Who we are and what this policy covers
North American Credit Card Assoc., Inc. (NACCA, “we,” “us,” or “our”) provides information about merchant payment services and related solutions through nacca.com. This policy explains how we handle information associated with this website, its inquiry form, the separate statement-review workflow described below, and our responses.
It does not replace privacy notices or agreements that apply to merchant applications, underwriting, transaction processing, an existing merchant account, or a separately enrolled messaging program. If you proceed with a service, the applicable service documents explain the additional information and processing involved. See the existing merchant privacy statement and SMS terms.
Information you provide
Our inquiry form asks for your name, organization, business email address, inquiry type, preferred contact method, and permission to contact you about the inquiry. You may also provide a phone number, message, and the software, gateway, or device you are asking about. A phone number is required if you choose a phone response. For a complex payment inquiry, we also ask for your role and authority to contact us on behalf of the business; you may describe the software, gateway, processor, devices, number of locations or merchant accounts, and timing. A complex inquiry may include the referring NACCA page (such as a profile or service page), but not the full referring URL. When you communicate with us about your inquiry, we also receive the information you provide in that correspondence.
Please provide only information needed to explain your business request. Do not submit payment-card details, patient information, bank-account details, passwords, tax identifiers, or other sensitive information through this form. The form does not offer file uploads.
Providing a phone number does not enroll you in a text-message marketing program. Submitting an inquiry does not subscribe you to a newsletter.
Separate statement-review workflow
You can request a statement review through Contact. If you choose to share a statement, use the separate secure upload page. If upload is unavailable, ask NACCA how to proceed. Do not email your statement or put its contents in the Contact form.
This separate workflow collects the authorized contact’s name, business, email address, role, and acknowledgment of authority. Optional information includes a contact phone number, software, gateway, processor, device names, and the question to evaluate. Providing a phone number does not enroll you in text messages. It also records whether the request was prepared with AI assistance, the acknowledgment version, relevant timestamps, and file-validation and delivery status. Assessment answers are not transferred to this workflow.
Choosing to request a verification email sends these contact details to the statement service. The email contains a time-limited upload authorization link; keep it private. Selecting Clear this page clears the page’s local state, but does not withdraw a submitted request or delete an uploaded file. Contact NACCA to request deletion.
After email verification and a separate upload acknowledgment, the workflow accepts one PDF. A processing statement can contain confidential business information. Use only a file you are authorized to share. Remove unnecessary bank-account details, tax identifiers, patient information, cardholder data, credentials, and other sensitive information before uploading.
Vercel handles website and statement-service requests. Amazon Web Services (AWS) stores the PDF and intake record in Ohio, checks files, and sends verification and staff emails. Statement PDFs go directly to private, encrypted AWS storage. After security and file-integrity checks, the accepted PDF and submitted details are emailed to three authorized NACCA reviewers. Their email services store those copies. We use the information to review your request and follow up.
We schedule original statement files in AWS for expiration 30 days after upload. Older versions are scheduled for permanent deletion seven days after becoming noncurrent. Intake records are scheduled for deletion 30 days after the request is created. These background processes may finish after their scheduled dates. Expiry of a verification link does not delete the file or intake record.
Our policy requires reviewers to remove original review emails, attachments and working downloads from active systems under our control within 30 days of the review email’s receipt. This includes internally forwarded copies and Deleted Items. Deleting an AWS file does not delete mailbox or work-folder copies. Backups and provider recovery copies have separate schedules. Information needed for an ongoing business relationship follows the applicable business-record schedule. A documented legal preservation requirement may require longer retention.
Assessment answers and unsubmitted information
The Level III assessment calculates its results in your browser. Its answers are not included in a Contact-form submission. Our form code does not send inquiry fields to Formspree before you choose to send, or save inquiry drafts to browser storage. The security check described below can process technical information before a submission.
These statements concern information entered into our application. Visiting the website still involves the technical processing described below.
Technical information and website services
We use Vercel to host and deliver the website, Formspree to process inquiry submissions, and Microsoft 365 for email and internal inquiry administration. These services may process technical information such as IP addresses, browser or device information, request times, and diagnostic or security information to provide and protect their services.
Formspree receives and stores submitted inquiry details and generates email notifications. Those notifications are delivered to inquiries@nacca.com and shared with authorized NACCA team members who handle your inquiry. Our mail services process and store the notifications and subsequent correspondence. We maintain a restricted internal tracker of inquiry references, assignments, dates, and deletion confirmations; it does not contain copies of inquiry messages.
We do not use website inquiry information for targeted advertising or sell it. Technical processing needed to deliver the website or protect it from abuse still occurs.
