سياسة الخصوصية

Zeeo Technologies, Inc. ("Zeeo", "we", "us", "our"), a Delaware corporation with a registered agent at 251 Little Falls Drive, Wilmington, DE 19808, United States, operates the Zeeo mobile application and the website at getzeeo.com (together, the "App").

This Privacy Policy explains what personal data we collect, why, who we share it with, how long we keep it, and what rights you have. It applies to everyone who uses the App, in the United States and the European Union.

Questions, requests or complaints: support@getzeeo.com.

---

1. Our Role

Zeeo is a software interface. We do not custody funds or private keys, and we do not perform the regulated parts of a transaction. Those are performed by Bridge (virtual accounts, conversion, payouts, KYC, AML and sanctions screening) and Privy (wallet infrastructure and authentication).

Different parties are responsible for different processing:

Bridge and Privy process your personal data under their own privacy policies, for their own legal and compliance purposes. We do not control that processing. Bridge uses Persona to run the identity-verification flow inside the App. Links are in Section 6.

---

2. Personal Data We Hold

This is a complete description of the categories of personal data stored in our systems.

2.1 Profile

First name, last name, username, email address, phone number, country, and state or region. Whether your phone number has been verified and when, and the number of failed verification attempts while a code is pending. The profile photo you choose to upload, or the avatar colour you select instead. Whether you have completed security setup. Account creation and update timestamps.

2.2 Wallet identifiers

Your Privy user identifier (privyDid), your Privy wallet ID, and your wallet address on the Base network.

2.3 Verification status

Your Bridge customer identifier, your verification status and the time it last changed, whether you have accepted Bridge's terms, and whether identity verification has been completed. During onboarding we also store the name and email address you supply to start verification, and the verification link issued to you.

We do not receive or store copies of your identity documents. You submit those through the Persona verification flow embedded in the App, which Bridge operates for its own verification. Persona and Bridge receive the documents and selfie; we receive the outcome, not the documents.

2.4 Virtual account details

The bank details of the virtual account issued to you for receiving money: bank name and address, IBAN and BIC, or routing and account number, beneficiary name and address, currency and payment rail.

2.5 External bank accounts you add

Account holder name, first and last name, bank name, bank country, the last four digits of the account, a label or display name you choose, whether the account is your own or belongs to someone else, and whether the holder is an individual or a business.

For accounts added under our current system we store only the last four digits, not the full account number or IBAN. Records created under an earlier version of the App may contain full bank details; these are being retired.

2.6 Transactions

For every transaction: type, status, network, asset, amount and display values, sender and recipient wallet addresses, sender and recipient Zeeo identifiers where both parties are Zeeo users, the blockchain transaction hash, the channel used, any optional note you attach, fees and exchange rates applied, and timestamps.

For payouts and incoming payments we additionally store the transfer or deposit identifier, its state history, the counterparty's bank name, the last four digits of the counterparty's account, the counterparty's name, the payment reference, receipt details, and — where a payment is returned — the refund reason and reference.

2.7 Referrals and invitations

Your referral code, the identifier of the user who invited you, and counts of invitations you have sent and users you have referred.

2.8 Card waitlist

If you reserve a place for a future card product, we store your identifier and your place in the queue.

2.9 Technical and diagnostic data

Device and app usage information, IP address, app version and operating system, basic log data, webhook event data received from Privy and Bridge, crash reports and error diagnostics collected through Sentry, and product analytics events collected through PostHog (for example, app opens and custom events such as completing onboarding or ordering a card), used to measure active users and understand how the App is used. PostHog identifies you by your Privy user identifier only; we do not send it your name, email or phone number.

Session replay. Sentry records a replay of the screens leading up to a crash or error so we can reproduce it. All text, images and inputs are masked before recording, so balances, names and account details are not captured.

In-app feedback. If you use the in-app feedback form, we receive the message you write, your email address, and any screenshot you choose to attach.

2.10 Communications

Emails, support messages, onboarding notes, and feedback you send us.

2.11 Deletion records

If you delete your account, the time of the request and any reasons you choose to give.

2.12 Push notification tokens

If you allow notifications, the push token issued for your device by Apple or Google, so we can deliver transaction, verification and security notifications. It is removed when you disable notifications in the App, sign out, or delete your account.

2.13 Website tools

If you use the Zakat calculator on getzeeo.com and ask for your results by email, we store the email address you enter, the figures you entered and the calculated result, the approximate country, region and city derived from your IP address, and your browser's user-agent string. This is kept in a separate lead database (Baserow) and is not linked to any Zeeo account.

2.14 Device permissions

The App asks for the following permissions only when you use the related feature. You can revoke each one at any time in your device settings.

