Privacy Policy

1. About This Policy

1.1 This Privacy Policy explains how Paxtra Inc. (Paxtra, we, us or our) collects, uses, shares, stores and protects personal information, and what choices and rights you have. Paxtra is a Canadian company based in Calgary, Alberta.

1.2 Paxtra is a technology platform that helps buyers and sellers transact more safely, particularly when a deal starts on social media, messaging apps, online communities or other informal channels. We use third-party providers, including Stripe for payments and identity verification, and Amazon Web Services (AWS), Cloudflare and others for infrastructure.

1.3 We handle personal information in line with the privacy laws that apply to us, including the federal Personal Information Protection and Electronic Documents Act (PIPEDA) and Alberta’s Personal Information Protection Act. Visitors from Quebec also keep the protection of Quebec’s private-sector privacy law (section 26), and section 27 explains the rules that may apply to people in the UK and the EU. Where the law requires your consent for a use of your information, we ask for it in a way that fits how sensitive the information is.

1.4 This Policy forms part of, and should be read with, our Terms of Service (the Terms) and our Cookie Policy. Capitalised terms not defined here have the meaning given in the Terms.

2. Where Paxtra Is Available, and How to Read This Policy

2.1 Availability.

Paxtra is based in Canada and makes its website accessible internationally. However, the availability of account registration, payment processing, payment methods, currencies, seller onboarding, identity verification and payouts varies depending on the customer’s location, applicable laws, regulatory requirements and the capabilities of our payment service providers, including Stripe. The display of a particular currency or the accessibility of the Paxtra website from a country does not guarantee that Paxtra’s payment services are available in that jurisdiction. Paxtra may restrict, suspend or decline services in certain countries or territories where payment processing, payouts, compliance requirements or other operational conditions cannot be satisfied.

2.2 Paxtra is preparing to launch live payment services in eligible Canadian provinces, excluding Quebec, with Canadian dollars as the first currency. We may later offer other currencies, such as pounds sterling, US dollars and euros, where they are supported. These are preferences for the future, not guarantees that any payment, settlement or payout is available.

2.3 How to read this Policy. This Policy describes what Paxtra does and how its platform is designed to work. Different parts of it relate to different stages of the service:

3. Personal Information We Collect

“Personal information” means information about an identifiable individual. What we collect depends on how you use Paxtra. Some information is collected directly by Stripe rather than by us, and we say so where that is the case.

3.1 Account and registration information. When you register, we ask for your name, email address, telephone number, country and password. We also keep your username or account identifier, profile details you add, and information about your account activity. Passwords are protected by secure one-way hashing. We do not store them in readable form.

3.2 Identity verification information. Stripe manages identity verification for Paxtra. Stripe may collect identity details directly from you, such as your legal name, date of birth, address, government-issued identification, document images, a selfie or other verification images, and, for businesses, registration details, directors and officers, beneficial owners and tax information. Paxtra is designed not to collect or keep identity document images through its own systems. We receive and keep the verification result, such as verified, pending or failed, the Stripe references that link to it, and the other limited information we need to run the platform.

3.3 Transaction information. The buyer and seller; the Transaction reference; the amount and currency; a description of the goods or services; the date and time; Transaction, payment and payout status; delivery details and tracking information; and refund, cancellation, dispute and chargeback information.

3.4 Payment information. Stripe collects and processes payment credentials, such as card details, directly. Paxtra is not intended to collect or store full card numbers or card security codes through its own systems. Paxtra receives limited payment-related information: payment status; payment method type; the last four digits of a card, where provided; Stripe and other payment identifiers; the amount and currency; refund, payout and chargeback status.

3.5 Seller and payout information. Where relevant: payout details; Stripe account identifiers; business information; payout status; and verification status. Bank account details are collected by Stripe. We do not intend to collect or store full bank account credentials in our own database. Paxtra keeps Stripe customer or account references, masked bank account information such as the last four digits where available, the bank name where necessary, payout status, and related payment and Transaction references.

3.6 Dispute and buyer and seller protection information. If a dispute is opened, we collect the information submitted to investigate and resolve it, including descriptions; screenshots, photographs and videos; receipts and invoices; tracking and proof of delivery, purchase or service completion; messages between buyer and seller (including relevant social media messages and emails); documents; timestamps; correspondence with us; and each party’s statements. Please do not submit unnecessary sensitive information about yourself or others (see section 21).

