Privacy Notice

Effective date: August 8, 2026

This notice explains how PayCure Technologies, Inc. ("PayCure," "we") handles information in connection with paycure.ai and the PayCure service. PayCure is business software for accounts payable and procurement; our customers are businesses, and we handle information about people almost entirely on those businesses' behalf.

1. The Two Roles We Act In

As a service provider (most of what we do). When your employer or a business you work with uses PayCure, the information inside their workspace — names of team members, vendor contacts, bills, approvals, bank details — belongs to that business. We process it only on their instructions, under our Data Processing Addendum. If you want that information corrected or deleted, the business that controls the workspace is the right door to knock on; we support them with the tools to do it.

As a business in our own right. For visitors to paycure.ai, people who sign up, and our billing relationships, we decide how information is used, and the rest of this notice describes that.

2. What We Collect

• Account information — your name, work email, password (stored only as a salted hash), role, and the company you belong to.
• Customer business records — what your company enters or connects: vendor details, bills and their attachments, purchase orders, approvals, and accounting data synced from a connected ERP.
• Financial details needed to move money — the bank account your company links for payments, and vendors' payment details. Bank account numbers and tax identifiers are encrypted at rest, displayed only in masked form, and every access to sensitive vendor data is logged.
• Usage and device information — sign-in times, IP address, browser type, and the actions taken in the service. Much of this is the audit trail our customers rely on: who approved what, when, from where.
• Support and correspondence — messages you send us.

We do not collect information from data brokers, and we do not use advertising trackers or third-party advertising cookies. The only cookies we set are the ones the service needs to work (your sign-in session).

3. What We Use It For

To provide and secure the service: operating your company's workspace, executing the payments your company approves through our regulated financial partners, preventing fraud and abuse, meeting legal obligations (including payment-network record-keeping rules), providing support, and improving the product. We do not sell personal information, we do not share it for cross-context behavioral advertising, and we do not use the contents of your company's workspace to train advertising or marketing systems.

4. Who We Share It With

Only what each party needs, and never for their own marketing:

• Payment partners — Increase and its partner chartered bank(s) receive the details required to execute payments and to meet their legal obligations (including Know-Your-Business and sanctions screening).
• Bank connectivity — Plaid, when your company links its bank account.
• Infrastructure — cloud hosting (Vercel), database hosting (Supabase), file storage, and transactional email (Resend). These providers process data to run the service, under contract.
• A connected accounting system — if your company connects its ERP (for example QuickBooks Online), data syncs both ways at your company's direction.
• Law and safety — if legally required, or to protect the rights, safety, or property of PayCure, our customers, or others. Where allowed, we tell the affected customer first.
• A future corporate transaction — if PayCure is acquired or merges, information transfers with the business, under this notice's commitments.

5. Retention

We keep workspace records for as long as the customer's account is active, plus the export window in our customer agreement. Some records we must keep longer by law — payment-authorization records, for example, are retained for at least two years after an authorization ends, as the Nacha Operating Rules require. Audit-trail records are kept because their permanence is the product: they are the evidence our customers rely on.

6. Security

Encryption in transit everywhere and at rest for sensitive fields (bank details, tax identifiers); role-based access; segregation-of-duties controls; logging of access to sensitive data; and independent, regulated partners holding the actual funds — PayCure never takes custody of money. No system is perfectly secure; if a breach affects your information, we will notify affected customers without undue delay.

7. Your Rights (Including California)

If you are a California resident, the CCPA gives you rights to know, correct, and delete personal information, and to opt out of sale or sharing. We do not sell or share personal information, so there is nothing to opt out of. For information we hold as a business (Section 1), email us at the address below and we will act on verified requests within the statutory window, and we will not treat you differently for exercising your rights. For information inside a customer's workspace, we will refer your request to that customer and support them in fulfilling it — that is what the law expects of a service provider.

8. Children

The service is for businesses. It is not directed to anyone under 16, and we do not knowingly collect information about them.

9. Changes

We will post any material change here with a new effective date, and notify customers in the service. Continued use after the effective date means the updated notice applies.

10. Contact

PayCure Technologies, Inc. · privacy@paycure.ai

Version 2026-08-08. Questions or privacy requests: privacy@paycure.ai.