---

3. Finding Other Users

You can send money to another Zeeo user using their Zeeo @username handle. To make this work, your username is visible to other users of the App.

You may also allow other users to find you by your phone number. This is a setting you control, and you can turn it off at any time in the App. When it is off, your phone number is not used for discovery.

Finding friends from your contacts. If you grant the App access to your contacts, it reads the phone numbers in your address book on your device, normalises them, and sends only the numbers to our servers to check which belong to Zeeo users who have chosen to be discoverable. Submitted numbers are compared against our index and are not stored or logged. Contact names stay on your device. You must have verified your own phone number before you can use this feature, and lookups are rate limited to prevent abuse.

What other users see. Your first name, last name, username and profile photo are shown to users you send money to or receive money from, and to users who find you by username or through their contacts.

---

4. Personal Data About Other People

When you add an external bank account belonging to someone else, or send money to another person, you provide us with their personal data — typically their name and partial bank details. When someone sends money to you, we receive their name and partial bank details from Bridge.

We process this data to execute the transaction, to display it accurately in your activity, and to meet recordkeeping obligations. If you provide us with another person's data, you confirm that you are entitled to do so.

---

5. How We Use Personal Data

• To create, verify and manage your account
• To operate the App and display your balance, activity and transaction history
• To pass your details to Bridge for verification and to execute transactions you instruct
• To issue and display your virtual account details
• To let you send money to other Zeeo users and to external bank accounts
• To calculate and display fees and exchange rates
• To operate the referral programme
• To meet legal and regulatory obligations, and to support our partners' AML, sanctions-screening and monitoring obligations
• To detect, investigate and prevent fraud, abuse, unauthorised access and other security issues
• To provide support, respond to your questions, and resolve disputes
• To debug errors, monitor stability and improve the App
• To verify your phone number by sending a one-time code by SMS or WhatsApp
• To send you transactional emails and push notifications about your account, transactions, verification status and security
• To send all users service announcements by email: maintenance, changes to these terms or policies, security matters, and new features we launch. You can unsubscribe from new-feature announcements using the link in the email; we will still send security, legal and service notices
• To notify our own team internally (via a private Discord channel) when an account is created, verified, referred or deleted, so we can operate and support the App
• To establish, exercise or defend legal claims and enforce our Terms of Service

We do not sell your personal data, and we do not share it for cross-context behavioural advertising. We do not use your data for automated decision-making that produces legal or similarly significant effects. Verification and compliance decisions are made by Bridge under its own policies; if such a decision affects you, contact us and we will direct you to Bridge's process.

---

6. Who We Share Personal Data With

Financial and wallet partners (independent controllers)

Service providers (processors acting on our instructions)

To display currency conversions, the App also retrieves current exchange rates from ExchangeRate-API (open.er-api.com). This is a simple, unauthenticated lookup of public exchange rate data — no personal data about you is sent or received as part of this call.

Others

• Professional advisers — lawyers, accountants and auditors, where necessary and under confidentiality obligations.
• Regulators, law enforcement and courts — where required by law, court order or lawful request, or to protect our rights or the safety of others. We and our partners may be legally prohibited from telling you that such a disclosure or report has been made.
• Acquirers — in connection with a merger, acquisition, financing or sale of assets, subject to appropriate safeguards.
• With your consent or at your direction.

---

7. Transaction Data on Public Networks

Transactions in the App settle on the Base blockchain, a public network. Transaction data — including wallet addresses, amounts and timestamps — is public, permanent, and outside the control of Zeeo, Privy and Bridge.

We cannot delete, alter or restrict these records, and no data subject right can be exercised against a public network. A wallet address may, in combination with other information, be linked back to you by third parties. Please take this into account when deciding what to transact and with whom.

---

8. Legal Bases (EEA and UK)

Where we rely on legitimate interests, we have assessed that our interests are not overridden by your rights and freedoms. Where we rely on consent, you may withdraw it at any time; withdrawal does not affect processing carried out beforehand.

---

9. International Transfers

Zeeo is established in the United States, and our application data is stored by Convex in the US East (Northern Virginia) region. The other processors listed in Section 6 (Twilio, Resend, Expo, Sentry, PostHog, Discord and Vercel) also process data in the United States; Baserow processes Zakat calculator entries in Germany, within the EU.

The United States is not covered by an EU or UK adequacy decision for the purposes of this processing, which means US law is not considered to provide the same level of protection as European law.

If you are in the EEA or the UK, your personal data is transferred to the United States. Where required, we rely on the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum where applicable), supplemented by technical and organisational measures. You may request a copy of the relevant safeguards by emailing support@getzeeo.com.

Bridge and Privy apply their own transfer mechanisms for the processing they carry out as independent controllers.

