Get PayitFast App and Start Spending at Visa accepted Merchants
Scan the QR code to download the app
Last Updated: 23 July 2026
This Privacy Policy describes how Silverleaf E-Money Services Limited dba PayitFast ("PayitFast", "we", "us", or "our") collects, uses, discloses, retains, and protects personal information in connection with our financial products and services. PayitFast operates as a Payment Services Provider (PSP) under the Canadian Retail Payment Activities Act and it is registered as a Money Services Business (MSB) with the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) and is therefore required to comply with:
This Policy explains:
By accessing our website, using our services, or submitting personal information to us, you acknowledge and agree to the practices described in this Privacy Policy.
Where we collect sensitive personal information, in particular biometric data and government-issued identification, we obtain your express, opt-in consent at the point of collection, separate from your acceptance of this Policy. We do not rely on your continued use of our services alone to establish consent for new or materially different purposes, and we will seek fresh consent where the law requires it.
This Privacy Policy applies to all products, platforms, technologies, and services offered by PayitFast (Silverleaf E-Money Services LTD) in the course of operating as a Payment Services Provider (PSP) and Money Services Business (MSB). This includes, but is not limited to:
This Policy governs the handling of personal information related to individual customers, business clients, beneficial owners, authorized representatives, and users who interact with PayitFast in any capacity. It applies regardless of whether users access our services through a browser, mobile device, integrated partner platform, or other digital channel.
This Policy also covers (i) concierge and lifestyle services that we make available through our partner, Verati, and (ii) virtual-currency and crypto-asset functionality, including custody and blockchain-analytics processes operated together with our service providers. This Policy does not apply to aggregated or anonymized information that cannot reasonably identify an individual.
As part of providing payment services, payment processing, identity verification, and regulatory compliance functions, PayitFast collects several categories of personal and business information. The types of information we collect include the following:
This includes information used to identify or contact an individual, such as:
This information is collected to meet onboarding, identity verification (KYC), and legal compliance obligations under PCMLTFA.
For corporate clients, we may collect:
This information is required for Know-Your-Business (KYB) verification and AML/ATF due diligence.
To operate e-money accounts, prepaid/virtual cards, and payment services, we collect:
This information is necessary for providing financial services, preventing fraud, and meeting regulatory reporting requirements.
When you access PayitFast platforms, we automatically collect certain technical information, including:
This information supports security monitoring, fraud detection, and performance optimization.
To comply with Canadian AML/ATF regulations and industry standards, we may collect and generate:
This information is required by law under the PCMLTFA and FINTRAC guidance for reporting entities.
Where you use concierge or lifestyle services offered through our partner Verati, we collect the information needed to fulfil your requests — for example, service and travel preferences, booking and reservation details, and related communications. This information is used to provide the concierge service and is shared with Verati as described in the “Sharing Personal Information” section.
Where you use virtual-currency or crypto-asset functionality, we collect and generate blockchain wallet addresses, on-chain transaction data, and crypto-asset balances, and we process risk indicators derived from blockchain analytics. For virtual-currency transfers subject to the FINTRAC “Travel Rule”, we also collect and transmit originator and beneficiary information, including counterparty virtual-asset service provider (VASP) details, as required under the PCMLTFR.
PayitFast processes personal information only where permitted under applicable Canadian privacy laws, including the Personal Information Protection and Electronic Documents Act (PIPEDA), relevant provincial laws, and regulatory obligations under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA) and FINTRAC guidance. We rely on the following legal bases:
We collect and process personal information with your knowledge and consent, except where otherwise permitted or required by law. Consent is obtained during account creation, onboarding, or when you voluntarily provide information.
We process information as necessary to:
Without this processing, we would be unable to deliver our services.
As a regulated entity under the PCMLTFA, PayitFast is required by law to:
These activities are mandatory and cannot be opted out of.
We process certain information to support:
These interests are balanced against user privacy rights and supported by appropriate safeguards.
While all personal information is stored securely in Canada, certain operational and compliance functions require processing by vetted and contractually-bound service providers located in other jurisdictions:
(a) United Kingdom (UK) — SumSub
Identity verification provider handling:
(b) United Arab Emirates (UAE) — Code Structure
Infrastructure and technology partner supporting:
(c) United States (US) — Rail
Payments and card program infrastructure provider supporting:
All international processing is governed by strict contractual safeguards, encryption, limited-access permissions, and compliance with applicable Canadian requirements regarding cross-border data handling.
PayitFast uses personal information only for purposes that a reasonable person would consider appropriate in the circumstances, as required under the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial laws. As a registered Payment Services Provider (PSP) under the Retail Payment Activities Act and a FINTRAC-registered Money Services Business (MSB), we use personal and business information for the following purposes:
We use personal and business information to:
These activities are required under the PCMLTFA and enforced through FINTRAC guidance applicable to reporting entities.
We process information to fulfill mandatory obligations including:
These activities cannot be opted out of, as they are required by law.
We use information to:
Information processed in this category is necessary to provide core financial services.
We use personal and technical data to:
This processing supports legal obligations and our legitimate interest in maintaining secure financial operations.
We use information to:
We use information for:
Some of our compliance and fraud-prevention processes — including identity-verification scoring, sanctions and PEP screening, transaction monitoring, and blockchain risk scoring — involve automated processing that can affect your eligibility for our services or result in a transaction being delayed, declined, or frozen. Where a decision about you is based solely on automated processing, you may request information about the principal factors involved, submit observations, and request review by a member of our staff, subject to the limits that AML/ATF law places on disclosing monitoring and investigative information.
PayitFast shares personal information only where necessary to provide our services, fulfill legal and regulatory obligations, prevent fraud, or operate our platform securely. We do not sell personal information. Information may be shared with the following categories of authorized third parties:
In addition to the categories of recipients described below, we share personal or transactional information with: Verati, our concierge-services partner, to fulfil concierge requests you make; Fireblocks, our digital-asset custody provider, which processes wallet and transaction data linked to your account; and Chainalysis, our blockchain-analytics provider, which receives wallet addresses and transaction data to perform sanctions screening and transaction risk scoring (KYT). Each of these providers operates under contractual data-protection obligations and access controls.
We share limited personal and transactional information with banking partners and financial institutions involved in:
These partners require this information to fulfill their regulatory and operational responsibilities.
We share data related to:
Card networks and processors require this information to enable secure payment transactions and comply with network rules.
To comply with PCMLTFA identity verification requirements, we share information with trusted, audited service providers, including:
These partners process data strictly for compliance and authentication purposes.
We share certain technical, transactional, or behavioral indicators with fraud-prevention and analytics providers that support:
These providers help maintain the integrity of our platform and reduce financial crime risk.
We may share limited information with infrastructure partners who support system operations, including:
These partners operate under strict contractual data-protection obligations and access controls.
We are required by law to disclose certain information to:
These disclosures occur only where mandated by legislation.
We may disclose information to law enforcement, courts, or government authorities when:
We review all requests to ensure they comply with applicable legal standards.
PayitFast stores all personal information securely within Canada using infrastructure that meets financial-industry security and availability standards. Data residency in Canada ensures compliance with applicable privacy and financial regulatory requirements, including PIPEDA and the PCMLTFA.
Although all information is stored in Canada, certain operational, compliance, and technology functions require limited processing by carefully vetted third-party service providers located in other jurisdictions. These providers perform essential services on behalf of PayitFast, and only the minimum necessary information is made accessible to them.
All customer and business information is hosted and stored on secure servers located in Canada. These environments are subject to:
Some data may be processed, and in certain cases stored, outside Canada by trusted, contractually bound partners:
i. United Kingdom (UK) — SumSub (Identity Verification Provider)
SumSub performs identity verification and regulatory screening functions, including:
This processing supports mandatory onboarding requirements under PCMLTFA and FINTRAC guidance.
ii. United Arab Emirates (UAE) — Code Structure (Technology & Infrastructure Partner)
Code Structure provides secure infrastructure and development support, including:
Access is restricted, controlled, and monitored to ensure confidentiality and integrity.
iii. United States (US) — Rail (Payments & Card Program Infrastructure)
Rail supports electronic money and card program functionality, including:
This ensures reliable and compliant operation of PayitFast's e-money and card products.
All cross-border processing is protected through:
These measures ensure that any data processed outside Canada receives a level of protection comparable to Canadian privacy standards.
