Last updated: September 27, 2026
This Privacy Policy explains how Prava Payments Inc. (“Prava,” “we,” “us,” or “our”) collects, uses, discloses, and protects personal data when people use or interact with Prava’s services. Prava is a Delaware corporation located at 8 The Green, STE R, Dover, Delaware 19901, USA.
In this policy, “personal data” also means “personal information” where that term is used by applicable law. The practices described below do not apply identically to every person or interaction. The data involved depends on the Prava service, the integration, and the choices made by the user or enterprise customer.
1. Scope
This policy applies to personal data processed through:
1. Direct services. Prava accounts, websites, hosted payment experiences, support channels, and other services used directly by consumers.
2. Embedded services. Prava experiences presented inside an enterprise customer’s website, application, or interface, including hosted pages and embedded components.
3. Technical services. Prava APIs, SDKs, dashboards, developer tools, Model Context Protocol (MCP) connections, command-line tools, and related integrations.
4. Agent-enabled services. Transactions or other actions initiated or assisted by an authorized agent, application, or integration, subject to the user’s instructions and approval settings.
5. Business interactions. Contacts with enterprise representatives, developers, prospective customers, vendors, and support requesters.
Prava is responsible for the personal data it processes as described in this policy. An enterprise customer, merchant, third-party application, agent provider, financial institution, or other third party is responsible for personal data it collects or uses for its own purposes. When an enterprise customer provides the Prava experience, that customer is responsible for its own privacy notice and for personal data it collects or uses independently. For Customer Data processed through that enterprise integration, Prava generally acts on the enterprise customer’s instructions and assists with privacy requests as required.
2. Prava’s role
Prava’s privacy-law role depends on the activity:
1. When Prava determines the purpose and means of processing, Prava acts as a controller or business. This generally includes direct accounts, Prava Pay wallet data, Service Data, service security, fraud prevention, legal compliance, billing, support, governance, and legal claims.
2. When Prava processes personal data solely on an enterprise customer’s documented instructions, Prava acts as a processor or service provider under privacy law. The enterprise customer controls that processing and is responsible for its own notice, instructions, and legal basis.
If a request concerns data Prava processes only for an enterprise customer, Prava may direct the requester to that customer and assist the customer as required. An enterprise application or third-party agent remains responsible for personal data it collects or uses independently.
3. Personal data we collect
Depending on the service and context, Prava may collect the following categories:
1. Account and contact data. Name, email address, phone number, organization, role, account identifier, login information, communication preferences, and support contact details.
2. Authentication and authorization data. Passkey credential identifiers and authentication results, session information, confirmations, approvals, mandates, consent records, delegated-authority settings, and related audit records. A device’s local passkey check may use a fingerprint, face, or device PIN, but Prava does not receive the fingerprint image, face image, or biometric template from that local check.
3. Enterprise, developer, and integration data. Business contact information, customer and developer identifiers, API keys and related credential metadata, integration configuration, webhook and environment information, application identifiers, technical support records, and service usage data.
4. Agent and instruction data. Prompts or instructions relevant to a requested action, merchant and spending constraints, mandate scope, approval status, confirmation records, and the identity of the authorized account, application, or agent involved.
5. Transaction and commerce data. Transaction attempts, merchant information, amount, currency, order and cart details, timestamps, authorization and status information, receipts, refunds or disputes, shipping and delivery information, and customer-support records. Prava may also receive information necessary to determine whether an attempted transaction is within an approved mandate.
6. Payment-related data. Vault-generated token references, masked card information, card network or brand, bank identification number (BIN) or similar card metadata, and scoped or one-time payment credentials. The boundary for raw funding-card data is described in Section 4.
7. Business onboarding and verification data. For enterprise onboarding or where required for compliance, business records, authorized-representative and beneficial-owner information, identity-verification results, and government identification information.
8. Device, usage, and security data. IP address, browser and device type, operating system, language, approximate location derived from IP, timestamps, referring pages, cookie or similar identifiers, interaction events, diagnostics, error reports, security logs, audit trails, and fraud or abuse signals.
9. Communications. Messages and attachments sent to Prava, feedback, survey responses, call or meeting details when applicable, and records of our responses.
Sources of personal data
We obtain personal data directly from users and business contacts; from enterprise customers, merchants, authorized applications, and agents; automatically from browsers, devices, and Prava services; and from payment-network participants, identity or security providers, and other service providers involved in a requested transaction or integration. We may also obtain business-contact information from public sources or referrals.
4. Funding-card data and payment credentials
Prava is designed so that the underlying funding-card primary account number (PAN) and card verification value (CVV) are entered through approved hosted fields and transmitted directly from the user’s browser to a PCI DSS Level 1-compliant vault provider. Prava does not receive, store, or have access to that raw funding-card PAN or CVV.
