1. Introduction
This Privacy Policy describes the ways in which CowCard gathers, uses, retains, discloses, and otherwise handles personal information and personal data through our website, Telegram bot, Telegram mini application, mobile and web-based interfaces, wallet services, card services, customer support channels, compliance operations, and related products and services (together, the "Services").
The purpose of this Privacy Policy is to give clear and transparent details about how we handle information about identified or identifiable individuals, such as customers, prospective customers, authorised users, website visitors, business contacts, and people who reach out to us regarding customer support or compliance-related issues.
Our Services may involve crypto-funded payment functionality, wallet functionality, card issuance and card management tools, balance display, funding and settlement functionality, digital wallet provisioning (including Apple Pay and other supported wallet solutions), payment processing capabilities, transaction monitoring, customer support, security controls, and compliance-related checks. Through our Telegram bot and embedded mini application, users may be able to reach certain features, such as checking balances, funding or managing a card, requesting card issuance, and adding an eligible card to a supported digital wallet, all subject to product availability, programme rules, legal restrictions, and partner requirements.
Since our Services may be offered worldwide, including to people located in the European Union and the United Kingdom, this Privacy Policy is built to cover the data protection requirements that apply to both our Canadian operations and our international user base.
When you use our Services, engage with our website, Telegram bot, mini application, or other interfaces, provide information to us, open an account, request or use a card product, connect a wallet, or reach out to us about the Services, you acknowledge that your information will be handled in line with this Privacy Policy.
2. Scope of This Privacy Policy
This Privacy Policy covers all personal data that we handle in connection with providing and running our Services, including via our website, Telegram bot, Telegram mini application, and any other digital interfaces or platforms offered by the Company.
More specifically, this Privacy Policy covers personal data handled in connection with:
- our website, its landing pages, and web-based interfaces;
- our Telegram bot and embedded mini application, covering user interactions, commands, and in-app features;
- account sign-up, onboarding, and user verification workflows;
- wallet functionality, covering the storage, display, and management of balances and transaction history;
- issuance, activation, management, and use of virtual or physical cards (including integration with digital wallet providers such as Apple Pay or similar services);
- crypto funding, top-up, conversion, exchange, spending, withdrawal, and settlement capabilities;
- payment processing, covering card transactions, authorisation, clearing, and settlement flows;
- customer service interactions, support requests, complaints, disputes, and the handling of chargebacks;
- compliance-related handling, covering anti-money laundering (AML), counter-terrorist financing (CTF), sanctions screening, fraud prevention, transaction monitoring, and risk assessment;
- security, authentication, and account protection safeguards;
- marketing and promotional communications, where allowed by applicable law;
- technical, device, behavioural, and analytics data gathered in connection with your use of our Services across all supported platforms.
This Privacy Policy does not cover personal data handled by third parties that are outside the Company's control, including but not limited to:
- third-party websites or services reached through links within our Services;
- financial institutions, payment service providers, card issuers, or programme partners that act as independent controllers;
- digital wallet providers (for example, Apple Pay or similar services);
- blockchain networks and distributed ledger systems, which run independently of the Company and may record transaction data on a public and immutable basis;
- merchants and merchant acquirers taking part in payment transactions.
These third parties may handle your personal data under their own privacy policies and legal terms. We encourage you to read those policies before using their services or engaging with them through our platform.
3. Applicable Privacy and Related Compliance Regimes
3.1 Canadian privacy framework
As a Canadian company, we handle personal information in line with the Personal Information Protection and Electronic Documents Act (PIPEDA), which governs private-sector organisations that collect, use, or disclose personal information during commercial activities.
Moreover, several Canadian provinces have passed private-sector privacy laws that are considered substantially similar to PIPEDA, including those of Alberta, British Columbia, and Quebec. Where relevant, such provincial legislation may apply to particular processing activities depending on where the individual is located and the nature of the processing.
When we collect personal information by digital or technological means from people located in Quebec, we strive to present this Privacy Policy in a clear, accessible, and understandable way, consistent with applicable legal expectations.
3.2 GDPR and UK GDPR
Because our Services may be offered to people located in the European Union and the United Kingdom, we may fall under the General Data Protection Regulation (EU) 2016/679 (GDPR) and the UK GDPR, including their extra-territorial reach.