3.7 Device and technical information. IP address; device type; browser; operating system; device identifiers where applicable; session and login information; timestamps; referring URLs; approximate location derived from your IP address; and application, error and security logs. We do not intentionally collect precise GPS location. We may use your IP address, approximate location and the country you select to prevent fraud, keep the Platform secure, and decide which currencies and payment services are available to you. Paxtra does not currently have a native mobile app.

3.8 Fraud and security information. Information we process to identify suspicious Transactions and unusual account activity, multiple or linked accounts, fraudulent payment methods, account takeover, identity fraud, chargeback abuse, collusion, money laundering and sanctions risks. It may come from our own systems, Stripe and other lawful sources.

3.9 Communications. Support messages sent to support@usepaxtra.com, emails, SMS messages, dispute correspondence, complaints, feedback, survey responses and messages sent through the Platform.

3.10 Marketing, waitlist and consent information. Name; email address; marketing preferences; waitlist registration; campaign engagement; survey participation; and records of your cookie and marketing consent choices.

4. How We Collect Personal Information

4.1 Directly from you, when you register, create Transactions, make payments or receive payouts, verify your identity, contact support, submit disputes, upload evidence, complete forms, join a waitlist or take part in a survey.

4.2 Automatically, through your use of the Platform: website and application interactions, cookies and similar technologies (see our Cookie Policy), logs, security systems and fraud-prevention tools. Analytics and advertising technologies run only if you consent.

4.3 From third parties, including Stripe; payment networks and financial institutions; delivery and tracking providers, where used; other users involved in your Transaction; public sources where legally permitted; and authorities, where legally appropriate.

5. How We Use Personal Information

We use personal information for the following purposes, based on your consent where the law requires it, and otherwise where the use is reasonable for providing the service you asked for or is permitted or required by law:

creating, managing and securing your account;

operating the Platform and facilitating Transactions;

processing payments, and facilitating payouts, refunds and chargeback handling;

verifying identity and businesses, and Know Your Customer (KYC) checks;

preventing, detecting and investigating fraud, account takeover and abuse, and monitoring Transactions;

sanctions and compliance screening, where applicable;

buyer and seller protection, and investigating and resolving disputes;

providing customer support and responding to complaints;

keeping the Platform secure, and troubleshooting;

keeping Transaction records;

enforcing the Terms and our prohibited-use rules;

understanding website and application use, and measuring our advertising, with your consent;

improving and developing Paxtra;

communicating with you, including service messages and, where permitted, marketing;

complying with legal and regulatory obligations, and responding to lawful government requests;

establishing, exercising or defending legal claims; and

protecting Paxtra, our users and others.

We will not use your personal information for a new purpose that a reasonable person would not expect, without telling you and, where required, obtaining your consent.

6. KYC and Identity Verification

6.1 Why we verify. Paxtra handles payments between people who often do not know each other. Verifying who users are helps us prevent fraud, protect buyers and sellers, meet the requirements of Stripe and other payment partners, and comply with financial-crime laws where they apply to us.

6.2 Who asks. Stripe manages identity verification. Stripe may ask you for identity information, and Paxtra may ask for further information. You may be asked at more than one point.

6.3 When it may be required. Before completing certain Transactions; before receiving payouts; before exceeding Transaction limits; before using seller features; before funds are released; or to continue using Paxtra.

6.4 If you do not provide it. If you do not provide the information requested, or it cannot be verified, we or Stripe may delay Transactions or payouts, restrict features, or suspend or close your account, as set out in the Terms.

6.5 What we keep. We keep the verification status and references, and the other limited information described in section 3.2, as set out in section 11. Information held by Stripe is held under Stripe’s own policies (see section 7).

7. Payment Processing and Stripe

7.1 What Stripe does for us. Stripe is Paxtra’s current payment processing and identity verification provider. When you make or receive a payment, or verify your identity, information is collected by or provided to Stripe where necessary to: process payments; facilitate payouts; verify users and businesses and carry out KYC checks; prevent fraud and assess Transaction risk; handle refunds, payment disputes and chargebacks; investigate suspicious Transactions; and meet Stripe’s own legal and regulatory obligations.

