The principles
This policy is published by VitaPay LLC ("VitaPay") and covers the records the VitaPay platform holds.
- Keep what the law, the books or security require — and say how long. Each kind of record below has its period and the reason for it.
- Never store what we do not need. Card numbers, expiry dates and security codes never reach the platform at all.
- Permanent records are permanent on purpose. The audit trail, labor records and financial records cannot be edited or deleted by anyone, including us. A correction is a new record beside the old one. That is what makes them evidence.
- Deletion is a reviewed decision. Except where this policy names an automatic deletion, records are removed only by a reviewed request, never silently.
Periods by kind of record
| Kind of record | What it includes | How long | Why |
|---|---|---|---|
| Card data | Card number, expiry date, security code | Never stored | Typed only into the payment provider's fields |
| Card references | Card brand, last four digits, the provider's reference or token | As long as the payment record | Receipts, refunds and disputes |
| Merchant applications | Business and owner details, documents, and encrypted Social Security numbers, tax IDs, dates of birth and bank details | The life of the merchant relationship and at least five years after it ends, or after a declined or withdrawn application | Processor, card network and anti-money-laundering record-keeping |
| Merchant and partner accounts | Names, contact details, roles, access | While the account is open, then as long as the records it made are kept | Who did what must stay answerable |
| Financial records | Transactions, deposits, fees, disputes, residuals, invoices, accounting entries, guest charges and tips | At least seven years | Tax, accounting and processor requirements |
| Employee and payroll records | Profiles, hiring forms, schedules, punches, timecards, pay rates, tips, tip pools, corrections, acknowledgments | At least six years — in practice permanently | Wage and tip-record laws (the longest names six years); these records cannot be edited or deleted |
| Guest records a venue keeps | Customer list, contact details, delivery addresses, visits, preferences, caller ID | While the venue keeps its account, unless the venue removes them sooner | The venue's own service to its guests |
| Marketing consents | Email and text consents, STOP and START | As long as the contact is kept, and the record of an opt-out permanently | Proof of consent and of opt-out |
| Phone-order memory | Past orders remembered for a returning caller | 30 days by default (the venue may set 1 to 365); off unless the venue turns it on; deleted when the venue turns it off | Convenience, only with the caller's agreement |
| Receipts | Receipt sent by email or text, and its link | The link works for 90 days; the payment record is kept as a financial record | A guest can fetch a receipt |
| Audit trail | Who did what, when, from which network address, before and after | Permanently | Integrity: it is the record that proves every other record, so it cannot be edited or deleted and is sealed so that tampering shows |
| Sign-in records | Sessions, trusted devices, sign-in attempts | Sessions end after 2 hours idle and 12 hours at most; the record of the sign-in is part of the audit trail | Security |
| Chat | Conversations, attached files, remembered notes | While the account is open; removing a file hides it rather than erasing it | Chat answers from the account's own history; the record of what was asked stays answerable |
| Device logs | Technical logs from terminals, kiosks, handhelds and TV screens, with card data removed before storage | 90 days, then deleted automatically | Support and diagnosis |
| Payment-link opens | That a link was opened, and when — no network address or browser | As long as the link's payment record | Show a venue that its link was used |
Deleting information
You can ask us to delete personal information as described in our Privacy Policy, by emailing go@vitapay.com. We will:
- confirm who you are;
- delete what we are free to delete;
- tell you which records we must keep, why and for how long — for example a payment record, a payroll record or the audit trail — and keep them only for those purposes.
If we hold the information for a merchant — you are a guest or an employee of a venue — we pass the request to that merchant, which decides, and we carry out its decision within the limits above.
When a merchant or partner closes its account, its records are kept for the periods above and then removed through the same reviewed process.
Changes
We will post any change here with a new version number and date.