Privacy Policy

1. Who we are & scope

NedaPay operates the Services available at nedapay.xyz. This Privacy Policy applies to personal data we process about visitors, applicants, customers, and end users of our Services.

Contact: support@nedapay.xyz.

2. The data we collect

We collect the following categories of personal data, depending on how you interact with us:

• Account & authentication data (via Privy): identifiers (e.g., name, email/handle), cryptographic public keys, wallet identifiers, linked accounts, session and authentication metadata, and audit logs.
• Identity & compliance data (via Sumsub): government ID data, selfies and facial imagery, biometric templates processed for liveness/face match, date of birth, nationality, address, and sanctions/PEP screening results.
• Usage & device data: logs about how you interact with the Services (e.g., pages viewed, timestamps), device and network identifiers, and approximate location derived from IP.
• Transactional data: on-platform activity such as funding, transfers, and other actions you take, including related metadata necessary to operate the Services and comply with law.
• Communications: messages you send us (support requests, feedback) and associated metadata.
• Cookies and similar technologies: see our Cookie Policy for details and choices.

Note: We do not intentionally collect data from children.

3. Where data comes from

• Directly from you (e.g., during sign-up, profile completion, support).
• Automatically from your device and usage of the Services (e.g., logs, cookies).
• From service providers acting on our instructions (e.g., Privy, Sumsub).

4. How we use personal data (and legal bases)

We use personal data to:

• Provide and maintain the Services, including authentication, wallets, onboarding, and support (performance of a contract).
• Conduct identity verification, sanctions/PEP screening, fraud prevention, and other compliance checks (legal obligation; public interest where applicable).
• Protect the Services, detect abuse, and ensure security (legitimate interests).
• Communicate with you about updates, features, and policy changes (legitimate interests or consent where required).
• Improve and develop the Services, including analytics and research (legitimate interests and/or consent for non-essential cookies).
• Comply with applicable laws, lawful requests, and enforce our terms (legal obligation).

5. How we share information

We do not sell your personal data. We share it only as follows:

• Service providers/Processors: We use vetted vendors under contract and data protection terms.
• Compliance and safety: Courts, regulators, or law enforcement where required by law or to protect rights, security, and integrity of the Services.
• Business transfers: In connection with mergers, acquisitions, financing, or sale of assets, subject to appropriate safeguards.

We require processors to process personal data only on our documented instructions and to implement appropriate security measures.

8. Data retention

We keep personal data only as long as necessary for the purposes described in this Policy, including to comply with legal, accounting, or reporting obligations (e.g., financial recordkeeping and AML requirements). Retention periods vary by data category and legal requirements. When we no longer need personal data, we delete or anonymize it.

9. Storage, Security and Risk Mitigation

We do not Store any sensitive data in our end, but we use third-party services/providers which are vetted and have strict security measures in place. No system is perfectly secure; you are responsible for maintaining the confidentiality of your credentials and assets and promptly notifying us of any suspected compromise.

10. Your rights & choices

Depending on your location, you may have rights to access, correct, delete, receive a copy of, or object your personal data. You may also withdraw consent where we rely on it. To exercise these rights, contact us at legal@nedapay.xyz. We may need to verify your identity before processing a request.

10. Children’s privacy

The Services are not directed to children. We do not knowingly collect personal data from anyone under the age where parental consent is required in their jurisdiction. If you believe a child has provided us personal data, please contact us and we will take appropriate steps to delete it.

11. Third-party services we use

• Privy (authentication & key management): we use Privy to authenticate users and help manage wallet keys.
• Sumsub (identity verification): we use Sumsub to verify identity and perform AML checks. Sumsub acts as our processor.
• Payment Rails / Liquidity Providers we use Payment Rails Providers to process payments and provide liquidity for our services.

These services may process your personal data on our behalf to provide the features you request and to help us meet legal obligations.

12. Changes to this Policy

We may update this Privacy Policy from time to time. We will post the updated version and revise the “Last updated” date above. If changes materially affect your rights, we will provide additional notice as required by law.

13. Contact us

Questions or requests? Email support@nedapay.xyz.