Privacy policy

01Who we are

KleePay LIMITED ("KleePay", "we", "us"), registered in Hong Kong at 65/F Central Plaza, 18 Harbour Road, Wan Chai, Hong Kong, is responsible for the personal data described in this policy.

This policy covers the KleePay website, the mobile app, the card, AI credits, the MCP server and the API. The card issuer, [card issuer], and RedotPay, which provides card program services, also process your data for their own legal and regulatory purposes. Their privacy notices explain how they do so. [Link to both.]

If you have a question about this policy, write to [[email protected]]. [Confirm whether a data protection officer is appointed and add their contact.]

02What we collect

Information you give us:

• Identity and contact details: name, email address, phone number, date of birth, residential address and nationality.
• Verification data: a copy of a government ID, a selfie or liveness check, and, where required, proof of address and information about the source of your funds.
• Business details if you open a business account: company name, registration number, and the people who own or control it.
• Messages you send to support, the email address you leave on the waitlist on this website, and the details you send in an ambassador application (name, email, country, Telegram handle, profile links, audience size and your answer).

Information created when you use KleePay:

• Funding records: the wallet addresses you send from, amounts, networks and transaction hashes.
• Card transactions: merchant name, category, amount, currency, date, time and approval status.
• Agent activity: the authorization requests your agents make, including the merchant, the amount and the reason text they send, the rules applied, and the result.
• Settings you choose: limits, allowlists, time windows, connected agents and API key metadata. We store keys in a form we cannot read back. [Confirm.]
• Rewards: cashback earned and claimed, AI credits earned, bought and used.
• Model usage through AI credits: which model, how many tokens, and when. [Confirm whether prompts and outputs pass through KleePay systems and whether any of them are stored.]

Information from your device: IP address, device model, operating system, app version, language, and crash and performance logs.

Information from others: identity verification and sanctions screening providers, the card issuer and Visa, fraud prevention services, and public blockchain data.

03How we use it

We use personal data for the purposes below. Where the law asks for a legal basis, it is given after each one.

• To open and run your account, issue and operate the card, process top-ups and payments, and provide the agent tools. (Performing our contract with you.)
• To verify your identity, screen against sanctions lists, monitor transactions and report suspicious activity. (Legal obligation.)
• To detect and prevent fraud, abuse of the rewards program and security threats. (Legitimate interests, and legal obligation where it applies.)
• To detect eligible AI charges and pay cashback and AI credits. (Performing our contract.)
• To answer support requests and send you service messages, such as receipts, security alerts and changes to our terms. (Performing our contract.)
• To understand how the product is used and improve it, using aggregated or de-identified data where we can. (Legitimate interests.)
• To tell you when the app launches, and to send product news. (Consent, which you can withdraw at any time.)
• To review ambassador applications and reply to them. (Consent, given when you apply, which you can withdraw at any time.)
• To keep records, meet accounting and tax rules, and establish or defend legal claims. (Legal obligation and legitimate interests.)

04Automated decisions

Some decisions are made automatically. Our fraud and risk checks may decline a transaction or pause an account automatically.

If an automated decision affects you significantly, you can ask for a person to review it by writing to [email protected].

05Who we share it with

We share personal data only where we need to, and only what each recipient needs:

• The card issuer, [card issuer], Visa and RedotPay, to issue the card and process payments.
• Identity verification and sanctions screening providers. [Name the provider.]
• Service providers who host our systems, send email and messages, and help with support, under contracts that limit their use of the data. [List categories or names.]
• AI model providers, when you use AI credits, limited to what is needed to process your request.
• Professional advisers such as auditors and lawyers.
• Regulators, law enforcement and courts, when the law requires it or to protect our rights and users.
• A buyer or successor, if KleePay is involved in a merger, acquisition or sale of assets. We will tell you before your data becomes subject to a different policy.

We do not sell personal data, and we do not share it with advertisers.

06Blockchain data

Stablecoin transfers are recorded on public blockchains. Wallet addresses and transaction amounts are visible to anyone and cannot be changed or deleted by us or anyone else. We do not publish your identity on a blockchain.

07International transfers

Our team, our partners and our service providers are located in several countries, so your data may be processed outside the country where you live. When we transfer data, we use the safeguards the law requires, such as standard contractual clauses or transfers to countries recognized as giving adequate protection. [Confirm the countries and mechanisms.]

08How long we keep it

• Identity, verification and transaction records: for as long as your account is open and for [5] years after it closes, as anti-money laundering rules require. [Confirm the period for each jurisdiction.]
• Support messages: [2] years after the conversation ends.
• Device and security logs: [12] months.
• Waitlist address: until you unsubscribe.
• Ambassador applications: for as long as the application is under review and [12 months] after a decision, unless you join the programme.

When we no longer need data, we delete it or make it anonymous.

09How we protect it

We encrypt data in transit and at rest, limit access to the people who need it, require strong authentication for staff, and log access to sensitive systems. [Confirm the controls and any certifications.]

Full card numbers and security codes are held by the card issuer and its processor. [Confirm that KleePay does not store them.]

No system is perfectly secure. If a breach affects your data and puts you at risk, we will tell you and the relevant authority as the law requires.

10Your rights

Depending on where you live, you may have the right to:

• get a copy of the personal data we hold about you;
• correct data that is wrong or incomplete;
• ask us to delete your data;
• ask us to limit how we use it, or object to a use based on our legitimate interests;
• receive your data in a portable format;
• withdraw consent you have given, such as for marketing;
• complain to your data protection authority. [Name the lead authority.]

To use any of these rights, write to [[email protected]] from the email on your account. We may need to confirm your identity first. We reply within [30] days.

Some rights have limits. For example, we cannot delete records that anti-money laundering law requires us to keep, and we cannot change data recorded on a blockchain.

11Cookies and similar technologies

This website sets no analytics or advertising cookies, and loads no tracking scripts. If we add any, we will update this section first, list each tool and what it records, and ask for consent where the law requires it.

The app uses device storage to keep you signed in and remember your settings. [List any analytics or crash reporting SDKs in the app.]

12Marketing

We send the launch email and product news only if you have asked for them or the law otherwise allows it. Every message has an unsubscribe link, and you can turn marketing off in the app. Service messages, such as receipts and security alerts, are not marketing and you will still receive them.

13Children

KleePay is not for anyone under 18. We do not knowingly collect data from children. If you believe a child has given us personal data, write to [[email protected]] and we will delete it.

14Changes to this policy

We will update this policy when what we collect or how we use it changes. If a change is significant, we will tell you by email or in the app before it takes effect. The date at the top of this page shows when the policy last changed.

15Contact

KleePay LIMITED, 65/F Central Plaza, 18 Harbour Road, Wan Chai, Hong Kong. Privacy questions: [[email protected]]. Everything else: [email protected].