1. Introduction
This Privacy Policy describes how Fintra Ltd, a company incorporated and registered in Hong Kong ("Fintra," "we," "us," or "our"), collects, uses, stores, and discloses personal information in connection with the fintrapay. platform and related services (collectively, the "Services").
fintrapay. is a crypto stablecoin payment gateway that enables businesses to accept, manage, and disburse stablecoin payments across multiple blockchain networks. Our Services include payment processing, custodial and non-custodial wallet infrastructure, payout and withdrawal facilitation, and an earn product for custodial account holders.
This Policy applies to all individuals who access or use our Services, including merchants, their authorised representatives, end users who interact with our payment interfaces, and visitors to our website. By accessing or using the Services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with the practices described herein, you should not use the Services.
2. Information We Collect
We collect and process the following categories of personal information in order to provide, maintain, and improve the Services:
2.1 Account Information
When you register for a fintrapay. account, we collect your full name, email address, company name, country of incorporation or residence, and login credentials. We also generate and store cryptographic API credentials associated with your account.
2.2 Transaction Data
When you create invoices, process payments, or initiate payouts or withdrawals through the Services, we collect and retain blockchain wallet addresses, transaction hash identifiers, transaction amounts and currencies, blockchain network identifiers, confirmation status, and timestamps associated with each transaction.
2.3 Technical Data
We automatically collect certain technical information when you access the Services, including your Internet Protocol (IP) address, device type and operating system, browser type and version, referring URLs, pages visited and actions taken within the platform, and cookie identifiers. This data is collected through server logs, cookies, and similar tracking technologies.
2.4 Identity Verification Data
Where applicable, and as required to satisfy our know-your-customer (KYC) and anti-money laundering (AML) obligations, we may collect government-issued identification documents, proof of address documentation, photographs or selfies for identity matching, business registration or incorporation documents, and information about the beneficial owners and directors of corporate accounts.
3. How We Use Your Information
We use the personal information we collect for the following purposes:
- Providing and maintaining the Services: To create and manage your account, process stablecoin payments, facilitate payouts and withdrawals, operate the earn product, and deliver the core functionality of the platform.
- Processing transactions: To execute payment instructions, verify transaction details, manage blockchain interactions, and maintain accurate records of all financial activity conducted through the platform.
- Fraud prevention and security: To detect, investigate, and prevent fraudulent, unauthorised, or illegal activity, to enforce our terms of service, and to protect the security and integrity of the Services and our users.
- Compliance with legal obligations: To satisfy our obligations under applicable laws and regulations, including those relating to anti-money laundering, counter-terrorism financing, sanctions compliance, tax reporting, and financial record keeping.
- Communications: To send you service-related notifications, including transaction confirmations, security alerts, account updates, and operational announcements. We may also contact you regarding material changes to the Services or this Policy.
- Platform improvement: To analyse usage patterns, diagnose technical issues, conduct internal research and development, and improve the performance, reliability, and user experience of the Services.
4. Legal Basis for Processing
We process your personal information on one or more of the following legal grounds:
- Contractual necessity: Processing is necessary for the performance of our contract with you, including the provision of the Services, the execution of transactions, and the management of your account.
- Legitimate interests: Processing is necessary for our legitimate business interests, including fraud prevention, platform security, service improvement, and the enforcement of our terms, provided that such interests are not overridden by your fundamental rights and freedoms.
- Consent: Where we rely on your consent as the legal basis for processing, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to the withdrawal.
- Legal obligations: Processing is necessary to comply with legal and regulatory obligations to which we are subject, including those imposed by financial services regulators, tax authorities, law enforcement agencies, and courts of competent jurisdiction.
5. Data Sharing and Disclosure
We do not sell your personal information to third parties. We may share or disclose your information in the following circumstances:
- Blockchain networks: Transaction data submitted to public blockchain networks (including wallet addresses, transaction amounts, and transaction hashes) becomes publicly visible and immutable by the inherent design of distributed ledger technology. We cannot control, modify, or delete information once it has been recorded on a blockchain.
- Identity verification providers: We may share identity-related information with third-party KYC and AML verification service providers who assist us in verifying customer identities and conducting due diligence checks. These providers are contractually bound to process your data solely for the purposes of providing verification services to us.
- Payment infrastructure partners: We may share limited transaction information with blockchain node providers, RPC infrastructure services, and other technical partners necessary for the execution and settlement of transactions on supported blockchain networks.
- Law enforcement and regulatory authorities: We may disclose your personal information to law enforcement agencies, regulatory authorities, courts, or other governmental bodies when we are legally compelled to do so, when disclosure is necessary to comply with a legal obligation, or when we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others.
- Corporate transactions: In the event of a merger, acquisition, reorganisation, or sale of all or a portion of our assets, your personal information may be transferred to the acquiring entity, provided that the acquiring entity agrees to be bound by obligations substantially similar to those set out in this Policy.
6. International Data Transfers
Fintra Ltd is incorporated in Hong Kong and operates infrastructure across multiple jurisdictions. Your personal information may be transferred to, stored in, and processed in countries other than the country in which you reside. These countries may have data protection laws that differ from the laws of your jurisdiction.
Where we transfer personal information across borders, we implement appropriate safeguards to ensure that your information receives an adequate level of protection regardless of where it is processed. Such safeguards may include standard contractual clauses, binding corporate rules, or reliance on an adequacy determination made by the relevant data protection authority.
