Privacy Policy

This policy covers this website and the information it collects from visitors to it. Highline Payments also handles information in the course of providing merchant payment services — under agreements, and alongside banks, processors and other parties who have their own obligations. Those arrangements are governed by the documents that set them up, not by this page.

If you are a merchant asking what happens to information inside an active processing relationship, that answer is in your agreement and we would rather point you to the right clause than paraphrase it here.

The only place on this website where you can send us anything is the contact form. What it collects is what you see on it: your name, your email address, and optionally your business name, a phone number, the subject you selected and your message. Nothing is collected that is not a field on the form, and nothing on it is pre-ticked.

If the form shows an acknowledgement of these terms, your answer to it is stored with your message, together with the exact wording that was on screen when you answered — so what you agreed to is a record rather than a reconstruction.

Please do not send card numbers, bank account details, government identification numbers or anything else sensitive through the form. It is a contact form; it is not a secure channel for account data, and nothing on it asks for any of that.

To answer you, and to keep a record that you asked. A submission is stored before any notification is attempted, so a message cannot be lost to a mail problem, and it may be emailed to the address the site is configured to notify.

It is not sold. It is not passed to anybody who is not involved in responding to you. It is not used to build an advertising profile, and this website runs no advertising pixels.

Cookies. This website sets one first-party cookie, a session cookie, and it exists for two purposes: to keep a form submission attached to the right browser across the redirect that follows it, and to carry the token that protects forms against cross-site request forgery. It holds an identifier and nothing else, it is marked HttpOnly and SameSite, and it is marked Secure whenever the site is served over HTTPS. It is not an advertising or analytics cookie and it does not follow you anywhere else.

Server logs. The hosting environment keeps ordinary web-server logs, as every web server does. The application itself writes an error log for faults; that log records what went wrong rather than who was reading.

Abuse prevention. The contact form is rate limited. The limiter stores a one-way keyed digest of the connecting address — not the address — and deletes it as the window passes. The address recorded against a stored submission is deliberately truncated before it is written: for IPv4 the final part is discarded, and for IPv6 all but the first three groups. That is enough to recognize a repeated abusive source and not enough to identify a person.

Analytics. This website is built to support an analytics tag, and emits none unless one has been configured. If no analytics identifier is set in the site configuration, no analytics script is served and no analytics cookie is set.

Fonts. Where webfonts are served from a third-party font host rather than from this site, your browser makes a request to that host in order to fetch them, and that host will see the request. Fonts served from this site make no third-party request at all.

If you send us a message, we reply to the email address you gave. That is the whole of it for most people, and it is the only contact this website itself initiates.

Your phone number. The contact form has an optional phone field. If you fill it in, it is used to reach you about the inquiry you sent — the same conversation, on a different channel — and for nothing else. Leaving it blank does not stop us answering you.

Text messages. This website does not sign you up to receive text messages, and there is no box on it that does. We do not send marketing text messages to a number given through this site. If that ever changes, it will change by asking you first, in a way that makes clear what you are agreeing to — not by amending this paragraph.

Inside an active relationship. Once there is an account, communication about it — including how you are contacted and about what — is governed by the agreements that set it up rather than by this page.

This website is hosted, and its email is delivered, by service providers acting on our instructions. They process information only to provide those services.

We do not publish the list of providers on this page, because it would be the kind of statement that is accurate on the day it is written and quietly wrong six months later. If you need to know who they are for a specific reason, ask and we will tell you.

Contact submissions are kept while they are useful — to answer you, and to have a record of the conversation — and are removed when they are not. There is no fixed period stated here, because a number invented to look precise would be worse than an honest description.

The truncated address stored with a submission is kept with it. The rate-limiter's keyed digests are deleted automatically as their window passes, which is a matter of minutes.

You can ask us to delete a message you sent. Say which one, from the address you sent it from.

Form input is validated on the server, escaped on output and stored through parameterised queries. Management access to this website requires an account, is rate limited against repeated failures, and supports a second authentication factor. Where information is stored that has to be recoverable but must not be readable from a database copy, it is encrypted with a key held outside the database.

No system is perfectly secure, and this page does not claim that this one is or that it has been certified against any particular standard. It describes what is actually in place.

You can choose not to use the contact form; nothing on this website requires it. You can ask what we hold about a message you sent, ask for it to be corrected, or ask for it to be deleted.

Depending on where you live you may have specific statutory rights over your personal information. This page does not attempt to summarise the law that applies to you — it tells you what we hold and how to reach us about it, and we will deal with a request on its merits.

This website is for businesses and the people who run them. It is not directed at children, and we do not knowingly collect information from them. If you believe a child has sent us something through this site, tell us and it will be removed.

This policy changes when the website changes. The date at the top of the page is the date the wording was last amended, and the current version is always the one published here.