevention.

Where EU or UK data protection law applies, the relevant basis is contract or requested pre-contract steps only when the individual is a party; legitimate interests for business-representative communications, administration, fraud prevention and security after balancing individual rights; a specific applicable legal obligation when one exists; or freely given consent where required. A corporate contract alone is not a contract with every employee or owner.

Using the website is not blanket consent. Consent-based processing can be withdrawn through legal@finlinksglobal.com without affecting prior lawful processing. Required business or security information may be necessary for access; refusal may prevent the requested software service. FinLinks does not infer universal BSA, GLBA, or bank-specific duties solely from an MSB registration.

4. Recipients and third-party boundaries

Information is shared on a need-to-know basis with authorized staff and contracted hosting, communications, support, security and verification providers; with independent licensed or authorized financial providers as necessary to route merchant-authorized data and receive status; with professional advisers and authorities where legally justified; and with prospective successors under appropriate safeguards in a lawful business transaction.

Third-party fonts, media, payment components, and other integrations can receive IP/device and request information when loaded. Financial components should receive sensitive financial inputs directly where appropriate. Independent payment providers execute payment, FX and clearing under their own contracts; FinLinks only orchestrates APIs. Provider outages or settlement failures do not create joint or several financial liability for FinLinks, subject to its own duties and mandatory law.

FinLinks does not sell or rent personal information. Information is not shared for another party's unrelated marketing. Provider fees are charged or deducted by the provider; FinLinks software fees are separately invoiced and do not involve handling customer transaction principal.

5. International transfers

Information may be processed in the United States, where FinLinks is based, and in locations used by the relevant service providers. Before a restricted EU or UK transfer, FinLinks must establish an applicable lawful mechanism, such as a relevant adequacy decision or appropriate contractual safeguards, and required supplementary measures. This notice does not assert that FinLinks or every provider is certified under a transfer framework. Request the applicable destinations, safeguards, and a copy or description of safeguards from legal@finlinksglobal.com.

6. Retention and deletion

Business inquiries are retained for the period needed to respond and manage a continuing relationship; software administration and instruction records for the service, reconciliation, support, and applicable claim periods; billing records for applicable accounting and tax obligations; and security logs for proportionate incident investigation and prevention. Retention is reviewed against necessity, contractual requirements, and applicable limitation periods.

Where a specific legal recordkeeping duty applies, records are retained for that mandated period and its correct trigger, with longer preservation only for a lawful hold or justified claim. There is no blanket five-year legal retention duty for every category merely because the service is financial-adjacent. On expiry, information is deleted or de-identified, subject to protected backup cycles and lawful holds. Requests may be restricted only for a valid legal reason.

7. Security and incident response

FinLinks must apply reasonable technical and organizational safeguards proportionate to the information and its role, including access restriction, secure transmission where appropriate, credential protection, and incident handling. Specific controls and processor commitments should be documented in the applicable service and data processing agreements. No unverified encryption algorithm, certification, cloud-residency arrangement, or absolute security guarantee is asserted here.

FinLinks will assess incidents and notify affected merchants, individuals, or authorities where required by applicable law or its binding data processing agreement. Third-party responsibility does not remove FinLinks' obligations for data within its own responsibility.

8. Individual rights and complaints

Where applicable law grants them, individuals may request access, correction, erasure, restriction, portability, information about sources and recipients, and withdrawal of consent. Rights depend on the jurisdiction and processing basis. Contact legal@finlinksglobal.com; identity or authority verification must be proportionate. FinLinks responds within applicable statutory periods.

RIGHT TO OBJECT: Where processing relies on legitimate interests, you may object on grounds relating to your situation. You may object to direct marketing at any time, and applicable direct marketing will stop. Unsubscribe instructions or a request to the legal contact may be used.

You may complain directly to the competent supervisory authority, including the UK Information Commissioner at https://ico.org.uk/make-a-complaint/ or your relevant EU authority where applicable. You need not first exhaust an internal complaint. Where FinLinks is processor, it assists the controller and directs the request appropriately.

This notice does not waive mandatory privacy or compensation rights. Contractual liability terms in an accepted MSA or ToS apply only to the extent lawful and cannot restrict non-waivable data-subject rights.

9. Cookies and similar technologies

Essential technologies may support session security, access, and user-requested functions. Non-essential analytics or marketing technologies must not be enabled where consent is legally required until valid consent is obtained. Third-party requests are not automatically evidence that cookies are set; actual deployed technologies require an accurate inventory and notice.

Browser controls can limit cookies, potentially affecting requested functions. This notice does not claim a cookie preference tool exists. Contact legal@finlinksglobal.com for the currently applicable technologies, providers, purposes, and lifetimes or to withdraw a previously given consent. An email request does not replace a required prior-consent mechanism.

10. Public ledgers, automation, and children

If an independently executed transfer uses a public blockchain, addresses, transaction hashes, amounts, and timestamps may be public and persistent. FinLinks cannot erase the public ledger. This does not remove its duties to minimize personal data, restrict off-chain copies, or respond to lawful requests. Do not put personal information on-chain through software metadata.

Software-access screening may flag activity for review. This notice does not authorize solely automated decisions with legal or similarly significant effects; any such processing requires its own lawful assessment, safeguards, and information. Contact the legal address to ask for human review where applicable.

The services are for businesses and authorized adult representatives, not children. If information about a child is received in error, notify the legal contact so it can be assessed and appropriately removed unless law requires preservation.

11. Updates and contact

Material changes to processing will be communicated as required before new processing begins, with consent obtained where required. A revision does not retroactively legalize processing or amend an existing data processing agreement.

Finlinks Global Solutions LLC, 30 N Gould St Ste R, Sheridan, WY 82801, United States. Legal and privacy: legal@finlinksglobal.com. Software support: support@finlinksglobal.com. Compliance: compliance@finlinksglobal.com.