Privacy Policy

Last Updated: October 2026

Who This Privacy Policy Covers

This Privacy Policy applies to the following categories of individuals:

• Website visitors. Individuals who visit our websites or interact with our online content, forms, or chat features.
• Customers, prospects, and business contacts. Individuals who purchase, use, or inquire about our products and services, or who interact with us on behalf of a company, including employees of payment companies, online platforms, marketplaces, and other customers.
• Certification applicants and certified merchants. Owners, officers, licensed professionals, and other representatives of businesses that apply for or hold a LegitScript certification.
• End users of our Customers. Individuals whose information we process on behalf of our business customers (“Customers”), for example, when a Customer uses our merchant onboarding, underwriting, Know Your Business (“KYB”), Know Your Customer (“KYC”), or identity verification services. In these cases, we generally act as a “processor” or “service provider” on behalf of the Customer, and the Customer’s privacy notice also governs that processing (see “Identity Verification, Know Your Customer, and Know Your Business Services” below).
• Individuals associated with businesses and websites we monitor. Individuals whose information appears in public or third-party sources that we review in providing our monitoring, risk intelligence, certification, and investigative services, such as the owners, operators, or contacts of websites, merchants, or online listings.

The Basics

LegitScript is committed to complying with all applicable data protection laws, including the data protection requirements introduced by California Consumer Privacy Act, as amended by the California Privacy Rights Act (the “CCPA”), other U.S. state consumer privacy laws, the European Union General Data Protection Regulation (Regulation 2016/679) (“GDPR”), and the GDPR as incorporated into the laws of the United Kingdom (“UK GDPR”). This Privacy Policy contains information on what data we collect, what we do with that information, and what rights you have.

We do process some personal data in order to run our business. There are some situations where we may share your information with third parties (for example, pursuant to a court order, government request, or with our business partners and service providers who support our business or partner with us). We also use artificial intelligence (“AI”), including machine learning and generative AI tools, in our products and in our internal operations. The section titled “Our Use of Artificial Intelligence” explains how, including whether we use personal information to train AI models.

We take the protection of your information seriously and take steps to make sure your personal information is secure. Please read the full Privacy Policy below. Please feel free to contact us if you have any questions.

The Details

LegitScript respects your privacy. This Privacy Policy outlines our commitment to protecting your data. Read together with our Terms and Conditions, this Privacy Policy describes the types of data we collect or data that you might provide us - for example, when you visit any of our websites, use our products, or contact us - and how we use, secure, and disclose data.

You should know that this Privacy Policy does not apply to information about you collected via any third-party site or application (including advertising or similar services) that may link to, or be accessible from, LegitScript’s websites. We are not responsible for the privacy policies or data collection, use, and disclosure practices of those sites. We encourage you to read the written policies of all sites you visit.

This Privacy Policy is a notice describing our practices: please read it carefully. We may update this Privacy Policy from time to time as described in the section “Changes to Our Privacy Policy” below.

Security

LegitScript takes appropriate steps to protect and secure your personal data from unauthorized access, use, and disclosure. We use reasonable and appropriate technical and organizational measures to protect your personal data against unauthorized, accidental or unlawful destruction, loss, alteration, misuse, disclosure, or access and against all other unlawful forms of data processing. We put these measures in place after evaluating current state of the art of the technology, the cost of implementation, risks presented by processing, and the nature of the personal data. These measures extend to the AI tools we use and include access controls, encryption, vendor security reviews, and internal rules that prohibit our personnel from entering confidential information or personal information into AI tools that LegitScript has not reviewed and approved.

Although we take reasonable security measures to protect your personal information, we cannot guarantee the security of your personal information transmitted to our websites. The transmission of information via the internet is not 100% secure. LegitScript does not ensure or warrant the security of any information you transmit to us. We are not responsible for circumvention of any privacy settings or security measures contained on the websites.

Information We Collect and How We Use It

We collect different types of information for our business operations, including but not limited to:

• Website data. This includes information provided at the time of purchasing or registering for our products and services, or requesting further services. Also, we may ask you for information when you report a problem with our websites, products, or services.
• Data you provide to us. When you click through our websites, purchase our services, or otherwise contact us, we may request, or you may choose, to give us information. This may include information by which you may be personally identified (“personal information” or “personal data”), such as your contact information, name, company, employer, e-mail address or telephone number, and records and copies of your communications with us. We may at times share this information with our business partners in order to provide our products and services to you.
• Certification and merchant onboarding data. If you apply for LegitScript certification, or a Customer onboards your business through our products, we collect information about you and your business, such as the names, titles, and contact details of owners, officers, and other principals; professional licenses, registrations, and disciplinary history; ownership information; business documents you submit; and information about the products and services your business offers.
• Communications, meetings, and recordings. We may keep records of your communications with us. With any notice or consent required by law, we may record, transcribe, and summarize calls and video meetings, including by using AI-enabled note-taking and transcription tools. We reserve the right to delete or archive communication records at any time, without notice, in accordance with our internal data retention policies and applicable laws.
• Marketing. If you are interested in, or have used our products in the past, you may periodically receive emails from us containing details about features of the products you use and/or about similar products or services that we offer.
• Public and third-party data. To provide our monitoring, certification, risk intelligence, and investigative services, we collect information from publicly available sources (such as websites, online marketplaces, social media, advertisements, domain registration records, corporate and licensing registries, court and government records, and sanctions lists and watchlists) and from commercial data providers and partners. This information primarily concerns businesses, websites, and products, but it may include personal information about individuals associated with them, such as owners, operators, officers, licensed professionals, and contact persons. We use automated tools, including AI and machine learning, to collect, analyze, classify, and link this information so that we and our Customers can detect and address illegal, fraudulent, or high-risk activity.
• Usage information, IP addresses and cookies. As you click through and interact with our websites, our websites might automatically collect certain information about your equipment, browsing actions and patterns using common internet technologies, such as cookies and Google analytics. These common internet technologies may collect information about details of your visits to our websites, including information about your connectivity, such as your IP address and browser information, location data, logs and other communication data, and the resources that you access and use on the websites. You may refuse the use of cookies by selecting the appropriate settings on your browser. If you do, please note that you may not be able to fully access our websites. Where required by applicable law (for example, in the European Economic Area (“EEA”), the United Kingdom, and Switzerland), we use cookies and similar technologies that are not strictly necessary only with your consent, which you may give or withdraw at any time through our cookie preferences tool. Where required by U.S. state law, we also honor opt-out preference signals such as Global Privacy Control (“GPC”). If you wish to withdraw your agreement to accept cookies and similar technologies, please delete the cookies via your browser settings. The following external guide explains what cookies are and how to delete them: http://www.aboutcookies.org/how-to-delete-cookies/

• Interactions with AI features. If you interact with an AI-powered chat assistant or other AI feature on our websites or in our products, we may collect the content you submit (such as questions, prompts, and files), the responses generated, and related usage information. We tell you when you are interacting with an AI system rather than a person where required by law. Please do not submit sensitive personal information to an AI feature unless we ask you to.
• General business operations. We may also receive or collect other personal data from or about you in the ordinary course of our business. Here is how we may use information that you provide or we collect:
  • To provide our websites, products, and services;
  • To give you information, products, or services that you request from us;
  • To let you know about changes to our website, products, or services;
  • To ensure the integrity and security of our websites, products, and services;
  • To develop, train, test, evaluate, and improve our products, services, and technology, including our AI and machine learning models, as described in “Our Use of Artificial Intelligence” below;
  • To detect, investigate, and prevent fraud, security incidents, and illegal or prohibited activity;
  • To send you marketing communications, subject to your choices described below;
  • To create aggregated, de-identified, or anonymized information, which we may use for any lawful purpose;
  • For our ordinary business operations, including business research and outreach and, for job applicants, recruiting (job applicants may receive a separate notice at the time of application); and
  • To comply with our legal obligations.

How We Justify Our Data Processing 

EEA, UK, and Switzerland. If you are located in the EEA, the United Kingdom, or Switzerland, we process your personal data only where we have a valid legal basis, namely where:

• the processing is necessary to perform our contractual obligations towards you or to take pre-contractual steps at your request, such as when we authenticate your log-in to our services or ensure that you only have access to the services and data you’ve agreed to buy;
• the processing is necessary to comply with our legal or regulatory obligations, such as tax reporting or regulatory requirements;
• the processing is necessary for the legitimate interests of LegitScript, and does not unduly affect your interests or fundamental rights and freedoms, such as operating and securing our websites and services, marketing our services to business contacts, detecting and preventing fraud and illegal activity online, and developing and improving our products, including our AI models. You have the right to object to processing based on legitimate interests, as described in “Your Privacy Rights” below; 
• we have your consent, which you may withdraw at any time without affecting the lawfulness of processing before withdrawal.

If we ever process any special categories of data relating to you, we will do so because:

• the processing is necessary for the establishment, exercise or defense of a legal claim;
• the data has been manifestly made public;
•  the processing is necessary for reasons of substantial public interest on the basis of applicable law (for example, to prevent or detect unlawful acts or fraud); or
• you have given your explicit consent to us to process that information (where legally permissible).

