Privacy Policy

• Account data: name, email address, mobile number, referral details.
• Identity verification data: the type of ID, name and date of birth as printed, the last 4 characters of the ID number, images of your ID (front and back), a selfie, short live camera frames and a short video with sound recorded during the face and liveness check (in which you read your name and date of birth aloud), and the verification result.
• Payment data: UPI IDs and bank account details you save (account numbers are encrypted), payment references and proofs you upload.
• Transaction data: orders, deposits, withdrawals, wallet addresses, blockchain transaction hashes and ledger entries.
• Security and device data: IP address, device and browser type, sign-in events, 2FA events and session information.
• Support data: tickets, messages, dispute evidence and call or chat notes.

• To open and run your account and process orders, payments and withdrawals.
• To verify your identity (reviewed by our staff) and to prevent fraud, multiple accounts, account takeover and money laundering.
• To meet legal and regulatory obligations such as record keeping, suspicious transaction reporting and responding to lawful requests.
• To resolve disputes and support requests, and to keep the service secure and reliable.
• To send service messages. We send marketing only with your consent, and you can opt out at any time.

Every identity verification is decided by a trained member of our staff. When you submit, the face in your face check is compared automatically with the faces of other accounts' verifications, only to stop one person from holding several accounts. If it clearly matches another account, the submission can't be completed; you can contact support and ask for a human review.

We keep identity, transaction and related records for at least five (5) years after our relationship ends, or longer where required by applicable law (for example anti-money-laundering rules) or while a dispute, investigation or legal claim is ongoing. Other data is kept only as long as needed for the purposes above, then deleted or anonymised. For an approved identity verification, your ID photos, selfie and face-check video are kept securely for five (5) years after your account’s last activity or the last decision on your verification (whichever is later), as required for legal and regulatory requests, and then deleted. If a verification is not approved, its ID photos, selfie and face-check video are deleted right after that decision. The still frames taken during the face check of an approved verification are deleted 7 days after the decision. The details you entered (name, date of birth, ID type and ID number), a small cropped photo of your face from the face check, and the face comparison data made from it are kept for as long as your account exists, even if the verification was not approved, only so one ID or one person can't be used to verify several accounts. Before buying without identity verification, we may ask you for a short face check (a few camera photos, taken only after you allow the camera). We keep one small photo of your face and the face comparison data made from it, for as long as your account exists, only to stop one person from using several accounts and to check it is still you; the other photos are deleted at once. A newer check replaces the older photo.

• Service providers acting for us under contract: cloud hosting and storage, email delivery, identity verification, sanctions screening, malware scanning and custody or blockchain infrastructure.
• Your order counterparty, only what is needed to complete the order (for example your display name and payment details for that order).
• Law enforcement, regulators, the Financial Intelligence Unit–India, courts and other authorities when we are legally required to, including in response to cyber-crime complaints.
• Professional advisers, and a successor business if the service is transferred, under confidentiality obligations.

Identity images and sensitive fields are encrypted at rest. Access is limited to authorised staff by role, sensitive actions need two-factor authentication, and staff views of identity documents are logged. No system is perfectly secure; tell us immediately if you suspect unauthorised access.

Subject to applicable law, including the Digital Personal Data Protection Act, 2023, you can ask to access, correct or update your data, withdraw consent (which may mean we can no longer provide the service), and ask us to erase data we are not required to keep. You can also nominate another person to exercise your rights in case of death or incapacity.

For privacy questions or complaints, contact us at [email protected]. We acknowledge and resolve complaints within the timelines required by law. If you are not satisfied, you may approach the Data Protection Board of India once it is operational.