Privacy Policy
Effective date: August 13, 2026 · Version 3.0
This Privacy Policy explains how Arabia Transfer, LLC, doing business as Arabia Pay ("Arabia Pay", "we", "us", or "our"), collects, uses, shares, and protects personal information when you visit our website, contact us, or use our payment services. Arabia Transfer, LLC is a company formed in the State of Delaware, United States.
1. Information we collect
Information you provide to us
- Contact details — such as your name, email address, company name, and phone number when you fill in our contact form, request a demo, or communicate with our sales or support teams.
- Account and onboarding information — if you apply for a merchant account, we collect business information such as your legal entity name, registration details, and ownership information. Identity documents required for verification ("Know Your Customer" requirements) are collected through our secure onboarding process, and bank account details for settlement are provided directly to our licensed Processing Partners.
Information collected automatically
- Usage data — pages visited, links clicked, browser type, device type, operating system, referring pages, and approximate location derived from your IP address.
- Preferences — this website stores your language choice (English or Arabic) in your browser's local storage. This preference stays on your device and is not transmitted to us.
- Anti-fraud signals — when you submit a merchant application we also record a device marker, a browser fingerprint (a non-identifying summary of your browser and device configuration), the network address the application came from, how long the form took to complete, and which identity fields were pasted rather than typed. We record these to detect automated and fraudulent applications. They are attached to the application, are not used for advertising, and are not shared with anyone outside the checks described below.
Payment transaction information
Payments made to merchants through our software are processed by licensed third-party payment processors. Cardholder data is collected and handled by those processors in accordance with the Payment Card Industry Data Security Standard (PCI DSS). Arabia Pay receives transaction metadata — such as amount, currency, payment method type, status, and billing details — needed to provide dashboards, invoicing, and reporting.
Support chat
The chat window on this website is answered by an automated assistant. What you type in it, and the reply, are sent to a third-party artificial intelligence provider that generates the answer on our behalf under a contract that forbids using your messages to train their models. If you ask to be put in touch with a person, the conversation and the email address you give us are emailed to our support team so they can reply. Please do not type identity documents, card numbers, passwords, or other sensitive details into the chat — use the application form or email instead.
2. How we use information
- To provide, operate, and improve our payment services and this website;
- To respond to your inquiries and provide customer support;
- To verify merchant identity and comply with anti-money-laundering (AML), counter-terrorist-financing (CTF), sanctions, and other legal obligations;
- To detect, prevent, and investigate fraud, abuse, and security incidents;
- To send service communications and, where permitted by law and with your consent where required, marketing communications you can opt out of at any time;
- To analyze usage so we can improve our products and website.
3. How we share information
We do not sell your personal information. We share it only with:
- Service providers that help us operate — such as banking partners, card networks, cloud hosting, identity-verification, fraud prevention, and analytics providers — under contracts that limit how they may use it;
- Financial partners and card networks as necessary to process transactions;
- Legal and regulatory authorities when required by law, regulation, legal process, or to protect the rights, safety, and property of Arabia Pay, our merchants, or others;
- Successors in connection with a merger, acquisition, or sale of assets, subject to this policy.
The processors we actually use
Naming them is more useful than describing them. These are the companies that handle personal information on our behalf, what each one receives, and where it is processed. We update this list when it changes.
| Processor | What it does | What it receives | Where |
|---|---|---|---|
| Supabase | Database, authentication, and our server functions | Everything in your application, and the risk signals attached to it | EU |
| EmailJS | Delivers our transactional email | Your email address, first name, and application reference. Since August 2026 the notification we send our own team carries only the reference — no applicant details pass through this route. | US |
| Zoho Mail | Our mailboxes | Anything you choose to write to us | EU |
| Anthropic | Powers the support chat assistant | What you type into the chat. It is not given your application, and it cannot look you up. | US |
| Komoot (Photon) | Address autocomplete on the application form | The address text you type, relayed through our own server so your IP address is never disclosed to them | EU |
| Calendly | Books onboarding meetings | Your name, email, and the slot you pick — only if you book | US |
| GitHub Pages | Serves this website | Standard web-server logs, including your IP address | US |
| Meta | Advertising analytics — only if you accept analytics cookies | Pages visited on this site. Decline, and it is never loaded. | US |
Sanctions screening runs against public lists published by the US Treasury (OFAC) and the UN Security Council. We download those lists; we do not send your details to either body. Domain-age checks read public domain registry records for the website you give us, which involves no personal data of yours.
