Clover Application Privacy Policy

1. Our role and the information covered

For Merchant Data, SG2 acts on the Merchant’s instructions under its services agreement and any applicable data-protection agreement. The Merchant determines the authorized business purposes and connected accounts. SG2 does not own this data or use it for its own marketing, analytics, or unrelated commercial purposes. SG2 separately handles its business contact, billing, and support records to manage the client relationship.

A Merchant agreement governs processing for that Merchant and controls a conflict to the extent permitted by law. Neither that agreement nor this policy permits processing prohibited by applicable law.

2. Information collected and its sources

Business contact and support information includes names, email addresses, telephone numbers, company and job details, billing information, and information voluntarily supplied in support communications. We receive it from Merchants, their authorized users, and people who contact us.

Merchant Data is information the Merchant supplies or authorizes SG2 to receive from connected POS and online-ordering providers for the agreed financial dashboard. The service scope covers sales, costs, franchise and royalty reporting, invoices, and report exports. Merchant Data can include customer or personnel names, contact information, employee records, and other business data where supplied under the Merchant’s instructions. The exact information varies with the contracted scope and connected source.

Technical information associated with operating the service may include IP addresses, device or browser details, and access or error records. We do not knowingly collect sensitive personal information unless specifically required and instructed by the client for the service. The information collected depends on the Merchant’s instructions, the agreed service scope, and the connected sources.

3. How we use information

Merchant Data is used to develop, test, deliver, host where agreed, maintain, and support the authorized application; organize and report the Merchant’s financial records; and respond to its service instructions. Merchant Data is not used for SG2’s own marketing, independent analytics, or model training.

Business contact and support records are used to respond to inquiries, perform agreements, manage billing and the client relationship, send administrative and security notices, and address support requests. Information may also be used to meet legal duties, enforce agreements, protect rights, and prevent fraud or unauthorized access.

4. Disclosures and service providers

We return or disclose Merchant Data as directed by the Merchant and may make it available to its authorized users. Providers and subcontractors, such as hosting, payment, development, and support services, may process information needed to perform their services under confidentiality and data-protection obligations. Disclosures of Merchant Data remain limited by the Merchant’s instructions, applicable agreement, and privacy law.

Information may be disclosed when legally required or necessary to protect lawful rights and safety. A business reorganization, acquisition, or asset transfer may involve transfer of information, subject to applicable law and continuing privacy obligations. Clover and other connected platforms have their own privacy notices for processing they perform.

5. Security and retention

SG2 uses reasonable administrative, technical, and physical safeguards to protect information. No system can guarantee absolute security. Merchants remain responsible for protecting their accounts, authorized users, and source systems.

We retain information only as necessary to perform the service, meet legal duties, resolve disputes, and enforce agreements. Merchant Data is retained under the Merchant’s instructions and service agreement, generally for the project or support period, and then returned or deleted unless otherwise agreed or lawfully required. Contact us about retention or deletion of information associated with your service.

6. Individual rights and requests

Depending on applicable law, individuals may have rights to access, correct, delete, obtain a portable copy of, restrict, or object to processing of their information. For information processed for a Merchant, contact that Merchant first so it can locate the records and determine the response. SG2 will refer direct requests to the responsible Merchant and reasonably assist with its response.

For information SG2 handles for its own client relationship or support purposes, use the contact channels below. Provide enough detail to identify your request and relevant relationship. Do not send passwords or full payment-card numbers. We will respond within the period required by applicable law.

For requests for which Clover is responsible, use Clover's Privacy Notice. SG2 will assist the responsible Merchant or Clover as required by law and the applicable agreement.

7. California privacy rights

Subject to the CCPA’s scope and exceptions, California residents may request the categories and specific pieces of personal information collected about them, its sources, the purposes of collection, and the categories of recipients. Requests may also cover information disclosed for business purposes or sold during the preceding twelve months, including the relevant categories and recipients.

Residents may request access, correction, deletion, and a portable copy of their information; opt out of a qualifying sale or sharing for cross-context behavioral advertising; and limit uses of sensitive personal information where that right applies. We will not discriminate against a person for exercising applicable privacy rights.

Submit a request using the email, telephone, or postal channels below. For requests concerning Merchant Data, contact the relevant Merchant. We may verify identity using information reasonably necessary to match the requester with the records and may ask for clarification. An authorized agent may submit a request with evidence of authority; we may also seek identity confirmation from the individual as permitted by law. If an exception limits a request, we will explain the applicable reason where required.

8. Sale or sharing of personal information

SG2 does not sell personal information or share it for cross-context behavioral advertising, as those terms are defined by the CCPA. Service-provider processing and Merchant-directed disclosures are subject to the restrictions described above.

During the twelve months preceding the effective date of this policy, SG2 did not sell personal information or share it for cross-context behavioral advertising.

9. Transfers, third-party services, and updates

Where information is transferred internationally, SG2 uses safeguards required by applicable law, including appropriate contractual protections where required. External services are governed by their own notices; review those notices when using them.

SG2 will post policy changes with an updated effective date and provide additional notice of material changes where required by law. Existing website and SMS disclosures continue to apply to those activities; these application terms do not authorize sharing SMS opt-in information or bypassing consent requirements.