Privacy Policy for AgentsPayouts

SMTM LAB LLC ("the Company", "we"), a limited liability company organized under the laws of the State of Florida, operates the AgentsPayouts platform (the "Service"). This Privacy Policy describes how we collect, use, and protect personal information in accordance with applicable law, including the Florida Information Protection Act (FIPA), United States federal law and, where applicable, the General Data Protection Regulation (GDPR). It is an informational notice: it does not need to be accepted, but when you sign in we ask you to confirm that you have read and understood it.

1. Information we collect

1.1 Information you provide: Account data (name, email, role and profile photo, if you upload one), Agency data (commission plans, internal notes), Business data (sales records, end-client names, booking numbers, travel dates, proposals, leads and reminders), attachments (e.g., PDF receipts, vouchers, contracts or certificates, and proposal photos), the bank transactions the Agency uploads if it uses the Banks module, and Billing data (billing email and subscription payment history). Credit card data is received directly by our payment processor Stripe and is never stored on our servers.

1.2 Information collected automatically: IP address, browser and device type, authentication session cookies, the browser time zone (to show correct dates and times), sign-in logs and audit logs. If you use the mobile app and enable notifications, we store your device's push identifier and its platform (iOS or Android). When you accept or acknowledge a legal document, we record the evidence described in section 6.

1.3 Sign in with Google: If you choose to sign in with Google (when that option is available), we receive your name, email address and profile photo from Google.

1.4 End-client file data (processed on behalf of the Agency): When the Agency or its agents enter it, we also process: the client's companions or family group (name, relationship and, optionally, date of birth), which may include minors (see section 9); the passport expiration date of the client and their companions, only the date and never the passport number or the number of any other identity document; and the travel preferences and indicators selected by the Agency or derived from the recorded bookings, such as frequent providers, products, trip types, airlines or travel months. Preference fields may not be used to store medical, religious or other sensitive data. With respect to this data, the Agency acts as Data Controller and SMTM LAB LLC as Data Processor (see section 5).

2. How we use the information

We process information for the exclusive purpose of providing and securing the Service, calculating and processing commissions, sending the Service's emails and notifications, providing support, preventing fraud, complying with our legal obligations, and improving platform performance through the use of aggregated and anonymized data.

3. Legal bases and regulatory compliance

Our legal bases for data processing are the performance of a contract, our legitimate interest, compliance with legal obligations and, for analytics cookies, your consent. FIPA compliance: We apply reasonable technical and administrative safeguards under Florida Statute § 501.171 to protect personal information and follow the data breach notification procedures that statute requires.

4. How we share information and sub-processors

SMTM LAB LLC does not sell personal information. We share data only with providers that deliver technical services to us (sub-processors), under agreements that require confidentiality and security: Supabase, Inc. (database, authentication and file storage), Vercel, Inc. (hosting and execution of the application, and cookieless traffic analytics), Cloudflare, Inc. (DNS, content delivery, perimeter protection, Turnstile CAPTCHA and email routing), Resend (transactional email), Functional Software, Inc. — Sentry (error monitoring, configured not to send personal data by default), 650 Industries, Inc. — Expo (push notifications to the mobile app through Apple and Google services; it receives the device identifier and the notification content, which may include end-client names), Google LLC — Google Drive (storage of encrypted backups) and Workblok (support ticket management, limiting data to the requester's name, email, and agency name, and the ticket content). This is the same list as Annex III of the Data Processing Agreement.

In addition, SMTM LAB LLC uses these providers for its own purposes: Stripe, Inc. (payment processing and subscription management; card data is received and held directly by Stripe under PCI-DSS certification and never passes through our servers) and Google LLC (Sign in with Google, if you choose it, and Google Analytics 4 for usage statistics and conversion measurement — see section 11). Some screens load third-party content directly in your browser, which therefore receives your IP address: provider logos (logo.dev), maps (OpenStreetMap) and help videos (YouTube, in its no-cookie mode).

Multi-tenant relationship: AgentsPayouts operates on a multi-tenant architecture. The administrators of each Agency access the data entered by agents within their own Workspace, and the database's row-level security policies keep each Agency's data separate.

Support access: To resolve a request or an incident, SMTM LAB LLC support staff may access an Agency's account in "View as" mode. Each access requires a reason, is logged and expires after 60 minutes, and any changes made are identified as made by AgentsPayouts support.

