Privacy Policy

Cybin Enterprises is a payment-solutions consultant and broker based in Pennsylvania, USA. We introduce merchants to third-party payment processors and acquiring banks and help them navigate the application and underwriting process. We do not process payments, extend credit, or transmit money ourselves.

This policy covers personal and business information we collect when you visit our website, complete our online application, upload documents to our secure portal, communicate with us, or otherwise use our services. When your information is shared with a payment processor or acquiring bank at your request, that third party's own privacy practices govern how it handles your information.

We collect the following categories of information.

• (a) Information you provide about you and your business. Through our application quiz and secure portal, you may provide: your name, email, and phone; the business owner's name, email, and phone; your business or legal name and any DBA; business type, industry, and website; years in business; your business address (street, city, state, and ZIP); monthly processing volume and average ticket; your primary payment issue; your current processor; your current bank or bank name; a description of your products; your delivery method; your refund policy; hardware needs; and any additional notes you choose to share.
• (b) Sensitive financial information you provide for a full application. To submit a complete application, you may provide your Employer Identification Number (EIN), bank routing number, and bank account number. These specific fields are encrypted at rest at the field level using AES-256-GCM encryption. We do not collect Social Security numbers (SSNs).
• (c) Documents you upload. Through the secure portal, you may upload supporting documents such as business formation documents, government-issued IDs, IRS/EIN letters, and a voided check or bank letter. When a processor requires them, you may also upload bank statements and processing statements. Uploaded documents are scanned for viruses and kept in access-controlled storage.
• (d) Information collected automatically. When you use our website, we automatically collect technical and usage information such as your IP address, user-agent and browser, device and operating system, pages viewed, referring page, and timestamps.

We use the information we collect to:

• Provide our consultation and matching services and respond to your application or request.
• Assess which third-party payment processors and acquiring banks may be a fit and, with your consent, facilitate introductions and support the underwriting process.
• Communicate with you about your application, request, or account, including by phone, text message, and email.
• Operate, maintain, secure, and improve our website and services, including scanning uploads for viruses and preventing abuse.
• Send you transactional messages and, where permitted, marketing communications about our services (you can opt out at any time).
• Comply with our legal obligations and enforce our agreements.

Where the laws of your jurisdiction require a legal basis for processing your personal information (for example, in the European Economic Area and the United Kingdom), we rely on the following bases:

• Consent — for example, when you submit an application authorizing us to share your information with payment processors and acquiring banks, or when you agree to receive marketing communications. You may withdraw your consent at any time.
• Legitimate interests — to operate, secure, and improve our services, prevent abuse and fraud, and carry out limited business-to-business marketing, in each case balanced against your rights and interests.
• Legal obligation — to comply with applicable laws, regulations, and lawful requests, and to keep records we are required to keep.

We share information only as described below. We do not sell or rent your personal information.

Service providers (subprocessors). We use third-party vendors to run our website and services. They process information on our behalf and are limited to that purpose:

• Supabase — encrypted database and document storage.
• Vercel — website hosting and serverless functions.
• Cloudflare — content delivery network and edge services.
• Upstash — Redis used for rate limiting and abuse prevention.
• Resend — delivery of transactional and marketing email (delivered over Amazon SES).
• Google Analytics 4 — aggregate website-usage analytics (sets cookies).
• Google Ads — conversion measurement. When you complete an application or Contact Us form and Ketch records the required advertising-measurement consent, Google's tag may record that completion and determine whether it followed an earlier ad interaction. Only when you complete our application and Ketch records consent for Google ad-user data may Google's tag process your email address and phone number into one-way SHA-256 hashes. Google Ads uses the resulting hashed email address and phone number only for this conversion measurement, not to create or target an advertising audience.
• Microsoft Clarity — product analytics that records user sessions and interactions and builds heatmaps (sets cookies).
• OpenStreetMap / Nominatim — address autocomplete on the application form; the address text you type is sent to look up matching results.
• Ketch — our consent-management platform, which powers the cookie and privacy consent banner on our site and records and applies the choices you make (including any "Do Not Sell or Share" request).
• Payment processors and acquiring banks — with your consent, we share your application information with these third parties to facilitate introductions and support underwriting.

Legal requirements. We may disclose information if we believe in good faith that it is necessary to comply with a law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of Cybin, our users, or others.

Business transfers. If we are involved in a merger, acquisition, financing, reorganization, or sale of assets, your information may be transferred as part of that transaction, subject to this policy.

We do not sell or rent your personal information, and we do not share it for cross-context behavioral advertising.