Canada. If you are located in Canada, we collect, use, and disclose your personal information with your consent, which may be express or implied depending on the sensitivity of the information and your reasonable expectations, or without consent where permitted or required by applicable law, for example, to investigate a breach of an agreement or a contravention of law, to detect, suppress, or prevent fraud, or to comply with a legal obligation. Where we process personal information on behalf of a Customer, the Customer is responsible for obtaining any consent required for that processing. You may withdraw your consent at any time, subject to legal or contractual restrictions and reasonable notice, although doing so may affect our ability to provide certain services to you.

If you are located in Quebec, we obtain your express consent before processing sensitive personal information, except where the law permits otherwise. If we make a decision about you based exclusively on automated processing of your personal information, we will inform you no later than the time we communicate the decision; on request, we will tell you what personal information was used, the reasons and principal factors and parameters that led to the decision, and your right to have that personal information corrected; and you may submit observations to a member of our personnel who is in a position to review the decision. Before transferring personal information outside Quebec, we assess whether the information will receive adequate protection. Our person in charge of the protection of personal information is Vice President, Risk & Compliance, and can be contacted at [email protected].

United States. U.S. privacy laws generally do not require a specific legal basis for processing. We process personal information for the purposes described in this Privacy Policy and limit our processing to what is reasonably necessary and proportionate to those purposes, as required by applicable law. Where a U.S. state law requires consent, for example, to process sensitive data, we (or our Customer) obtain that consent. See “Notice to U.S. State Residents” below for more information.

Other jurisdictions. Where the law of another jurisdiction requires a legal basis for processing, such as Brazil’s General Data Protection Law (Lei Geral de Proteção de Dados Pessoais, “LGPD”), we rely on the grounds described above for the EEA, the United Kingdom, and Switzerland, together with other grounds available under that law, such as the prevention of fraud and the protection of credit, where applicable.

LegitScript may, from time to time, access accounts and information you may have stored with us or third-party applications operating in conjunction with our services, in order to provide technical assistance or to ensure the veracity of the data contained therein.

Data Integrity

We do not use personal data in ways that are inconsistent with those described in this Privacy Policy. We only collect and retain as much personal data as we need for the specific purposes we have described, or to comply with our legal and regulatory obligations.  When data retention is no longer necessary, we may delete personal data or retain it in a form that does not personally identify anyone. We take reasonable steps to keep personal data accurate and complete, including by maintaining human review of AI-assisted outputs that are used in our certification decisions or delivered to Customers.

Our Use of Artificial Intelligence

LegitScript uses AI, including machine learning models and generative AI tools such as large language models, to operate our business and to power our products and services. This section explains how we use AI in connection with personal information and the safeguards we apply.

AI in our products and services. Our products and services use AI to, for example:

• identify, classify, and summarize websites, products, advertisements, and other online content;
• detect potentially illegal, fraudulent, or high-risk merchants, websites, and activity;
• extract and analyze information from documents and web pages, and detect altered or forged documents;
• match and link businesses, websites, and the individuals associated with them across data sources; and
• generate risk indicators, scores, alerts, summaries, and recommendations for our analysts and Customers.

Human involvement and automated decisions. AI outputs in our products are designed to support, not replace, human judgment. LegitScript certification decisions are made by trained LegitScript analysts, who review AI-assisted outputs before a decision is made. When our Customers use our products to make decisions about merchants or individuals, such as whether to onboard or continue to support a merchant, those decisions are made by our Customers under their own policies, and our Customers are responsible for providing any notices and honoring any rights that apply to their decisions. LegitScript does not make decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects concerning you. If that changes, we will provide the notices and rights required by applicable law, which may include the right to opt out, to obtain information about the logic involved, and to request human review of a decision.

AI in our internal operations. We also use AI tools, including tools provided by third-party vendors, to support our internal business functions, such as drafting, translating, and summarizing documents and communications; transcribing and summarizing meetings and calls; responding to support inquiries; software development; research and analysis; sales and marketing; and security monitoring. Where we use AI tools in recruiting or other employment-related processes, a human makes the final determination.

Use of personal information to train and improve AI. We do not collect, use, or sell personal information for the purpose of training large language models. We use personal information that we process on behalf of our Customers to improve our products and models only as permitted by our agreements with those Customers and applicable law, and in de-identified form where reasonably feasible. When we use AI services provided by third parties, we contractually prohibit those providers from using any personal information we provide to train or improve their own general-purpose models.

Our AI safeguards. We maintain an AI governance program designed to promote the responsible use of AI. It includes an inventory of the AI systems we use; review and approval of AI tools before deployment; risk assessments where required by law; testing for accuracy, reliability, and unfair bias; human oversight; vendor due diligence; restrictions on the data that may be entered into AI tools; and employee training.

