Platform privacy notice

FactorFox Software LLC provides the FactorFox application to institutions that fund receivables: factors, asset based lenders, purchase order funders and other specialty finance companies.

For information about a customer institution’s own clients, debtors and transactions, the institution ordinarily decides why and how that information is processed, and FactorFox acts as its service provider or processor under contract. FactorFox may act as a controller for limited purposes such as administering customer accounts, keeping security records and communicating directly with users.

Depending on the modules a customer enables and the permissions it grants, the application may process names and business contact details, identity and verification records, bank account identifiers and balances, transaction history, receivables, invoices, payment instructions, and the activity and audit records of authorized users.

We do not collect categories of information that a customer has not enabled, and we do not ask for special category information.

FactorFox is introducing the option for an authorized user to connect a financial account using Plaid Inc. Where a user chooses to connect an account, Plaid provides FactorFox with access to account information for the functions shown at the time of connection, such as verifying account ownership, confirming balances or reviewing transactions that support financing and payment workflows.

Before a connection starts, the application will explain why the connection is requested and what it will be used for, and the user’s authorization will be recorded. Connecting an account is a choice, and where a legitimate alternative exists, such as providing statements, a connection will not be presented as mandatory. Plaid’s own handling of information is governed by the Plaid End User Privacy Policy.

Information retrieved through Plaid is used only to provide the functionality the user authorized. It is not sold and it is not used for advertising. Access tokens issued for a connection are kept on our servers and are not shown in the application.

We use information to provide the contracted software functions, authenticate users and connections, verify banking information, support financing and payment workflows, detect and prevent fraud, operate and secure the platform, provide authorized support, and meet legal obligations.

Access and use are limited by the permissions the customer institution assigns, a business purpose and the applicable contract. We do not sell personal information and we do not use financial account information for unrelated advertising.

We share information only with the customer institution that controls it and with service providers that help us deliver the service, and only to the extent each needs to perform its function. The categories are:

• Cloud hosting, identity and communications services that run the application.
• Plaid, where a user connects a financial account.
• Banking and payments partners, where a customer uses payment features.
• Contracted operational and professional providers, including advisers and auditors.

Each provider is engaged under a written contract requiring confidentiality and appropriate security. We may also disclose information where the law requires it or where it is necessary to establish, exercise or defend legal claims.

Access to customer information is limited by role, and information is encrypted in transit and at rest. The controls that protect the platform are described on our security and controls page.

We keep information for as long as the customer agreement, applicable law and our retention schedule require. Some records, such as ledger entries, evidence supporting financing decisions, fraud prevention records and information subject to a legal hold, may need to be kept after a bank connection is removed. When information is no longer needed for those purposes, it is deleted or anonymized.

An authorized user with sufficient permissions can ask to disconnect a linked financial account, through the institution that operates the account in FactorFox or by contacting us. When an account is disconnected, we revoke the associated access and stop retrieving new information from it. Information already collected is then handled under the retention section above.

Disconnecting an account, deleting stored financial information and deleting an institution’s business records are separate actions with different consequences, and each may require its own authorization.

Depending on where you are, you may have rights to access, correct or delete personal information, to object to or restrict certain processing, to receive a portable copy, and to withdraw consent where consent was the basis for processing.

If your information is held by a FactorFox customer, the quickest route is usually to contact that institution, because it controls the information. You can also write to us. We will confirm who you are, identify the institution responsible, and respond or help that institution respond within the time the law and the relevant contract allow. Where we cannot fully meet a deletion request because of a legal or regulatory duty to retain information, we will explain why.

We are established in the United States and our customers operate in several regions. Information may be processed in the United States and in other locations used by our service providers. Transfers follow the customer agreement, applicable data protection law and the transfer safeguards that law requires.

When this notice changes, the date at the top changes with it and we describe what changed. Where a change materially affects how we use information already collected, we will give direct notice where the law requires it.

Write to sales@factorfox.com with any question about this notice or to make a request. Put the word privacy in the subject line so it reaches the right person quickly.

FactorFox Software LLC, 153 Sugar Belle Drive, Suite B-104, Winter Garden, FL 34787, United States.