Privacy Policy for AgentsPayouts

SMTM LAB LLC ("the Company", "we"), a limited liability company organized under the laws of the State of Florida, operates the AgentsPayouts platform (the "Service"). This Privacy Policy describes how we collect, use, and protect personal information in strict compliance with the Florida Information Protection Act (FIPA), the United States federal regulatory framework, and applicable international standards, including the General Data Protection Regulation (GDPR).

1. Information we collect

1.1 Information you provide: Account data (name, email, role), Agency data (commission plans, internal notes), Business data (sales records, end-client names, booking numbers, travel dates), attachments (e.g., PDFs), and Billing data (billing email and subscription payment history). Credit card data is received directly by our payment processor Stripe and is never stored on our servers.

1.2 Information collected automatically: IP address, browser type, authentication session cookies, and audit logs.

1.3 Third-party sign-in: Data strictly necessary received via Google OAuth (name, email, profile photo).

2. How we use the information

We process information for the exclusive purpose of providing and securing the Service, calculating and processing commissions, preventing fraud, complying with our legal obligations in the jurisdiction of Florida, and improving platform performance through the use of aggregated and anonymized data.

3. Legal bases and regulatory compliance

Our legal basis for data processing is the performance of a contract and our legitimate commercial interest. FIPA compliance: We implement technical and administrative safeguards under Florida Statute § 501.171 to protect personal information and adhere to the mandatory notification protocols for data breach incidents.

4. How we share information and sub-processors

SMTM LAB LLC does not sell personal information. We share data exclusively with technical sub-processors under strict confidentiality agreements: Supabase (database and authentication), Vercel and Vercel Analytics (hosting and anonymous analytics), Resend (transactional email), Sentry (error monitoring), Cloudflare (DNS/Edge Protection), Stripe, Inc. (payment processing and subscription management — card data is received and held directly by Stripe under PCI-DSS certification and never passes through our servers), and HubSpot, Inc. (customer support management, limiting data to the requester's name, email, and agency name).

Multi-tenant relationship: AgentsPayouts operates on a multi-tenant architecture. The administrators of each Agency have exclusive access to the data entered by agents within their respective Workspace.

5. Responsibility over third-party data (end clients)

The Customer (Travel Agency) acts at all times as the Data Controller with respect to the data of its travelers and end clients. It is the absolute and exclusive responsibility of the Agency to obtain informed and explicit consents from its clients before uploading any information to AgentsPayouts. SMTM LAB LLC acts solely and strictly as the Data Processor.

6. International transfers and data retention

Data is processed on infrastructures located in the U.S. For users accessing from the European Economic Area (EEA), international data transfers to our sub-processors are governed by the Standard Contractual Clauses (SCCs) approved by the European Commission. We retain business records for a period of six (6) years to comply with our tax and corporate obligations in Florida, after which the data will be permanently deleted or de-identified.

7. Your rights

Depending on the applicable jurisdiction (Florida, CCPA/CPRA in California, or GDPR in the EEA), you have the right to request access, rectification, deletion (right to be forgotten), or portability of your data. All legal requests must be directed to: [email protected].

8. Information security

We implement TLS encryption in transit, encryption at rest, row-level security (RLS) on our databases, and CAPTCHA protection. While we apply the highest industry standards, SMTM LAB LLC cannot guarantee absolute security against unlawful third-party interventions, limiting its liability to the maximum extent permitted by law.

9. Children's privacy (COPPA)

The Service is designed exclusively for corporate use by travel agencies and travel agents. We do not knowingly collect personal information from children under 13 years of age. If an Agency uploads booking data that includes information about minors, the Agency warrants that it holds the legally required parental consent.

10. Legal contact

SMTM LAB LLC
9826 Introduction Way, Orlando, FL 32832, United States
Email: [email protected]

11. Cookie Policy

We use strictly necessary cookies for the operation of the Service. They cannot be disabled in our systems.

Additionally, and only with your explicit consent through the cookie banner, we use analytics cookies. If you do not accept them, they are not installed. Vercel traffic analytics work without cookies.

We fully honor the Global Privacy Control (GPC) and Do Not Track (DNT) privacy signals; if your browser emits them, the deployment of analytics cookies is immediately blocked.

We also use the browser's local storage (localStorage) for functional preferences: your cookie consent choice, the visual theme (light/dark), and interface settings. This information stays on your device and is not transmitted to third parties.