Privacy Policy

OKO230688 LLC, registration number 94727228, N208, Mshvidoba str., Senaki 4100, Georgia.

Questions about your data: privacy@mosaicpay.io

We keep the data below because the service cannot work without it — we do not collect anything for advertising, and we do not sell data.

• Account: your email address, and the one-time codes we email you to sign in. If you sign in with Apple or Google, we also store the identifier that provider gives us (and, for Apple, the relay address if you chose "Hide My Email").
• Card issuance: the first and last name you enter for the card. Depending on the partner, a phone number is required by the issuer; where you do not supply one, we generate a placeholder rather than ask for your real number.
• Money movement: your deposit addresses on each supported chain, incoming blockchain transactions to those addresses, conversions, and the card transactions your card partner reports to us (amount, currency, merchant descriptor, status, time).
• Security: IP address, browser/app user agent, and timestamps for sign-ins and sensitive actions (revealing a card number, CVV or PIN, blocking a card). A PIN you set is stored only as a salted hash.
• Optional links: your Telegram account, if you connect it; your device push token, if you enable notifications.
• Support: the messages you send us and anything you include in them.
• Preferences: interface language, notification channel settings, card appearance.

We do not collect location, contacts, photos, or advertising identifiers. Biometrics (Face ID / Touch ID) never leave your device — iOS only tells the app whether the check passed.

• To provide the service (performance of a contract): issuing and servicing cards, crediting deposits, converting funds, showing your history, answering support.
• To keep accounts safe (legitimate interests): the sign-in and sensitive-action audit trail, rate limiting, detecting abuse.
• To meet legal obligations: record keeping, and responding to lawful requests from competent authorities.
• With your consent: notifications, Telegram linking, and delivering one-time payment codes over the channels you switch on. You can withdraw these at any time in the app.

We share only what a recipient needs to do its job:

• Card-issuing partners — the name used on the card and the instructions to issue, load, freeze or query it. They act as independent controllers for the card account they operate.
• Email delivery provider — your email address and the message, to send sign-in codes and notifications.
• Push and messaging platforms — Apple (APNs) for push notifications, and Telegram if you connected it.
• Infrastructure providers — hosting and database operators processing data on our instructions.

Blockchain transactions are public by nature: a deposit you send is visible on that chain to anyone, independently of us.

We do not sell personal data and do not share it for advertising.

Our servers are located in the European Union. We are established in Georgia, and our partners may process data elsewhere. Where data leaves the EU/EEA we rely on appropriate safeguards, including the European Commission's standard contractual clauses.

Account and transaction records are kept while your account is open and afterwards for as long as financial and anti-money-laundering rules require us to keep them.

One-time sign-in codes expire within minutes. Security audit entries are kept for a limited period. Support conversations are kept while the ticket is open and for a reasonable period after.

You can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or receive it in a portable form. Where we rely on consent, you can withdraw it at any time.

Write to privacy@mosaicpay.io and we will respond within one month.

Deleting an account does not erase records we are legally required to keep, or transactions already recorded on a blockchain — those are outside anyone's control.

If you are in the EU/EEA you may complain to your local data protection authority. In Georgia, you may complain to the Personal Data Protection Service.

Traffic is encrypted in transit. Sensitive card data is never stored on our servers — it is fetched from the issuing partner at the moment you ask to see it and is not written to our database. Access to production systems is restricted and audited.

No system is perfectly secure. Use the app lock (PIN or biometrics) and keep your email account protected, since it is the key to your MosaicPay account.

MosaicPay is not for anyone under 18, and we do not knowingly collect data from children.

If we change this policy we will update the date at the top and, for significant changes, tell you in the app or by email.