7.2 What Stripe collects directly. Stripe collects payment details and identity verification information directly from you, in Stripe-provided forms. Information that Stripe collects directly is handled by Stripe, and Paxtra does not receive all of it.

7.3 What Paxtra receives. Paxtra is not intended to collect or store full card numbers, card security codes or identity document images through its own systems. We receive and keep the Stripe references, verification statuses, Transaction information and limited payment and payout details needed to operate the platform, as set out in sections 3.2 to 3.5.

7.4 Stripe’s own role. Stripe processes personal information under its own privacy documentation and its own legal and regulatory obligations. In some respects Stripe decides for itself how it uses information, for example for fraud prevention, risk management and compliance with financial regulation, and Paxtra does not control those decisions. Please read Stripe’s Privacy Policy at https://stripe.com/privacy and any Stripe terms that apply to your account.

7.5 If you do not want Stripe to process your information. Stripe is essential to how payments and verification work on Paxtra. If you do not agree to Stripe processing your information, you will not be able to make or receive payments through the Platform.

8. Cloud Infrastructure: AWS, CloudFront and Cloudflare

8.1 AWS. Paxtra uses Amazon Web Services (AWS) as its primary infrastructure provider. AWS is used to host the Platform, run databases and backend services for account management and application functionality, provide security, maintain backups, and send email and SMS messages through AWS-native services. Primary application data is hosted in Canada, and we intend to store the following in Canadian AWS regions: customer registration and account information; Transaction and payment records; customer-uploaded documents; dispute evidence and supporting files; application databases; application and security logs; database backups; and customer support records.

8.2 CloudFront and Cloudflare. We use AWS CloudFront to deliver website content and Cloudflare to support website infrastructure and security. Content delivery and security services work through servers in many countries, and may process technical information such as your IP address and request details in those countries.

8.3 Providers’ roles. AWS, CloudFront and Cloudflare provide infrastructure and act in line with the contractual and data-protection terms that apply to their services. Paxtra remains responsible for the personal information it places on that infrastructure.

8.4 No promise of Canada-only processing. Using an AWS Canadian region does not mean that every provider or service processes personal information only in Canada. We explain international processing in section 12.

9. Analytics and Advertising

9.1 What we use. With your consent, we use Google Analytics 4 to understand traffic, engagement, navigation and sign-ups; and the Meta Pixel and the TikTok Pixel to measure which of our advertising campaigns lead to visits and registrations. We do not currently use Google Ads conversion tracking on this website. We use Google Search Console to monitor search performance. Search Console gives us search performance information from Google and does not require analytics tracking on our website.

9.2 Consent. Google Analytics 4 runs only if you agree to analytics. The Meta Pixel and the TikTok Pixel run only if you agree to marketing. Google Ads conversion tags are not currently installed. We use Google Consent Mode so that Google’s tags do not run before you consent. We recognise Global Privacy Control and Do Not Track signals. Our Cookie Policy explains your choices and how to change them.

9.3 What these providers receive. If you consent, they may receive information such as the pages you view, clicks, sign-up events, your device and browser details and IP address. We do not send passwords, payment card details, identity documents, dispute evidence or other sensitive financial information to analytics or advertising providers. Payment reporting uses our own systems, and only carefully selected, non-sensitive events are shared with outside platforms.

9.4 No customer matching. We do not upload customers’ email addresses or telephone numbers to advertising platforms for customer matching.

9.5 Their own role. Google, Meta and TikTok act under their own privacy policies, may combine this information with information they already hold about you, and may process it outside Canada, including in the United States.

10. How We Share Personal Information

10.1 We do not sell your personal information for money.

10.2 We share personal information only as described below, and limit it to what is reasonably necessary.

Stripe and other payment providers, for payments, payouts, identity verification, fraud prevention, refunds, chargebacks and compliance (section 7).

AWS, Cloudflare and other infrastructure providers, for hosting, delivery, storage, security and operating the Platform (section 8).

Analytics and advertising providers, only if you consent, and only non-sensitive information (section 9).

