What is 'Cloaking'?

'Cloaking' (including grammatically inflected forms) is the practice of creating proxy-based identifiers corresponding to personally identifiable information.

What information does Cloaked collect?

Summary: We collect the categories of information listed below. We do not have access to passwords, which are salted and hashed, or encrypted.  

Depending on your use of the Service, we may collect information about you, the Service may generate cloaked identifiers to mask categories of information listed below. We will have access to those cloaked data elements.
‍
• Account and contact information, including your name, username, passwords (name, username, password, as stored: salted + hashed, or encrypted), contact information, and other specifics based on product type.
‍
• Billing and tokenized credit card information.
‍
• For Cloaked Pay, Certain know-your-customer information, including date of birth, gender, and financial account data.
Cloaked Pay GLBA Notice
‍
• For Cloaked Data Deletion, Certain information that may be used to allow us to perform data deletion services on your behalf, including information to locate and delete you from data broker platforms.

• Device information, We store requested and referring URL, browser/IP information, and analytical data on use of the service.‍

How is information collected with Cloaked?

Summary: We collect information as part of payment authorization and fraud screening. Cookies provide Service functionality. Information in log files provide and improve our Service. 

We collect information directly from you as well as from third parties, like those providing payment processing and fraud prevention services.‍

Registering to Use and While Using the Service
You may create an account to use features of the Service.  You may provide information to us and directly to our service providers, like our payment services provider.

Cookies
‍When you visit our Site, cookies may be placed on your device in order to personalize and optimize your experience on the Site. This Privacy Policy does not govern cookies or action tags by third parties on their websites or services through the Service.

Log Files
‍In addition to cookie data, we collect Device Information via log files to administer and monitor the Service.

Financial Institutions and Data Aggregators
‍We may use data aggregators to link your financial institution accounts with Cloaked and/or Cloaked Pay. Currently, we use Plaid, Inc., Paypal, Inc., and/or Stripe, Inc. Plaid, Paypal, and Stripe may collect your financial institution account credentials, such as username, password, and multi-factor authentication methods you use, to connect your financial institution with us or for payment purposes. Our privacy policy does not cover how data aggregators, such as Plaid, Paypal, or Stripe, collect and share your information. By applying for and/or using Cloaked or Cloaked Pay, you acknowledge that the terms of Plaid, Paypal, or Stripe’s privacy policy will govern use of such information. When you connect your financial institution accounts with us through Plaid, Paypal, or Stripe, we collect Financial Data as described above.

Does Cloaked collect information from children under 13 years of age?

No: The Service is not permitted, designed for, or directed to children under the age of 13. We do not collect information from any person we actually know is under the age of 13. If you believe your child has provided us with personal information, please alert us at [email protected]. If we learn that we have collected personal information from a minor, we will promptly take steps to delete such information. Cloaked Card is not permitted for persons under the age of 18.‍

What does Cloaked do with the information it collects?

We may also process your personal information for purposes that are disclosed to you at the time you provide your personal information or as otherwise set out in this Policy. 

European Data Protection Laws require us to explain the legal bases for our processing of your information. We process your information: 

(a) where you have given consent to the processing, which consent may be withdrawn at any time without affecting the lawfulness of processing based on consent prior to withdrawal;

(b) where it is necessary to perform the contract we have entered into or are about to enter into with you (whether in relation to the provision of the Service or otherwise);

(c) where it is necessary for us to comply with a legal obligation to which we are subject; and/or

(d) where it is necessary for the purposes of our legitimate interests (or those of a third party) in providing or marketing the Service and your interests or fundamental rights and freedoms do not override those legitimate interests. 

Unless you request otherwise (where permitted by law), we and third parties acting on our behalf may subsequently send you electronic newsletters or contact you about the Service. If you no longer desire to receive these communications, we will provide you with the option to change your preferences in each communication we send to you. You may also inform us by email: [email protected].

If you identify yourself to us by e-mail with questions, we will use your information to respond to your questions or comments, and file your questions or comments (with your information) for future reference.

We also use information collected to send announcements regarding the Service or your billing account status. You cannot unsubscribe from Service or transactional announcements as they contain important information relevant to your use of the Service.     ‍

When does Cloaked disclose information to third parties?