On our public marketing pages, we use Google Analytics 4 and Microsoft Clarity, which set cookies. Google Analytics 4 helps us understand aggregate website usage. Microsoft Clarity records user sessions and interactions and builds heatmaps so we can see how visitors use our pages and improve them. These analytics tools are loaded only on our public marketing pages — they are not loaded inside the admin area or the secure application portal.

We use a consent-management platform, Ketch, to present your cookie and privacy choices. Our analytics tools load only after you accept them through that banner, and you can review or change your choices at any time using the "Your Privacy Choices" option on our site.

We also use functional browser storage (localStorage) to save your progress as you complete the application form so you do not lose your place. This is a browser feature used for functionality and is not shared with third parties.

You can control or delete cookies through your browser settings. To opt out of Google Analytics across websites, you can install the Google Analytics opt-out browser add-on offered by Google. Blocking cookies or storage may affect how some parts of the site function.

Application submissions and the data they contain are automatically deleted approximately 90 days after submission, through a scheduled auto-deletion process. Documents you upload follow the same lifecycle and are deleted on the same schedule.

We may retain limited information for longer where we are required to do so to comply with our legal obligations, resolve disputes, or enforce our agreements.

We take steps designed to protect your information. Information is transmitted over encrypted connections using TLS. The sensitive financial fields described above (EIN, bank routing number, and bank account number) are encrypted at rest at the field level using AES-256-GCM encryption. We apply access controls to limit who can access stored information, and uploaded documents are scanned for viruses.

No method of transmission or storage is 100% secure, and we cannot guarantee absolute security. We work to protect your information using reasonable technical and organizational measures, but you provide it at your own risk.

Depending on where you live, you may have rights over your personal information. To exercise any of the rights below, email us at [email protected]. We will respond as required by applicable law and may need to verify your identity before acting on a request.

If you are a California resident, you may have the following rights, subject to certain exceptions:

• The right to know what personal information we have collected, used, and disclosed about you.
• The right to delete personal information we have collected from you.
• The right to correct inaccurate personal information we maintain about you.
• The right to opt out of the sale or sharing of your personal information. We do not sell your personal information, and we do not share it for cross-context behavioral advertising. Because we do not sell or share personal information, there is no sale or share to opt out of; this serves as our "Do Not Sell or Share My Personal Information" disclosure. We also make a "Your Privacy Choices" control available on our website — powered by our consent-management platform, Ketch — where you can review and record your preferences.
• The right not to receive discriminatory treatment for exercising any of your privacy rights.

If you are located in the European Economic Area, the United Kingdom, or another jurisdiction with similar laws, you may have the right to:

• Access the personal information we hold about you.
• Request that we rectify inaccurate or incomplete information.
• Request erasure of your personal information.
• Request that we restrict processing of your information.
• Request portability of the information you provided to us.
• Object to certain processing, including processing based on our legitimate interests.
• Withdraw consent at any time where we rely on consent (this does not affect processing that already took place).

We are based in the United States, and our service providers may process information in the United States and other countries. If you access our services from outside the United States, your information will be transferred to and processed in the United States, where data-protection laws may differ from those in your country. Where required, we take steps intended to provide an appropriate level of protection for such transfers. By using our services, you understand that your information may be processed in the United States.

To exercise any of these rights, email us at [email protected]. You may also have the right to lodge a complaint with your local data-protection authority.

We send transactional messages related to your application and account. We may also send business prospects outbound marketing email about our services. Every commercial email we send complies with the CAN-SPAM Act: it includes our physical mailing address and a clear, one-click way to unsubscribe (including a List-Unsubscribe option).

You can opt out of marketing email at any time by using the unsubscribe link in any marketing message or by emailing us at [email protected]. We will still send you necessary transactional or service-related messages about your application or account.

Our website and services are intended for businesses and business owners who are at least 18 years old. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us with personal information, please contact us so we can delete it.

Our website and communications may contain links to third-party websites and services, including payment processors and acquiring banks. We are not responsible for the privacy practices or content of those third parties. We encourage you to review the privacy policies of any third-party site you visit.

We may update this Privacy Policy from time to time. When we do, we will revise the effective date at the top of the policy and, where appropriate, provide additional notice. Your continued use of our website and services after an update means you accept the revised policy.

If you have questions about this Privacy Policy or wish to exercise your privacy rights, contact us:

Email: [email protected]

Phone: +1-412-218-3006

Mailing address: Cybin Enterprises, 3202 McKnight East Dr, PMB 317, Pittsburgh, PA 15237, USA