The other party to your Transaction. To complete a Transaction or resolve a dispute, the buyer and seller may see each other’s name or appropriate account identity, Transaction details, delivery information, dispute information and relevant evidence. We limit this to what is reasonably necessary, and may withhold or redact information for privacy or safety reasons.

Professional advisers, such as lawyers, accountants, auditors, insurers and compliance advisers, under duties of confidentiality.

Government and regulatory authorities, where we reasonably believe disclosure is required or permitted by law.

Law enforcement, where legally required or otherwise legally permitted.

Corporate transaction parties. If Paxtra is involved in an investment, financing, merger, acquisition, restructuring, sale of assets, insolvency or reorganisation, personal information may be disclosed to the parties and their advisers, and transferred to a successor. We will require appropriate confidentiality and protection, and the recipient may use the information only for purposes consistent with this Policy.

10.3 We may also share information with other people when you ask us to or give consent.

10.4 Where we use a service provider to handle personal information for us, we require it by contract to protect the information and use it only for the services it provides to us.

11. How Long We Keep Personal Information

11.1 We keep personal information only for as long as reasonably necessary for the purposes in this Policy, including providing the services, completing Transactions, resolving disputes, processing chargebacks, preventing fraud, maintaining security, meeting legal, accounting, tax and regulatory obligations, and establishing or defending legal claims. When it is no longer needed we delete, de-identify or anonymise it.

11.2 We generally retain personal information for the periods described in this Policy, subject to applicable legal requirements, regulatory obligations, fraud prevention, ongoing disputes, investigations and other legitimate retention needs. These periods are our general practice. They are not a promise that information is held for the full period, and they may be longer where a legal hold, an investigation, a legal obligation or an open dispute or claim requires it, or shorter where the law requires deletion.

11.3 Closing or deleting your account does not mean that all of your information is deleted at once. We may need to keep Transaction, payment, verification, fraud and dispute records where retention is legally or operationally necessary (see section 16). Information held by Stripe and other providers is kept under their own retention rules.

12. Where Your Information May Be Processed

12.1 Paxtra is based in Canada, and primary application data is stored in a Canadian AWS region. However, we and our providers, including AWS, CloudFront, Cloudflare, Stripe, Google, Meta and TikTok, are or may be located in, or process or transfer information in, other countries where necessary for their services and permitted by law. Your personal information may therefore be processed, stored or accessed outside your province or country, including outside Canada.

12.2 When information is processed in another country, it may be subject to the laws of that country, and courts, law enforcement and other authorities there may be able to access it under those laws.

12.3 We use contractual, organisational and technical measures that are intended to protect information that our providers handle, including the measures in section 13. We do not guarantee that information will remain in Canada. If you are in Quebec, the UK or the EU, see sections 26 and 27 for additional information about transfers.

13. Security

13.1 We use reasonable administrative, organisational and technical safeguards designed to protect personal information against loss, theft, and unauthorised access, use, disclosure, copying or modification. The safeguards are proportionate to how sensitive the information is.

13.2 We are implementing the following safeguards as required measures for the Paxtra platform: encrypted connections (HTTPS) for website and application traffic; encryption of sensitive information at rest; secure password hashing; mandatory multi-factor authentication for administrators; role-based access controls; security and activity logging; and secure, encrypted backups. We also use fraud monitoring, together with Stripe’s fraud-prevention tools.

13.3 No internet-based service or electronic storage system can be guaranteed to be completely secure. This does not limit our responsibility to protect personal information under applicable law.

13.4 You can help protect your account by using a strong, unique password, keeping your devices secure, and telling us promptly at support@usepaxtra.com if you suspect unauthorised access to your account.

14. Privacy and Security Incidents

14.1 We respond to privacy and security incidents in accordance with applicable law. Where the law requires, we may investigate; take steps to contain the incident and reduce harm; record it; notify affected individuals; and notify the Office of the Privacy Commissioner of Canada, the Alberta Information and Privacy Commissioner, Quebec’s privacy regulator, or other regulators or authorities.

14.2 Where the law requires notification, for example where a breach of security safeguards creates a real risk of significant harm, or the equivalent test in applicable law, we will notify affected individuals as soon as feasible, with the information the law requires. We keep records of incidents as the law requires.

