HERLINE – PCI DSS COMPLIANCE STATEMENT

Herline Ltd is committed to protecting users' financial data and ensuring that every transaction made through our platform is processed safely, transparently, and in full alignment with the Payment Card Industry Data Security Standard (PCI DSS).

Herline does not directly store or process any payment-card information on its own servers.

All payments, including the purchase of gems or premium features, are handled through our certified payment partners such as Stripe, which maintain PCI DSS Level 1 Service Provider status — the highest level of certification available.

• Transactions are conducted using HTTPS / TLS 1.2+ encryption.
• Cardholder information is tokenised by Stripe, meaning sensitive data never touches Herline's infrastructure.
• Stripe's systems are independently audited and comply with PCI DSS Version 4.0.
• All payment communications between Herline and Stripe are authenticated and encrypted.

Herline Ltd:

• Requires all employees and contractors with payment-related access to use multi-factor authentication;
• Restricts access to financial data strictly on a need-to-know basis;
• Conducts periodic internal reviews of payment flows;
• Ensures that all subcontractors handling payment integrations also comply with PCI DSS requirements.

We do not collect, view, or retain full card numbers, CVV codes, or bank details.

Users' payment information is securely stored and processed only by our PCI-certified partners.

Any data shared with Herline (e.g., transaction IDs or receipts) is used solely for record-keeping, dispute resolution, and fraud prevention.

If Herline becomes aware of a payment-related security issue, we will:

1. Notify affected users promptly;
2. Work directly with Stripe's PCI DSS compliance team;
3. Inform relevant regulatory authorities if required under law;
4. Take immediate steps to mitigate and resolve the issue.

Herline Ltd continually monitors updates to PCI DSS standards and will adjust its systems, policies, and training accordingly.

Our partners' compliance certificates are reviewed annually to ensure continued adherence to the highest security practices.

If you have questions about this statement or our payment-security practices, please contact: [email protected]