This Privacy Policy explains how U.CASH Inc. ("U.CASH", "we", "us") collects, uses, and shares personal information when you use our apps and infrastructure (the "Services").
U.CASH Inc. is the controller of personal information processed through the Services. You can contact us about privacy at [email protected], or write to us at: U.CASH Inc., legal/privacy, c/o our contact address published on the Contact page. Where the GDPR requires a representative, or a data protection officer for large-scale processing, we will identify that contact on this page.
This policy applies to all U.CASH apps and websites (pay, swap, buy, names, agents, verify, send, portal, ai, una, uantum, status, and u.cash itself) and to the personal information of visitors, registered users, merchants, agent operators, and developers using our APIs and SDKs. It does not apply to third-party services we link to, such as payment processors, decentralized exchanges, or Unstoppable Domains, which have their own policies.
For users in the European Economic Area, the United Kingdom, and Switzerland, we process personal information only where we have a lawful basis under Article 6 of the GDPR:
| Lawful basis | Examples of our use |
|---|---|
| Performance of a contract | Creating your account, processing your requests, providing the app features you asked for. |
| Legal obligation | Keeping records to comply with tax, AML, or sanctions obligations that apply to us. |
| Legitimate interests | Security, fraud and abuse prevention, network integrity, and product improvement, balanced against your rights. |
| Consent | Non-essential cookies and analytics, marketing if you opt in, and certain optional features. |
| Vital interests | Protecting someone's physical safety in rare emergencies. |
We try to collect as little as possible. The categories we may collect include:
We never hold your private keys, seed phrases, recovery phrases, or funds. We cannot see or recover them. Any on-chain activity associated with your wallet is recorded on a public blockchain that we do not control; this policy covers only the personal information we process on our own systems, not public ledger data.
We share personal information only as described here, and only with service providers that help us operate, under written contracts that require confidentiality and appropriate security. Current categories of sub-processors and third parties include:
| Provider category | Purpose | Location |
|---|---|---|
| Cloud hosting | Hosting the Services and databases | Canada / United States |
| Email delivery | Transactional and notification email | United States |
| Analytics (on consent) | Aggregated usage measurement | United States |
| DEX aggregators and liquidity | Routing swap and buy quotes | Decentralized / on-chain |
| Unstoppable Domains / FIO | Web3 domain registration | United States |
| Payment processors | Optional card or fiat legs | Varies by processor |
The full, dated sub-processor list and the transfer mechanism for each are maintained in our Data Processing Agreement. We may also disclose information when required by law or to protect rights, property, or safety.
Your information may be processed in Canada, the United States, and other countries where our providers operate. Where we transfer personal information out of the European Economic Area, the United Kingdom, or Switzerland, we rely on a recognized transfer mechanism, such as the European Commission's Standard Contractual Clauses, adequacy decisions, or another lawful basis, and we carry out a transfer impact assessment as required.
We keep personal information only as long as needed for the purposes in this policy or to meet legal obligations. Indicative retention periods:
| Category | Retention |
|---|---|
| Account information | Life of the account, plus up to 36 months after closure |
| Server and access logs | Up to 13 months |
| Support tickets | Up to 36 months |
| Sanctions screening records | Up to 5 years, as required by applicable AML/sanctions rules |
| Consent records | Until consent is withdrawn, plus the legal limitation period |
We use industry-standard safeguards such as encryption in transit and at rest, access controls, and monitoring. Because we do not custody funds or keys, the most important security control is one you hold: protecting your own wallet. See our Responsible Disclosure and Security page for more.
Depending on where you live, you may have some or all of the following rights. To exercise any right, contact [email protected]. We will respond within the time required by applicable law.
| Regime | Rights you may have |
|---|---|
| GDPR / UK GDPR | Access, rectify, erase, restrict, data portability, object, withdraw consent, and rights regarding automated decision-making. |
| CCPA / CPRA (California) | Know, delete, correct, opt out of "sale or share", limit use of sensitive personal information, and non-discrimination. See Section 12. |
| Other US states | Residents of Virginia, Colorado, Connecticut, Utah, Texas, and other states with comparable laws have similar access, correction, deletion, and opt-out rights. |
| Canada (PIPEDA) | Access the personal information we hold about you and correct inaccuracies. |
U.CASH does not sell personal information for monetary consideration. For California residents, "sharing" and "cross-context behavioral advertising" have specific meanings under the CCPA. We do not engage in cross-context behavioral advertising, and we do not share personal information for that purpose. You have the right to opt out of any sale or share. To opt out, email [email protected] with "CCPA opt-out" in the subject, or use the "Do Not Sell or Share My Personal Information" link where it appears in our cookie banner.
The Services are not directed to children. We do not knowingly collect personal information from children under 13 (under 16 where the GDPR or applicable law requires a higher age). If you believe a child has provided us personal information, contact [email protected] and we will delete it.
We use a small number of cookies and similar technologies. Essential cookies are necessary for the Services to work; others (such as analytics) are set only with your consent in regions that require it. Full details and controls are in our Cookie Policy.
We may update this policy from time to time and will revise the "Effective" date above. For material changes we will provide notice as described in the Terms of Service. You also have the right to lodge a complaint with your local data-protection authority. For any privacy question, contact [email protected].