0

I'm looking for a payment processor to integrate with my app or website and want to reduce the risk of my purchases being logged, analyzed by artificial intelligence, or have copies of that transaction exposed to as few third parties as possible.

Can someone define the nouns (payment processor, networks, institutions) and what has the most privacy guarantees?

To limit the scope, this is an online or in person purchase from a US person to a US based company).

1

Can someone define the nouns (payment processor, networks, institutions) and what has the most privacy guarantees?

I can define the nouns, but the short of it is - there are no privacy guarantees you can count on, except that the companies involved prefer to avoid the legal and reputational impact of data breaches.

(This answer excludes constraints imposed by the GDPR, as you've explicitly limited scope to "an online or in person purchase from a US person to a US based company")

Let's start with the parties involved -

Card Brands - Visa, Mastercard, American Express, etc. etc. These are the central clearinghouses that facilitate transaction. When you use a credit card, your transaction details will traverse the chain and get approved or declined by the card brand shown on the card. The Card Brand owns your transaction details.

Acquiring Banks act as the backend for the merchant; when a credit card transaction is approved, the acquiring banks sends money down the chain to the merchant, and then collects the money to cover that from the Issuing Bank. The Acquiring Bank owns your transaction details.

Issuing Banks issue credit cards to people ("cardholders"). They send the money for transactions to the Acquiring Bank, and then collect the money to cover that from the Cardholder. The Issuing Bank owns your transaction details.

Payment Processors act as an aggregation point between Merchants, the Card Brands, and the Acquiring Banks. Rather than having each merchant try to set up connections to each Card Brand and an Acquiring Bank - which is complex, hard work - the Processor provides the value-add of simplifying the process for both ends of the chain. The Processor also owns your transaction details. There may be multiple processors in the chain.

The Merchant is the store that charges people's cards in return for goods or services. When you say "I'm looking for a payment processor to integrate with my app or website" you're saying "I want to be a Merchant." The Merchant has to have a relationship with a Payment Processor (the majority), or directly with the Card Brands and an Acquiring Bank (a rarity).

Either the Merchant or the Processor may involve Third Parties, such as Fraud Detection clearinghouses. A Fraud Detection company may, for example, work with multiple Processors, and provide the value-add that it has a more complete view of card and fraud activity than any single Processor can have.

And the data???

When someone uses a credit card, the details of their transaction traverse the chain and everyone involved gets a copy. Those transactional details are required for the credit card process to work. Have you ever disputed a fraudulent charge? In order to do that, all the parties involved have to have a record of that charge. The various Card Brands have different policies on how long information must be available to support a disputed charge, but as a rule of thumb, you can expect that 18 months is the minimum your transactional data will be available for use by each link in the chain.

In addition, each one of those entities considers the transactional data valuable in its own right. The Card Brands, for example, have sophisticated AI that is constantly working to predict fraud more correctly, which includes knowing about past transactions. Processors are constantly performing data analytics to provide value-add services to the Merchants, explaining trends in the data that Merchants lack the resources to delve on their own.

All their contracts say they can do this. All their contracts include the ability to share the data with third parties that will do more of it. When Merchants sign a contract with a Payment Processor, they are agreeing to these usages. When cardholders open that thick envelope of fine print with a credit card in it, and sign the card, they're indicating they read and agree with all the contracts that allow this usage. If they don't agree, their recourse is to destroy the card and not use it.

So to take this back to your original question, you

want to reduce the risk of my purchases being logged, analyzed by artificial intelligence, or have copies of that transaction exposed to as few third parties as possible

Presumably when you say "my purchases" you mean "purchases customers make against my application/web site", which means you are a Merchant. As such, all you can do is shop around and examine the contracts offered to you by the various Processors. Unless you are large, you will likely be seeing standard contracts, and unless you are very large, you will not have room to negotiate those contracts.

Those contracts will basically say, they will protect the data, and can do various things with the data, including analysis and sharing with third parties. They may list third parties, and reserve the right to change the list. I would be surprised if you find any significant outliers there; that's not an area the Processors use to differentiate themselves, in part because they're only one link in the chain.

And as for the chain, Processor contracts cannot be used to further constrain the Card Brands and the Acquiring Banks. The sharing of your data with those entities is an inherent and necessary requirement of the contract to process card transactions.

Bottom line: If you want privacy guarantee that your customer's purchases won't be logged, analyzed, or shared, then don't accept credit cards.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.