1. Who is responsible for your data
This Privacy Policy explains how RT collects, uses, shares, and protects personal data when you visit rt.app, apply for an account, sign in to the RT dashboard, or use RT APIs and products. The controller of your personal data depends on where the business you represent is established, or where you are located if you are only visiting the site:
Percentagem Envolvente, Lda.
Private limited company (sociedade por quotas) registered in Portugal. Contracting entity and data controller for businesses established in the European Union and European Economic Area.
RealtimePay Inc.
Contracting entity and data controller for businesses in the United States and every other supported region outside the EU and EEA.
For visitors, applicants, and customers in the European Union and European Economic Area, the controller is Percentagem Envolvente, Lda. (Portugal). For everyone else, the controller is RealtimePay Inc. You can contact either controller at privacy@rt.app.
2. Personal data we collect
- Application and identity data: name, role, work email, phone, business details, beneficial ownership, and the identity documents and checks required for KYB, KYC, and sanctions screening.
- Account and transaction data: balances, transfers, payments, cards, counterparties, invoices, disputes, and statements.
- Agent and API data: agent permissions, rules, payment requests, API keys metadata, webhook and integration logs.
- Device and usage data: IP address, browser, device identifiers, sign-in events, and pages viewed, used for security and service improvement.
- Communications: messages you send us and records of support interactions.
We collect data from you, from the business you represent, from our regulated infrastructure partners, and from identity verification, fraud prevention, and sanctions screening providers.
3. How we use personal data and our legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Opening, operating, and supporting your account and the Services | Performance of a contract |
| KYB, KYC, anti-money laundering, sanctions, tax, and record-keeping obligations | Legal obligation |
| Fraud prevention, AI risk screening, security, and protecting funds | Legitimate interests and legal obligation |
| Improving and developing the Services, analytics, and reporting | Legitimate interests |
| Product updates and marketing emails | Consent, which you can withdraw at any time |
Where we rely on legitimate interests, we balance them against your rights. You can ask us for details of that assessment.
4. Automated decisions and AI
We use automated tools, including AI models, to score payment risk, route payments, and flag unusual activity. Where an automated decision would significantly affect you or your business, such as declining an application or closing an account, you can ask for human review, express your point of view, and contest the decision by contacting privacy@rt.app.
6. International transfers
Some recipients, including RealtimePay Inc. and certain service providers, are located outside the EU and EEA. When we transfer personal data from the EU or EEA, we use safeguards recognised under the GDPR, such as adequacy decisions, the EU–US Data Privacy Framework where the recipient is certified, or the European Commission’s Standard Contractual Clauses, together with additional measures where needed. You can request a copy of the relevant safeguards.
7. How long we keep data
We keep personal data only as long as needed for the purposes above. Customer due diligence and transaction records are kept for the period required by anti-money laundering law, which for EU and EEA customers of Percentagem Envolvente, Lda. is generally seven years after the end of the business relationship under Portuguese law. Marketing preferences are kept until you withdraw consent. Website analytics data is kept for up to 26 months.
8. Your rights
Depending on where you are, you may have the right to access, correct, delete, or port your personal data, to restrict or object to processing, and to withdraw consent at any time. Some rights are limited where we must keep data by law, for example for anti-money laundering records.
To exercise your rights, email privacy@rt.app. We will respond within one month, which may be extended where the law allows.
Supervisory authority. If you are in the EU or EEA, you can complain to the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD), at www.cnpd.pt, or to the authority in your own country.
United States. Residents of US states with privacy laws, such as California, may have similar rights to know, correct, delete, and opt out. We do not sell personal data or share it for cross-context behavioural advertising.
9. Cookies and similar technologies
rt.app uses strictly necessary cookies and local storage to keep you signed in, remember preferences, and protect forms from abuse. We use analytics cookies only where permitted, and with your consent in the EU and EEA. You can control cookies through your browser settings.
10. Security
We protect personal data with encryption in transit, access controls, two-factor authentication, monitoring, and staff confidentiality obligations. No system is completely secure, so please keep your credentials safe and report concerns to security@rt.app.
11. Children
The Services are for businesses and are not directed to anyone under 18. We do not knowingly collect personal data from children.
12. Changes to this policy
We may update this Privacy Policy from time to time. We will post the updated version here with a new “Last updated” date and notify customers of material changes by email or in the dashboard.
13. Contact
Privacy requests and questions: privacy@rt.app
Legal questions: legal@rt.app
See the Legal notice for full details of each RT entity.
Questions about this document? Contact legal@rt.app. For privacy requests, contact privacy@rt.app.