By using the Services, you acknowledge that your information may be processed in jurisdictions outside your country of residence. If you have questions or concerns regarding the specific safeguards applied to cross-border transfers of your data, please contact us using the details provided in Section 13.
7. Data Retention
We retain your personal information only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following retention periods apply:
- Transaction records: Retained for a minimum of seven (7) years from the date of the transaction, in accordance with financial record-keeping obligations applicable to payment service providers.
- Account data: Retained for the duration that your account remains active, plus an additional two (2) years following account closure or deactivation, to allow for the resolution of any outstanding matters and to comply with legal obligations.
- Identity verification data: Retained for the period required by applicable anti-money laundering and know-your-customer obligations in the relevant jurisdiction, which may extend beyond the closure of your account.
- Technical and analytics data: Retained for up to twenty-four (24) months from the date of collection, unless a longer retention period is required for security investigation or legal purposes.
Upon expiration of the applicable retention period, personal information will be securely deleted or irreversibly anonymised. Please note that information recorded on public blockchain networks cannot be deleted or modified due to the immutable nature of distributed ledger technology.
8. Your Rights
Depending on your jurisdiction, you may have the following rights with respect to your personal information:
- Right of access: You may request a copy of the personal information we hold about you, together with information about how and why it is processed.
- Right to rectification: You may request that we correct any inaccurate or incomplete personal information we hold about you.
- Right to erasure: You may request that we delete your personal information, subject to certain exceptions, including where retention is required to comply with legal obligations or to establish, exercise, or defend legal claims.
- Right to restriction of processing: You may request that we restrict the processing of your personal information in certain circumstances, such as where you contest the accuracy of the data or object to its processing.
- Right to data portability: Where processing is based on your consent or contractual necessity and carried out by automated means, you may request that we provide your personal information in a structured, commonly used, and machine-readable format, or transmit it directly to another controller where technically feasible.
- Right to object: You may object to the processing of your personal information where such processing is based on our legitimate interests. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
- Right to withdraw consent: Where processing is based on consent, you may withdraw your consent at any time without affecting the lawfulness of processing carried out before the withdrawal.
- Right to lodge a complaint: You have the right to lodge a complaint with the competent data protection supervisory authority in your jurisdiction if you believe that the processing of your personal information infringes applicable data protection law.
To exercise any of these rights, please contact us at support@fintrapay.io. We will respond to your request within a reasonable timeframe and in accordance with applicable law. We may request verification of your identity before processing your request.
9. Cookies and Tracking Technologies
We use cookies and similar tracking technologies to operate, secure, and improve the Services. The categories of cookies we use include:
- Essential cookies: These cookies are strictly necessary for the operation of the Services. They enable core functionality such as authentication, session management, security features, and load balancing. The Services cannot function properly without these cookies, and they cannot be disabled.
- Analytics cookies: These cookies help us understand how users interact with the Services by collecting information about pages visited, features used, and errors encountered. This data is aggregated and anonymised where possible, and is used solely to improve the performance and usability of the platform.
- Preference cookies: These cookies remember your settings and preferences (such as language, display options, and interface customisations) so that we can provide a more personalised experience when you return to the Services.
You can manage your cookie preferences through your browser settings. Please note that disabling essential cookies may impair the functionality of the Services. For more detailed information about the specific cookies we use and how to manage them, please refer to our Cookie Policy.
10. Security Measures
We implement robust technical and organisational measures to protect your personal information against unauthorised access, alteration, disclosure, or destruction. These measures include, but are not limited to:
- Encryption: All sensitive data, including cryptographic key material, is encrypted at rest using AES-256 encryption. All data in transit is protected using TLS 1.2 or higher.
- Authentication security: API communications are authenticated using HMAC-SHA256 cryptographic signatures with timestamp-based replay protection. Administrative access requires time-based one-time password (TOTP) two-factor authentication.
- Access controls: Access to personal information is restricted to authorised personnel on a need-to-know basis. Role-based access controls and the principle of least privilege are enforced across all systems.
- Audit logging: All access to and modifications of personal information are recorded in tamper-evident audit logs. Administrative actions are logged with full attribution, including timestamps and IP addresses.
- Infrastructure security: Our infrastructure is protected by firewalls, intrusion detection systems, rate limiting, and regular security assessments.
While we take all reasonable precautions to protect your information, no method of transmission over the Internet or method of electronic storage is completely secure. We cannot guarantee the absolute security of your personal information.
11. Children's Privacy
The Services are not directed at, and are not intended for use by, individuals under the age of eighteen (18). We do not knowingly collect personal information from children. If we become aware that we have inadvertently collected personal information from an individual under the age of eighteen, we will take reasonable steps to promptly delete such information from our records.
If you are a parent or guardian and believe that your child has provided personal information to us, please contact us at support@fintrapay.io so that we can take appropriate action.
12. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make material changes to this Policy, we will notify you by posting the revised Policy on the Services with an updated "Last updated" date, and where appropriate, by sending a notification to the email address associated with your account.
We encourage you to review this Policy periodically to remain informed about how we protect your information. Your continued use of the Services following the posting of a revised Privacy Policy constitutes your acceptance of the changes.
13. Contact Information
If you have any questions, concerns, or requests regarding this Privacy Policy or our data protection practices, please contact us:
We will endeavour to respond to all enquiries within thirty (30) days of receipt.