Bland Pay — Privacy Policy

Last updated: April 2, 2026

1. Introduction

Bland Productions LLC ("Company," "we," "us") operates Bland Pay. This Privacy Policy describes how we collect, use, disclose, and protect your personal and financial information. This policy complies with the Gramm-Leach-Bliley Act ("GLBA"), California Consumer Privacy Act / California Privacy Rights Act ("CCPA/CPRA"), General Data Protection Regulation ("GDPR"), UK Data Protection Act 2018, Brazil's Lei Geral de Protecao de Dados ("LGPD"), Australia's Privacy Act, Japan's Act on Protection of Personal Information ("APPI"), and other applicable data protection laws worldwide.

2. Information We Collect

Category	Data Collected	Purpose
Identity	Full legal name, date of birth, government ID (when required)	Account creation, KYC/AML compliance, identity verification
Contact	Email address, phone number, residential address	Account security, communications, regulatory requirements
Financial	Bank account details, debit/credit card information, transaction history, account balance	Payment processing, transaction execution, fraud prevention
Verification	Social Security Number or national identifier (last 4 or full, when required), photo ID	Identity verification, tax reporting (1099-K), regulatory compliance
Device	IP address, device type, operating system, browser, unique device identifiers	Security, fraud detection, account protection
Usage	Pages viewed, features used, transaction patterns, login history	Service improvement, fraud detection, analytics
Location	IP-based geolocation (city/country level)	Regulatory compliance, fraud prevention, sanctions screening

3. How We Use Your Information

Process transactions and maintain your account
Verify your identity and comply with KYC/AML regulations
Detect, prevent, and investigate fraud and unauthorized transactions
Screen against government sanctions lists (OFAC, EU, UN, UK HMT)
File regulatory reports (SARs, CTRs) as required by law
Issue tax documents (IRS Form 1099-K) as required
Communicate with you about your account, transactions, and service updates
Improve our services and develop new features
Comply with legal obligations, court orders, and regulatory requirements
Enforce our Terms of Service

4. Information Sharing

We do not sell your personal or financial data. We share information only in these circumstances:

Payment Processor (Stripe): To process your transactions. Subject to Stripe's privacy policy.
Banking Partners: To facilitate fund transfers and card processing.
Identity Verification Services: To verify your identity for KYC compliance.
Law Enforcement / Regulators: When required by law, subpoena, court order, or regulatory request. We may be prohibited from notifying you of such disclosures.
Fraud Prevention Services: To detect and prevent fraudulent activity.
Tax Authorities: As required by law (IRS, state tax agencies, international equivalents).
Corporate Transactions: In connection with a merger, acquisition, or sale of assets, with notice to you.

5. GLBA Financial Privacy Notice

As required by the Gramm-Leach-Bliley Act, we provide this notice regarding our information sharing practices:

We collect nonpublic personal information from your account applications, transaction history, and identity verification processes.
We do not disclose nonpublic personal information to nonaffiliated third parties except as permitted by law.
We restrict access to nonpublic personal information to employees and service providers who need it to provide services to you.
We maintain physical, electronic, and procedural safeguards to protect your information.

6. Data Security

We implement industry-standard security measures including: encryption of data in transit (TLS 1.2+) and at rest (AES-256), tokenization of payment card data (PCI DSS compliant via Stripe), multi-factor authentication capabilities, regular security assessments, access controls and audit logging, and incident response procedures. No system is 100% secure. If a data breach occurs affecting your financial information, we will notify you and relevant authorities within a commercially reasonable timeframe following discovery and investigation, as required by applicable law.

7. Data Retention

Account information: Retained for the life of your account plus 7 years (tax and regulatory requirements)
Transaction records: Retained for 7 years minimum (BSA/AML requirements)
Identity verification documents: Retained for 5 years after account closure
Device and usage logs: Retained for 2 years
Closed accounts: Core records retained for 7 years per regulatory requirements, then deleted

8. Your Rights

All users: Access your data, correct inaccuracies, close your account and withdraw funds.

California residents (CCPA/CPRA): Right to know what data we collect, right to delete (subject to regulatory retention requirements), right to opt out of sale (we do not sell data), right to non-discrimination.

European/UK users (GDPR/UK DPA): Right of access, rectification, erasure (subject to legal retention), restriction of processing, data portability, objection to processing. Legal basis: contractual necessity (account and transactions), legal obligation (KYC/AML/tax), legitimate interest (fraud prevention). DPO contact: [email protected].

Brazilian users (LGPD): Right to confirmation of processing, access, correction, anonymization, portability, deletion, information about sharing, consent withdrawal.

Some data cannot be deleted while your account is open or during mandatory retention periods. To exercise your rights, contact [email protected].

9. Children's Privacy

Bland Pay is not available to anyone under 18. We do not knowingly collect information from minors. If we discover we have collected information from someone under 18, we will immediately close the account and delete the data.

10. International Data Transfers

Your data may be transferred to and processed in the United States. For EU/UK users, transfers are made under Standard Contractual Clauses (SCCs) as approved by the European Commission. For other jurisdictions, we rely on your consent and contractual necessity as legal bases for transfer.

11. Cookies and Tracking

Bland Pay uses strictly necessary cookies for authentication and session management. We do not use advertising cookies or third-party tracking on payment pages. Our analytics (Bland Analytics) collects usage data as described in Section 2.

12. Changes to This Policy

We will notify you of material changes via email at least 30 days before they take effect. Continued use constitutes acceptance.

13. Contact

Bland Productions LLC
Privacy inquiries: [email protected]
General support: [email protected]
Legal: [email protected]
Data Protection Officer: [email protected]