Privacy Policy

Railz Incorporated PRIVACY POLICY

Last updated: September 3, 2026

1. INTRODUCTION

Railz Incorporated, a Delaware corporation ("Railz", "we", "us", or "our"), has created this Privacy Policy to explain how we collect, use, disclose, and protect information when you visit https://railz.app (the "Site"), create an account, connect a payment processor or ecommerce platform, or use our chargeback automation software, dashboards, APIs, and related tools (collectively, the "Platform" and the "Services"). This Privacy Policy should be read together with our Terms of Service at https://railz.app/terms/, which govern your use of the Platform and Services.

Railz helps merchants manage payment card disputes and chargebacks. We are chargeback automation software. We are not a bank, payment processor, money transmitter, or law firm. We do not take deposits, issue cards, hold customer funds, or provide FDIC-insured accounts.

By visiting the Site, creating an Account, connecting an integration, or using the Platform or Services, you acknowledge the practices described in this Privacy Policy. If you do not agree, do not use the Platform or Services.

2. WHAT DOES THIS PRIVACY POLICY COVER?

This Privacy Policy covers information about identifiable individuals and information that can reasonably be used to identify an individual ("Personal Information"). It applies to merchants and other businesses that register for the Services ("Customers"), individuals who access a Customer Account as employees, contractors, or other authorized users ("Authorized Users"), prospective customers and partners, and visitors to the Site.

The Platform and Services are intended for business use. When you connect Stripe, Shopify, or another supported integration, we may access dispute, order, transaction, and customer records controlled by you. For that merchant-controlled data, you are generally the data controller and Railz acts as a service provider or processor on your behalf, as described in our Terms of Service and any applicable data processing agreement.

This Privacy Policy does not apply to third-party websites, payment processors, ecommerce platforms, alert networks, or other services you choose to connect to Railz. Those providers have their own privacy policies and terms. You are responsible for providing any notices and obtaining any consents required before sharing Personal Information about your customers, employees, or contractors with Railz.

3. INFORMATION WE COLLECT

3.1. Account and business information

When you register for an Account or are invited as an Authorized User, we collect the information needed to authenticate access, operate the Services, communicate with you, and bill for performance-based fees. The categories of Personal Information we collect depend on your role and how you use the Platform:

3.2. Dispute, order, and integration data

When you connect a supported payment processor or ecommerce platform, or upload files to the Platform, we collect and process the data needed to sync disputes, organize evidence, prepare representment responses, calculate Success Fees, and operate automation features you enable. Depending on your integrations and settings, this may include:

(a) Chargeback and dispute records, including dispute identifiers, reason codes, amounts, currencies, statuses, deadlines, network or processor metadata, and outcome data;

(b) Order, transaction, subscription, refund, fulfillment, and delivery information connected to a disputed payment;

(c) Customer or cardholder information contained in connected records or evidence, such as names, email addresses, shipping or billing addresses, IP addresses, device or session signals, and customer communications;

(d) Evidence files and templates you upload or generate, including PDFs, images, policies, terms, tracking records, and other supporting documents;

(e) OAuth tokens, API credentials, webhook payloads, store identifiers, and other integration configuration data needed to maintain a connection; and

(f) Pre-dispute alert settings, auto-refund rules, automation preferences, and workflow history.

Railz does not require you to provide full payment card numbers, and we do not intentionally collect or store raw primary account numbers (PAN). When card-related metadata is available from your payment processor, such as card brand, last four digits, expiration metadata, or authorization results, we may process that information to help manage disputes.

3.3. Website, device, and usage information

When you visit the Site or use the Platform, we automatically collect technical and usage information such as IP address, browser type, device identifiers, operating system, referring URLs, pages viewed, feature usage, log files, error reports, and approximate location derived from IP address. We use this information to secure the Platform, diagnose technical issues, understand product usage, and improve the Services.

