Privacy policy
Version V.4.0RC · Last updated: November 2, 2026
This Privacy Policy explains how eMerchantBroker.com LLC DBA Bankful (“Bankful,” “we,” “us”) collects, uses, shares and protects personal information. It applies to everyone who visits our websites or uses our Services, including website visitors, merchant applicants, merchants and their users. Bankful, eMerchantBroker.com, and First American Merchant are brands of eMerchantBroker.com LLC DBA Bankful. In this policy, “Bankful,” “eMerchantBroker,” “we,” “us,” and “our” all refer to that company.
It covers bankful.com, support.bankful.com, docs.bankful.com, emerchantbroker.com, firstamericanmerchant.com, our online merchant application at atlasmanager.com, paybybankful.com, and our dashboards, APIs and plug-ins (together, the “Services”).
2985 E. Hillcrest Dr. Suite #209
Thousand Oaks, CA 91362
Phone (888) 882.9494
www.bankful.com
SECTION 1 – INFORMATION WE COLLECT
When you visit our websites or use the Services, Bankful collects information to provide, secure, improve and market those Services, including:
- Identification & Contact Information: Name, address, phone number, email, business details, tax ID, and details about business owners and principals needed for underwriting, such as date of birth, government ID and Social Security number.
- Account & Authentication Data: User IDs, credentials, permissions, audit logs.
- Billing & Transaction Data: Amounts, dates, merchant IDs, masked card or token data (Bankful never stores full PANs for direct gateway use).
- Device & Network Data: IP address, approximate location based on your IP address, browser type, operating system, device ID, a device fingerprint (an ID built from your browser and device settings), cookie and advertising identifiers, diagnostics.
- Usage & Telemetry: Feature use, performance, crash logs; on our websites, pages viewed, clicks, scrolling, form interactions and session recordings.
- Support Records: Tickets, chat, and call logs, including live chat transcripts and call recordings.
- Marketing & Lead Data: Information you enter in website forms, how you found us (such as the ad campaign, referral partner, the web page that sent you and the page you started on), and your communication preferences and consents.
- Information From Others: Credit bureaus, identity-verification vendors, banks and processors, referral partners and agents, and advertising and analytics providers.
When you visit our sites, we automatically receive your IP address and related technical data to ensure platform security and functionality, measure site performance and, with your consent where required, show you Bankful ads. See Section 4A.
Sensitive personal information. Some information we collect, such as tax IDs, bank account details, government ID numbers and account login credentials, is “sensitive personal information” under some US state laws. We use it only to evaluate applications, provide the Services, secure your account, prevent fraud and meet legal obligations, and not to infer characteristics about you.
SECTION 1A – RISK & COMPLIANCE PROCESSING
When you apply for or use the Services, Bankful collects, analyzes and retains personal and business information for:
- Risk assessment and fraud prevention
- Know-Your-Customer (KYC) and Anti-Money-Laundering (AML) compliance
- Merchant onboarding and underwriting
- Regulatory and card-network obligations
Bankful may obtain and share information with acquiring banks, payment processors, identity-verification vendors, credit bureaus, or compliance partners to perform these functions. Such processing is essential to deliver the Services and is conducted under lawful bases including performance of contract, legitimate interests, and regulatory compliance.
To prevent fraud and protect accounts, our online application creates a device fingerprint and checks forms with Google reCAPTCHA. Google receives device and browser data to run reCAPTCHA. We verify logins and email addresses with one-time codes sent by text or email.
SECTION 2 – CONSENT & COMMUNICATIONS
When you provide personal information or submit a merchant application, you authorize Bankful to collect, verify, store, and analyze that information to evaluate your application and provide Services.
You also authorize Bankful to obtain credit, business, or banking information from third-party sources as needed for underwriting.
Transactional Communications: When you submit one of our forms, you agree that Bankful may contact you about your inquiry by email and phone call. When you create an account, you also agree that Bankful may contact you about your application and account by email, phone call and text message, including automated texts. This includes essential onboarding, transactional, risk, and service-related messages (e.g., account alerts, security notices, billing updates). Other than automated texts about your application and account, we send automated or AI calls and text messages only to people who have opted in to them, as described below.
