Privacy Policy

Last updated 19 August 2026

The short version. We collect the minimum we need to run a payment network: your phone number, a secure token representing your bank connection, and a record of your loads and payments. We never see or store your bank login credentials. We do not sell your personal information, and we do not use it for advertising.

This policy explains how Owena Labs Inc. (“Pico,” “we,” “us”) collects, uses, shares, and protects personal information in connection with the Pico payment network.

1. Information we collect

Information you give us

Your mobile phone number, which is how you create and access your account.
Optionally, an email address and notification preferences.
Anything you send us when you contact support.

Information from connecting your bank

A secure token from our payments provider that lets us initiate transfers you authorize, along with your bank’s name and the last few digits of the account.
Where you authorize it, a balance check before a load, so we can avoid overdrawing your account.

You log in through your own bank’s secure interface, operated by our payments provider. Pico never receives, sees, or stores your bank username or password, and we do not store your full account or routing number.

Information created by using Pico

Your loads, balances, payments, and which Network Stores you paid.
Device and session information — device type, browser, IP address, and the security keys used to confirm your identity.
Records showing that you authorized a specific load or payment, including the confirmation your device produced. These are important evidence if a transaction is ever disputed.

Where you confirm a payment with your fingerprint or face, that biometric is checked by your own device and never transmitted to or stored by Pico. We receive only a cryptographic confirmation that your device authorized the transaction.

2. How we use it

To open and operate your account and process loads and payments you authorize.
To confirm your identity when you sign in or authorize a transaction.
To send you service messages — sign-in codes, load confirmations, receipts, and reminders you have opted into.
To detect, investigate, and prevent fraud, unauthorized transactions, and abuse, and to manage risk.
To respond to disputes and provide evidence that a transaction was authorized.
To provide customer support and fix problems.
To understand how Pico is used in aggregate so we can improve it.
To meet our legal, regulatory, audit, and record-keeping obligations.

3. Who we share it with

We share personal information only as described here:

Our payments provider, to connect your bank, move money you have authorized, and pay Network Stores.
Network Stores, which see the amount and time of a payment made at that store and enough to confirm it. They do not receive your bank details.
Service providers who help us operate — hosting, text messaging, error monitoring, and customer support — under contracts limiting them to that purpose.
Legal and safety, where required by law, subpoena, or regulator, or to investigate fraud or protect the rights and safety of our users or ourselves.
A business transfer, if Pico or Owena Labs is involved in a merger, acquisition, or sale of assets. We will tell you if your information becomes subject to a different policy.

We do not sell personal information, and we do not share it for cross-context behavioural advertising. We do not share your data with advertisers.

4. How long we keep it

We keep account and transaction records for as long as your account is open and afterwards for as long as required by financial record-keeping law — generally at least five years from the transaction or account closure. Authorization and dispute-evidence records are kept for the period during which a transaction may be disputed and any resulting claim resolved. Support correspondence is kept for as long as needed for the matter and our ordinary business records.

5. Security

We encrypt data in transit and at rest, store bank access as revocable tokens rather than credentials, require device-based confirmation for sensitive actions, restrict internal access to staff who need it, and log administrative actions. No system is perfectly secure, but we treat financial data as the most sensitive thing we hold.

6. Your choices and rights

Text messages. Reply STOP to opt out of non-essential messages. See our Messaging Terms.
Bank connection. You can disconnect your bank account at any time in the app.
Access, correction, deletion. You may request a copy of your personal information, ask us to correct it, or ask us to delete it. Some records we must keep to comply with financial law even after account closure.
Closing your account. Contact us and we will close it and return any remaining balance to the bank account you loaded from.

California residents have rights under the CCPA/CPRA, including the right to know, delete, and correct personal information, and the right not to be discriminated against for exercising them. Residents of other states with comprehensive privacy laws have comparable rights. Some information we hold is subject to the Gramm-Leach-Bliley Act, which governs financial information and applies alongside these rights.

To make a request, email hello [at] paywithpico.com. We will verify it and respond within the time the applicable law requires.

7. Children

Pico is for adults 18 and over. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will delete it.

8. Changes

We may update this policy. The “last updated” date reflects the current version, and if a change materially affects how we handle your information we will notify you before it takes effect.

9. Contact

Owena Labs Inc.
hello [at] paywithpico.com