14.3 If an incident involves information held by Stripe, AWS, Cloudflare or another provider, we also rely on the notifications and cooperation those providers owe us.

15. Your Privacy Rights

Depending on where you live and the law that applies, you may be able to:

ask for access to the personal information we hold about you;

ask us to correct inaccurate or incomplete information;

withdraw your consent to certain uses or disclosures, subject to legal and contractual restrictions and reasonable notice (this may mean we can no longer provide some or all services);

ask questions about how we handle your information;

challenge our privacy practices and make a complaint;

ask us to delete your information, where the law gives you that right; and

manage your cookie and marketing choices at any time.

Customers in Quebec, the UK and the EU may have additional rights (see sections 26 and 27).

15.1 How to ask. Email privacy@usepaxtra.com with your name, the email address on your account and what you are asking for. We may need to verify your identity before we act on a request, to protect your information from being given to someone else.

15.2 Response time. We will respond as soon as reasonably possible and within the time the law requires (generally 30 days, which in some cases may be extended with notice to you).

15.3 When we may refuse or limit a request. We may refuse or limit a request, or keep information despite it, where we need the information for an active Transaction; a dispute or chargeback; fraud prevention or security; compliance with regulatory, tax, accounting or other legal obligations; establishing, exercising or defending legal claims; or other purposes the law permits. We will tell you the reasons, unless the law prevents it, and tell you about your options to complain.

15.4 Complaints. If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada or the privacy regulator in your province, territory or country (section 29).

16. Account Closure and Deletion

16.1 You can ask us to close your account by contacting us or using account settings. Before we can fully close an account, any pending Transactions, disputes, refunds, chargebacks, holds or amounts you owe must be resolved.

16.2 There are three different things:

Account closure. We deactivate your account so you can no longer sign in or transact.

Deletion of profile information. Where there is no reason to keep it, we delete or anonymise information that is not needed, in line with the periods in section 11.

Retention of required records. We keep Transaction, payment, verification, fraud and dispute records, and any information needed to meet legal obligations or defend claims, for as long as retention is legally or operationally necessary. Information held by Stripe and other providers is subject to their own retention.

16.3 Backup copies expire in the normal backup cycle (section 11), and we aim not to routinely restore deleted records.

16.4 We will tell you, where reasonably practicable, which categories of information we are keeping after closure and why.

17. Cookies and Analytics

17.1 We use cookies and similar technologies. Strictly necessary cookies work without optional consent. On the current marketing website, that is the cookie that remembers your cookie choice. Cookies for signing in, security, fraud prevention and payments apply only if those features are enabled, as listed in the Cookie Policy. Analytics and marketing cookies run only if you agree.

17.2 When you first visit, a cookie banner gives you three equally prominent choices: Accept All, Reject Optional, or Manage Preferences. You can change or withdraw your choice at any time through the Cookie Settings link. We recognise Global Privacy Control and Do Not Track signals. Refusing optional cookies does not stop you creating an account, signing in or using essential payment services.

17.3 Our Cookie Policy lists each cookie by name, provider, purpose and duration, and explains your choices in detail.

18. Marketing and Messages

18.1 Service messages are different from marketing. We send service messages, such as account notices, Transaction updates, payment and dispute notices, security alerts, verification codes and legal notices, by email or SMS, using AWS-native services. They are needed to run your account.

18.2 Marketing. We send marketing messages only with your consent, or where Canada’s Anti-Spam Legislation (CASL) and other applicable law otherwise permits. We keep records of your consent. Marketing messages identify us and contain a working unsubscribe mechanism. We do not currently use a separate third-party email marketing or SMS platform.

18.3 Opting out. You can unsubscribe from marketing at any time using the link in the message, your account settings, or by contacting privacy@usepaxtra.com. Opting out of marketing does not stop service, security or legal messages.

19. Age

19.1 Paxtra is a financial and transaction platform. Paxtra accounts are restricted to individuals aged 18 and over.

19.2 We do not knowingly collect personal information from anyone under 18. If we learn that an account is held by someone under 18, we may suspend or close it, and delete or restrict the information we hold, subject to legal retention duties. If you believe a child has given us personal information, please contact privacy@usepaxtra.com.