Marketing Communications: We send marketing emails, calls and text messages only with your consent where the law requires it. Our forms ask for this consent in a separate, optional checkbox. Consent to marketing calls and texts is not a condition of any purchase or service.
Calls and Texts: If you check the phone consent box, you agree that Bankful may contact you at the number you provided with marketing calls and text messages, including calls and texts made with automated technology, prerecorded or artificial voices, or AI-generated voices. Message frequency varies. Message and data rates may apply. Reply STOP to opt out at any time. Reply HELP for help.
AI-Powered Communications: Some of our emails and chats are written by AI. For people who have opted in, some of our calls and text messages are also made by AI, including AI voice agents that can hold a conversation. When you talk or chat with one of our AI agents, we tell you at the start that you are dealing with AI and not a person. Calls and chats with our AI agents are recorded and transcribed and kept as support records. You can opt out of AI calls and texts the same way as any other call or text.
Call Recording: Bankful records all phone calls, including sales and support calls, for quality, training, compliance and record-keeping. We use AI tools to transcribe and summarize recordings for these same purposes. We tell you a call is being recorded at the start of the call. By continuing the call, you consent to the recording. If you do not want to be recorded, you may end the call and contact us by email instead.
We do not sell or share mobile phone numbers or text-message opt-in consent with third parties for their own marketing.
Canada: We send commercial emails or texts to people in Canada only with express consent or where the law allows implied consent.
Bankful honors opt-out requests as soon as practicable and no later than 10 business days after we receive them. After you opt out of texts, you may receive one message confirming your request.
If you continue receiving unwanted communications after that period, contact [email protected] for manual removal, and Bankful will promptly update your preferences.
SECTION 3 – INFORMATION SHARING
Bankful may share information:
- With service providers and processors under contract who assist in hosting, website operation and security, analytics, compliance, support, phone and chat, electronic signatures, text and email delivery, AI tools (including calling, messaging and transcription), or marketing.
- With advertising partners (such as Google, Meta, Reddit, LinkedIn and Microsoft, and the others listed in Section 4B) through cookies and pixels on our websites, to measure our ads and show Bankful ads on other sites. See Section 4A.
- With referral partners and agents who introduced you to Bankful, including partners whose branded application pages send your application to us, as needed to manage that relationship.
- With acquiring banks, payment processors, and financial institutions selected by you or required for settlement.
- To comply with law, regulations, or card-network rules, or to enforce our agreements.
- To protect rights, property, security, or integrity of Bankful or others.
- In connection with a merger, acquisition, financing, or sale of assets.
Our CRM also sends conversion events (records of actions people take after seeing or clicking our ads) to advertising platforms so we can measure our ads. These events include hashed contact details, such as email address or phone number, which the platforms use to match the event to an ad. Hashing scrambles the details so they are not sent in readable form.
By using the Services, you authorize these disclosures and acknowledge that Bankful exercises commercially reasonable diligence in selecting partners but is not responsible for their independent compliance or security practices.
Bankful does not sell personal information for money. When advertising cookies are on, our advertising partners may receive device identifiers and information about your activity on our websites. Under California and other US state laws, this may be a “sale” or “sharing” of personal information for cross-context behavioral (targeted) advertising.
SECTION 4 – DATA STORAGE & SECURITY
Bankful stores data in secure, access-controlled environments.
All direct payment gateways follow PCI DSS standards. Card data is tokenized or handled through PCI-compliant providers; Bankful does not store full card numbers.
Bankful implements administrative, technical, and physical safeguards designed to protect data; however, no security system is impenetrable, and Bankful cannot guarantee absolute security.
By using the Services, you acknowledge inherent risks in Internet transmissions.
Retention: Bankful retains merchant and applicant data as long as necessary for operational, regulatory, and risk purposes—including up to seven (7) years after account closure—to meet audit, tax, and legal obligations.
We keep website, analytics and marketing data only as long as needed for the purposes described in this policy, then delete or anonymize it. If you become a merchant, the retention rule above applies.
SECTION 4A – COOKIES, PIXELS & SESSION RECORDING
We and our partners use cookies, pixels, tags and similar tools on our websites. We also link visits across our websites and our online application (cross-domain tracking), so we can see which ad or page led to an application. This linking follows the consent choices described below. We group these tools into five categories:
- Strictly necessary: run the site, keep it secure, prevent fraud, protect forms from spam and bots, and remember your cookie and privacy-notice choices. Always on.