Before transferring personal information outside Canada, we assess the destination jurisdiction’s legal framework and the adequacy of the receiving party’s protections through a privacy impact assessment, consistent with Quebec’s Law 25 and applicable Canadian requirements; this assessment gives particular attention to transfers to jurisdictions without a comprehensive data-protection regime. Where personal information relating to individuals in the EU or UK is transferred to a country without an adequacy decision, we rely on Standard Contractual Clauses (or the UK International Data Transfer Agreement) together with a transfer risk assessment.
PayitFast maintains a comprehensive security program designed to protect personal information against loss, unauthorized access, misuse, alteration, and disclosure. Our safeguards meet or exceed the expectations set out under PIPEDA, financial-industry best practices, and applicable regulatory guidance for Payment Services Provider (PSP) and Money Services Businesses (MSBs). These measures include administrative, technical, and physical controls such as:
We implement policies, procedures, and governance frameworks to support secure handling of personal information, including:
Technical protections secure data throughout its lifecycle, including:
Where payment card data is handled, PayitFast and its partners comply with:
Physical protections include:
When trusted service providers process data on our behalf (e.g., SumSub, Code Structure, Rail), we require:
These controls ensure that personal information handled by third parties receives the same high level of protection as information managed directly by PayitFast.
PayitFast maintains procedures to detect, assess, contain, and respond to breaches of security safeguards. Where a breach creates a real risk of significant harm to an individual, we will notify affected individuals and report to the Office of the Privacy Commissioner of Canada as soon as feasible, as required under PIPEDA, and we will notify any other organisation or government institution that may be able to reduce the risk of harm. For individuals in Quebec, we will also notify the Commission d’accès à l’information where the incident presents a risk of serious injury, in accordance with Law 25. We keep records of all breaches of security safeguards as required by law.
PayitFast retains personal information only for as long as necessary to fulfill the purposes for which it was collected, to comply with legal and regulatory obligations, and to support legitimate operational needs. Retention periods differ based on the type of information and applicable laws.
In accordance with the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA) and related regulations, PayitFast is required to retain all identity verification records, KYC/KYB documentation, beneficial ownership information, and related due-diligence materials for a minimum of five (5) years from:
These records must remain accessible for audit and regulatory review by FINTRAC.
Transactional information, including payments, loads, withdrawals, card activity, settlement data, and monitoring alerts, is retained to:
These records are typically retained for a minimum of five (5) years, or longer where legally required.
Suspicious transaction reports, risk assessments, ongoing monitoring logs, sanctions screening results, and related compliance records are retained as required under AML/ATF regulations and internal compliance policies. These may also be retained for five years or more, depending on the nature of the record.
Information used for customer support, service improvement, system monitoring, or internal governance is retained only for as long as necessary to:
Where possible, data is anonymized or pseudonymized once it is no longer needed in identifiable form.
If PayitFast is involved in an audit, investigation, regulatory inquiry, or legal claim, certain information may be retained beyond standard retention periods until the matter is resolved.
Once retention periods expire and data is no longer required, PayitFast securely destroys the information using:
PayitFast uses cookies and similar tracking technologies to ensure the secure and efficient operation of our platforms, to enhance user experience, and to support fraud-prevention and compliance functions. These technologies help us recognize your device, understand usage patterns, and improve our services.
i. Essential Cookies
These cookies are required for the website and platform to function properly. They enable:
These cookies cannot be disabled because they are necessary for service delivery and platform security.
ii. Analytics and Performance Cookies
These cookies help us understand how users interact with our website and applications, including:
Analytics cookies allow us to improve platform functionality and enhance overall user experience.
iii. Security and Fraud-Prevention Cookies
These cookies support:
They play a critical role in maintaining the safety and integrity of financial services.
Some analytics, verification, or security tools used by PayitFast may deploy their own cookies or device identifiers. These third-party technologies help support:
Any third-party cookie usage is governed by strict contractual and technical safeguards.
You may manage or disable cookies through your browser settings. However:
For non-essential cookies and similar technologies (such as analytics and performance cookies), we obtain your consent through a cookie banner before they are set, and you may withdraw that consent at any time. Essential and security cookies are strictly necessary for the service and are not set on an opt-in basis.