20. Automated Fraud and Risk Tools

20.1 We and Stripe use automated and partly automated tools, together with our own Transaction monitoring and risk-management procedures, to assess fraud, Transaction risk, payment risk, account security and suspicious activity. These tools can lead us to delay or hold a Transaction or payout, ask for more information, or restrict an account.

20.2 We do not publish the rules or signals these tools use, because doing so would help people get around them.

20.3 Decisions made by Paxtra, and decisions made by Stripe. Paxtra does not rely exclusively on automated systems to make final decisions in our dispute process. Where a decision made by Paxtra significantly affects you, you may email privacy@usepaxtra.com to ask for it to be reviewed by a person, and eligible decisions will be reviewed in line with applicable law. Some decisions, such as Stripe’s fraud and verification checks, are made independently by Stripe under its own policies. We do not control them, and you can contact Stripe about them. We take account of the legal requirements that apply to automated decisions, including in Quebec, the UK and the EU.

21. Dispute Evidence and Privacy

21.1 Information submitted in a dispute may include personal information about you, the other party or other people.

21.2 We may review and keep the evidence; give relevant evidence to the other party; give evidence to Stripe, other payment providers, banks and card networks; give evidence to authorities where legally required; use it to prevent fraud; and use it to enforce the Terms. We limit what we share to what is reasonably necessary, and may redact material that is not needed.

21.3 Please submit only information that is reasonably relevant to the dispute. In particular, please avoid submitting information about other people that is not related to the Transaction; passwords or login codes; complete card numbers or bank account numbers (hide all but the last four digits); and highly sensitive information that is not needed to show what happened, such as health information or government ID numbers.

21.4 You are responsible for having the right to submit the information you give us. Our Dispute Resolution Policy explains how evidence is assessed.

22. Fraud Investigations

22.1 We may keep and analyse information connected with suspended accounts, fraudulent or attempted fraudulent Transactions, chargeback abuse, false identities, linked accounts and prohibited Transactions, so that we can detect and prevent repeat abuse, protect users and meet our legal obligations.

22.2 Closing or deleting your account does not oblige us to erase information we need to prevent fraud, protect others or comply with law. We keep it only for as long as reasonably necessary (section 11).

23. Third-Party Links and Social Media

23.1 Many Paxtra Transactions begin on social media or messaging platforms. Paxtra is independent of those platforms and is not affiliated with, sponsored by or endorsed by them. We are not responsible for how external websites, apps or social media services handle your information, and you should read their privacy policies.

23.2 If you share a message or screenshot from another platform with us, for example as dispute evidence, we handle it under this Policy once we receive it.

24. Business Users

24.1 If you use Paxtra for a business, we and Stripe may collect personal information about its directors, officers, employees, authorised representatives, beneficial owners and business contacts, for example to verify the business, meet the requirements of Stripe and other payment partners, and prevent fraud.

24.2 If you give us personal information about another person, you confirm that you are allowed to do so and have told them how it will be used and shared, including by Stripe.

25. Legal Requests

25.1 We may preserve and disclose information in response to subpoenas, court orders, warrants, regulatory requests, lawful law-enforcement requests and other legally binding processes, or where the law otherwise permits or requires disclosure.

25.2 Where appropriate and legally permitted, we check that a request is valid, limit what we provide to what is required, and tell the affected person, unless the law or the request prevents us. We may also be required by law to report suspicious activity without telling you.

26. Customers in Quebec

26.1 Paxtra’s live payment services are not offered in Quebec at launch. Quebec may be added later, once the language, legal and operational requirements are met. Visitors to our website from Quebec keep the privacy rights that Quebec’s private-sector privacy law gives them, including when they browse the website, join the waitlist or contact us. This section applies in addition to the rest of this Policy.

26.2 Person responsible. Our Privacy Officer, named in section 30, is the person responsible for the protection of personal information at Paxtra.

26.3 Consent and purposes. We tell you the purposes for which we collect information, and ask for your consent in clear and simple terms for each purpose where the law requires it. Optional cookies and tracking technologies are off until you choose to turn them on.

26.4 Transfers outside Quebec. Your information may be processed outside Quebec, including outside Canada (section 12). Where Quebec law requires it, we carry out a privacy impact assessment before communicating personal information outside Quebec, and we will not make the transfer before it is completed.