Summary: We may disclose contact information, and device data, to third-parties to comply with relevant law, or for legal reasons. This information may also be disclosed to Professional Advisors to provide us with business services. In the event of an investment in Cloaked or a sale of our business, we may share limited, required information with an investor or purchaser.
‍
We disclose information we gather through the Service to the following third parties, as set forth by our Terms of Service, or as separately authorized by you:

Laws and Legal Rights
‍We may disclose your information as required by law, to enforce law or contract, or to protect the safety and/or security of our users or the Service.

Professional Advisors
‍We may provide information to our Professional Advisors in the course of professional services rendered to provide us with business services like accounting or legal services.     

Outside Contractors
‍We may employ independent contractors, third party service providers, vendors, and suppliers to provide us with business services related to the Service which may be located both inside and outside the United States. These Outside Contractors may have access to information collected through the Service. We use reasonable efforts to ensure that these Outside Contractors (a) limit their use of your information only to the extent necessary to provide services, and (b) are capable of protecting the security of your information. 

Sale of Business
‍We may transfer information to a third party in connection with a sale, merger, transfer of all or substantially all of the assets of Cloaked.

To Perform Elected Services
‍‍We may provide information to third parties based on services you elect, including providing data broker websites your information for purposes of deletion of your personal information from such sites.

Is the information collected through the service secure?

Summary: Your information is stored using commercially reasonable security techniques.

We want your information to remain secure. We strive to provide transmission of your information from your device to our servers that align with commercially reasonable standards and to employ administrative, physical, and electronic measures to protect your information from unauthorized access.
Our Data Protection Officer (DPO) acts as an administrative control to ensure commercially reasonable privacy controls are employed and working, both for Cloaked and third parties utilized by Cloaked. Our DPO can be reached at [email protected]. 

There is always risk involved in transmitting information over the Internet.  As a result, although we strive to protect your information, we cannot ensure or warrant the security or privacy of information you transmit to us, and you do so at your own risk.‍

Could my information be transferred to other countries?

Summary: Your information may be transferred to the United States. If you are located in the European Economic Area or the United Kingdom, although the United States has less stringent privacy laws than your home country, where required, we ensure the same degree of protection that is required under European Economic Area and United Kingdom regulations. 
‍
Information collected on the Service may be transferred to countries that may not have laws of general applicability regulating the use and transfer of such information (such as the United States). By using the Service, you consent to the transfer of such information. Further, you hereby expressly grant consent to Cloaked to: (a) process and disclose such information in accordance with this Privacy Policy; (b) transfer such information to and from the United States; and (c) disclose such information to comply with lawful requests by public authorities, including to meet national security or law enforcement requirements. To the extent required by applicable law: whenever we transfer your personal data (as defined in the European Data Protection Laws) to third parties (as described in this Privacy Policy) located in the United States, we ensure a similar degree of protection is afforded; we may use specific contracts approved by the European Commission or the UK Information Commissioner’s Office, as applicable; and if we rely on another transfer mechanism, we will keep you updated or contact you if required. Please contact us if you want further information on the specific mechanisms used by us when transferring your personal data to the United States. If you are a user accessing the Service from a jurisdiction with laws or regulations governing processing of personal data that differ from those of the United States, please be advised that all aspects of the Service are governed by the internal laws of the United States and the Commonwealth of Massachusetts, USA, regardless of your location. 

For how long will my information be kept?

We will only retain your information for as long as necessary to fulfill the purposes for which we collected it or as otherwise permitted by applicable law.

To determine the appropriate retention period for information, we consider the amount, nature, and sensitivity of that information, regulatory requirements, the potential risk of harm, and the purposes for which we process your information and achieving those purposes through.

What choices do I have regarding my information?

Summary: You can opt out of marketing communications by contacting us. As outlined below, users in the European Economic Area, Canada, and the United Kingdom may have additional rights which can be exercised by contacting us.   
‍
We process information as described in this Privacy Policy and our Terms of Service. Where appropriate, we will ask for your consent to use your information for other purposes. 

If you have questions, requests, or would like to update information, please contact us at [email protected].

‍Residents of Europe
‍Under certain circumstances and in compliance with the European Data Protection Laws, you may have the right to: 
‍
Request access to your information (commonly known as ‘data subject access request’).
Request correction of the information that we hold about you.
Request erasure of your information.
Object to processing of your information where we are relying on a legitimate interest (or that of a third party) and there is something about your particular situation which makes you want to object to processing on this ground;
Request the restriction of processing of your information.
Request the transfer of your information to another party; and
Lodge a complaint with the relevant supervisory authority (as defined in the European Data Protection Laws).

