Legal
How Tupay collects, uses and protects personal data across accounts, payments and stablecoin conversions.
Last updated September 2026
This Privacy Policy explains what personal data Tupay.space ("Tupay", "we", "us") collects, why we collect it, and the choices you have.
Because we provide regulated financial services, some of the data we collect is required by law. Where processing is mandatory, we cannot open or maintain an account without it.
Account data: your name, email address, company details, jurisdiction and the account type you selected.
Verification data: identity documents, date of birth, tax identification numbers and the results of sanctions and politically exposed person screening.
Transaction data: deposits, transfers, conversions, balances and the counterparties and references associated with them.
Technical data: device and browser information, sign-in history and security events recorded on your account.
To open and operate your account, execute your instructions and show you your balances and transaction history.
To verify your identity, meet anti-money-laundering and counter-terrorist-financing obligations, and comply with sanctions regimes.
To detect and prevent fraud, secure the service and record security-relevant events such as new device sign-ins.
To communicate with you about your account, and to improve the reliability and usability of the service.
Identity verification and KYC/AML screening are carried out with the support of our infrastructure partner Bridge. Documents you upload are used for the purpose of verification and are retained for as long as the law requires.
Where a verification provider determines that additional information is needed, that requirement is shown in the verification section of your dashboard.
Account and transaction records are retained for the period required by financial recordkeeping rules, which is typically five years after the end of the relationship.
Security logs and verification records are retained for the period necessary to demonstrate compliance and to defend against claims.
Data is encrypted in transit and at rest. Access to production systems is restricted to personnel who require it, and authentication to internal systems requires a second factor.
You can strengthen the protection of your own account by enabling two-factor authentication and keeping your recovery codes in a safe place.
Subject to applicable law, you may request access to your personal data, ask for it to be corrected, request its deletion, or object to certain processing.
Some requests cannot be granted where we are required to retain the data. Requests can be raised from the Support section of your dashboard.
Because payments and digital assets move across borders, your data may be processed outside your country of residence. Where that happens we rely on appropriate safeguards required by applicable law.
Questions about this policy, or about the data we hold about you, can be raised from the Support section of your dashboard.