Transparency. Where required by law, we tell you when you are interacting with an AI system, and we label content that has been generated or manipulated by AI.

Your choices about AI and automated processing. Depending on where you live, you may have rights relating to profiling and automated decision-making, including the right to opt out of certain profiling, to obtain information about the logic involved, and to contest a decision and obtain human review. See “Your Privacy Rights” and “Notice to U.S. State Residents” below. If you have questions about our use of AI, please contact us at [email protected].

Information Use, Disclosure, and Your Options

It is important to us that we adequately protect your personal information, especially when we disclose information about you. We may disclose or transfer personal information that we collect or you provide as described in this Privacy Policy, including:

• As required by law, including to respond to any government or regulatory request.
• To enforce the Terms and Conditions that apply to the use of our products and services, including to protect the rights, property or security of LegitScript, our employees, our users, and others.
• As part of a merger, acquisition, divestiture, restructuring, reorganization, dissolution or other sale or transfer of some or all of LegitScript’s assets.
• To our affiliates, agents, contractors, and service providers (including cloud hosting, AI and machine learning, data analytics, communications, and security providers), and others we use to support our business or collaborate with and who are bound by contractual obligations to keep personal information confidential and use it only for the purposes of providing services for or with us.
• To our Customers, in connection with the services we provide to them, for example, when we report the results of our monitoring, certification, onboarding, or verification services.
• Publicly, in connection with our certification program, for example, by displaying a business’s certification status through our certification seal and online lookup tools.

You have choices about the personal data you provide us.  Here are some ways you can control the data we have:

• You may be able to change your internet browser settings to refuse all or some browser cookies, or to alert you when cookies are being sent. If you disable or refuse cookies, please note that some parts of our websites may be inaccessible or not function properly.
• You may opt out at any time from the use of your personal information for direct marketing purposes by contacting us at [email protected]. Please allow us a reasonable time to process your request. If you do not wish to receive promotional e-mail messages from us, you can always opt-out at https://go.legitscript.com/Subscription-Management.html.

Your Privacy Rights

Depending on where you live, and subject to exceptions under applicable law, you may have the right to:

• access the personal data we hold about you and receive information about how we process it;
• correct inaccurate or incomplete personal data;
• delete your personal data;
• restrict our processing of your personal data;
• object to our processing of your personal data where we rely on legitimate interests, and object at any time to processing for direct marketing;
• receive your personal data in a portable format and have it transmitted to another organization;
• withdraw your consent at any time, where our processing is based on consent;
• not be subject to a decision based solely on automated processing, including profiling, that produces legal or similarly significant effects concerning you, except as permitted by law; and
• lodge a complaint with a data protection supervisory authority.

We will respond within the time required by applicable law (for example, within one month under the GDPR, which may be extended in certain circumstances). Before responding, we may need to verify your identity, using information proportionate to the nature of your request. Residents of U.S. states with consumer privacy laws should also see “Notice to U.S. State Residents” below.

We may also ask you to provide information that helps us better understand what you are asking. To exercise your rights, send an email to [email protected]. We’ll do our best to honor these requests as required by applicable laws, but understand that your data access rights are not absolute. They may not always apply to you and exemptions may be appropriate. For example, LegitScript may have limited access to the data we process on behalf of our customers in connection with our services. Therefore, if you are an individual whose personal data was submitted by a Customer, your request should include the name of the LegitScript Customer who submitted your personal data to LegitScript. We will forward such requests to the customer you identify to respond directly to you and will provide any necessary assistance in that Customer’s response to you. If you are not satisfied with how we process your personal data, please let us know and we will investigate your concern. If you are not satisfied with our response, you have the right to make a complaint to the relevant authority in the jurisdiction where you live or work, or in the place where you think an issue in relation to your data has arisen. Contact details for EEA supervisory authorities are available at https://www.edpb.europa.eu/about-edpb/about-edpb/members_en, and the UK Information Commissioner’s Office can be reached at https://ico.org.uk.

Third-party Services

LegitScript’s use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.

Notice to U.S. State Residents (including California) 

This section supplements this Privacy Policy and applies to residents of California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia, and any other U.S. state with a comprehensive consumer privacy law that applies to LegitScript (“Covered States”). Where a Covered State has a unique requirement, it applies only to residents of that state. Some of these laws do not apply to information about individuals acting in a business or commercial context, or to personal information we process as a service provider or processor for our Customers.

Personal information we collect, use, and disclose. In the preceding 12 months, we have collected the following categories of personal information, from the sources described, and disclosed them for business purposes to the categories of recipients described: