Privacy Policy

Last Updated

July 4, 2026.

Information We Collect

We collect only the information required to provide payment orchestration, authentication, fraud prevention, audit logging, and regulated verification services for users and enterprise customers.

Google Sign-In Data Accessed

When a user selects Google Sign-In, Smith-Heffa Paygate requests only the standard Google OAuth scopes openid, email, and profile. Through those scopes, Google may provide the user's Google account email address, display name, unique Google account identifier, and basic profile metadata such as a profile image.

Smith-Heffa Paygate uses Google account data only to identify the user, create or match a local account, complete a secure login session, and record a security audit event for the sign-in action. Our application does not request access to Gmail, Google Drive, Google Calendar, Google Contacts, or any other restricted or sensitive Google API scope.

How We Use Data

Data is used to authenticate users, route payment intents, protect sessions, comply with security and regulatory obligations, and improve service reliability.

How Google User Data Is Stored

For Google-authenticated users, we store only the minimum data required for account operations inside Smith-Heffa Paygate, which can include the user's email address, display name, the fact that Google was used as the authentication provider, an internal session record, and a security audit log entry related to the sign-in event.

We do not intentionally store Google passwords. We do not intentionally retain Google refresh tokens for long-term offline access in this sign-in flow. We do not sell Google user data.

How Google User Data Is Shared

Google user data is shared only when necessary to operate the service, maintain security, or comply with applicable law. This may include trusted infrastructure, authentication, hosting, logging, and compliance subprocessors acting on our behalf under confidentiality and security obligations. We do not use Google user data for advertising or data brokerage.

AI / Model Training Disclosure

Google user data obtained through Google Sign-In is not used to train generalized artificial intelligence or machine learning models.

Third-Party Services

Depending on the selected flow, Smith-Heffa Paygate may interact with providers such as Google, Interac, Stripe, PayPal, Apple, telecom operators, and banking or identity verification partners.

Security

We apply session hardening, transport encryption, access controls, signed audit trails, and least-privilege operational practices to protect data.

User Controls

Users may choose not to use Google Sign-In and instead use other supported authentication methods where available. Users may also contact Buttertech Inc. to request account review, correction, or deletion, subject to legal, security, and financial record retention requirements.

Contact

For privacy requests or compliance questions, contact Buttertech Inc. via buttertech.io.