3.4. Communications

If you contact us by email, support ticket, or in-app message, we collect the content of your communications and related metadata. If you opt in to receive promotional messages, we collect your contact preferences and message engagement data. If you provide a mobile number, we may send service-related texts or authentication messages. Message and data rates may apply.

4. HOW WE USE INFORMATION

We use Personal Information and other data we collect to:

(a) provide, operate, maintain, and improve the Platform and Services;

(b) authenticate users, manage Accounts and Authorized User permissions, and prevent unauthorized access;

(c) sync disputes from connected processors, organize evidence, prepare representment responses, and submit evidence when you enable automation;

(d) configure and operate pre-dispute alerts, auto-refund rules, and other workflow settings you choose;

(e) invoice Success Fees, process payments, and manage billing disputes;

(f) send service announcements, security alerts, product updates, and support messages;

(g) respond to inquiries, troubleshoot problems, and provide customer support;

(h) monitor trends, usage, and performance, and develop new features;

(i) detect, investigate, and prevent fraud, abuse, security incidents, and violations of our Terms of Service;

(j) comply with law, respond to lawful requests, and enforce our agreements; and

(k) send marketing communications where permitted by law and subject to your opt-out choices.

We may create aggregated or de-identified data that does not identify you or your customers, and we may use that data for analytics, benchmarking, and product improvement.

5. HOW WE SHARE INFORMATION

5.1. Service providers and subprocessors

We use third-party companies and individuals to help us operate the Platform and Services, including for hosting, database management, authentication, email delivery, customer support, analytics, payment processing, and security monitoring ("Service Providers" or "Subprocessors"). These providers may access Personal Information only to perform tasks on our behalf and are contractually required to protect it and use it only for the services they provide to Railz. A current list of Subprocessors is available at https://railz.app/sub-processors.

5.2. Payment processors and integrated platforms

When you connect Stripe, Shopify, or another integration, we exchange data with that provider as needed to sync disputes, retrieve order or transaction context, and submit representments or other actions you authorize. Those providers process information under their own terms and privacy policies.

5.3. Business transfers

If Railz is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, Personal Information may be transferred as part of that transaction, subject to applicable law and notice where required.

5.4. With your direction or consent

We may share information when you instruct us to do so, when you connect an integration that requires disclosure, or when you otherwise consent.

5.5. Legal and safety disclosures

We may disclose information if we believe in good faith that disclosure is necessary to comply with law, regulation, legal process, or governmental request; enforce our Terms of Service or other agreements; protect the rights, property, or safety of Railz, our users, or others; or detect, prevent, or address fraud, security, or technical issues. This may include exchanging information with other companies and organizations for fraud protection.

5.6. Text messaging opt-in data

Text messaging originator opt-in data and consent, including mobile phone numbers collected for the purpose of sending or receiving SMS or MMS messages, will not be sold, shared, rented, or otherwise disclosed to any third party or affiliate for their own marketing purposes. Railz may use Service Providers to deliver text messages on our behalf, but those providers may use SMS opt-in data only to provide messaging services to Railz.

We do not sell Personal Information, and we do not share Personal Information for cross-context behavioral advertising.

6. DATA RETENTION

We retain Personal Information for as long as needed to provide the Services, fulfill the purposes described in this Privacy Policy, comply with legal obligations, resolve disputes, and enforce our agreements. Retention periods may vary based on the type of data, your Account status, and legal or operational requirements.

When you disconnect an integration or close your Account, we may retain certain information for backup, security, fraud prevention, billing, or legal compliance. We may also retain aggregated or de-identified data that no longer identifies you. When retention is no longer necessary, we will delete or de-identify Personal Information in accordance with our retention practices and applicable law.

7. SECURITY

Railz implements reasonable administrative, technical, and organizational safeguards designed to protect Personal Information against unauthorized access, disclosure, alteration, or destruction. These measures may include access controls, encryption in transit, encryption at rest where appropriate, monitoring, and employee training.

No method of transmission or storage is completely secure. We cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your login credentials, reviewing Authorized User access, and promptly notifying us at support@railz.app if you suspect unauthorized access to your Account or connected integrations.