Card details are never in this table because they never reach us. They are captured and held end to end by the licensed, PCI DSS certified processing partner.
4. International transfers
We are based in the United States and serve merchants and customers in multiple countries. Your information may be processed in countries other than your own. Where required, we use appropriate safeguards for cross-border transfers.
5. Automated checks and decisions
To review merchant applications fairly and consistently, and to meet our legal obligations, some checks run automatically:
- Sanctions screening — the applicant's name is compared against the published sanctions lists of the United States Treasury (OFAC) and the United Nations Security Council. A possible match is flagged for a person to review; it is never by itself a decision, because common names produce false matches.
- Website checks — the age of the business website is read from public domain registry records, and throwaway or disposable email addresses are refused at the point of submission.
- Application behaviour — the anti-fraud signals described in section 1 are scored to identify automated submissions.
- Inactivity closure — if we ask an applicant for changes after an onboarding meeting and hear nothing, we send a reminder and, if there is still no response after a further notice period, the application is closed automatically.
A person decides. No application is approved or declined solely by automated means. Automated checks produce signals; a member of our team reviews them and makes the decision. Where an application is closed for inactivity, or where you believe a decision about you was wrong, you may ask for it to be looked at again by a person, explain your circumstances, and contest the outcome — write to privacy@arabia-transfer.com and we will review it.
6. Data security
We protect personal information using industry-standard measures, including TLS encryption in transit, encryption at rest, access controls, and monitoring. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
7. Data retention
We keep personal information only as long as we need it, and we put numbers on that rather than leaving it open-ended:
- Applications that are approved — kept for the life of the merchant relationship, and for five years after it ends, because anti-money-laundering rules require records to be available for that long.
- Applications that are declined or withdrawn — kept for 180 days, then automatically redacted. Your name, date of birth, email, phone, WhatsApp, home and business address, registration number, website, description, IP address and device marker are irreversibly destroyed. What survives is a record with no person attached to it: the country, the business category, the decision, and the reason — which is what lets us show that decisions are made consistently.
- Support chat — the conversation is held in your browser for the session. If you ask us to pass you to a person, the transcript you approve is emailed to our team and kept with that support request.
- One-time links — the link to correct a declined application expires 14 days after we send it. Meeting-booking links expire after 72 hours.
Deleting an application in our own systems redacts it on the schedule above; it does not merely hide it from view.
8. Your rights
Depending on where you live, you may have rights to access, correct, delete, or receive a copy of your personal information, to object to or restrict certain processing, and to withdraw consent where processing is based on consent. To exercise any of these rights, contact us at privacy@arabia-transfer.com. We will respond within the timeframe required by applicable law. You may also have the right to complain to your local data protection authority.
9. Children
Our website and services are intended for businesses and are not directed at children under 16. We do not knowingly collect personal information from children.
10. Third-party links
Our website may link to third-party sites (for example, our partners). Their privacy practices are governed by their own policies, which we encourage you to review.
11. Changes to this policy
We may update this Privacy Policy from time to time. We will post the updated version on this page with a new effective date, and — for material changes — provide additional notice where required by law.
12. Contact us
Arabia Transfer, LLC (d/b/a Arabia Pay)
2810 N Church St, STE 89929, Wilmington, DE 19802, United States
Email: privacy@arabia-transfer.com