The inquiry form uses Google reCAPTCHA v2 to help prevent automated abuse. Loading and using the security check involves requests to Google and may process technical information such as your IP address, browser or device information, and interactions with the check. reCAPTCHA sets a necessary cookie for risk analysis. This processing can occur before you send an inquiry. Google's Privacy Policy and Terms of Service apply. If you prefer not to use the check, contact NACCA by phone or email instead.
You can manage cookies and browser storage through your browser settings. Blocking technologies needed by a service may affect its operation. Links to external reporting portals and other websites lead to services with their own privacy practices.
Optional analytics
If you accept optional analytics, Google Analytics measures visits to eligible public pages, clicks on NACCA phone and email links, and inquiries accepted by our form service. For an accepted inquiry we send its topic. We exclude statement uploads, verification links and Level III assessment pages. We omit form entries, URL queries and fragments from the events we send.
Google receives technical information such as IP address, browser information and analytics identifiers. The website requests host-only analytics cookies with a lifetime of up to 30 days. We disable advertising features in the website tag. Google Analytics is configured to retain event-level data for two months and user-level data for 14 months, with the user-level period restarting on new activity. Aggregated reports can remain available longer. See Google’s Privacy Policy.
Declining keeps optional collection off. Withdrawing consent stops future collection on this website and clears its analytics cookies. Contact NACCA about information already collected. Google reCAPTCHA on Contact operates separately.
If you choose Accept or Decline, this browser can remember your preference for up to 180 days. To change it, open Cookie settings in the footer. Clearing your browser storage removes the saved preference.
Why we use information
We use information to respond to questions, assign requests to an appropriate team member, discuss requested payment solutions, coordinate demos or other next steps, maintain inquiry records, and protect our website and communications from abuse. MaxilloSoft demo requests are coordinated through NACCA.
An assessment result is informational. It is not a merchant-account approval, credit decision, or guarantee of payment-processing eligibility or savings.
How long information is kept
The inquiry-message schedule below applies to Formspree inquiries and related mailbox copies. The statement-upload schedule is described above.
We delete spam and synthetic test inquiries from Formspree and notification mailboxes within 30 days of receipt. We delete closed inquiries from Formspree and notification mailboxes, including copies distributed internally, 180 days after closure.
An inquiry is closed when the request is resolved or the conversation has ended and closure is recorded. Renewed contact is recorded separately and does not automatically extend the original inquiry’s deletion deadline.
Information needed for an ongoing customer or partner relationship is transferred to the appropriate business records. Its retention is determined by the continuing relationship, the purpose of the record, applicable agreements, and legal obligations. Transferring needed information does not exempt the original inquiry and notification copies from their deletion schedule.
Our internal tracker records administrative references and completion information separately from the original submissions. Its retention is managed separately from inquiry-message retention.
These periods concern copies in active systems under our control. Removing those copies does not necessarily immediately remove information from provider logs, backups, or mail-recovery systems. A specific legal preservation requirement may also prevent deletion of particular information. Where that occurs, we limit continued retention and use to the applicable purpose and handle deletion when the requirement ends. We do not promise that all provider backup copies are erased on the same date as an active record.
Security
We use access controls and account-security measures to limit access to inquiry information. No website, email service, or storage system can guarantee absolute security. Please use the Contact form only for ordinary business inquiries and follow its sensitive-information warning.
Your questions and privacy requests
You may contact us to ask about your information or request access, correction, or deletion. Depending on the laws that apply to you and to our processing, you may have additional rights, including obtaining a copy, objecting to certain processing, withdrawing consent where processing relies on it, or appealing a denied request.
Send requests to inquiries@nacca.com or the mailing address below. Include enough information for us to identify the relevant inquiry, but do not email identity documents, card details, or other sensitive information unless we arrange an appropriate method. We may need to verify your identity and, where relevant, an authorized representative’s authority.
We will respond within the period required by applicable law. If we cannot fulfill a request, we will explain the reason and any available appeal process. To request reconsideration, email the same address with “Privacy appeal” in the subject. Where applicable, you may also contact the privacy regulator or attorney general for your jurisdiction. We will not unlawfully discriminate against you for exercising a privacy right.
Location of processing and external services
NACCA operates in the United States. Service providers may process information in the United States and other locations where they operate. Applicable privacy protections can differ between locations. Contact us if you have questions about the services involved in your inquiry.
External merchant-reporting portals, software-provider websites, and other linked services are operated separately. Review their notices before providing information to them.
Children
This website is intended for business users and is not directed to children under 13. If you believe a child has submitted personal information through our inquiry form or statement-review workflow, contact us so we can review and address it.
Changes and contact
We will post revisions here with an updated effective date and provide additional notice when required. Changes do not replace any consent required for a new use of information.
North American Credit Card Assoc., Inc.
57 Old Post Road NO 2
Greenwich, CT 06830
Privacy questions: inquiries@nacca.com