---

10. Retention

How deletion works. When you delete your account, we first mark it as deleted, which immediately removes your access to the App and stops it being used. We then remove or anonymise personal data that we are not required to keep, and retain the remainder for the periods above. Transaction and compliance records cannot be deleted on request, because we and our partners are legally required to keep them.

Bridge and Privy apply their own retention periods to data they hold as controllers, which may exceed ours and which we cannot shorten. Records on the Base network cannot be deleted at all (Section 7).

---

11. Your Rights

Depending on where you are located, you may have the right to:

• Access the personal data we hold about you and receive a copy
• Rectify inaccurate or incomplete data
• Erase your data, subject to legal and regulatory retention requirements
• Restrict or object to certain processing, including direct marketing
• Withdraw consent where processing is based on consent
• Port certain data to another provider in a structured, machine-readable format
• Lodge a complaint with your supervisory authority

How to exercise them. Email support@getzeeo.com with "Privacy Request" in the subject line. We will respond within one month, extendable by two further months for complex requests, and we will tell you if we need the extension. You can also update your profile details yourself in the App.

Verification and authorised agents. We will usually verify a request by asking you to send it from, or confirm it through, the email address on your account; for sensitive requests we may ask for further information. Where the law allows, someone else may submit a request on your behalf if they provide your written, signed permission and we can verify your identity.

Limits. We cannot delete data we are required to retain by law, and we cannot alter or delete records on a public network. Where Bridge or Privy holds your data as an independent controller, direct your request to them as well; we will help you identify the right contact.

EEA and UK. You may complain to your national data protection authority; in the UK, the Information Commissioner's Office.

California and other US states. You may have the right to know, delete, correct, and opt out of the "sale" or "sharing" of personal information and of targeted advertising, and to limit the use of sensitive personal information. We do not sell or share personal information for cross-context behavioural advertising, we do not use your data for targeted advertising, and we do not profile you in a way that produces legal or similarly significant effects. We do not process sensitive personal information to infer characteristics about you. We will not discriminate against you for exercising your rights. You may appeal a denied request by replying to our response; we will respond to appeals within 45 days.

Do Not Track and Global Privacy Control. Because we do not sell or share personal information or use it for targeted advertising, there is nothing for a "Do Not Track" or Global Privacy Control signal to opt you out of, and we do not change our processing in response to them.

California "Shine the Light". We do not disclose personal information to third parties for their own direct marketing purposes.

Nevada. We do not sell personal information within the meaning of Nevada Revised Statutes Chapter 603A.

---

12. Cookies

Our website does not use analytics, advertising or social-media cookies, and does not show a cookie banner because it sets nothing that requires consent. Our hosting provider, Vercel, processes request logs (including your IP address) to serve and secure the site. If we add non-essential cookies in future, we will update this section and ask for your consent where the law requires it.

Our mobile app does not use browser cookies. It uses SDKs and on-device storage for authentication and session persistence (Privy), error monitoring and masked session replay (Sentry), and product analytics (PostHog). There is no advertising SDK in the App, and we do not use your device's advertising identifier.

---

13. EU / UK Representative

[To be appointed. As a US-established controller offering services to individuals in the EU, Zeeo is likely required to designate a representative in the Union under Article 27 GDPR, and a UK representative under Article 27 UK GDPR if it offers services to UK individuals. Insert the representative's name, address and contact email here once appointed, or remove this section if counsel confirms an exemption applies.]

---

14. Security

We use technical and organisational measures designed to protect personal data, including encryption in transit and at rest, access controls on a least-privilege basis, authentication for administrative access, logging and monitoring, and vendor due diligence.

No system is completely secure. We cannot guarantee absolute security. You are responsible for protecting your device and your login credentials. Because your wallet is self-custodial, Zeeo cannot recover it or restore access on your behalf.

The optional app lock (passcode, Face ID or Touch ID) is handled by your device's operating system. Biometric data never leaves your device and is never sent to us; we store only whether you have completed security setup.

If we become aware of a personal data breach affecting you, we will notify you and the relevant authorities where required by applicable law.

---

15. Children

The App is not intended for anyone under 18, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact support@getzeeo.com and we will delete it.

---

16. Third-Party Links

The App and our website may link to third-party sites and services that operate independently of us. Their privacy practices are governed by their own policies. We encourage you to review them.

---

17. Changes to This Policy

We may update this Policy from time to time. If we make material changes, we will post the updated version, update the "Last updated" date, and notify you by email or in-app notice where required.

---

18. Contact

Zeeo Technologies, Inc. Registered agent: 251 Little Falls Drive, Wilmington, DE 19808, United States Email: support@getzeeo.com

Privacy requests: email support@getzeeo.com with "Privacy Request" in the subject line.