1. Zero-PII Architectural Guarantee
Opti Technologies, Inc. and its international affiliates (“Opti”, “we”, “us”, or “our”) build privacy-by-design financial infrastructure. Our proprietary offer-matching software connects card issuers (banks and credit unions) with merchants without exposing personally identifiable information (PII).
Unlike conventional marketing aggregators, Opti never accesses or creates individual cardholder profiles. All scoring occurs on mathematically aggregated Bank Identification Number (BIN) ranges and anonymized spend categories.
2. Information We Process
To operate our enterprise matching and settlement platform, we process only the following categories of data:
A. Enterprise Partner Business Information
- Authorized Personnel Contacts: Business email addresses, corporate names, job titles, and contact numbers of bank and merchant administrators accessing our web portals.
- Authentication Credentials: Multi-factor authentication logs, encrypted enterprise single sign-on (SSO) assertions, and session audit logs.
B. Anonymized Offer & Cohort Telemetry
- Merchant Offer Parameters: Offer discount values, redemption caps, eligible store locations, category classifications, and validity windows.
- Cohort Aggregations: Aggregated card product identifiers (e.g. Visa Signature vs. Mastercard World Elite), spend recency indices, and ticket size affinity tiers.
- Settlement Records: Aggregated transaction count, redemption utilization rates, and merchant fee allocations.
3. Legal Basis for Processing (GDPR & UK DPA)
Where European Union (GDPR) or United Kingdom data protection legislation applies, we rely on the following lawful bases:
- Contractual Necessity (Art. 6(1)(b) GDPR): To perform our Master Services Agreement with partner financial institutions and participating merchants.
- Legitimate Interests (Art. 6(1)(f) GDPR): To maintain system uptime, prevent platform abuse, and enforce cryptographic security.
- Legal Compliance (Art. 6(1)(c) GDPR): To fulfill statutory accounting, taxation, and regulatory audit mandates.
4. Banking Partner Data Boundary & No Sub-Licensing
Under no circumstances does Opti:
- Sell, rent, monetize, or broker any partner transaction or offer telemetry.
- Share bank portfolio telemetry with third-party advertising networks or data brokers.
- Combine bank partner cohort telemetry with external consumer databases.
5. Cloud Infrastructure & Cryptographic Security
We deploy defense-in-depth measures compliant with SOC 2 Type II and ISO/IEC 27001 standards:
- Encryption at Rest: All stored database volumes and object stores are encrypted using AWS Key Management Service (AWS KMS) utilizing FIPS 140-2 validated AES-256 keys.
- Encryption in Transit: Mandatory TLS 1.3 encryption across all public endpoints and internal service meshes.
- Network Isolation: Production databases are isolated in private VPC subnets with zero direct internet routing.
- Role-Based Access Control (RBAC): Strict principle-of-least-privilege enforcement with automated session expiration.
6. International Data Transfers
Opti provides localized data residency options across AWS regions (including US East, Europe Ireland/Frankfurt, and Asia-Pacific Singapore). Transfers between regions comply with Standard Contractual Clauses (SCCs) approved by the European Commission.
7. Data Retention Schedule
Aggregated settlement and audit records are retained for statutory accounting periods (typically seven years). Portal authentication logs and session data are automatically purged or rotated after 90 days.
8. Individual & Cardholder Rights
Because Opti holds no cardholder PII, cardholders wishing to exercise rights under GDPR (access, rectification, erasure) or CCPA/CPRA should contact their issuing bank directly. Corporate portal administrators may exercise access or deletion rights regarding their enterprise logins by emailing our privacy team.
9. Contact & Data Protection Officer
If you have questions regarding this Privacy Policy or our security posture, contact our compliance team: