Privacy Policy

Last updated: September 13, 2026

This Privacy Policy explains how NOVAPAY Panamá (“NOVAPAY”, “we”, “us”), the company that operates the TrueGate platform, dashboard, API and SDKs (collectively, the “Service”), handles personal data submitted through them. NOVAPAY is a company incorporated and existing under the laws of the Republic of Panama, with registered office at Sortis Business Tower, Piso 6, Oficina EF, Ciudad de Panamá, Panamá, and is the entity responsible for the Service under this Policy. It applies both to our customers (regulated businesses that use TrueGate) and to the end users those customers verify through TrueGate.

1. Roles

For personal data submitted through verifications, NOVAPAY acts as a processor and our customer acts as the controller. For account and billing data of our customers, NOVAPAY is the controller.

2. Data we process

  • Customer account data: business name, contact name, email, phone, billing information, API usage metrics.
  • End-user verification data: government-issued document image and data (name, date of birth, document number, nationality), selfie/liveness capture, IP address, device metadata, submission timestamps, sanctions/AML match results, and PDF audit reports.
  • Website analytics: pages visited, referrer, device type and coarse location. Where legally required, only after consent.

3. Purposes & legal basis

  • To deliver the verification and screening Service (contract).
  • To comply with AML/KYC and sanctions regulations applicable to our customers (legal obligation).
  • To detect fraud, secure the platform and prevent abuse (legitimate interest).
  • To improve our matching, fraud detection and Service quality (legitimate interest; data used in aggregate/anonymized form wherever possible).

4. Sub-processors

We rely on carefully vetted sub-processors to operate the Service, across the following categories: cloud infrastructure and hosting, managed database, transactional email, SMS and messaging, identity verification and biometric checks, sanctions and watchlist data, business registry data, and AI-assisted compliance review (with no training on customer data). Each sub-processor is bound by confidentiality and data-protection obligations equivalent to the commitments in this Policy. The current list of specific sub-processors is available to customers under a signed NDA — write to privacy@truegate.io to request it.

5. Retention

Verification records and audit trails are retained for the period required by the applicable AML/KYC regulation (typically 5 years), unless a longer period is required by law or requested by our customer. Marketing contacts are retained until you unsubscribe.

6. Your rights

Depending on your jurisdiction you may have the right to access, correct, delete or port your personal data, and to object to or restrict certain processing. End users should exercise these rights with the customer of TrueGate that submitted their verification. Customers may exercise these rights, or forward end-user requests, by writing to privacy@truegate.io.

7. International transfers

Data may be processed in the United States, the European Union and Latin America. Where personal data is transferred outside its country of collection, we rely on Standard Contractual Clauses or an equivalent legal mechanism.

8. Security

We apply appropriate technical and organizational measures, including encryption in transit, encryption at rest for sensitive fields, role-based access control, audit logs and regular reviews. No system is perfectly secure; we ask customers to help by keeping API keys confidential and reporting suspected incidents to security@truegate.io.

9. Contact

Data-protection questions should be sent to privacy@truegate.io.