Prava may receive and use permitted token references, masked card information, card metadata, mandates, and scoped or one-time payment credentials needed to provide an authorized payment flow. A scoped or one-time credential is distinct from the underlying funding card and may be limited by merchant, amount, purpose, time, or other controls. An authorized merchant, application, or agent may receive only the credential or information needed for the approved checkout flow.
Prava maintains PCI DSS Level 2 compliance applicable to its activities. Card networks, issuing banks, acquiring banks, payment service providers, vault providers, and merchants perform their respective functions under their own terms and privacy practices.
5. How we use personal data
Prava uses personal data as reasonably necessary to:
1. Provide the services, including account access, integrations, hosted or embedded experiences, mandates, payment-authority controls, checkout support, transaction status, receipts, and support.
2. Authenticate and authorize activity, including passkey confirmations, account security, delegated authority, user approvals, and enforcement of merchant, amount, time, or purpose limits.
3. Protect users and the services, including detecting, investigating, and preventing fraud, abuse, security incidents, prohibited activity, and unauthorized access.
4. Operate and maintain Prava, including troubleshooting, reliability, quality assurance, capacity planning, and providing service features. Functional analytics and service improvement use Service Data and aggregated or de-identified information as described in Section 8.
5. Manage business relationships, including enterprise onboarding, integrations, billing, account administration, communications, and contract performance.
6. Comply with obligations, including applicable law, card-network or financial-participant requirements, audits, legal process, tax and accounting duties, dispute handling, and enforcement or defense of legal claims.
Where consent is required, Prava requests it before the relevant processing and permits withdrawal as required by law. Withdrawal does not affect processing already completed and may prevent use of a feature that depends on the data.
6. How we disclose personal data
Prava may disclose personal data to the following categories of recipients for the purposes described in this policy:
1. Enterprise customers and customer applications. When they provide the Prava experience, administer an account or integration, initiate a user-authorized flow, or need transaction and support information.
2. Payment and commerce participants. Card networks, issuing and acquiring banks, payment service providers, PCI-compliant vault providers, merchants, marketplaces, order-fulfillment providers, and other participants needed to complete, secure, reconcile, refund, or dispute a transaction.
3. Authorized applications and agents. When a user or enterprise customer authorizes an application or agent to initiate or assist with an action. We limit the information or scoped credential to what is reasonably needed for the approved flow.
4. Service providers. Providers of cloud hosting, authentication, security, communications, customer support, functional analytics, identity verification, audit, and similar operational services. They are permitted to process data only for contracted services and subject to appropriate obligations.
5. Professional advisers and business counterparties. Lawyers, auditors, insurers, accountants, and parties involved in financing, diligence, a merger, acquisition, reorganization, or transfer of all or part of our business, subject to appropriate safeguards.
6. Authorities and other parties for legal or safety reasons. Regulators, courts, law enforcement, card-network investigators, and others when we reasonably believe disclosure is required or permitted to comply with law, protect rights or safety, investigate misconduct, or establish, exercise, or defend legal claims.
At a person’s direction. Other recipients when the person requests or authorizes the disclosure.
7. Embedded services, agents, and third parties
A Prava interface may appear within another company’s website or application. Prava may receive information from that company or send it information needed to provide the integrated service. The company independently determines what it collects outside the Prava service and must provide its own privacy disclosures.
If a user authorizes an agent or third-party integration, Prava may act on instructions received through that integration and maintain records of the instruction, mandate, approval, and resulting activity. Users should review the agent or integration provider’s privacy practices. Prava does not provide an agent with the raw PAN or CVV of the underlying funding card.
If a user connects a Google account or Google API service, Prava’s use and transfer of information received from Google APIs will comply with the Google API Services User Data Policy, including its Limited Use requirements.
8. No sale, targeted advertising, or general-purpose AI training
Prava does not sell personal data. Prava does not share or process personal data for targeted advertising or cross-context behavioral advertising. Prava does not train general-purpose artificial intelligence models on personal data.
We use Service Data, such as transaction metadata, performance information, and risk or fraud signals, to operate, secure, and support the services. For functional analytics and service improvement, we use aggregated or de-identified Service Data that does not identify an enterprise customer or end user. We maintain de-identified information in de-identified form and do not attempt to re-identify it.
9. Cookies and technical collection
Prava and its service providers may use cookies, local storage, pixels, logs, and similar technologies to keep users signed in, remember settings, secure sessions, prevent fraud, measure performance, diagnose errors, and understand feature use. Disabling necessary browser storage may affect the services. Prava does not permit providers to use this data for cross-context behavioral advertising.
Prava honors legally recognized opt-out preference signals, such as Global Privacy Control, where applicable. Because Prava does not sell personal data or use it for targeted advertising, such a signal generally will not change those practices. Browser Do Not Track settings are not governed by a single industry standard.
