Privacy policy

1. Who we are

NMS.io is the NUMUS Merchant Systems website of Numus Payments LLC ("NUMUS," "we," or "us"). This policy explains how we handle information collected through this website and its processing inquiries.

Separate merchant applications, acquiring banks, payment processors, and other providers may have their own privacy notices. Review those notices when you use their services or submit a full application.

2. Information we collect

Information you provide. Our short processing inquiry asks for your name, email address, phone number, business name, business website or social-media profile (required; you may enter N/A if unavailable), industry, country, monthly card-volume range, current processing status, processing needs, and permission to follow up. Campaign-specific forms may also ask about your current processor and main processing priority. We also receive information you provide when you contact our team.

Inquiry records. We record a submission identifier, receipt time, and the form and contact-permission version associated with an inquiry. Referral and campaign information, including campaign, ad-set, and ad identifiers when present, may accompany your request. When you use a processing-review link, your inquiry may also include that page’s identifier and permalink, its resource topic, the link identifier and placement, and the destination form. These details help our team understand the context of your request; browser-reported attribution is not proof of how you found us.

Website and security information. Website delivery and abuse prevention involve technical information such as request details, IP addresses, and browser information. Our inquiry service uses a derived identifier for rate limiting. Hosting and other service providers may maintain their own operational logs.

Optional measurement. If you allow analytics, Google Analytics measures page visits, form progress, saved inquiries, and general contact or application clicks. Vercel Speed Insights measures website performance on supported pages. Our measurement events do not include the answers you enter in the inquiry form. Advertising measurement is enabled by default unless you opt out or your browser sends Global Privacy Control. Meta Pixel measures page visits and confirmed saved inquiries using standard PageView and Lead events. Meta receives page/referral information, permitted campaign and advertising-click identifiers, browser/device and network information such as IP address, cookies, and an opaque inquiry-event identifier used to avoid duplicate counts. When advertising measurement is enabled for an inquiry, including under the default policy, our server also sends a Lead event through Meta’s Conversions API with normalized, SHA-256-hashed email and phone details, the event identifier and receipt time, a public page address, IP address and browser information, and available advertising-click and browser identifiers. Hashing does not make matching information anonymous. We do not send business names, industries, processing volumes, free-text answers, documents, or other business details to Meta. Browser and server events share an identifier to avoid duplicate counts.

For the two-step form at NMS.io/lead, advertising measurement can also record successful business-detail completion, the start of a linked merchant application, and its accepted submission. These application milestones are sent by our server; the full application does not load the Meta Pixel. A secure, opaque first-party cookie links the saved inquiry to an application started in the same browser within seven days. Matching context, including hashed email and phone and available browser/click identifiers, is retained for up to seven days, subject to scheduled cleanup. IP address and browser information are supplied with the current request and are not kept in that longer-lived matching context. New milestone events require current advertising-preference evidence. A decline or Global Privacy Control received with a later funnel request suppresses further measurement for that linked funnel. Bank statements, identity documents, account numbers, income, application answers, processing volumes, and approval decisions are not sent to Meta. These funnel events use the site domain without URL paths or query strings, and do not include custom business parameters.

3. How we use information

• Respond to inquiries and help you explore merchant processing options.
• Maintain inquiry records, route requests to our team, and coordinate follow-up.
• Understand which pages or campaigns led to an inquiry.
• Operate, maintain, and protect the website and prevent abusive submissions.
• Measure website use and performance when you allow optional analytics.
• Measure visits, confirmed inquiries, and linked application milestones associated with our Facebook and Instagram advertising under the separate advertising preference described here.
• Handle requests, disputes, and applicable legal or recordkeeping obligations.

Permission to respond to a processing inquiry is not a blanket agreement to unrelated marketing. Any separate marketing choices should be described where they are requested.

4. Service providers and other recipients

We use service providers to operate this website and manage inquiries. These include Vercel for hosting and server functions, Supabase for inquiry storage, and GoHighLevel for customer relationship management and sales follow-up. Inquiry information is copied into our CRM for handling by our team. With your analytics choice, Google and Vercel also receive the measurement information described above. Unless advertising measurement is declined or blocked by Global Privacy Control, Meta receives the Pixel and server-side Conversions API event and matching information described above. Meta may associate information from its business tools with other information it holds for measurement and advertising under its own policies. Our inquiry service sends the selected measurement information; it does not export the CRM contact or opportunity record.