If you are covered by the European Data Protection Laws and want to review, verify, correct or request erasure of your information, object to the processing of your information, or request that we transfer a copy of your information to another party, please contact [email protected].

Residents of Canada
If you are a Canadian resident, unless otherwise required or allowed by the laws applicable in your province ‎or ‎territory of ‎residence, we will only ‎collect, use, or communicate your personal information ‎with ‎your consent ‎‎(which may be express or implied) for the purposes set out in this Privacy Policy.‎ You are generally not obliged to provide your ‎personal ‎information, ‎however we may be unable to provide certain services to you if you refuse to ‎disclose certain personal ‎‎‎information.‎  We will only collect personal information as authorized by law.‎

You acknowledge that your personal information may be processed and stored in foreign jurisdictions as described above.  In these cases, we will comply with applicable local law requirements relating to the conditions for disclosure or release of personal information.

If you are a Canadian resident, you have certain rights regarding your personal information as ‎described below:‎

• Access: You have a right to access your personal information held by us.‎ Upon written ‎request and authentication of identity, we will provide you with your personal information ‎‎under our control. We will also give you information about the ways in which that ‎information is ‎being used and a description of the individuals and organizations to whom ‎that information has been ‎disclosed. We may charge you a reasonable fee for doing so.‎

In some situations, we may not be able to provide access to certain personal information (e.g. legal bases). We may ‎also be prevented by law from providing access to ‎certain personal information.‎  If we must refuse an access request, we will notify you in writing. 

• Accuracy and Correction: If you demonstrate the inaccuracy or incompleteness of your personal ‎information, we will amend the ‎information as required.

• Withdraw Consent: You have the right to withdraw your consent to use or communication of your ‎personal information at any time by communicating with us at [email protected]. We may however be unable to offer you ‎certain services if you withdraw your consent. This will not affect the ‎lawfulness of any use or communication of your information that ‎happened before such withdrawal, nor does it oblige us ‎to delete personal information that we are otherwise allowed or required ‎to ‎retain under applicable law;‎

• Complaints: If you request, we will provide our complaint procedure, absent legal circumstances that prevent us from doing so.

• Supervisory Authorities:  If ‎you have unresolved concerns, you have the right to complain to ‎a data ‎protection authority where you reside, where you work, or where you believe ‎there ‎has been non-compliance with data protection or privacy laws.‎

If you are a resident of the province of Québec, the following additional rights are available ‎to you:

• Portability of Your Personal information: You have the right ‎to receive your personal ‎data in a structured, commonly-used and ‎machine-readable format. You also have ‎the right to request that we ‎transmit your personal information to another organization.

• De-indexation: You have the right to request, in certain ‎circumstances, that we cease ‎disseminating your personal information or ‎to ‎de-‎index any hyperlink that allows access to ‎that personal information ‎by technological means, if ‎‎such dissemination contravenes ‎applicable law ‎or a court order.‎

These rights may be limited, for example, if fulfilling your request would reveal ‎personal ‎information about another person, or if you ask us to delete information ‎that we are required by ‎law or have compelling legitimate interests to keep.‎

We may revise this Privacy Policy from time to time. If we make make ‎will change the "Last Updated" date at the end of this Privacy Policy. If we make material changes ‎to this Privacy Policy, we will notify you by email to your registered email address, by prominent posting ‎on our website or our online services, or through other appropriate communication channels, and will ‎obtain your consent if required by applicable law. All changes will be effective from the date of ‎publication unless otherwise communicated to you.

‍All Users‍
All users have the right to "opt out" of receiving marketing communications by following directions provided in the communication or  by contacting [email protected].

Such updates, corrections, changes and deletions will have no effect on other information that we maintain, or information that we have provided to third parties in accordance with this Privacy Policy prior to such update, correction, change or deletion. To protect your privacy and security, we may take reasonable steps (such as requesting a unique password) to verify your identity before granting you profile access or making corrections. You are responsible for maintaining the secrecy of your unique password and account information at all times.

DO NOT TRACK
We take no action in response to automated Do Not Track requests. However, if you wish to stop such tracking, please contact us with your request.

How will I know if there are any changes to this privacy policy?

We may revise this Privacy Policy from time to time. If legally required based on the changes, we will provide an opt-in. For minor changes, we do not require your opt-in. Visit this page periodically for changes.

Who do I contact if I have any privacy questions.

‍Contact us at: [email protected]

Policy last updated on: February 1, 2024