Where these laws apply, we handle personal data according to the core data protection principles, including lawfulness, fairness, and transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, and accountability.
We also strive to present privacy information in a clear and user-friendly format, including through layered notices within our website, Telegram bot, mini application, and other interfaces where relevant.
3.3 AML, sanctions, card scheme, and related compliance frameworks
We work in a setting where privacy duties overlap with other legal and regulatory duties, including those relating to anti-money laundering and counter-terrorist financing, sanctions compliance, fraud prevention, transaction monitoring, card programme and payment network requirements, dispute and chargeback handling, regulatory reporting, and record retention obligations.
As a result, in certain situations we may handle personal data not only to deliver the service, but also to satisfy legal obligations, safeguard our systems and users, fulfil partner requirements, or prevent abuse, fraud, or other unlawful activity.
4. Categories of Personal Data We Process
The categories of personal data we handle depend on which Services you use, the functionality you reach (including via our website, Telegram bot, or mini application), your location, the applicable product tier, our legal and regulatory obligations, the behaviour and activity tied to your account, and the requirements set by our partners, including payment institutions, card issuers, and compliance service providers.
4.1 Account and profile information
In connection with creating an account and your ongoing use of our Services, we may handle personal data needed to identify and manage your account and stay in touch with you. This may include your name, username or account identifier, date of birth, country of residence, nationality, and contact details such as your email address or telephone number.
We may also handle account-related metadata, including account status, internal reference numbers, preferred language, and communication preferences, so as to deliver the Services and support users.
4.2 Identity verification and compliance data
Depending on the nature of the Services used, applicable legal requirements, transaction thresholds, risk indicators, or partner requirements, we may handle personal data for identity verification and compliance purposes. This may include information taken from government-issued identification documents, images or copies of such documents, and, where relevant, biometric verification elements such as selfie images or liveness checks.
Where needed for compliance purposes, we may also handle information about your financial profile or transactional behaviour, including source of funds or source of wealth information, screening results, sanctions and politically exposed person (PEP) checks, and other compliance-related assessments.
Further information may be created internally, such as verification status, risk scores, compliance notes, case management records, adverse media checks, and enhanced due diligence outcomes. Such handling may take place both at onboarding and throughout the life of your account.
4.3 Card and payment programme data
When you use card-related functionality, including virtual or physical cards and integrations with digital wallets such as Apple Pay or similar services, we handle personal data needed to issue, manage, and run the card. This may include information about your card application, card status, tokenised identifiers, provisioning status for digital wallets, and operational data about card usage.
We may also handle transaction-related data, including authorisation and settlement records, transaction amounts, merchant categories, and merchant descriptors, along with data about declined, blocked, reversed, or disputed transactions. Information tied to chargebacks, refunds, and dispute resolution may likewise be handled as part of the card lifecycle. Wherever possible, we aim to limit the handling of sensitive payment data by relying on tokenisation and secure processing arrangements through regulated partners.
4.4 Wallet, crypto, and transaction data
When you use wallet or crypto-related features, we handle data tied to blockchain-based and off-chain transactions. This may include wallet addresses, whitelisted addresses, deposit and withdrawal instructions, transaction hashes, blockchain identifiers, timestamps, transaction values, and asset types.
We may also handle internal records tied to funding, withdrawals, settlement, liquidity operations, and reconciliation processes. On top of that, we may handle blockchain analytics data and risk signals, including indicators drawn from transaction monitoring tools or compliance providers, to gauge transaction risk, spot suspicious activity, and stay compliant with applicable legal obligations.
4.5 Device, technical, and usage data
When you reach or engage with our Services through our website, Telegram bot, mini application, or other interfaces, we may gather and handle technical and device-related information. This may include your IP address, device identifiers, operating system, application or browser version, language settings, and device characteristics.
We may also handle usage data such as session activity, login events, authentication records, and behavioural interactions with the Services. Technical logs, crash reports, and performance data may be gathered to keep systems stable and improve service functionality. In some cases, we may derive approximate geolocation information from technical data where relevant for security, compliance, or fraud prevention purposes.
4.6 Customer support and communications data
When you engage with us through customer support channels, we may handle personal data contained in your communications. This may include support tickets, chat messages, email correspondence, complaint records, and dispute-related communications.
