Scope reduction
Card data is captured directly by PCI DSS validated third-party processors. Sensitive authentication data and full card numbers are never stored, processed, or transmitted by our application unless and until it is properly certified to do so.
Tokenization
Saved payment methods are represented by processor-issued tokens that cannot be used outside our processor account.
Encrypted transmission
All payment interactions occur over encrypted connections using current TLS.
Third-party processors
Our processors maintain their own PCI DSS attestations, which we review during vendor onboarding and periodically thereafter.
Fraud, chargebacks, and refunds
Fraud screening, chargeback handling, and refund processing follow the Payment Terms and Refund Policy.
Changes to this document
We may update this document as our services, technology, and legal obligations evolve. Material changes are published with a new version number, an updated effective date, and a summary of changes in the version history below.
Continued use of our websites, products, services, experiences, or communities after an update takes effect constitutes acceptance of the current version.
Contact
Questions about this PCI DSS Compliance Statement may be sent to our legal and compliance contact through the contact form on this site. Please reference the document title and version number.
- Legal & compliance requests: use the Contact Legal link on this page
- Privacy and data rights requests: see the Consumer Privacy Rights policy
- Accessibility accommodations: see the Accessibility Statement
Review notice
This document is a high-quality draft template prepared for review. It is not legal advice and no guarantee of compliance is made or implied. Final responsibility for legal sufficiency rests with the organization's licensed legal counsel.
Enterprise payment questions?
We will share our processor attestations and payment data flow on request.