Privacy Policy

1. Who We Are

FodyPay ("FodyPay", "we", "us", or "our") is a digital payment and cryptocurrency wallet application operated by FodyLabs LLC, a US limited liability company ("FodyLabs"). We are committed to protecting your personal information and your right to privacy.

For questions about this policy, contact us at [email protected].

2. Information We Collect

2.1 Information You Provide

• Identity data: full name, date of birth, nationality, government-issued ID (for KYC verification)
• Contact data: email address, phone number, postal address
• Financial data: bank account details, payment card information (upon launch, to be processed by our regulated payment infrastructure partners; we will not store raw card numbers)
• Account credentials: hashed password, biometric identifiers (stored locally on device only)
• Profile data: profile picture, preferences, settings

2.2 Automatically Collected Data

• Device data: device model, operating system, unique device identifiers, IP address
• Usage data: pages visited, features used, clickstream data, session duration
• Transaction data: amount, recipient, timestamp, type, and status of every transaction you initiate
• Location data: approximate location derived from IP address (we do not collect precise GPS location unless you explicitly permit it)

2.3 Data from Third Parties

• Payment processor (intended: Stripe, Inc.): upon launch, payment processing data, fraud signals, and risk scores
• Crypto infrastructure partner (intended: Bridge): upon launch, stablecoin and cryptocurrency transaction data, wallet addresses, and compliance signals
• Identity verification providers: KYC/AML check results
• Financial institutions: account verification and transaction confirmations

3. How We Use Your Information

4. Payment Processing

Upon launch, we intend to use Stripe, Inc. as our payment processor. When you add a payment method or initiate a transaction, your payment information will be transmitted directly to our payment processor's secure servers. FodyPay will not store your full card number, CVV, or bank credentials.

Our intended payment processor, Stripe, is certified to PCI DSS Level 1, the highest level of payment card industry compliance. Its data practices are governed by the Stripe Privacy Policy.

5. Cryptocurrency Infrastructure

Upon launch, cryptocurrency and stablecoin transactions are intended to be facilitated through our regulated crypto infrastructure partner (Bridge). When you perform crypto operations, relevant transaction data (including wallet addresses and amounts) will be shared with that partner to execute and settle transactions.

Our intended crypto infrastructure partner applies AML and sanctions screening to all transactions as required by applicable law. Its data practices will be governed by its published privacy policy, which will be linked in-app prior to activation of crypto features.

6. Sharing Your Information

We do not sell your personal data. We share it only with:

• Service providers acting on our behalf (payment processors, KYC providers, cloud infrastructure, analytics)
• Regulatory authorities when required by law (financial regulators, law enforcement, tax authorities)
• Business partners disclosed at the point of data collection
• Acquirer or successor in the event of a merger, acquisition, or asset sale

All third parties are contractually bound to handle your data with equivalent levels of protection.

7. International Data Transfers

Your data may be transferred to and processed in countries outside your country of residence, including the United States and the European Economic Area. We implement appropriate safeguards (such as Standard Contractual Clauses) for such transfers in compliance with applicable data protection law.

8. Data Retention

We retain your personal data for as long as your account is active and for a minimum of 5 years after account closure, as required by financial services regulations (AML, KYC record-keeping obligations). Transaction records may be retained for up to 7 years to comply with tax and accounting laws.

9. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you
• Rectify inaccurate or incomplete data
• Erase your data (subject to legal retention obligations)
• Restrict or object to certain processing
• Data portability — receive your data in a machine-readable format
• Withdraw consent at any time (where processing is consent-based)
• Lodge a complaint with your local data protection authority

To exercise any right, email [email protected]. We will respond within 30 days.

10. California Privacy Rights (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) grants you the following rights regarding your personal information:

• Right to Know: Request disclosure of the categories and specific pieces of personal information we have collected about you, the sources, the business purpose, and the third parties with whom we share it.
• Right to Delete: Request deletion of personal information we have collected, subject to legal retention obligations (e.g., AML/KYC record-keeping).
• Right to Correct: Request correction of inaccurate personal information we hold about you.
• Right to Opt-Out of Sale or Sharing: We do not sell or share your personal information for cross-context behavioral advertising.
• Right to Limit Sensitive Data Use: We use sensitive personal information (government ID, financial data, biometrics) only as necessary to provide the Service and meet legal obligations.
• Right to Non-Discrimination: We will not discriminate against you for exercising any CCPA/CPRA rights.

To submit a California privacy request, email [email protected] with subject line "California Privacy Request". We will respond within 45 days. You may designate an authorized agent to make requests on your behalf by providing written authorization.

11. Security

We implement industry-standard security measures including TLS encryption in transit, AES-256 encryption at rest, multi-factor authentication, regular penetration testing, and SOC 2 compliant infrastructure. No system is completely secure; in the event of a breach affecting your rights, we will notify you as required by law.

12. Cookies

Our website uses strictly necessary cookies for session management and security. We use analytics cookies (with your consent) to understand how visitors use our site. You can manage cookie preferences via your browser settings.

13. Children

FodyPay is not directed to persons under 18 years of age. We do not knowingly collect personal data from minors. If we become aware that a minor has provided us data, we will delete it promptly.

14. Changes to This Policy

We may update this policy from time to time. When we make material changes, we will notify you by email or in-app notification at least 14 days before the changes take effect. The "Last updated" date at the top of this page reflects the most recent revision.

15. Contact Us

FodyLabs LLC — operating FodyPay
Email: [email protected]