Where relevant and legally permitted, we may also handle call recordings and internal notes made by support or compliance personnel. Such data is used to answer your requests, resolve issues, raise service quality, and keep records for compliance and audit purposes.
4.7 Marketing and preference data
Where applicable law permits, we may handle personal data for marketing and communication purposes. This may include information about your subscription to newsletters or promotional materials, your communication preferences, and your interactions with marketing campaigns.
We may also handle data about referral programmes, loyalty schemes, or promotional incentives, where such features are offered. You may opt out of marketing communications at any time by following the instructions given in such communications or within your account settings.
4.8 Cookies, SDKs, and similar technologies
We and our service providers may use cookies, software development kits (SDKs), pixels, local storage, and similar technologies to gather information about your interactions with our Services. These technologies may serve to support functionality, strengthen security, analyse usage, and, where permitted, deliver marketing communications.
Such data may include identifiers, usage patterns, and technical information tied to your device or application environment. Where the law requires it, we will obtain your consent before using non-essential technologies that store or access information on your device.
5. Sources of Personal Data
We gather personal data from a range of sources so as to deliver our Services, meet legal and regulatory obligations, ensure security, and keep our platform running properly.
In many cases, personal data comes directly from you when you engage with our Services. This covers situations where you register an account, use our website, Telegram bot or mini application, submit information during onboarding, start or complete transactions, request a card, contact customer support, or otherwise communicate with us.
We also gather certain information automatically through your use of the Services. This covers technical, device, and usage-related data created when you reach or engage with our website, application, or other interfaces. Such data may be gathered through system logs, security monitoring tools, cookies, SDKs, and similar technologies, and serves operational, security, and analytical purposes.
On top of that, we may receive personal data from third parties involved in delivering our Services. These include payment institutions, card issuers, programme managers, processors, liquidity providers, compliance and identity verification providers, transaction monitoring and blockchain analytics providers, customer support tools, and other technology or infrastructure partners. Such parties may supply information needed to enable transactions, carry out compliance checks, prevent fraud, or support the running of our Services.
We may also obtain data from blockchain networks and related analytical tools where this is needed to process transactions, verify activity, or gauge risk. Given the nature of distributed ledger technologies, certain transaction-related information may be publicly accessible and may be examined using specialised tools.
Where needed for compliance purposes, we may gather or receive information from publicly available sources and official databases, including sanctions lists, politically exposed person (PEP) registers, adverse media sources, fraud prevention databases, and regulatory or law enforcement data sources.
In connection with payment transactions, disputes, or chargebacks, we may also receive data from merchants, acquiring banks, payment processors, card networks, or dispute resolution entities. This information may serve to process transactions, investigate claims, or resolve disputes.
Lastly, in the context of business accounts or corporate relationships, we may receive personal data from authorised representatives, directors, beneficial owners, or other individuals acting on behalf of a legal entity.
6. Purposes for Which We Process Personal Data
We handle personal data in order to provide, run, and improve our Services, as well as to meet legal and regulatory requirements and safeguard the security and integrity of our platform.
6.1 Service provision
We handle personal data to provide and run our Services, including creating and managing user accounts, enabling wallet functionality, processing crypto funding and settlement, issuing and managing card products, supporting digital wallet integrations, processing payments and withdrawals, authenticating users, and sending account-related communications such as notifications and statements.
6.2 Compliance and legal obligations
We handle personal data to meet applicable laws and regulatory requirements, including anti-money laundering and sanctions obligations, transaction monitoring, record-keeping, and responding to lawful requests from regulators, courts, and law enforcement authorities. We may also handle data to satisfy requirements set by payment partners, issuers, and card programme providers.
6.3 Fraud prevention, risk management, and security
We use personal data to safeguard our Services and users by spotting and preventing fraud, identifying suspicious activity, managing risk, and ensuring platform security. This may involve applying restrictions, carrying out investigations, and responding to security incidents.
6.4 Customer support and dispute management
We handle personal data to provide customer support, answer inquiries, handle complaints, and manage disputes, including chargebacks and transaction-related issues.
6.5 Service improvement and analytics
We examine personal data to track performance, improve functionality, enhance user experience, and support internal reporting and operational decision-making.
6.6 Marketing
Where applicable law permits, we may use personal data to send marketing communications, run promotional or referral programmes, and understand how effective our communications are. You may opt out of such communications at any time.
