Version 3.1 · Updated October 29, 2026 · Published revisions apply as notified

1 Scope and YapPay’s responsibilities

This Crypto Privacy Policy explains how YapPay handles personal information for merchant applications, accounts, KYB/KYC, anti-money-laundering and counter-terrorist-financing reviews, sanctions screening, transaction monitoring, payments, settlement and support. It applies to applicants, sole proprietors, beneficial owners, controlling persons, representatives, account users and customers or transaction counterparties whose information YapPay receives in connection with these activities. A merchant must provide any required customer-facing notices when supplying information to YapPay.

YapPay determines the purposes and means of its merchant onboarding, account administration and compliance processing and acts as the controller for those activities where that term applies. YapPay makes its merchant approval and account-review decisions, supported by verification, screening and monitoring technology. Other providers may process information on YapPay’s instructions or independently for their own functions, as explained below.

This policy supplements the YapPay Privacy Policy, which identifies YapPay and describes our general privacy practices. Read both notices together. For YapPay Crypto, this policy governs any conflicting description of onboarding, verification, approval, compliance monitoring, transaction or settlement practices.

2 Information and sources

Information may include names, date of birth, nationality, contact details, identity or tax numbers, business registration and licensing details, ownership and control, proof of address, banking details, wallet addresses, source-of-funds information, risk questionnaires, payment and exchange-quote records, payment-status history, refund and payout instructions, invoices, fulfillment evidence, customer-dispute records and support communications. Verification may also involve document images, selfies or video, facial comparison or liveness data, device and IP signals, sanctions and politically exposed person screening results, relevant adverse-media findings and review records, depending on the checks enabled and permitted.

Sources include you, authorized representatives, verification vendors, lawful registries and databases, screening providers and transaction partners. YapPay receives verification results and relevant evidence and maintains records directly or through authorized providers. Not every check or data category is used for every person or country. Application and acceptance records may exist even if an application is incomplete, declined or withdrawn.

Transaction and monitoring information may include sending, receiving, refund and settlement wallet addresses; blockchain transaction identifiers; assets, networks, amounts, timestamps and payment status; relevant public blockchain history and address-exposure information; geographic and device indicators; alerts, risk scores, case notes, supporting evidence and review outcomes. Wallet addresses and blockchain identifiers may be personal information when linked to an identifiable individual. Sources include payment activity submitted through YapPay, public blockchain records, screening and analytics services, public records, merchants and individuals providing information, and lawful official requests. We do not request wallet private keys or recovery phrases.

3 Purposes and legal bases

YapPay uses information to evaluate merchant applications; verify businesses, owners and relevant individuals; conduct ongoing due diligence; screen for sanctions, fraud, money laundering and terrorist-financing risks; monitor payments and payouts; investigate alerts and discrepancies; manage accounts and limits; process authorized payments and reimbursements; reconcile records; provide support; and respond to lawful obligations and requests. Where applicable, this includes maintaining compliance cases and making legally required or otherwise lawful disclosures or reports.

Where a legal basis is required, it depends on the activity and the individual. Contract performance or requested pre-contract steps may apply where the individual is party to the relevant contract. Other processing may rely on legitimate interests in secure services, fraud prevention and risk management, an applicable legal obligation, or specific consent. A business’s agreement does not by itself establish contract performance as the basis for every use of an owner’s or customer’s information. Sensitive, biometric and other specially protected information requires the additional conditions or consent applicable to that processing. This notice does not itself create a legal duty or substitute for a consent required separately.

4 Verification providers and sensitive data

YapPay requests business and identity verification using Didit as a verification technology provider. Didit generally processes verification information on YapPay’s instructions and may have limited independent purposes described in its notices. YapPay uses the results for its own merchant approval, ongoing due-diligence and review process. Additional authorized screening and monitoring providers may supply sanctions, fraud, wallet-risk or transaction-analysis services.

Verification Privacy Notice

End User Terms for Identity Verification

Where enabled, verification may use document images, face images or video, facial comparison and liveness analysis. We provide the applicable verification notices and obtain any legally required specific consent before capture. A business representative cannot supply another person’s required biometric consent merely by accepting merchant terms. Verification records, including any retained biometric templates, are subject to applicable retention and deletion requirements. We provide any additional biometric notice and retention information required for the verification flow.

5 Sharing information and service partners

YapPay shares information reasonably necessary for the requested services and its lawful compliance activities with verification, screening, blockchain-analysis, transaction-monitoring, hosting, security, communications, processing, conversion, custody, banking, payout and professional-service providers. This may include relevant identity and business details, merchant identifiers, approval or verification status, wallet and transaction information, alerts and supporting evidence, and refund or settlement details. YapPay administers merchant KYB/KYC and compliance reviews; this does not mean that every processing partner routinely receives a merchant’s full verification file. Relevant records may be shared for a necessary and lawful request, investigation, service requirement or legal obligation.

