CubePay Privacy Policy

Effective date: 07/10/2026 · Last updated: 07/10/2026

1. Who We Are

Empyrean Merchant Services Inc. ("Empyrean", "we", "us" or "our") operates the CubePay platform, including the websites cubepay.io, admin.cubepay.io and pay.cubepay.io (together, the "Service"). We are located at 177-1881 Steeles Avenue W., Toronto, Ontario M3H 0A1, Canada.

This Privacy Policy explains how we collect, use, disclose and protect personal information when you use the Service. It is written to comply with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable Canadian provincial privacy laws. Capitalized terms not defined here have the meanings given in our Terms and Conditions.

2. Who This Policy Applies To

The Service is used by three groups of people, and our role differs for each:

• Merchants are businesses that subscribe to CubePay to create invoices and accept payments, along with the individuals they authorize to use their account ("Users"). For Merchant and User information, we decide how the information is used and are responsible for it.
• Payers are the Merchant’s customers who receive invoices and pay them through pay.cubepay.io. Payer information is collected and used on behalf of the Merchant, according to the Merchant’s instructions. The Merchant is responsible for its own privacy obligations to Payers, including obtaining any required consent. Payers with questions about how a Merchant uses their information should contact that Merchant directly; we will assist the Merchant in responding.
• Visitors are people who browse cubepay.io without logging in.

3. Information We Collect

Merchants and Users

• Business information such as legal and operating name, business address, phone number and business type.
• User account information such as name, business email address, phone number, role and login credentials.
• Subscription and billing information, such as plan, billing history and the payment method used to pay CubePay fees (handled by our payment processor as described below).
• Content you upload or create in the Service, such as customer lists, invoices, line items and notes.
• Communications with our support and sales teams.

Payers

• Information the Merchant provides about you, such as your name, email address, phone number, billing address and invoice details.
• Information you provide when paying, such as your name and billing address.
• Limited transaction information returned by the payment processor, such as card brand, last four digits, payment amount, date and approval status.

Payment card and bank information

Card details entered on pay.cubepay.io are captured and tokenized directly by our payment processor, Elavon/Fiserv. CubePay does not receive or store full card numbers, CVV codes or full bank account numbers. We store only the processor-issued token and the limited transaction information listed above.

Information collected automatically

When you use the Service we collect usage data, such as IP address, browser type and version, device identifiers, pages visited, time and date of visit, time spent on pages, and diagnostic data.

Cookies and similar technologies

We use the following types of cookies:

• Essential cookies keep you logged in, secure your session and make the Service work. The Service cannot function without them.
• Preference cookies remember your settings.

You can set your browser to refuse cookies or to alert you when cookies are sent. If you refuse essential cookies, parts of the Service will not work.

4. How We Use Information

We use personal information to:

• Provide, operate and maintain the Service, including creating and sending invoices and processing payments.
• Create and manage Merchant and User accounts and verify identity.
• Bill Merchants for subscription fees.
• Provide customer support and respond to inquiries.
• Send service-related notices, such as payment receipts, security alerts and changes to the Service or our policies.
• Monitor, secure and improve the Service and detect, prevent and address fraud, security incidents and technical issues.
• Send marketing communications to Merchants, as described in Section 6.
• Comply with legal, regulatory and card network requirements.

We do not use Payer information for our own marketing.

5. Consent

We collect, use and disclose personal information with your consent, except where the law permits or requires otherwise. Consent may be express (for example, when you create an account) or implied (for example, when information is needed to complete a payment you initiate). You may withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice, by contacting us at the address in Section 14. Withdrawing consent may mean we can no longer provide some or all of the Service.

6. Marketing Communications

We send commercial electronic messages only in accordance with Canada’s Anti-Spam Legislation (CASL). Every marketing email includes an unsubscribe link, and you may also opt out by emailing support@cubepay.io. We will process opt-out requests within 10 business days. Opting out of marketing does not stop service-related messages, such as receipts and security notices.

7. How We Share Information

We do not sell or rent personal information. We share it only as follows:

• Payment processors, including Fiserv and Elavon, to process payments and Merchant subscription fees. Processors use the information under their own privacy policies and card network rules.
• Service providers who host the Service, deliver email, provide analytics or support our operations. They may use the information only to perform services for us and must protect it under written agreements.
• Integrations a Merchant enables, such as QuickBooks Online. When a Merchant connects a third-party service, information is shared with that service at the Merchant’s direction and is governed by that service’s privacy policy.
• The Merchant, in the case of Payer information, so it can manage its invoices and payments.
• Legal and safety reasons, where required by law, court order or a valid request from a public authority, or where reasonably necessary to protect the rights, property or safety of Empyrean, our users or the public, or to investigate fraud.
• Business transactions, such as a merger, acquisition or sale of assets, where the recipient agrees to protect the information in a manner consistent with this Policy.

8. Where Information Is Stored

CubePay data is hosted on servers located in Canada. Our payment processors and some service providers may process information outside Canada, including in the United States. When information is processed in another country, it may be accessible to that country’s courts, law enforcement and national security authorities.

9. Retention

We keep personal information only as long as needed for the purposes described in this Policy, or as required by law. In general:

• Account and transaction records are kept while the Merchant’s account is active and for up to 7 years after it closes, to meet tax, accounting, card network and legal obligations and to handle disputes.
• Marketing contact information is kept until you unsubscribe or, if you have no ongoing relationship with us, for no longer than 24 months.
• Usage data is generally kept for a shorter period, unless it is needed for security investigations or to meet a legal obligation.

When information is no longer needed, we securely delete it or anonymize it.

10. Security

We use administrative, technical and physical safeguards appropriate to the sensitivity of the information, including encryption in transit (TLS), tokenization of payment data by our processors, role-based access controls and PCI DSS validation. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

If a breach of security safeguards involving personal information under our control creates a real risk of significant harm, we will notify affected individuals and the Office of the Privacy Commissioner of Canada as required by law. Where the affected information belongs to a Merchant’s Payers, we will also notify the Merchant.

11. Your Rights

Subject to legal exceptions, you may:

• Ask whether we hold personal information about you and request access to it.
• Ask us to correct information that is inaccurate or incomplete.
• Withdraw consent, as described in Section 5.
• Ask us to delete information that we are no longer required to keep.

Send requests to the Privacy Officer listed in Section 14. We will verify your identity before responding, and we will respond within 30 days or let you know if we need more time, as permitted by law. Access requests are free of charge; if a request is unusually large, we will tell you of any cost in advance. If the request concerns Payer information we hold for a Merchant, we may refer it to that Merchant.

If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada (www.priv.gc.ca) or, if you are in Quebec, the Commission d’accès à l’information du Québec.

12. Children

The Service is intended for businesses and adults. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us with personal information, contact us and we will delete it.

13. Links to Other Sites and Changes to This Policy

The Service may link to third-party websites. We are not responsible for their content or privacy practices, and we encourage you to read their privacy policies.

We review this Policy at least once a year. If we make material changes, we will notify Merchants by email or by a notice in the Service at least 30 days before the changes take effect, and we will update the effective date above. Other changes take effect when posted.

14. Contact Us and Privacy Officer

Our Privacy Officer is responsible for our compliance with this Policy. Questions, requests and complaints can be sent to:

Privacy Officer

Empyrean Merchant Services Inc., 177-1881 Steeles Avenue W., Toronto, ON M3H 0A1

Email: support@cubepay.io

Phone: 1-877-773-1001