Privacy Policy

This policy explains what personal information KardX collects when you use our website, apps and API, why we collect it, and what we do with it.

• Account details: your name, email address, phone number and country.
• Identity verification: the result of your identity check, and which tier you have reached.
• Transactions: what moved, when, how much, and between which accounts.
• Support conversations: what you write to us and what we reply.
• Device and technical data: IP address, device type and app version, used to keep the account secure.

When you verify your identity, your documents and selfie go directly to our verification partner. They are not stored on KardX systems. What we receive back is the outcome — verified or not, and at what level.

The same is true of card details. When you add funds by card, the card number is entered on our payment provider's own page. KardX never sees or stores it.

Our engineering rules forbid writing any of the following to application logs, and the code is written to strip them:

• Full wallet addresses
• Transaction amounts
• Email addresses and phone numbers
• Anything from an identity check

Logs record identifiers and error codes, which is enough to find a problem without carrying your details around with it.

• To run your account and move money when you ask us to — this is necessary to perform our contract with you.
• To verify your identity, monitor for financial crime and keep records — this is required of us by law.
• To keep accounts secure and investigate suspected fraud — our legitimate interest, and yours.
• To answer your support messages.
• To send product news, only if you have turned that on. You can turn it off at any time in Notifications.

Security alerts — a new sign-in, a password change, an account being blocked — are always sent and cannot be switched off. Being able to silence those would help someone take an account quietly.

We share only what is needed, and only with:

• Our payment, custody, card and verification partners, so a transaction can actually happen.
• Our cloud hosting and database providers, who store the data on our behalf.
• Regulators, law enforcement and courts, where the law requires it.

We do not sell your personal information, and we do not share it for anyone else's advertising.

Financial regulation requires us to keep records of transactions and identity checks for a set period after an account closes — usually five years, longer in some countries. Support conversations and technical logs are kept for a shorter period.

This means that closing your account does not delete everything immediately: we are obliged to retain some of it.

Depending on where you live, you can ask us to:

• Give you a copy of the personal information we hold about you.
• Correct anything that is wrong.
• Delete information we are not legally required to keep.
• Stop using your information for a particular purpose.
• Send your information to another provider.

Write to info@kardx.io. We will respond within one month. If you are not satisfied, you may complain to your local data protection authority.

Our systems and our partners operate in several countries, so your information may be processed outside the one you live in. Where that happens we rely on the safeguards the law provides for such transfers.

KardX is not for anyone under 18. We do not knowingly collect information about children, and will delete it if we find we have.

If we change this policy we will update the date at the top and, for anything significant, tell you directly.

Questions: info@kardx.io. See also our Terms of Service.