26.5 Automated decisions. If a decision about you is made exclusively through automated processing, we will tell you, and you can ask what information was used and the main factors behind the decision, ask for the information to be corrected, and ask for a person to review the decision (section 20).

26.6 Your rights. You may ask to access your personal information, to have it corrected, to withdraw consent, and, where the law gives you the right, to receive your computerised information in a structured, commonly used format. Contact privacy@usepaxtra.com. You may complain to Quebec’s privacy regulator, the Commission d’accès à l’information.

26.7 Language. Our website is currently in English. We plan to add French when Quebec services are introduced.

27. Customers in the United Kingdom and the European Union

27.1 Live payment services are not available to customers in the UK or the EU at launch. We may offer them later, after the necessary approvals (section 2). Where the UK GDPR or the EU GDPR applies to our processing of personal information about people in those places, such as website visitors and waitlist members, this section applies in addition to the rest of this Policy. Paxtra Inc. is the controller of that personal information. We will assess whether a UK or EU representative is legally required before we begin services that trigger that obligation, and if one is required we will appoint one and publish the details here.

27.2 Why we may process your information, and on what basis.

27.3 Your rights. You may have the right to access your personal information; to have it corrected; to have it erased; to restrict or object to certain processing; to receive it in a portable format; and to withdraw consent. You also have the right to object to processing based on our legitimate interests. Contact privacy@usepaxtra.com. Some rights are limited where we must keep information to meet legal obligations or defend claims.

27.4 International transfers. Paxtra is in Canada and uses providers in other countries. Where UK or EU law requires a safeguard for transferring personal information out of the UK or EU, we will apply an appropriate mechanism, such as an adequacy decision or standard contractual clauses, before the relevant transfer takes place.

27.5 Complaints. You may complain to your local data protection authority, such as the Information Commissioner’s Office in the UK, or the supervisory authority in your EU country.

28. Changes to This Policy

28.1 We may update this Policy when our services, technology, payment partners or legal requirements change. We will post the updated Policy with a new Last updated date.

28.2 If a change is material, we will tell you in a suitable way, such as by email or a notice on the Platform. Where the law requires your consent for a new use, we will ask for it.

29. Contact and Privacy Complaints

29.1 To exercise your rights or ask a question. Email privacy@usepaxtra.com with your name, the email address on your account and what you are asking for. For general account or payment help, use support@usepaxtra.com.

29.2 To make a complaint. Email privacy@usepaxtra.com, describing your concern. We will investigate, reply in writing and take appropriate steps, including changing our practices where the complaint is justified. If you are not satisfied, you may complain to the Office of the Privacy Commissioner of Canada, the Office of the Information and Privacy Commissioner of Alberta, or the data protection authority where you live, including Quebec’s Commission d’accès à l’information if you are in Quebec. Our Complaints Procedure explains how we handle other complaints.

30. Privacy Officer

30.1 Paxtra has designated a Privacy Officer, who is responsible for our compliance with privacy law, oversees this Policy, and handles requests and complaints. The Privacy Officer is Louis Bessam, Paxtra’s Chief Executive Officer. You can reach the Privacy Officer at privacy@usepaxtra.com.

31. Possible Future Feature: Account Reliability and Trust Score

31.1 Status. Paxtra plans to consider an account reliability or Trust Score feature in the future. It is not part of the initial pilot and is not operating today. Paxtra does not currently generate Trust Scores or profile users for that purpose.

31.2 What we will tell you first. Such a feature may involve profiling and automated processing of personal information. Before it is switched on, we will update this Policy and explain what personal information will be used; why we process it; whether scoring is automated; whether a person can review the result; whether scores are visible to other users; how long scoring information is kept; whether third parties receive it; how you can ask for access or correction; how you can challenge a materially inaccurate result; and the privacy rights that apply.

31.3 Review before use. Any automated decision that significantly affects access to payment services, account restrictions or transaction limits will go through legal and privacy review before it is introduced, and will involve meaningful human oversight.

31.4 More information. Section 22.0 of our Dispute Resolution Policy explains how Paxtra expects to approach account reliability assessments.