This Privacy Policy is incorporated by reference into our Terms & Conditions. By creating a Zippy account or using our services, you agree to the collection and use of information as described in this Policy. If you do not agree, please do not use the Zippy app.
Information We Collect
- Account & profile information: name, email address, phone number, date of birth, residential address, country, username, and password (stored in hashed form by our authentication provider). For business accounts: business name, registration details, category, address, number of employees, founder name, and any social/website links you provide.
- Identity verification (KYC): to comply with anti-money-laundering and know-your-customer laws, we collect a government-issued ID document and a selfie or liveness capture. This is collected and verified through an embedded third-party identity-verification provider — Zippy does not independently store your raw ID document images outside that verification flow.
- Financial & transaction data: your wallet balance, transaction history, payment ID, transfer and payment request details (including any note or memo you attach), and virtual/physical card information issued through our card program partner.
- Payment method data: when you add money by card, your card details are entered directly into a hosted checkout page operated by our payment processor. Zippy's own servers and app do not directly capture or store your full card number.
- Device & security data: device model, operating system version, app version, a device-specific cryptographic key pair used to authorize your transactions, and (with your permission) a push-notification token used to deliver alerts to your device.
- Camera, microphone, and photo library: used only when you actively use a related feature — capturing identity documents during verification, taking or choosing a profile photo, scanning a QR code, or saving a QR code/receipt to your photos.
- Information you provide to support: anything you share with us when you contact customer support.
Information We Do Not Transmit
Your 6-digit transaction PIN and whether you've enabled biometric login (Face ID / fingerprint) are stored only on your device, encrypted, and are never sent to our servers. Biometric authentication itself is performed entirely by your device's operating system — Zippy never receives your fingerprint or face data.
App data cached on your device for performance (such as recently viewed activity) is stored in encrypted local storage.
How We Use Your Information
- To create and maintain your account, verify your identity, and comply with anti-money-laundering, sanctions-screening, and know-your-customer obligations under applicable law.
- To process transactions you authorize, including funding your wallet, sending or requesting money, and card issuance.
- To secure your account, including device-based fraud detection, authorizing transactions with your device's cryptographic key, and detecting unauthorized access.
- To send you push notifications and other communications about your account and transactions.
- To provide customer support and respond to your requests.
- To meet legal, regulatory, and recordkeeping obligations, including under the Bank Secrecy Act and similar laws.
How We Share Your Information
- With service providers who perform functions on our behalf, including our identity-verification vendor, payment processor and card program partner, authentication provider, and push-notification service — each only receives the data necessary to perform its function.
- With banking and payment-rail partners necessary to route and settle your transactions.
- With regulators, law enforcement, or other parties where required by law, legal process, or to protect Zippy's rights, users, or the public.
- In connection with a merger, acquisition, or sale of assets, subject to the same protections described in this Policy.
We do not sell your personal data.
International Data Transfers
Where personal data is transferred outside the jurisdiction in which it was collected, we rely on appropriate safeguards recognized under applicable law, including Standard Contractual Clauses, adequacy decisions, or equivalent lawful transfer mechanisms, to ensure your data remains protected wherever it is processed.
Data Retention & Deletion
We retain your personal data for as long as your account is active and as needed to provide the Zippy services. If you request account deletion, we will delete or de-identify your personal data within a commercially reasonable period, except for information we are required to retain under applicable law.
In particular, KYC identity-verification records and biometric source data (such as selfie images used for verification) are retained for up to seven (7) years following the end of your relationship with Zippy, consistent with recordkeeping obligations under the Bank Secrecy Act and equivalent anti-money-laundering laws. During this retention period, the data is restricted from active use and is not deleted, even if you request erasure. Data connected to an active dispute, investigation, or legal hold is retained only for as long as legally required.
For details on how to request deletion, see our Delete Account & Data page.
Your Rights and Choices
Subject to applicable law, you have the following rights over your personal data:
- Right to be informed about how your data is collected and used.
- Right of access — request a copy of the personal data we hold about you.
- Right to rectification — request correction of inaccurate or incomplete data.
- Right to erasure — request deletion of your data, subject to the retention exceptions described in Section 6.
- Right to restriction of processing in certain circumstances.
- Right to data portability — receive your data in a structured, commonly used, machine-readable format.
- Right to object to processing based on legitimate interests.
- Right to withdraw consent at any time, where processing is based on consent.
- Rights related to automated decision-making — our risk-scoring and fraud-detection systems may use automated processing, but where such processing materially affects your access to a financial service, you have the right to obtain human review, express your point of view, and contest the decision.
- Right to lodge a complaint with your local data protection supervisory authority.
You may access and update most of your account information directly in the app, and you may close your account at any time from your account settings.
How to Exercise Your Rights
You may submit a request to access, correct, restrict, or delete your personal data, or to exercise any other right described above, through any of the following channels:
- Email our Data Protection Officer at dpo@zippytechnologies.net
- Postal mail to Zippy Technologies Inc., 218 NW 24th Street, 2nd & 3rd Floors, Miami, Florida 33127, United States
What to expect: before responding, we take reasonable steps to verify your identity, proportionate to the sensitivity of the data requested. We respond without undue delay and, in any event, within one month of receiving your request — this may be extended by up to two further months for complex or numerous requests, in which case we'll tell you why. Requests are handled free of charge.
Data Security
We use industry-standard measures to protect your data, including encryption of data in transit and, on your device, encrypted local storage for cached app data and secure, hardware-backed storage for sensitive credentials and cryptographic keys. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
Children's Privacy
The Zippy services are not directed to, and may not be used by, anyone under eighteen (18) years of age, or the age of legal majority in their jurisdiction of residence if higher. We do not knowingly collect personal data from children.
Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes through the Zippy application, by email, or by posting an updated version with a new effective date. Your continued use of the Zippy services after an update takes effect constitutes your acceptance of the updated Policy.
Contact Us
If you have questions about this Privacy Policy or wish to exercise any of your rights, contact us at dpo@zippytechnologies.net or admin@zippytechnologies.net.
Zippy Technologies Inc., 218 NW 24th Street, 2nd & 3rd Floors, Miami, Florida 33127, United States.