8. YOUR CHOICES AND RIGHTS

8.1. Account information

You may review and update certain Account information through the Platform or by contacting us. You may disconnect integrations through the Platform or through the third-party provider.

8.2. Marketing communications

You may opt out of promotional emails by using the unsubscribe link in a message or by contacting us. Even if you opt out of marketing, we may still send service-related communications about your Account, security, billing, or material changes to this Privacy Policy or our Terms of Service.

8.3. Access, correction, and deletion

Depending on your location, you may have the right to request access to, correction of, or deletion of Personal Information we hold about you, subject to exceptions under applicable law. To make a request, contact us using the details in Section 14. We may need to verify your identity before responding.

If you are a cardholder or customer of one of our merchant Customers and want to exercise privacy rights regarding dispute or order data, please contact that merchant first. Railz generally processes that information on the merchant's behalf.

8.4. California residents

If you are a California resident, you may have additional rights under the California Consumer Privacy Act, as amended, including the right to know, delete, and correct certain Personal Information, and the right to non-discrimination for exercising those rights. Because Railz provides business-to-business services, some exemptions may apply. To submit a request, email support@railz.app with the subject line "California Privacy Request".

9. RESIDENTS OF THE EUROPEAN ECONOMIC AREA, UNITED KINGDOM, AND SWITZERLAND

If you are located in the European Economic Area ("EEA"), the United Kingdom, or Switzerland, you may have additional rights under applicable data protection law, including the EU General Data Protection Regulation ("GDPR").

For merchant-controlled dispute and customer data accessed through your integrations, you are generally the controller and Railz acts as a processor. For Account registration data and information Railz collects directly from Authorized Users or Site visitors, Railz may act as an independent controller.

Where Railz is a controller, you may have the right to request access, correction, deletion, restriction, portability, or objection to certain processing, and to withdraw consent where processing is based on consent. You also have the right to lodge a complaint with your local supervisory authority.

We rely on one or more lawful bases to process Personal Information, including performance of a contract, legitimate interests in operating and securing the Services, compliance with legal obligations, and consent where required.

10. INTERNATIONAL DATA TRANSFERS

Railz is based in the United States. We process and store information on servers located in the United States and may use Service Providers in other countries. If you access the Services from outside the United States, you understand that your information may be transferred to, stored in, and processed in the United States and other jurisdictions that may have different data protection laws than your home country.

Where required, we use appropriate safeguards for cross-border transfers, such as standard contractual clauses approved by the European Commission or equivalent mechanisms.

11. COOKIES AND SIMILAR TECHNOLOGIES

We use cookies and similar technologies to operate the Platform, keep you signed in, remember preferences, understand usage, and improve performance. A cookie is a small file stored on your device. We use session cookies and persistent cookies for authentication, security, and analytics.

Most browsers allow you to control cookies through settings. If you disable cookies, some features of the Site or Platform may not function properly. We do not currently respond to Do Not Track signals.

12. CHILDREN'S PRIVACY

The Platform and Services are intended for businesses and are not directed to children under 16 years of age. We do not knowingly collect Personal Information from children under 16. If you believe a child has provided Personal Information to us, contact support@railz.app and we will take appropriate steps to delete it.

13. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time. If we make material changes, we will post the updated policy on the Site and update the "Last updated" date above. We may also provide additional notice by email or in-app message where appropriate. Your continued use of the Platform or Services after the effective date of an updated Privacy Policy constitutes acceptance of the changes, except where applicable law requires additional consent.

14. GOVERNING LAW

This Privacy Policy is governed by the laws of the State of Delaware, without regard to conflict-of-law principles, except to the extent federal law applies or mandatory consumer protection laws in your jurisdiction require otherwise.

15. CONTACT US

Questions about this Privacy Policy or our privacy practices may be sent to:

Railz Incorporated
Attn: Privacy
1764 Ruby Drive
Pingree Grove, IL 60140
USA
support@railz.app