Enterprise Privacy Policy

1. Scope and Architecture

This Privacy Policy describes how the Collections Copilot autonomous accounts receivable system ("Collections Copilot", "the Service") processes, stores, and protects transaction data, merchant information, and client communications within enterprise deployments integrated with the PayPal Orders v2 and Payments v2 APIs.

2. Data Processed by the Autonomous Engine

• Accounts Receivable Records: Invoice identifiers, outstanding balances, currencies, due dates, aging buckets, and settlement receipts.
• Client Communication Metadata: Delivery timestamps, recipient addresses, chasing channel records (Email, SMS, Webhook), and adaptive tone ladder history.
• Dispute Evidence Artifacts: Signed merchant fulfillment documents, carrier tracking digests, delivery attestations, and cryptographic evidence manifests.
• Contractor Disbursement Records: Tax identifiers, verified payout handles, revenue allocation percentages, and batch settlement logs.

3. Cryptographic Merkle Audit Ledger

All automated decisions, policy escalations, and human approvals are permanently recorded in an append-only cryptographic Merkle audit chain with SHA-256 hash chaining. Ledger entries contain zero raw credentials or unencrypted payment card information and are retained for enterprise compliance and auditability.

4. Third-Party API Integration and Data Sharing

The Service communicates exclusively with authenticated PayPal REST endpoints using mutual TLS and bearer token credentials. Data is never sold, shared with advertising networks, or transferred to unvetted external systems.

5. Data Retention and Deletion

In accordance with financial compliance mandates, operational transaction logs are maintained for seven (7) years following invoice settlement. Tenant organizations maintain sovereign rights to request complete data extraction upon termination of service.

6. Security and Access Governance

Dual-key authorization is mandatory for disbursements, settlement write-offs exceeding threshold ceilings, and policy modifications. All operator access requires multi-factor authentication and role-based access control (RBAC).

7. Contact and Data Protection Officer

For inquiries regarding enterprise data privacy, cryptographic ledger verification, or compliance certifications, contact our Data Protection Office at dpo@collections.paypal.com.