10. Retention
We retain personal data only for as long as reasonably necessary for the purpose collected, including to provide and secure the services, complete and document transactions, manage the customer relationship, resolve disputes, enforce agreements, and meet legal, accounting, tax, audit, fraud-prevention, or card-network requirements. The period varies by the type of data, the sensitivity and risk, the applicable relationship, and legal or contractual requirements.
Account and integration data is generally retained while the account or relationship is active and for a reasonable period afterward. Transaction, mandate, authorization, security, and audit records may be retained longer when needed for disputes, fraud prevention, evidentiary purposes, or compliance. Support and business records are retained for operational and legal needs. When Prava acts solely as a processor or service provider, retention also follows the enterprise customer’s documented instructions and applicable agreement.
When retention is no longer necessary, we delete or de-identify the data. Data may remain temporarily in protected backups until those backups are overwritten in the ordinary cycle, or longer if subject to a legal hold, security need, or other lawful exception. Deleting an account or payment token does not require deletion of records Prava must retain for payment, fraud, dispute, audit, tax, legal, or security purposes.
11. Security
Prava uses administrative, technical, and organizational safeguards designed to protect personal data. These include access controls and least-privilege practices, multi-factor authentication for privileged access, encryption in transit and at rest where appropriate, credential and secret-management controls, logging and monitoring, vulnerability and patch management, secure development practices, environment separation, incident response procedures, and oversight of relevant service providers.
No system or transmission method is completely secure. Users should protect their devices and credentials, use available authentication controls, and contact us promptly if they suspect unauthorized activity. If a personal-data incident requires notice, Prava will provide notice in accordance with applicable law.
12. U.S. privacy rights
Prava provides all U.S. users with the ability to request access to, correction of, deletion of, or a portable copy of personal data Prava controls, subject to verification and lawful exceptions. Depending on the state and the circumstances, a person may also have the right to:
1. Confirm processing and obtain information, including categories of personal data, sources, purposes, and recipient categories, and, where required, information about specific third parties to which Prava disclosed personal data.
2. Opt out, where applicable, of the sale of personal data, targeted advertising, or profiling in furtherance of decisions that produce legal or similarly significant effects. Prava does not sell personal data or use it for targeted advertising.
3. Control sensitive data, including providing or withdrawing consent where required. Prava uses sensitive personal data only as reasonably necessary to provide and protect the services, meet legal obligations, or for another legally permitted purpose; we do not use it to infer characteristics for advertising.
4. Appeal a decision, if Prava declines a request and applicable law provides an appeal right.
5. Receive equal service, without unlawful discrimination for exercising a privacy right.
How to submit a request
To submit a request, email support@prava.space with the subject Privacy Request and describe the right you wish to exercise. For an embedded experience, identify the enterprise customer or application when possible. Prava may direct the request to that customer if it controls the relevant processing.
Prava verifies requests using information reasonably related to the account or interaction and does not require more data than reasonably necessary. An authorized agent may act where state law permits, subject to proof of authority and any permitted identity verification. Prava responds within the period required by law and explains a denial where required.
Lawful exceptions may include completing a transaction, protecting security, preventing fraud, complying with law, preserving legal claims, and keeping records required for disputes, audits, tax, accounting, backups, or payment-network obligations.
To appeal, reply to Prava’s decision or email support@prava.space with the subject Privacy Appeal. Delaware residents whose appeal is denied may contact the Delaware Department of Justice at privacy@delaware.gov. A person may also contact the privacy regulator or attorney general in their state.
California and other state notices
For California and similar state laws, the categories in Section 3 may include identifiers; customer records; commercial and transaction information; internet or electronic activity; approximate geolocation; professional information for business contacts; security or fraud-related inferences; and sensitive information such as account credentials, payment-access information, and government identification where onboarding requires it. Prava uses, retains, and discloses these categories as described in this policy.
During the preceding 12 months, Prava may have disclosed these categories for business purposes to the recipients in Section 6. Prava has not sold personal data or shared it for cross-context behavioral advertising, does not offer a financial incentive for such sale or sharing, and does not disclose personal data for third parties’ own direct marketing.
13. International processing
Prava is based in the United States and the services are presently intended for U.S. users. Prava and its service providers may process personal data in the United States and other countries where they operate. Those countries may have privacy laws different from the laws where a person lives. Where required, Prava uses appropriate contractual or other safeguards for cross-border processing.
14. Children
Prava’s services are not directed to children under 18, and Prava does not knowingly collect personal data directly from a child under 18. If you believe a child has provided personal data to Prava, contact support@prava.space. If the information was provided through an enterprise customer’s application, contact that enterprise customer as well. We will take appropriate action consistent with applicable law.
15. Changes to this policy
Prava may update this policy to reflect changes in its services, practices, or applicable law. Prava will post the updated policy with a revised last-updated date and provide additional notice or request consent when required.
16. Contact Prava
Questions, privacy requests, and appeals may be sent to:
Prava Payments Inc.,
Attn: Privacy
8 The Green, STE R, Dover, Delaware 19901, USA
support@prava.space