7. Verification and Additional Information
We may ask for identity verification or additional information at any point in the relationship where this is needed to meet applicable laws, regulatory obligations, or partner requirements, or where it is called for on security or risk management grounds.
This may happen, for instance, when transaction thresholds are met, when unusual or potentially suspicious activity is detected, or when our payment partners, issuers, or service providers set verification requirements.
Access to certain features, transaction limits, or continued use of the Services may depend on additional verification measures. The scope of data gathered and the level of verification required may shift over time based on legal, contractual, or operational considerations.
8. Automated Decision-Making and Profiling
We may use automated tools, rule-based systems, and risk scoring mechanisms to gauge risk, detect fraud, monitor transactions and wallet activity, and support compliance and security processes. This may involve profiling built on transaction patterns, wallet behaviour, device and technical indicators, sanctions screening results, fraud alerts, and other behavioural or risk-related signals.
Because of such handling, certain actions may be taken automatically or semi-automatically, including asking for additional information or verification, applying account or transaction restrictions, reviewing or declining card issuance, delaying or rejecting transactions, or, where needed and permitted by law, suspending or closing an account.
Where applicable data protection laws require it, we will give you additional information about such handling and the rights available to you in relation to automated decision-making.
9. Blockchain-Specific Privacy Disclosures
Some features of our Services may rely on blockchain or distributed ledger technologies that are public, decentralised, and outside the Company's control.
When you use wallet functionality, crypto funding, withdrawals, settlement, or blockchain-linked transactions, certain information may be written to a blockchain network. This may include wallet addresses, transaction hashes, timestamps, asset types, and transaction amounts. Depending on the context, such data may be publicly accessible.
Owing to the nature of blockchain technology, records placed on a blockchain are generally immutable or hard to change. As a result, we may be unable to delete, amend, or restrict access to data that has been recorded on a public blockchain. For this reason, we aim to limit the use of personal data on-chain and, where possible, keep user-identifying information off-chain within controlled environments.
We may keep off-chain records tied to blockchain activity for operational, compliance, reconciliation, and support purposes. That said, certain data subject rights, such as the right to erasure, may be limited where the relevant data is held on a blockchain outside our control.
Where public keys, wallet addresses, transaction metadata, hashed values, or encrypted records can reasonably be tied to an identifiable individual, we may treat such data as personal data and handle it in line with applicable data protection laws.
10. Card Ecosystem and Digital Wallet Disclosures
Our card-related Services function within a wider payment ecosystem made up of multiple independent entities, each of which may handle personal data in connection with card issuance, payment authorisation, transaction processing, settlement, dispute handling, tokenisation, fraud prevention, and programme administration.
Depending on how the card programme is structured, your personal data may be handled by various participants in the payment chain, including the card issuer or BIN sponsor, programme manager, card processor, payment networks (such as Visa or Mastercard), merchant acquirers and processors, dispute resolution providers, and digital wallet or tokenisation providers.
When you choose to add your card to a digital wallet, such as Apple Pay, Google Pay, or similar services, your card details may be swapped for a tokenised or device-specific identifier for transaction purposes. This means that, during payments, the underlying card number is not shared with merchants, which strengthens security and reduces exposure of sensitive payment data.
Each of these entities may act as an independent controller or processor of personal data in line with their own legal and regulatory obligations. We encourage you to read the privacy policies of such third parties to understand how your data is handled within the wider payment ecosystem.
11. Sharing of Personal Data
We may share personal data with third parties where this is needed for the purposes set out in this Privacy Policy, including to deliver the Services, meet legal obligations, ensure security, and function within the wider financial and technical ecosystem that supports our platform.
11.1 Programme and payment partners
We may share personal data with entities involved in running our payment and card programmes, including:
- card issuers or their BIN sponsors;
- programme managers and card processing firms;
- payment institutions and their banking partners;
- providers of settlement and liquidity;
- digital wallet providers (for example, Apple Pay or similar services);
- infrastructure providers for transaction processing and dispute resolution.
These entities may handle personal data as part of payment authorisation, settlement, fraud prevention, and programme administration.
11.2 Compliance and security providers
We may share personal data with third-party providers that support our compliance and risk management functions, including:
- providers of identity verification and KYC;
- providers of AML and sanctions screening;
- providers of transaction monitoring and blockchain analytics;
- vendors handling fraud prevention and risk assessment;
- service providers for compliance and case management.
