Privacy Policy

This Privacy Policy explains how UffPay Tech, Inc., a Florida corporation, and UffPay, S.A. in Guatemala (together, "UffPay", "we", "us", or "our") collect, use, disclose, retain, and protect personal information when you visit our website, use our mobile applications, open or manage an account, send or receive money, use wallet or card features, contact support, or otherwise interact with UffPay.

1. Scope of this policy

This Policy applies to www.uffpay.com, UffPay mobile applications, onboarding and identity-verification flows, wallet, transfer, payment, card, customer-support, security, fraud-prevention, and compliance features, and any other service that links to this Policy (collectively, the "Services"). It does not apply to third-party websites, apps, wallets, banks, payment processors, or card networks that publish their own privacy notices.

2. Personal information we collect from you

Depending on how you use the Services, we may collect information that you provide directly to us, including:

• Identity information, such as full legal name, date of birth, nationality, tax or government identification details, DPI, passport or other identity-document information, and identity-document images.
• Contact and profile information, such as email address, phone number, mailing address, preferred language, account settings, username, credentials, and customer profile details.
• Verification information, such as selfie, liveness, document-review, signature, proof-of-address, and other information needed to complete know-your-customer, anti-fraud, sanctions-screening, and account-risk checks.
• Financial and transaction information, such as wallet activity, balances, payment method details, card or bank-account references, transfer amounts, recipients, senders, merchants, fees, refunds, disputes, chargebacks, and transaction history.
• Support and communications information, such as messages, forms, call notes, attachments, complaint details, consent records, and preferences for notices or marketing.

3. Information collected automatically

When you use the Services, we and our service providers may collect technical and usage information, including device type, browser type, operating system, IP address, approximate location derived from IP address, app version, pages and screens viewed, links clicked, session identifiers, cookie and SDK identifiers, crash reports, diagnostics, security logs, and fraud-risk signals. Precise device permissions, such as camera access for identity verification, are requested through the app or device controls before they are used.

4. Information from third parties

We may receive information about you from sources that support financial-services operations, including identity-verification vendors, official or legally available identity sources, sanctions and watchlist providers, payment processors, card program providers, banking and funds-custody partners, fraud-prevention networks, merchants, recipients, senders, customer-support providers, referral partners, and publicly available sources. We use this information to verify identity, assess risk, process transactions, prevent fraud, comply with law, and provide the Services.

5. Sensitive and financial information

Because UffPay provides payments, wallet, transfer, and card-related services, some information we collect may be considered financial, identification, or sensitive information under applicable law. We use this information only for permitted purposes, such as account opening, identity verification, fraud prevention, transaction processing, customer support, security, compliance, legal reporting, dispute handling, and service administration. We do not use account, KYC, balance, or transaction information for cross-context behavioral advertising.

6. How we use personal information

We use personal information to operate UffPay and protect our users, our platform, and the financial system. Our uses include:

• Creating, verifying, authenticating, maintaining, and securing accounts.
• Providing wallet, transfer, payment, card, balance, receipt, notification, and customer-support features.
• Performing KYC, AML, counter-terrorist-financing, sanctions, fraud, abuse, and risk checks in Guatemala, the United States, and other jurisdictions where UffPay operates or supports transactions.
• Processing transactions, calculating fees, reconciling activity, resolving disputes, responding to chargebacks, and maintaining audit trails.
• Detecting, investigating, preventing, and responding to fraud, unauthorized access, account takeover, misuse, suspicious activity, security incidents, and unlawful conduct.
• Meeting legal, regulatory, tax, accounting, audit, recordkeeping, card-network, payment-network, and law-enforcement obligations.
• Improving reliability, usability, accessibility, product performance, customer support, and user experience.
• Sending service notices, security alerts, transaction confirmations, account updates, policy notices, and, where permitted, product or marketing communications.

7. Compliance, fraud prevention, and risk reviews

UffPay uses internal tools, service-provider tools, and the BlackEagle compliance platform to support identity verification, sanctions screening, AML monitoring, transaction monitoring, fraud detection, risk scoring, and regulatory reporting. These reviews may use account, device, identity, document, payment, transaction, behavioral, and third-party risk signals. Where required by law or our compliance procedures, activity may be escalated for manual review, additional documentation, limitation, suspension, reporting, or account closure.

