VaPay Privacy Policy

Effective date: July 2, 2026  |  Last updated: July 2, 2026

VaPay Technologies Inc. ("VaPay," "we," "us," or "our") provides a mobile and web application for global money transfers, multi-currency wallets, currency exchange, and stablecoin (USDC/USDT) payments (the "Service"). This Privacy Policy explains what information we collect, how we use and share it, and the choices and rights you have. By creating an account or using the Service, you agree to the practices described in this policy.

VaPay is a financial technology company, not a bank. Banking services are provided by our licensed partner financial institutions, and stablecoin services rely on third-party issuers (Circle for USDC, Tether for USDT) and public blockchain networks. Because we operate a regulated money-transmission and payments service, we are required by law to collect certain information for identity verification, fraud prevention, and anti-money-laundering (AML) compliance.

1. Information We Collect

1.1 Information you provide to us

• Account & identity information: name, date of birth, email address, phone number, mailing address, government-issued ID (e.g., passport, driver's license), Social Security Number/Social Insurance Number or equivalent tax ID, and a photo or video for identity verification (KYC), as required by law.
• Financial information: bank account and routing numbers, debit/credit card details, and information about linked payment sources.
• Transaction information: details of transfers, currency conversions, stablecoin purchases/sales, payment links you create, and recipient/sender information you provide.
• Communications: messages you send to customer support, survey responses, and other feedback.

1.2 Information collected automatically

• Device information: device model, operating system, unique device identifiers, IP address, mobile network information, and app version.
• Usage data: features used, pages viewed, session duration, crash logs, and diagnostic data.
• Location information: approximate location (derived from IP address) and, if you enable it, precise device location, used for fraud prevention and regulatory compliance (e.g., confirming you are transacting from a permitted jurisdiction).
• Biometric authentication data: if you enable Face ID/Touch ID or similar, authentication is handled by your device's operating system; VaPay does not receive or store your biometric data itself.

1.3 Information from third parties

• Identity verification and fraud-screening providers.
• Banking partners and payment processors (e.g., Plaid, for securely linking bank accounts).
• Stablecoin issuers and blockchain networks (Circle/USDC, Tether/USDT).
• Card networks and payment processors (e.g., Visa, Stripe).
• Credit bureaus or sanctions/watchlist screening services, where required for compliance.

2. How We Use Your Information

We use the information described above to:

• Create and manage your account, verify your identity, and enable transfers, currency exchange, and stablecoin transactions;
• Process payments and route funds through our banking and payment partners;
• Detect, investigate, and prevent fraud, unauthorized transactions, and other illegal activity;
• Comply with legal and regulatory obligations, including KYC, AML, sanctions screening, and record-keeping requirements imposed by financial regulators;
• Provide customer support and respond to your requests;
• Improve, personalize, and troubleshoot the Service;
• Send transactional notifications (e.g., confirmations, security alerts) and, where permitted, marketing communications;
• Enforce our Terms of Service and protect the rights, property, and safety of VaPay, our users, and others.

3. Legal Bases for Processing

Where applicable law requires a legal basis (for example, under the GDPR for users in the UK/EU), we rely on: performance of a contract with you (providing the Service), compliance with legal obligations (KYC/AML/tax reporting), our legitimate interests (fraud prevention, service improvement), and, where required, your consent (e.g., for certain marketing or location features), which you may withdraw at any time.

4. How We Share Information

We do not sell your personal information. We share information only as follows:

• Banking and payment partners: licensed banks, card networks, and processors that execute transfers, currency exchange, and card transactions on your behalf.
• Stablecoin and blockchain service providers: Circle, Tether, and blockchain infrastructure providers needed to process stablecoin transactions.
• Identity verification and compliance vendors: to perform KYC checks, sanctions/watchlist screening, and fraud detection.
• Service providers: cloud hosting, customer support, analytics, and communication vendors who process data on our behalf under contractual confidentiality and security obligations.
• Regulators and law enforcement: where required by law, court order, or regulatory request, or to protect against fraud or harm.
• Business transfers: in connection with a merger, acquisition, financing, or sale of assets, subject to standard confidentiality protections.
• With your direction: for example, when you send money to another user or share a payment link, necessary details are shared with the recipient.

5. Stablecoin & Blockchain Transactions

Stablecoin transfers (USDC/USDT) are recorded on public blockchain networks. Blockchain transaction data — including wallet addresses and transaction amounts — is, by design, publicly visible and permanent, and is not controlled by VaPay. While blockchain addresses are not inherently linked to your real-world identity, VaPay maintains internal records connecting your account to your transactions for compliance and security purposes. Please be aware that blockchain data cannot be deleted or altered once recorded.

6. International Data Transfers

VaPay operates across 180+ countries. Your information may be transferred to, stored, and processed in Canada, the United States, and other countries where we or our service providers operate, which may have different data protection laws than your home country. Where required, we use appropriate safeguards (such as standard contractual clauses) for cross-border transfers.

7. Data Retention

We retain personal information for as long as your account is active and as necessary to provide the Service. Financial and identity-verification records are retained for the period required by applicable money-transmission, AML, and tax regulations (commonly five to seven years after account closure), even after you close your account. We retain other information only as long as needed for the purposes described in this policy, or as required by law.

8. Security

We use administrative, technical, and physical safeguards designed to protect your information, including AES-256 encryption at rest, TLS 1.3 encryption in transit, 24/7 automated fraud monitoring, and SOC 2 Type II-audited controls. No system is completely secure, and we cannot guarantee the absolute security of your information. If you believe your account has been compromised, contact us immediately at the email below.

9. Your Rights & Choices

Depending on where you live, you may have the right to:

• Access, correct, or update your personal information;
• Request deletion of your personal information, subject to our legal and regulatory record-keeping obligations;
• Object to or restrict certain processing, and withdraw consent where processing is based on consent;
• Request a copy of your data in a portable format;
• Opt out of marketing communications at any time via the unsubscribe link or your in-app notification settings;
• Lodge a complaint with your local data protection authority.

To exercise these rights, contact us using the details in Section 14. We will verify your identity before fulfilling your request and may need to retain certain information to comply with legal obligations, such as AML recordkeeping.

10. Cookies & Tracking

Our website and app use cookies, SDKs, and similar technologies to keep you signed in, remember preferences, measure performance, and detect fraud. You can control cookies through your browser settings and manage app tracking permissions through your device settings (e.g., iOS App Tracking Transparency).

11. Children's Privacy

The Service is not directed to, and may not be used by, anyone under the age of 18. We do not knowingly collect personal information from children. If we learn that we have collected information from a person under 18, we will delete it and close any associated account.

12. Regional Disclosures

Canada (PIPEDA)

We collect, use, and disclose personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws. You may contact our Privacy Officer using the details below to ask questions or exercise your rights.

European Union / United Kingdom (GDPR/UK GDPR)

If you are located in the EU/UK, you have the rights described in Section 9, and you may lodge a complaint with your local supervisory authority. Our legal bases for processing are described in Section 3.

California (CCPA/CPRA)

California residents have the right to know what personal information we collect and share, to request deletion, to correct inaccurate information, and to opt out of the "sale" or "sharing" of personal information. VaPay does not sell personal information for money. We do not knowingly sell or share the personal information of consumers under 16 years of age.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will post the updated policy with a new "Last updated" date and, for material changes, provide additional notice (such as an in-app notification or email).

14. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your personal information, contact us at:

VaPay Technologies Inc.
Email: support@vapay.ca