- Analytics: understand how our websites are used and how they perform.
- Session recording: record how visitors move through pages (clicks, scrolling, mouse movement) so we can fix usability problems.
- Advertising: measure our ads and show Bankful ads on other sites.
- Support chat: provide live chat with our team. We ask for your consent before you start a chat. Chat transcripts are kept as support records.
How you choose. Analytics, session recording and advertising (including lead attribution) never run before you opt in, in any region. By region:
- EU and Quebec: only strictly necessary cookies run until you opt in.
- UK: only strictly necessary cookies run until you opt in.
- US and other regions: only strictly necessary cookies run until you opt in.
You can accept, reject or choose by category in our cookie banner, and change your choice at any time with the “Cookie Settings” icon on every page. Rejecting is as easy as accepting.
We treat a Global Privacy Control (GPC) signal from your browser as a request to opt out of the sale and sharing of your personal information for that browser.
For the cookies each tool sets and how long they last, see our Cookie Policy at support.bankful.com/cookie-policy/.
SECTION 4B – TOOLS WE USE
We use or may use third-party tools, including the following on our websites and online application. Tools marked “may use” are not active today but may be added later. Each provider handles data under its own privacy policy.
- Google Tag Manager (Google): Strictly necessary. Loads and manages the other tools on our sites.
- Cloudflare: Strictly necessary. Protects our sites from attacks and bots and helps them load reliably.
- Google reCAPTCHA (Google): Strictly necessary. Protects forms on our websites and online application from spam, bots and abuse.
- FingerprintJS (open-source): Strictly necessary. Fraud prevention on our online application. Creates a device fingerprint that is sent only to Bankful.
- Docusign or Dropbox Sign: Electronic signature of application documents.
- Google Analytics 4 (Google): Analytics.
- Bankful lead attribution: Advertising. Our own first-party cookies and records that note how you found us (such as an ad campaign or the web page that sent you) and link it to your application. Campaign details in the web address you arrive from (UTM parameters) are read into your application form and are not stored on your device. Anything we save on your device for attribution waits until you accept advertising cookies.
- Mailchimp: Email. Powers the newsletter sign-up form on some blog posts.
- Microsoft Clarity (Microsoft): Session recording.
- Optimizely: Analytics. May use.
- Formbricks: Analytics. May use.
- YouTube (Google): Advertising.
- SoundCloud: Advertising.
- Google Ads (Google): Advertising. Ad measurement and remarketing.
- Meta Pixel (Meta): Advertising.
- Reddit Pixel (Reddit): Advertising.
- LinkedIn Ads (LinkedIn): Advertising. May use.
- Microsoft Advertising (Microsoft): Advertising. May use.
- StackAdapt: Advertising. May use.
- ChatGPT Ads (OpenAI): Advertising. May use.
- Tidio: Support chat.
SECTION 5 – THIRD-PARTY SERVICES & LINKS
Certain third-party services (e.g., payment gateways, hosting, analytics, advertising, chat) operate under their own privacy policies.
When you connect third-party platforms or processors, their collection and use of data are governed by their terms.
Bankful is not responsible for the data handling practices of such providers once information has been transferred for legitimate business purposes.
SECTION 6 – USER RIGHTS & REGIONAL DISCLOSURES
A. General Rights
Depending on your jurisdiction, you may have rights to access, correct, delete, restrict, or port certain data, and to object to specific processing.
To exercise rights, contact [email protected] or call (888) 882-9494. We will verify and respond within timeframes required by applicable law. You may use an authorized agent to make a request for you. We will not treat you differently for exercising your rights.
B. California and Other US States
Under the California Consumer Privacy Act (CCPA), as amended by the CPRA, and similar laws in other US states, you may request to know, access, delete, or correct personal information, and to opt out of the sale or sharing of personal information and targeted advertising.
To opt out, use the “Cookie Settings” icon shown on every page of our Sites, or turn on Global Privacy Control in your browser. We honor Global Privacy Control automatically, with no extra steps.