5. Roles in the processing of data

With respect to the data of travelers and end clients processed on behalf of and under the instructions of the Agency, the Agency acts as Data Controller and SMTM LAB LLC as Data Processor. The Agency is responsible for having a valid legal basis and for providing the privacy notices and obtaining the consents or authorizations that may be required. SMTM LAB LLC may act as an independent Controller with respect to the data it processes to manage accounts, billing, security, fraud prevention, audit logs and compliance with its own legal obligations.

The processing that SMTM LAB LLC carries out on behalf of the Agency is also governed by the Data Processing Agreement accepted by each Agency (or by each independent agent, who is their own Customer).

6. International transfers and data retention

Data is stored mainly on infrastructure located in the United States: the database and files, in our provider's United States region. Some services, such as Cloudflare's network or push notification delivery, operate on global infrastructure. Where applicable law requires a mechanism for international transfers (for example, for data subject to the GDPR), the Standard Contractual Clauses approved by the European Commission are incorporated, where applicable, through the Data Processing Agreement accepted by each Agency.

Retention: We keep the contractual, billing and accounting records of our relationship with each Customer for the period required by our legal, tax and corporate obligations, generally six (6) years after the relationship ends. The data of travelers and end clients that we process on behalf of the Agency is returned or deleted under the Data Processing Agreement when the Service ends. After those periods, we delete or de-identify the data.

Evidence of acceptance of legal documents: When you accept or acknowledge a legal document, we record your user, the Agency, your role, the document, the version, a digital fingerprint (SHA-256 hash) of the exact text of that version, the language, the date and time (UTC), your IP address, your browser or device (user agent) and, where applicable, the statement of authority to bind the Agency. We keep this evidence for six (6) years from the end of the relationship or from the last relevant acceptance, whichever is later, unless we must keep it because of a legal obligation or a dispute; afterwards we delete or anonymize the personal identifiers.

7. Your rights

Depending on the applicable jurisdiction (Florida, CCPA/CPRA in California, or GDPR in the EEA), you have the right to request access, rectification, deletion (right to be forgotten), or portability of your data. To exercise your rights or ask privacy questions, write to privacy@agentspayouts.com. If your data was uploaded by an Agency, which is the Controller of that data, we will refer you to it or help it respond.

8. Information security

We apply reasonable technical and organizational measures, including: TLS encryption in transit, encryption at rest provided by our infrastructure providers, row-level security (RLS) in the database to keep each Agency's data separate, available two-factor authentication, CAPTCHA protection on sign-in and public forms when enabled, and encrypted backups. No system is completely secure: SMTM LAB LLC cannot guarantee absolute security against unlawful third-party interventions and limits its liability to the maximum extent permitted by law. To report a security incident, write to security@agentspayouts.com.

9. Data of minors

AgentsPayouts is not directed to minors and does not allow minors to create accounts. However, the platform may process limited data of minors included in travel bookings uploaded by an authorized Agency.

In such cases, the Agency must have a valid legal basis and ensure that the data has been provided by a parent, guardian, legal representative or adult legally authorized to manage the booking, as appropriate under applicable law. The data must be limited to what is reasonably necessary to manage the trip.

10. Legal contact

SMTM LAB LLC
9826 Introduction Way, Orlando, FL 32832, United States
General enquiries: info@agentspayouts.com
Privacy and data requests: privacy@agentspayouts.com
Security incidents: security@agentspayouts.com

11. Cookie Policy

We use strictly necessary cookies for the operation of the Service. They cannot be disabled in our systems.

Additionally, and only with your explicit consent through the cookie banner, we use Google Analytics 4 analytics cookies. If you do not accept them, they are not installed: the Google Analytics script runs in restricted mode (Google Consent Mode), without cookies or persistent identifiers, and may send Google basic technical signals such as your IP address and browser. Vercel traffic analytics work without cookies. If you accept analytics cookies, when you sign up we associate the identifier from the Google Analytics “_ga” cookie with your account so that we can notify Google, from our servers, when your subscription becomes paid. We do not send your name, email, or payment data.

We honor the Global Privacy Control (GPC) and Do Not Track (DNT) privacy signals: if your browser emits them, we do not install analytics cookies or store the Google Analytics identifier, even if you previously accepted analytics cookies.

We also use the browser's local storage (localStorage and sessionStorage) for preferences and features: your cookie consent choice, the visual theme (light/dark), interface settings (for example, kiosk mode or notices you dismissed) and drafts of forms you have not submitted yet. This information stays on your device and is not transmitted to third parties.