Privacy policy

This policy applies to personal information we process about customers, prospective customers, recipients (where we receive data about them from senders), business users, website visitors, and app users.

Dropfunds is a financial technology company, not a bank. Depending on your location, Services may be provided by Dropfunds Finance Inc. (Canada), Dropfunds Inc. (United States), or other group entities. The entity named in your account agreement or terms is typically the controller for account-related processing.

We collect information you provide, information generated through your use of the Services, and information from third parties (such as identity vendors, fraud databases, banking partners, and app stores). Categories include:

• Identity and profile: name, date of birth, nationality, government ID numbers and images, photographs and selfies for verification, username, and password credentials
• Contact: email, phone number, postal address
• Financial and transaction: bank account or card details (where you pay in), transfer amounts, currencies, corridors, recipient details, transaction history, balances, and limits
• Device and technical: IP address, device type, operating system, app version, browser type, language, time zone, mobile advertising identifiers (where available), and crash or performance logs
• Usage: pages or screens viewed, features used, clicks, session duration, and referral source
• Communications: support tickets, chat transcripts, call recordings where disclosed, and survey responses
• Compliance: sanctions and PEP screening results, risk scores, and investigation notes
• Approximate location: derived from IP address or, if you grant permission on mobile, more precise location for fraud prevention or regulatory requirements

Our iOS and Android apps may request access to device features only when needed for the function you use. You can deny permission in device settings; some features may not work without it.

• Camera: capture ID documents and selfies during identity verification (KYC)
• Photo library / files: upload documents or images you choose for verification or support
• Notifications: send transfer status, security alerts, and service messages (you can disable in OS settings)
• Clipboard: paste referral codes or account details only when you initiate paste actions, where supported
• Biometric login: Face ID, Touch ID, or Android biometrics may unlock the app locally on your device; biometric data is not sent to our servers
• Network: required to connect to our APIs and partners securely

When you download our app from the Apple App Store or Google Play, the store may collect information about you under its own privacy policy. We receive limited data from stores (for example app version, crash diagnostics if you opt in to Apple/Google reporting).

Apple App Store: Our app privacy “nutrition labels” and App Privacy details on the store listing describe categories of data linked to you and used for tracking, consistent with this policy. On iOS, if we use data for cross-app tracking, we will request permission through Apple’s App Tracking Transparency (ATT) prompt where required. You can change tracking permission in iOS Settings → Privacy & Security → Tracking.

Google Play: Our Data safety section on Google Play describes data collected, security practices (such as encryption in transit), and whether data is optional or required. It is aligned with this policy. You may request account or data deletion as described in Section 12.

In-app links: the privacy policy URL shown in store listings points to this document (or the current localized version). Material changes will be reflected in store disclosures when required.

We use personal information to:

• Provide, maintain, and improve the Services, including executing transfers and displaying quotes
• Verify identity, conduct KYC/AML/sanctions screening, and prevent fraud and financial crime
• Process payments with banks, card networks, and payment partners
• Communicate with you about transactions, security, and product updates
• Provide customer support and resolve disputes
• Comply with law, respond to lawful requests, and enforce our terms
• Analyse aggregated or pseudonymised usage to improve performance and design
• Market our Services where permitted and with consent when required (you may opt out of marketing emails)

Where the GDPR or UK GDPR applies, we rely on one or more of: performance of a contract (providing the Services you request); legal obligation (AML, tax, licensing); legitimate interests (security, fraud prevention, product improvement balanced against your rights); and consent (for example optional marketing or certain cookies/tracking where required). You may withdraw consent without affecting lawfulness of prior processing.

We do not sell your personal information for money. We share data with:

• Payment and banking partners to move funds and complete payouts
• Identity verification, fraud prevention, and sanctions screening providers
• Cloud hosting, analytics, customer support, and communications vendors under contract
• Professional advisers (lawyers, auditors) under confidentiality duties
• Regulators, law enforcement, and courts when required or permitted by law
• Affiliates within the Dropfunds group for operations described in this policy
• Successors in a merger, acquisition, or asset sale, subject to this policy or notice to you

We operate globally. Personal information may be processed in countries other than your own, including Canada, the United States, the European Economic Area, the United Kingdom, and other locations where we or our providers maintain facilities.

When we transfer data from the EEA, UK, or Switzerland, we use appropriate safeguards such as Standard Contractual Clauses, adequacy decisions, or other mechanisms recognised by applicable law.

We keep personal information for as long as needed to provide the Services, meet legal and regulatory retention periods (including AML record-keeping), resolve disputes, and enforce agreements. Retention may continue after account closure where required by law.

When data is no longer needed, we delete or anonymise it in accordance with our retention schedule and technical capabilities.

We implement administrative, technical, and organisational measures designed to protect personal information, including encryption in transit (TLS), access controls, and monitoring. No method of transmission or storage is completely secure; you are responsible for keeping your credentials confidential.

Depending on your location, you may have rights to access, correct, delete, restrict, or object to certain processing, and to data portability. You may also withdraw consent and lodge a complaint with a supervisory authority.

California residents may have rights under the CCPA/CPRA, including to know, delete, and correct personal information, and to opt out of “sale” or “sharing” for cross-context behavioural advertising where applicable. We do not sell personal information as defined by the CCPA for monetary consideration.

To exercise rights, email support@dropfunds.io with “Privacy request” in the subject. We may verify your identity before responding. Authorized agents may submit requests where permitted by law.

You may close your account through the app or web dashboard where available. Closing an account does not automatically delete all data where we must retain records for legal, AML, or dispute purposes.

To request deletion of personal information beyond account closure, contact support@dropfunds.io. Google Play users may also use in-app or Play Store data deletion options where we make them available. We will respond within timeframes required by applicable law and store policies.

The Services are not directed to anyone under 18 (or the age of majority in your jurisdiction). We do not knowingly collect personal information from children. Contact us if you believe a child has provided data to us.

We use automated systems for fraud detection, transaction monitoring, and risk scoring. Outcomes may include blocked transactions, enhanced verification, or account review. You may contact us to request human review of significant automated decisions where required by law.

Our Services may link to third-party websites or embed partner flows (for example payment authentication). Their privacy practices are governed by their own policies. Social login providers (if offered) receive information according to your choices with that provider.

We use cookies and similar technologies on the web and in apps as described in our Cookie Policy. Mobile apps may use local storage and device identifiers for similar purposes.

We may update this Privacy Policy from time to time. We will post the revised version with a new “Last updated” date and, where required, notify you through the Services, email, or app store update notes. Continued use after changes take effect constitutes acceptance where permitted by law.

Privacy questions, requests, or complaints: support@dropfunds.io (subject: “Privacy”).

Canada: Dropfunds Finance Inc., 1285 West Broadway Suite 600, Vancouver BC V6H 3X8, Canada.

United States: Dropfunds Inc., 651 N Broad St, Suite 206, Middletown DE 19709, USA.

If you are in the EEA or UK and believe we have not resolved your concern, you may contact your local data protection authority.