Providers acting as processors handle information under YapPay’s instructions and applicable contractual requirements. Some recipients independently determine how information is used for their own legal, security or compliance duties. We provide additional recipient information or notices where required by law. YapPay remains responsible for its own disclosures and for its obligations when engaging processors.

YapPay may also disclose relevant information to authorities, regulators, courts or law-enforcement agencies where required or permitted by law; to protect or exercise legal rights; or in a business transfer subject to applicable safeguards. Restrictions may prevent us from disclosing the existence or contents of a legally protected report or particular investigation records. Disclosure is limited to the relevant purpose and applicable legal basis.

6 Retention and deletion

YapPay maintains application, verification, transaction, monitoring, compliance-review and acceptance records for the periods needed for the service and applicable contractual, dispute and legal purposes. Retention depends on the category, purpose, jurisdiction and account status. Records relevant to a lawful investigation, unresolved complaint or legal claim may be preserved until the matter and any applicable retention duty are resolved. These preservation needs do not automatically justify retaining unrelated verification media or biometric information for the same period. Verification media and biometric data are retained only for their applicable purposes and lawful retention periods, which may be shorter than those for financial records. Contact [email protected] for information about retention applicable to your records.

Closing an account does not require deletion of records that must lawfully be retained. Deletion requests are assessed against applicable rights and retention duties and communicated to relevant processors where required. Public blockchain records generally cannot be changed or deleted by YapPay and may remain accessible indefinitely.

7 International processing

Your information may be processed outside the country where you or your business are located. For transfers YapPay arranges, we use the safeguards or authorizations required by applicable law. Depending on the transfer, these may include recognized contractual safeguards, an applicable adequacy decision or another lawful transfer basis. Where required, you may contact [email protected] for information about applicable destinations and safeguards, or a copy of available safeguards subject to necessary redactions. Required country-specific notices and explicit authorizations must be presented separately where needed. Acknowledging this policy is not blanket consent to every transfer, and the provider entity that contracts with YapPay does not alone determine an individual’s privacy rights.

8 Security cookies and external services

YapPay uses safeguards appropriate to the information and systems involved, but no electronic service is completely secure. Protect your credentials and report suspected compromise promptly to [email protected]. Necessary cookies and similar technologies may support login, security and service operation. Optional analytics or advertising technologies are subject to applicable notices and consent controls where required.

When you use an external verification service or open a third-party website linked from our pages, that service may receive technical information such as your IP address, browser or device details, access time and referrer, as well as information you submit directly. Its privacy notice explains its handling of that information. YapPay remains responsible for its own collection, use and disclosure of information.

9 Rights automated processing and review requests

Depending on applicable law, you may have rights to access, correct, delete or obtain a copy of information; restrict or object to processing; withdraw consent; or seek review of a privacy decision or a legally significant automated decision. Contact [email protected] with your request. We may need to verify identity and explain lawful exceptions or retention duties. A withdrawal may affect a service that requires the information, without affecting prior lawful processing.

YapPay coordinates requests relating to its merchant onboarding and account administration, including requests involving processors acting on its instructions. Independently controlled provider information may require a request to that provider using its published contact details. You may also complain to the competent privacy authority where applicable.

Verification, screening and transaction-monitoring tools may use automated comparisons, rules or risk scoring to identify discrepancies, unusual activity, potential list matches or other risk indicators. These results can influence requests for information, approval, limits and transaction or account review. Relevant factors may include those described in Sections 2 and 3, such as transaction patterns, location, ownership and wallet exposure. Some configured controls can temporarily restrict activity automatically while a matter is reviewed. Where applicable law requires additional notice, a particular legal basis, human intervention or a right to contest a legally significant solely automated decision, YapPay provides those protections. Contact [email protected] to request correction of inaccurate information or review; access may be limited for legally protected investigation or reporting information.

Send compliance concerns and requests for review of compliance-related account or transaction restrictions to [email protected]. Privacy-rights requests, including access, correction, deletion and privacy-related complaints, may be sent to [email protected]. If a request involves both privacy and compliance, YapPay will coordinate it internally; you do not need to submit it twice. These channels do not restrict your right to contact a competent authority.

10 Communications and changes

Acknowledging this policy does not enroll you in optional marketing. Marketing preferences should be collected separately where required, and you may use available unsubscribe or preference controls. Application, security, verification and account notices may still be necessary. We will publish changes with an updated effective date and provide additional notice or obtain consent where required. Acceptance of service terms and acknowledgment of a privacy notice do not replace any specific consent required for international transfers or other processing.

11 Contact

YapPay
Compliance concerns and compliance-related reviews: [email protected]
Crypto service support and privacy requests: [email protected]

Request a secure channel before submitting identity documents or other sensitive evidence. Do not send passwords, unrestricted API secrets, private wallet keys or recovery phrases.