If you proceed with a merchant application or request a provider review, relevant application information may need to be provided to acquiring banks, independent sales organizations (ISOs), or other processing providers involved in that request. Their application instructions, agreements, and privacy notices govern their own handling of that information.

We may also disclose information where required by law or where reasonably necessary to address fraud, security incidents, legal claims, or protection of rights.

Service providers may process information in the United States or other countries where they operate. Applicable privacy laws and protections may differ by location.

5. Cookies, analytics, and your choices

You can allow or decline optional analytics and change your choice using Analytics preferences in the footer. Your inquiry works either way. Use Advertising preferences for the separate Meta Pixel and Conversions API choice. Advertising measurement is on by default; neither a processing inquiry nor analytics permission is recorded as an advertising opt-in. Advertising preferences stay in the footer and open only when you choose to open them; no advertising-choice popup appears automatically. Allow and Decline are equally available. The default includes the hashed email and phone matching described above, without recording a pretend opt-in or choice timestamp. Saved advertising opt-outs, including earlier-version declines, remain effective without an expiry until you explicitly allow measurement again or clear the saved preference. Analytics preferences still open when requested. If your browser sends Global Privacy Control, optional advertising measurement stays off. Advertising withdrawal stops subsequent browser events and sharing for new inquiries. A previously submitted inquiry retains its recorded measurement state, and an already queued or in-flight event may complete. Withdrawal does not delete records already received by Google, Meta, Vercel, NUMUS, or the CRM. Clearing site storage removes saved preferences: analytics returns to off, while advertising measurement returns to its default enabled state unless Global Privacy Control applies. You can use Advertising preferences to decline again.

Separately, the site keeps first-visit referral and campaign information for the browser-tab session and includes it with a submitted inquiry. That session attribution operates independently of the analytics choice. A separate, short-lived record carries the page and link context when you click a processing-review link to the inquiry form. It is valid for up to 15 minutes and is cleared after a confirmed inquiry receipt or when the handoff no longer matches the page being used. It does not collect a browsing history. Read our Cookies & Analytics page for the storage details and controls.

Meta describes its practices in Meta’s Privacy Policy (opens in a new tab). Google explains its processing in How Google uses information from sites or apps that use its services (opens in a new tab).

6. Embedded forms and other websites

Our contact page includes a CRM-hosted form at api.crm.accufy.net. Loading or using that form connects your browser to its provider, independently of the NMS analytics choice, and the provider may use its own cookies or similar technologies. Applications on go.numuspayments.com and other linked services can also have different fields, technologies, and notices. This policy’s description of our short inquiry is not a complete description of those separate services.

7. Retention and security

We retain information for as long as reasonably needed for the purposes described here, including inquiry follow-up, business records, security, disputes, and legal obligations. Retention varies by record and provider; browser preference periods are not deletion deadlines for inquiry or CRM records.

We use access restrictions and other technical measures to protect information. No internet transmission or storage system can be guaranteed completely secure.

8. Privacy requests

Depending on applicable law and your location, you may have rights to request access to, correction of, or deletion of personal information, a copy of your information, or restrictions on certain processing. Contact support@nms.io with your request and enough information for us to identify the relevant inquiry. Please do not email identity documents or other sensitive information unless we arrange an appropriate method.

We may need to verify your identity or authority before acting on a request. Rights can be subject to exceptions, including records needed for legal, security, or business obligations. We will assess requests under the law that applies.

You can also contact us to update your inquiry details or ask us to stop optional follow-up. Necessary administrative or legally required communications may still be sent.

9. Children and policy updates

This website is intended for business representatives, not children under 18. Please do not submit an inquiry on behalf of a business unless you are an adult authorized to represent it. If you believe a child has provided personal information, contact support@nms.io.

We may update this policy as the website or our practices change. The revised policy and its update date will appear here.