Privacy policy

Who is responsible for your data

Satora (SatoraPay, operating the website satorapay.com) is the controller of the personal data described here. For any question about this policy, or to exercise any of the rights below, email privacy@satorapay.com.

What we collect, and when

Almost everything on this site can be used without giving us any personal data at all. The calculator runs entirely in your browser and transmits nothing. The guides and category pages set no tracking cookies.

Personal data is collected in exactly two places:

The pre-qualification form

The first four steps ask about your business, not about you: category, monthly volume, your current processing situation, urgency and the jurisdiction the business is established in. None of that identifies you, and you can complete those steps and leave without us knowing who you are.

The final step asks for your name and email, and optionally a phone number, company name and website. At that step you are also asked to tick a consent box, which is not ticked by default. Submitting the form without ticking it is not possible.

Email

If you email us directly, we hold that correspondence and whatever you chose to include in it.

What we do with it

• Assess whether we can help. A specialist reads your business details and compares them against what providers are currently boarding.
• Introduce you to a provider. With your consent, we share your application details with one partner payment provider or specialist consultant at a time, chosen because their appetite matches your profile. We do not broadcast your details to multiple parties.
• Send you an acknowledgment. Including the document checklist for your category, so you can start assembling paperwork immediately.
• Record the outcome. We keep a record of whether an introduction resulted in a placement, which is how we know which providers actually board which profiles.

We do not sell your data to data brokers, we do not rent it, we do not share it with advertisers, and we do not use it to build a marketing profile. We do disclose it to the provider we introduce you to — that is the service you asked for — and that provider pays us a commission if you board. Some US state privacy laws treat a disclosure made for valuable consideration as a “sale” regardless of what it is called. Your rights below explain how to stop it.

Consent, and what exactly you agreed to

The consent box at the final step of the form reads:

I agree that Satora may share the details in this application with a partner payment provider or specialist consultant in order to find a provider that fits my business, and that Satora and any provider I am introduced to may contact me about this application by email, telephone or SMS. Consent to be contacted is not a condition of any purchase, and I can withdraw it at any time.

We store the exact wording you agreed to, the version identifier of that wording, and the time you agreed, alongside your record. If the wording changes, existing records keep the version that was actually shown to them. The current version is 2026-09-v2.

That consent covers being contacted about your application by email, telephone or SMS, by us and by any provider we introduce you to. It is not a condition of anything you buy, and you can withdraw it without withdrawing the rest — reply STOP to any SMS, or email privacy@satorapay.com and say which channels you want stopped. We do not make marketing calls, we do not use automated dialling or pre-recorded messages, and we do not pass your number to anyone other than the provider we introduce you to.

How it is protected

Your contact details — name, email, phone, company and website — are encrypted with AES-256-GCM before they are written to storage. The encryption key is held separately as a platform secret and is not stored alongside the data.

Contact details are excluded from internal notifications: when a new enquiry arrives, the alert contains a reference, your category, volume band, situation and urgency, and no identifying information. Personal data is not written to application logs, and is never placed in a URL.

Legal bases

Where the UK GDPR or EU GDPR applies to you, we rely on:

• Consent for sharing your application details with partner providers. You can withdraw it at any time, though not retrospectively for an introduction already made.
• Legitimate interests for assessing your enquiry and responding to it, and for keeping a record of outcomes to improve how we match merchants to providers.
• Legal obligation where we are required to retain records.

How long we keep it

Enquiry records are kept for as long as needed to deal with the enquiry and any resulting introduction, and then for a further period to meet record-keeping obligations relating to commission arrangements. Where you ask for deletion we act on it promptly, subject to any legal retention requirement, and we will tell you if such a requirement applies.

Your rights

Depending on where you are, you may have the right to access the personal data we hold about you, to have it corrected, to have it deleted, to restrict or object to how we use it, to receive it in a portable format, and to withdraw consent. If you are a California resident, you also have the right to know what is collected and disclosed, the right to delete, the right to opt out of the sale or sharing of personal information, and the right not to be discriminated against for exercising those rights.

On that opt-out right, plainly: we disclose your details to the provider we introduce you to, and that provider pays us a commission if you board. We think that disclosure is the thing you asked us to do rather than a sale to a stranger, but it is made for valuable consideration, and we would rather describe it than argue about the label. You can tell us not to make it — email us and we will stop. The consequence is that we cannot introduce you to anyone, because passing your details on is the introduction.

To exercise any of these, email privacy@satorapay.com. If we have already introduced you to a provider, that provider holds its own copy of your details as a separate controller; we will tell you who they are so you can contact them.

If you are in the UK or EU and are unhappy with how we have handled your data, you can complain to your national supervisory authority. In the UK that is the Information Commissioner's Office.

Cookies and analytics

We do not use advertising cookies and we do not run cross-site tracking. Where analytics is enabled, it is a privacy-focused service that does not use cookies, does not collect personal data and does not track visitors across sites. The pre-qualification form uses your browser's session storage to remember your answers to the first four steps if you refresh the page; that data stays in your browser, is never sent to us, and your contact details are never stored there.

Bot protection

The form is protected by Cloudflare Turnstile, which checks that submissions come from a real browser rather than an automated script. It is designed to work without tracking users across sites.

Changes

If this policy changes materially we will update the date at the top. The consent wording is versioned separately, so a change to it never alters what an existing record shows you agreed to.