Privacy Policy

1. Information We Collect

Sterling Ridge LLC ("Sterling Ridge," "we," "us") collects information in three ways: information you provide to us, information collected automatically when you use our website and services, and information we receive from third parties.

• Information you provide: contact details (name, email address, phone number, mailing address), business information (legal business name, EIN, ownership details, licenses, bank statements, and other underwriting documents), account credentials, and the contents of messages you send us.
• Transaction and financial information: when you or your customers use our payment services, we process payment data such as bank account and routing numbers, payment card information, transaction amounts, and settlement details. This data is handled in accordance with PCI DSS and applicable banking regulations.
• Information collected automatically: IP address, device and browser type, operating system, pages viewed, referring URLs, and interactions with our site, collected through cookies and similar technologies described below.
• Information from third parties: identity verification and fraud prevention providers, bank verification services (such as Plaid), credit bureaus, acquiring bank partners, and publicly available business records used for underwriting and compliance.

2. Cookies and Tracking Technologies

We use cookies, pixels, and similar technologies to operate the website, remember your preferences, analyze traffic, and measure the effectiveness of our marketing. These fall into three categories: strictly necessary cookies (required for the site to function), analytics cookies (which help us understand how visitors use the site), and marketing cookies (which help us reach relevant audiences).

You can manage cookies through your browser settings and, where offered, through our cookie preferences controls. For full details — including the specific categories we use and how to opt out — please see our Cookie Policy at /cookie-policy.

3. How We Use and Share Information

We use the information we collect to: provide, operate, and improve the Services; underwrite and onboard merchant accounts; process payments and payouts; verify identity and prevent fraud; comply with legal, regulatory, and payment network obligations (including KYC/KYB, anti-money-laundering, and OFAC screening); provide customer support; and send service communications and — with your consent where required — marketing communications.

We do not sell your personal information. We share information only with:

• Service providers who process data on our behalf — hosting, analytics, communications, identity verification, and bank verification partners — under contracts limiting their use of the data.
• Financial partners including acquiring banks, ODFIs, card networks, and NACHA-governed systems, as required to underwrite your account and process transactions.
• Legal and safety recipients such as regulators, law enforcement, or other parties where required by law, subpoena, or to protect the rights, safety, or property of Sterling Ridge, our merchants, or others.
• Business transfer parties in connection with a merger, acquisition, financing, or sale of assets, subject to confidentiality protections.

4. SMS and Text Message Consent

Where you provide a mobile number and opt in, we may send you text messages about your account, application status, service alerts, and — where you have separately consented — marketing offers. Message frequency varies; message and data rates may apply.

You may opt out of SMS messages at any time by replying STOP to any message, and get help by replying HELP. Opting out of marketing texts does not affect essential service notifications. Mobile opt-in data and consent are not shared with third parties for their own marketing purposes.

5. Your State Privacy Rights (CCPA/CPRA and Others)

Depending on your state of residence — including under the California Consumer Privacy Act as amended by the CPRA, and similar laws in states such as Colorado, Connecticut, Virginia, and Utah — you may have the right to: know what personal information we collect and how we use it; access a copy of your personal information; correct inaccurate information; delete personal information (subject to legal retention obligations); opt out of the sale or sharing of personal information and of targeted advertising; and limit the use of sensitive personal information.

We do not sell personal information, and we do not use sensitive personal information for purposes other than providing the Services and meeting legal obligations. To exercise any right, contact us at contact@sterlingridge.io with the subject line "Privacy Request." We will verify your identity before responding and will respond within the timeframe required by applicable law. You may designate an authorized agent to submit requests on your behalf. We will not discriminate against you for exercising your privacy rights.

We also honor opt-out preference signals such as Global Privacy Control (GPC), as described in our Cookie Policy.

6. Children's Privacy

Our website and Services are designed for businesses and are not directed to individuals under 18 years of age. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us personal information, please contact us at contact@sterlingridge.io and we will delete it promptly.

7. Data Security

We maintain administrative, technical, and physical safeguards designed to protect personal information, including encryption of data in transit and at rest, access controls and least-privilege permissions, network monitoring, and vendor security reviews. Payment card data is handled in accordance with PCI DSS, and bank credentials used for account verification are tokenized by our verification partners and are not stored by Sterling Ridge.

No method of transmission or storage is completely secure. If a breach affecting your personal information occurs, we will notify you and the relevant authorities as required by applicable law.

8. Data Retention

We retain personal information for as long as needed to provide the Services and for legitimate business purposes, and thereafter as required by law. Because we operate in a regulated financial environment, certain records — including transaction records, payment authorizations, and underwriting documentation — are retained for extended periods required by NACHA rules, card network rules, anti-money-laundering laws, and tax law (typically two to seven years).

When retention is no longer required, we delete or de-identify personal information in accordance with our data retention schedule.

9. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, or legal requirements. When we do, we will post the revised policy on this page and update the "Last updated" date. For material changes, we will provide additional notice — such as email or a dashboard notification — before the changes take effect. Your continued use of our website or Services after the effective date constitutes acceptance of the updated policy.

10. Contact Us

If you have questions about this Privacy Policy, or wish to exercise any of your privacy rights, contact us at:

• Sterling Ridge LLC — Attn: Privacy, 750 S Fort Thomas Ave, Fort Thomas, KY 41075, United States
• Email: contact@sterlingridge.io
• Phone: +1 (364) 204-3463