Privacy Policy

1. Scope and roles

This policy applies to payway.jlastore.com, its public API, hosted checkout pages, and related support. It does not govern a merchant's website, the ABA Mobile app, ABA Bank, or ABA PayWay.

A merchant decides which transaction information and callback URLs to submit and is responsible for its own customer notices and lawful use of personal information. JLA Store handles submitted information to provide and protect the JLA Payway service.

2. Information we collect

Information submitted by merchants

• Transaction reference, amount, and ABA Payway data or Payment Link.
• Optional success, cancellation, and webhook destination URLs.
• Support messages and information supplied when reporting a problem.

Transaction information received from Payway

• Payway transaction and client identifiers, status, timestamps, and expiry.
• QR payloads, payment options, and merchant or order summary data.
• Receipt and status-response information needed to confirm a payment.

Technical information

• IP address, request identifier, HTTP method and path, response status, duration, and response size.
• Security and error events needed to diagnose failures and attempted misuse.

Request bodies are not written to operational logs by default. Fields required to create, reuse, display, and check a transaction are stored in transaction-reference records.

3. How we use information

• Create payment requests and hosted checkout pages.
• Prevent duplicate transactions when the same reference is reused.
• Check payment status and deliver merchant-requested webhooks.
• Operate, secure, troubleshoot, and improve service reliability.
• Investigate misuse, resolve disputes, and meet lawful obligations.

We do not sell personal information or use transaction data for third-party advertising.

4. When information is shared

Information may be shared only as reasonably needed with:

• ABA Bank and ABA PayWay to create and confirm the requested payment.
• The merchant's chosen destinations when redirecting a customer or delivering a webhook.
• Hosting and technical providers that process information on our behalf to operate the service.
• Authorities or advisers when required by law or necessary to protect users, the service, or legal rights.

A merchant controls its submitted callback URLs. Customers and developers should review the merchant's privacy notice before following those links.

5. Retention

Operational log files are normally retained for 14 days. Transaction reference records are retained for as long as reasonably needed to provide status checks, prevent duplicate creation, investigate disputes, maintain security, and satisfy applicable accounting or legal duties.

The current service does not automatically expire transaction-reference records. They are removed through administrative maintenance when no longer reasonably required. Retention may be longer when a dispute, fraud review, legal hold, or regulatory requirement applies.

6. Security

We use access controls, restricted administration routes, request-size limits, input validation, sensitive-field log redaction, and HTTPS in production. No internet transmission or storage system is completely secure, so absolute security cannot be guaranteed.

Merchants must keep API administration credentials private and should never submit ABA credentials, customer passwords, or one-time passwords.

7. Your choices and requests

Subject to identity verification and applicable legal or transaction record requirements, you may ask whether we hold information connected to you and request access, correction, or deletion. Merchants should identify the relevant transaction reference when making a request.

This site does not use advertising or analytics cookies. A third-party payment page or app may use its own storage under its separate policy.

8. ABA and other third-party services

JLA Payway is an independent integration service. It is not ABA Bank or ABA PayWay. ABA Bank and ABA PayWay process payment information under their own agreements and privacy practices.

9. Changes to this policy

We may update this policy when the service, data practices, or legal requirements change. The current version and effective date will be posted on this page. Material changes will apply prospectively unless applicable law requires otherwise.

10. Contact

For privacy requests or concerns, contact JLA Store support and include enough information to locate the relevant transaction without sending banking credentials.