Legal

Privacy Policy

Last updated: July 2026 · Draft pending counsel review

Triceratops ("Triceratops," "we," "us") provides an AI-powered payments platform for small businesses — invoicing, pay-by-link, recurring billing, and automated payment follow-up. This Privacy Policy explains what information we collect, how we use it, and the choices available to you. It applies to triceratops.com and to the Triceratops platform (together, the "Services").

Triceratops handles information in two distinct roles. For our own website visitors and merchant customers, we decide how information is used. For the customers of our merchants, we process information on the merchant's behalf and under their instructions — those individuals' primary relationship is with the business that invoiced them.

1. Information we collect

From website visitors

When you visit triceratops.com or request early access, we collect what you provide: name, business name, email address, and any details you include about your business. Our site does not use advertising trackers; standard server logs (IP address, browser type, pages viewed) are retained for security and performance.

From our merchants

When a business signs up for Triceratops, we collect account information (legal business name, contact details, authorized users), configuration choices (message tone, follow-up schedules), and — through our payment partners — the information required to underwrite and settle payments, such as business registration details and bank account information for deposits.

On behalf of our merchants

To operate invoicing and payment follow-up for a merchant, we process information about that merchant's customers: names, email addresses, phone numbers, invoice amounts and status, payment history, and communications sent and received through the platform. We process this information under the merchant's instructions and our agreement with them.

What we deliberately do not store

Full payment card numbers never touch Triceratops servers. Card details entered on our payment pages are tokenized at the point of entry by our PCI-DSS-certified payment infrastructure partners; Triceratops stores only tokens and truncated identifiers (for example, the last four digits and card brand).

2. How we use information

  • To provide the Services: generating invoices, delivering payment links, processing payments through our partners, and sending payment-related communications on merchants' behalf.
  • To operate the AI follow-up agent: composing and scheduling payment reminders in the merchant's name, adjusting timing and channel, and pausing when a customer replies. Merchant configuration controls the agent's behavior; merchants may review messages before sending.
  • To improve the Services: aggregate, de-identified analytics such as collection rates and days-to-payment. We do not use one merchant's customer data to benefit another merchant.
  • To communicate with merchants and early-access requesters about the Services.
  • To meet legal, security, and fraud-prevention obligations, including those of our payment partners.

3. Text messages and email sent by the platform

The platform sends payment-related messages (for example, invoice notices and payment reminders) on behalf of, and in the name of, the merchant to whom the payment is owed. Merchants are responsible for having appropriate consent to contact their customers, and our agreements require it. Every text message supports STOP to opt out and HELP for assistance; opt-outs are honored immediately and synchronized across the platform. Messages are sent during appropriate local hours. Message and data rates may apply. Every email includes the sender's identity and a functioning unsubscribe mechanism.

4. When we share information

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We share information only with:

  • Service providers that help us operate: payment infrastructure and processing partners, cloud hosting, AI model providers, and email/SMS delivery carriers. Each is bound by contract to use information only to provide services to us.
  • The relevant merchant: a merchant can see the invoice, payment, and communication history of their own customers.
  • Legal and safety recipients: when required by law, legal process, or to protect the rights, safety, and integrity of the Services, our users, or the public.
  • Business transfers: in a merger, acquisition, or asset sale, subject to this policy's commitments.

A current list of our subprocessors is available on request at [email protected].

5. Security and retention

We use encryption in transit, access controls, and tokenization-first payment architecture. No system is perfectly secure, but our design principle is simple: hold as little sensitive data as possible. We retain information for as long as needed to provide the Services, meet legal and financial record-keeping obligations (payment records carry statutory retention periods), and resolve disputes; we then delete or de-identify it.

6. Your choices and rights

If you are a merchant's customer

Your relationship is with the business that invoiced you. Requests to access, correct, or delete your information should go to that business; we support our merchants in honoring them. You can opt out of text messages at any time by replying STOP, and out of email via the unsubscribe link.

If you are a merchant or website visitor

You may request access to, correction of, or deletion of your personal information by emailing [email protected]. We will verify your request and respond as required by applicable law. Depending on your state of residence, you may have additional rights under state privacy laws, including the right to know, delete, correct, and opt out of certain processing, and the right not to be discriminated against for exercising them.

Nevada residents

Nevada law (NRS 603A) allows Nevada consumers to opt out of the sale of certain covered information. Triceratops does not sell covered information; Nevada residents may nonetheless submit a verified opt-out request to [email protected].

California residents

If the California Consumer Privacy Act (as amended) applies to our processing of your information, you may exercise the rights it provides — including access, deletion, correction, and opting out of sale/sharing (we do neither) — by emailing [email protected]. We honor these requests without discrimination.

7. Children

The Services are for businesses and are not directed to anyone under 18. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will delete it.

8. Changes to this policy

We will post any changes here and update the date above. For material changes affecting merchants, we will provide direct notice.

9. Contact

Triceratops LLC, a Nevada limited liability company
Reno, Nevada
Postal address available on request.
[email protected]