In the past 12 months, we collected these categories of personal information:
| Category | Source | Why we use it | Who receives it | How long we keep it |
|---|---|---|---|---|
| Identifiers and contact details (name, email, phone, address) | You; referral partners and agents | Applications, Services, support, marketing with consent, ad measurement | Service providers; banks and processors; referral partners; advertising partners (hashed contact details only) | Up to 7 years after account closure |
| Business and owner information (tax ID, ownership) | You; credit bureaus; ID-verification vendors | Underwriting, KYC/AML, fraud prevention | Banks, processors, ID-verification vendors, credit bureaus | Up to 7 years after account closure |
| Sensitive personal information (government ID, bank account details, account login credentials) | You; ID-verification vendors | Underwriting, Services, account security, fraud prevention, legal obligations only | Banks, processors, ID-verification vendors | Up to 7 years after account closure |
| Commercial and transaction data | Your use of the Services; processors | Services, billing, risk monitoring | Banks, processors, service providers | Up to 7 years after account closure |
| Internet activity and device data (cookies, IP, pages viewed, device fingerprint) | Your browser and device; our tools | Security, fraud prevention, analytics, advertising | Analytics and advertising partners (Section 4B); service providers, including Google for reCAPTCHA | See our Cookie Policy |
| Audio and electronic records (call recordings, chat transcripts) | Calls and chats with us | Support, quality, training, compliance | Service providers (phone and chat) | As described in Section 4 (Retention) |
| Approximate location (from IP address) | Your device | Security, consent rules by region, analytics | Service providers; analytics partners | See our Cookie Policy |
Sold or shared. In the past 12 months, we may have “sold” or “shared” (as California defines those terms for targeted advertising) these categories with advertising partners: identifiers, including hashed contact details; internet activity and device data; and approximate location. We do not sell or share sensitive personal information, and we do not sell or share personal information of anyone we know is under 16.
Appeals. If we deny your request, you may appeal by emailing [email protected] with “Appeal” in the subject line. We will respond in writing within the time the law requires and explain our decision. If you are not satisfied, you may contact your state attorney general.
Where we collect personal information on a form, we show a short notice next to the form with a link to this policy.
C. EU / UK Residents (GDPR)
If you are in the EU or UK, you can contact us about your personal information at [email protected].
We process personal information to perform our contract with you, to meet legal obligations, for our legitimate interests (such as security, fraud prevention and improving the Services) and, for non-essential cookies and marketing, with your consent.
When we transfer personal information out of the UK or EU, we use safeguards recognized by law, such as the EU standard contractual clauses and the UK International Data Transfer Agreement or UK Addendum.
Some application decisions are made automatically using identity, business and risk checks. If you disagree with an automated decision, you can ask for a person to review it at [email protected].
You may exercise rights to access, rectify, erase (“right to be forgotten”), restrict, or object to processing, including automated decision-making used for risk or underwriting. You may withdraw consent at any time.
To submit a request, contact [email protected]; proof of identity may be required. You also have the right to complain to the UK Information Commissioner’s Office or your local EU data protection authority.
D. Canada and Quebec
If you are in Canada, you may request access to and correction of your personal information and withdraw consent, subject to legal limits. In Quebec, tracking that can identify or profile you is off unless you turn it on.
You can reach our Compliance Officer, who is responsible for protecting personal information, at [email protected].
SECTION 7 – AGE OF CONSENT
By using the Services, you represent that you are at least the age of majority in your jurisdiction.
The Services are intended for businesses and are not directed to anyone under 18. We do not knowingly collect information from minors.
SECTION 8 – CHANGES TO THIS POLICY
We review this Privacy Policy at least once every 12 months and update it when our practices change. We will post the new version on support.bankful.com with a new “Last updated” date. Earlier versions are archived and available on request.
Material changes will be communicated by email or other electronic means where applicable.
If Bankful is acquired or merged, your data may be transferred to the successor entity to continue providing Services.
SECTION 9 – CONTACT INFORMATION
For privacy questions, rights requests, or complaints, contact:
Bankful Privacy Compliance Team
[email protected]
(888) 882-9494
2985 E. Hillcrest Dr., Suite 209
Thousand Oaks, CA 91362 USA
UK office: 196E Campden Hill Road, London W8 7TH, United Kingdom
Earlier versions
See every earlier version of the Bankful Privacy Policy and the dates each was in effect: Bankful Privacy Policy version history