Scope. This policy covers website visitors, portal users, businesses applying to process payments, and the owners and officers of those businesses. Cardholder data handled on behalf of a merchant is addressed in section 2.
1. Who we are and what this covers
High Wire Enterprises LLC operates the High Wire website, developer tools, and the merchant, agent and platform portals. This policy explains how we handle personal information in those contexts and when a business applies to process payments with us.
We operate in the United States.
2. Our two roles
As a business, for our own purposes. When you browse the site, create a portal login, contact sales, or apply to process payments, we decide what to collect and why. This policy describes that.
As a service provider, for our merchants. When a merchant uses High Wire to take payments, we handle cardholder and transaction data on that merchant’s instructions, under our agreement with them. We do not use it for our own purposes beyond operating, securing and improving the service as that agreement permits. A cardholder with a question about a purchase should contact the business they bought from.
3. What we collect and why
| Category | Examples | Why |
|---|---|---|
| Identifiers | Name, business email, phone, postal address, account ID, IP address | Create and secure accounts, respond to inquiries, send service messages |
| Business and application data | Legal entity, registration and tax identifiers, ownership, website, category, projected volume, processing history, bank details | Underwrite the business, match it to processors, meet know-your-customer obligations |
| Identity verification data | Government identification, date of birth, verification results, screening results | Verify owners and officers, screen against sanctions and watchlists |
| Transaction data | Payment identifiers, amounts, card type and last four, authorization and settlement outcomes, disputes, payouts, fees | Provide the service, prevent fraud, reconcile money, meet record-keeping rules |
| Commercial information | Products inquired about, plan, contract and billing records | Provide and bill for the service |
| Internet and device activity | Server log data only: IP address, pages requested, referring URL, browser and device, approximate location from IP. No cookies and no device storage are used on this website | Operate and deliver the site, protect against abuse |
| Communications | Emails, support tickets, call notes, and recordings where made | Support, dispute handling, quality and training |
| Inferences | Risk scores and segmentation derived from the above | Underwriting, fraud prevention, monitoring |
4. Sensitive personal information
Underwriting a business requires information that is sensitive under California law, including government identification numbers such as a Social Security number used for a beneficial owner check, and financial account details.
We use it only for the purposes for which it was collected: verifying identity, meeting legal obligations, preventing fraud and providing the service. We do not use or disclose it to infer characteristics about anyone. Where a right to limit the use of sensitive personal information applies, we honor it, though verification and record-keeping obligations may limit what we can stop doing.
5. Where the information comes from
- Directly from you, through forms, applications, portals and conversations.
- From the business you represent, or from an agent or platform that referred you.
- From verification, screening and credit vendors we use to check identity, ownership and sanctions status.
- From processors, acquirers and card networks, including decisions, settlement files and dispute records.
- From your browser when it requests a page, in standard server logs. We set no cookies and store nothing on your device.
6. Who we share it with
| Recipient | What for |
|---|---|
| Acquirers, processors and card networks | Boarding applications, processing transactions, settlement, disputes |
| Verification and screening vendors | Identity, ownership, sanctions and watchlist checks |
| Infrastructure and software vendors | Hosting, logging, communications, support tooling |
| Agents and platforms | Where a merchant was referred by one, limited to their own portfolio |
| Professional advisers and auditors | Legal, accounting and assessment work under confidentiality |
| Authorities | Where required by law, subpoena or a regulator, or to report suspicious activity |
| A buyer | In a merger, acquisition or sale of assets, subject to this policy |
7. Automated decisions
Parts of underwriting, fraud screening and routing are automated. An application may be scored, matched to processors, or flagged for review by automated systems, and a payment may be screened or declined automatically.
- Automated: risk scoring, sanctions and watchlist matching, category and content checks, transaction screening and routing decisions.
- Human review: you can ask for a person to review a significant automated decision about you, and we will tell you the main factors behind it to the extent we can without revealing fraud controls.
8. How long we keep it
| Category | Retention |
|---|---|
| Onboarding and verification records | For the life of the relationship and then five years after it ends, to meet financial record-keeping rules |
| Transaction and settlement records | For the life of the relationship and then five years, covering dispute and chargeback windows and record-keeping rules |
| Stored card credentials | Until the merchant deletes them, or processing ends, whichever is first |
| Portal accounts and access logs | While the account is active, then 12 to 24 months for security investigation |
| Marketing and website data | 13 to 24 months, or until you opt out or ask for deletion |
| Support communications | 5 to 7 years |
Where a legal obligation requires us to keep something, we keep it even if you ask for deletion, and we tell you that is why.
9. Selling and sharing
We do not sell personal information, and we do not share it for cross-context behavioral advertising. There are no advertising or analytics tags on this website and no cookies are set, so there is no mechanism by which a visit could be shared with an advertising network.
Because we do not track visitors over time or across other websites, and set no cookies or tracking technologies, our website behaves the same whether or not your browser sends a Do Not Track signal. We also do not allow third parties to collect information about your online activity on our website.
10. Your rights
Depending on where you live, you may have the right to:
- Know what we collect, use, disclose and keep about you.
- Access a copy of it, in a portable form where required.
- Correct it if it is wrong.
- Delete it, subject to the legal obligations described above.
- Limit how we use sensitive personal information.
- Opt out of sale or sharing, if that ever applies.
- Not be treated differently for exercising a right.
- Appeal a refusal, where your state provides that.
11. How to exercise them
Write to [email protected] or use the contact form. We verify who you are before acting, usually by confirming details we already hold, and may ask for more where the request is sensitive.
- We confirm receipt within 10 business days and respond within 45 calendar days, extendable once by a further 45 where needed, and we tell you if we extend.
- An authorized agent may act for you with written permission, and we may still verify you directly.
- We honor the Global Privacy Control signal where it applies.
- A cardholder asking about a purchase should contact the merchant. We support their response.
12. Financial privacy laws
Much of what we hold is financial information governed by federal financial privacy and anti-money-laundering law. Some state privacy rights do not apply to information covered by those rules, and some obligations, particularly record retention, override a request to delete. Where that is the case we say so in our response rather than refusing without explanation.
13. Security
Card data is tokenized on capture. Access is role-based and logged, and our control environment is described on the security and trust page. No system is perfectly secure. Report a suspected issue to [email protected].
14. Children
The services are for business use and are not directed to children. We do not knowingly collect personal information from anyone under 16. If we learn that we have, we delete it.
15. Changes and contact
We review this policy at least every 12 months and update it when our practices change. The effective date is at the top. Material changes are notified through the portal or by email.
Contact: [email protected], or 515 Marin St., Suite 316, Thousand Oaks, CA 91360.