8. Legal bases and legal framework

Where a legal basis is required, we process personal information to perform our contract with you, comply with legal obligations, protect legitimate interests such as platform security and fraud prevention, protect users and the public, and, where required, with your consent. We process personal data in accordance with applicable law, including Guatemala's access-to-information and habeas-data framework, Decree No. 57-2008 where applicable, financial-services and AML obligations, and U.S. privacy and financial-data rules such as the Gramm-Leach-Bliley Act (GLBA) and, where applicable, the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA).

9. How we share personal information

We share personal information only as needed to provide, secure, improve, and comply with the Services. Recipients may include:

• UffPay group companies and authorized personnel who need the information for business, compliance, security, support, or operational purposes.
• Payment processors, card program providers, card networks, banking and funds-custody partners, payout partners, and other regulated financial-service providers involved in a transaction.
• Identity-verification, sanctions-screening, fraud-prevention, risk, security, hosting, analytics, communications, customer-support, and technology providers that process information for UffPay under contract.
• Merchants, recipients, senders, billers, or other parties involved in a transaction when needed to complete, confirm, investigate, or dispute that transaction.
• Regulators, law-enforcement agencies, courts, tax authorities, auditors, card networks, payment networks, or other parties when required by law, legal process, regulatory obligation, network rule, or to protect rights, safety, and security.
• Professional advisers, insurers, financing sources, or transaction counterparties in connection with audits, risk management, legal claims, financing, merger, acquisition, reorganization, or similar corporate events.

10. No sale of personal information

We do not sell your personal information for money. We also do not share account, KYC, balance, or transaction information for cross-context behavioral advertising. If a privacy law defines certain analytics or advertising disclosures as a sale or sharing, we provide the choices required by that law through our cookie and privacy controls.

11. Cookies, SDKs, and similar technologies

We use cookies, SDKs, pixels, device identifiers, local storage, and similar technologies to operate the Services, remember preferences, protect accounts, detect abuse, measure performance, and improve the website and apps. Non-essential analytics or marketing technologies are used only where permitted by law and your choices. See our Cookies and Tracking Technologies Policy for more detail.

12. International transfers

UffPay operates through entities, partners, and service providers that may process information in Guatemala, the United States, and other countries. Privacy and data-protection laws may differ across jurisdictions. When information is transferred, stored, or accessed outside your country, we apply safeguards appropriate to the information and the applicable legal requirements.

13. Security

We use administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit and at rest, access controls, least-privilege permissions, monitoring, logging, transaction-risk controls, vendor review, and incident-response procedures. No method of transmission or storage is completely secure, but we work to protect the Services and respond promptly to suspected security issues.

14. Data retention

We retain personal information for as long as needed to provide the Services, maintain accounts, process transactions, resolve disputes, prevent fraud, meet audit and compliance obligations, satisfy AML, financial, tax, accounting, and legal recordkeeping requirements, and enforce agreements. When information is no longer needed, we delete it, de-identify it, aggregate it, or retain it only where legally required or permitted.

15. Your privacy choices and rights

Depending on where you live and the type of information involved, you may have the right to request access, correction, deletion, portability, restriction, or objection to certain processing; to withdraw consent where processing is based on consent; to opt out of marketing; and to appeal a decision where local law provides that right. Some requests may be limited by financial-services, AML, fraud-prevention, security, dispute-resolution, tax, legal, or recordkeeping obligations. We may need to verify your identity before responding to a request.

16. California and U.S. state privacy notices

Where CCPA/CPRA or similar U.S. state privacy laws apply, the categories of personal information we collect are described in Sections 2 through 4, the purposes are described in Sections 5 through 7, and the categories of recipients are described in Section 9. We do not knowingly sell or share personal information of minors. Financial information handled under GLBA may be exempt from some state-law rights, but we still apply the rights and choices that remain available under applicable law.

17. Children's privacy

The Services are intended for adults and are not directed to children. We do not knowingly collect personal information from children in violation of applicable law. If you believe a child has provided personal information to UffPay, contact us so we can review and take appropriate action.

18. Changes to this policy

We may update this Privacy Policy to reflect changes in law, technology, product features, partners, compliance requirements, or our data practices. When we make material changes, we will update the effective date above and provide additional notice where required by law. The current version will always be available on this page.

19. Contact us

For privacy questions, account-data requests, or privacy-rights requests, contact us:

• Email: support@uffpay.com
• UffPay Tech, Inc. - Florida, United States.
• UffPay, S.A. - Carretera a El Salvador 1-16, Apartamento 1, Fraijanes, Guatemala.
• Website form: you may also use the contact form on www.uffpay.com.

We will respond within a reasonable time and in accordance with applicable law.