You may also clear existing cookies at any time using your browser or device controls.
Where we send you commercial electronic messages (for example, product updates or offers), we do so in accordance with Canada’s Anti-Spam Legislation (CASL), with your consent where required, and every such message includes an unsubscribe mechanism. Withdrawing marketing consent does not affect service-related or legally required communications.
As an individual whose personal information is handled by PayitFast, you have certain rights under PIPEDA and applicable provincial privacy laws. These rights allow you to understand and control how your information is collected, used, and disclosed. Because PayitFast operates as a Payment Services Provider (PSP) and Money Services Business (MSB), some rights are subject to regulatory limitations, including mandatory record-keeping requirements under the PCMLTFA.
You may exercise the following rights, subject to identity verification and applicable legal exceptions:
You may request access to the personal information we hold about you, including:
We will provide access unless restricted by law (e.g., information related to AML/ATF monitoring or ongoing investigations).
You may request that we correct or update any inaccurate, incomplete, or outdated personal information. Corrections may be refused if restricted by AML/ATF legislation or if doing so would interfere with regulatory compliance.
You may request deletion of your personal information. However, we cannot delete records that must be retained under the PCMLTFA, including:
These records must be retained for a minimum of five years and cannot be removed upon request.
Where processing is based on consent (e.g., optional features), you may withdraw your consent at any time. Withdrawal does not apply to:
In cases where withdrawal affects your ability to use the service, we will inform you.
You may request additional details about:
We will provide this information unless restricted by legal or supervisory requirements.
Where required by applicable law (including Quebec’s Law 25), you may request that the computerised personal information you have provided to us be communicated to you, or to another organisation you designate, in a structured, commonly used technological format, subject to AML/ATF and other legal exceptions.
To submit a request, you may contact us at:
We may require identity verification before responding to your request to protect your account and personal information.
If you are not satisfied with how we have handled your personal information or a privacy request, you may escalate your concern to the Office of the Privacy Commissioner of Canada (www.priv.gc.ca). Residents of Quebec may also contact the Commission d’accès à l’information du Québec.
Although PayitFast primarily operates under Canadian privacy and financial regulatory requirements, certain users may be entitled to additional rights based on their location or applicable legislation. Where relevant and required by law, PayitFast recognizes the following regional privacy rights:
Individuals located in the EU or UK may have rights under the General Data Protection Regulation (GDPR) or UK GDPR, including:
These rights apply only where GDPR jurisdiction is legally triggered.
California residents may have rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), including:
PayitFast does not sell personal information.
PayitFast's services are intended for adults who are legally able to enter into financial and contractual relationships. Our products, payments and money services, and onboarding processes are not designed for or directed to individuals under the age of 18.
We do not knowingly:
If we become aware that personal information has been collected from a person under the age of 18, we will:
If you believe a minor has provided us with personal information, please contact us immediately using the details provided in Section 15.
PayitFast may update or modify this Privacy Policy from time to time to reflect changes in our services, legal or regulatory requirements, industry practices, or operational needs. When updates are made, we will revise the "Last Updated" date at the top of the Policy.
We may also provide additional notice of significant changes through:
Your continued use of PayitFast's services after any changes take effect will constitute your acceptance of the updated Privacy Policy. If you do not agree with the revised Policy, you must discontinue using our services.
If you have questions, concerns, or requests relating to this Privacy Policy or the handling of your personal information, you may contact us using any of the methods below. We will respond in accordance with applicable privacy and financial regulatory requirements.
Our Privacy Officer is responsible for PayitFast’s compliance with this Policy and with applicable privacy law, including PIPEDA and Quebec’s Law 25. You may contact the Privacy Officer using the details below or by email to privacy@payitfast.com.
PayitFast (Silverleaf E-Money Services LTD) 1090 Homer Street, Suite 300 Vancouver, BC V6B 2W9 Canada
Email: privacy@payitfast.com Phone: +1 (778) 806-1367
You may also contact us to exercise your privacy rights, request additional information about our data-handling practices, or file a complaint regarding how your personal information has been managed.
Cookies
We use essential cookies to run this site. With your consent we also use Google Analytics to understand how it is used. You can change your choice at any time from Cookie Settings in the footer, or read our Privacy Policy.