11.3 Technology and support providers
We depend on various service providers to support the running of our Services. These may include:
- providers of cloud hosting and infrastructure;
- cybersecurity and IT service vendors;
- providers of analytics and performance monitoring;
- platforms for customer support and communication;
- tools for document management and workflow.
These providers handle personal data on our behalf or in line with their own legal obligations, subject to appropriate contractual and technical safeguards.
11.4 Professional advisers and authorities
We may share personal data with:
- legal advisers, auditors, and insurance providers;
- regulators, tax authorities, and supervisory agencies;
- law enforcement bodies, courts, or other competent public authorities,
where such disclosure is required or allowed by applicable law.
11.5 Corporate transactions
Should there be a merger, acquisition, financing, restructuring, or sale of assets, personal data may be disclosed to relevant parties as part of the transaction process, subject to appropriate confidentiality and data protection safeguards.
We do not sell personal data in the ordinary sense of trading user information for monetary consideration.
12. International Transfers of Personal Data
As a Canadian company with international users, partners, and service providers, we may handle and transfer personal data across borders, including between:
- Canada and the European Union or European Economic Area;
- Canada and the United Kingdom;
- Canada and the United States of America;
- Canada and further jurisdictions in which our service providers operate.
Where applicable law requires it, we use appropriate transfer mechanisms and safeguards. Depending on the circumstances, these may include:
- reliance on an adequacy decision;
- Standard Contractual Clauses;
- the UK International Data Transfer Agreement or UK Addendum;
- risk assessments for transfers;
- additional technical, organisational, or contractual safeguards.
When personal data is transferred from the EU to Canada, such transfers may, where relevant, rely on the European Commission adequacy decision for commercial organisations in Canada. When personal data is transferred from the UK, we assess whether UK transfer requirements are met, including whether the relevant processing falls under the applicable adequacy framework or calls for a separate transfer mechanism.
When transfers involve jurisdictions not covered by adequacy, we aim to put in place contractual and operational safeguards to provide an appropriate level of protection.
13. Data Retention
We keep personal data only for as long as needed for the purposes set out in this Privacy Policy, unless a longer retention period is required or allowed by law.
Retention periods differ depending on the category of data and the purpose of processing. As a general rule:
- account and service records may be kept for the length of the account relationship and for a period after closure to handle claims, audits, or regulatory requirements;
- customer support and dispute records may be kept for the period needed to resolve the issue and for a reasonable period afterwards;
- marketing preference records may be kept to honour opt-out choices and maintain suppression lists;
- technical logs may be kept for shorter periods unless needed for security investigations;
- regulated compliance records, including AML-related records, may be kept for at least five years after the end of the business relationship or the relevant transaction, where the law requires it.
Retention may be extended where needed to comply with law, to respond to investigations, to establish, exercise, or defend legal claims, to handle disputes, to enforce our contractual terms, or to investigate fraud or abuse.
Once retention is no longer needed, we aim to delete, anonymise, or irreversibly de-identify data, unless such deletion is not feasible owing to legal requirements or the nature of blockchain records.
14. Security Measures
We put in place technical and organisational measures intended to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or unauthorised access. Such measures may include:
- encryption both in transit and at rest for sensitive information, where appropriate;
- access control based on least-privilege principles;
- multi-factor authentication to gain administrative access;
- monitoring and logging activity;
- internal separation of duties;
- management of vulnerabilities;
- secure practices for software development;
- vendor due diligence together with contractual controls;
- tokenisation or other card security controls where relevant;
- incident response planning and procedures for handling breaches.
Where payment card data environments are involved, relevant programme participants or providers may operate in line with payment security standards, including PCI DSS-aligned requirements, where applicable.
No method of transmission or storage is entirely secure. For this reason, although we take reasonable and proportionate steps to protect your information, we cannot guarantee absolute security.
15. Your Privacy Rights
Depending on where you are located and which laws apply to you, you may hold some or all of the following rights over your personal data:
- the right to ask for access to your personal data;
- the right to ask for correction of inaccurate or incomplete data;
- the right to ask for deletion of data in certain situations;
- the right to ask for restriction of processing in certain situations;
- the right to object to certain processing, such as direct marketing;
- the right to data portability, where relevant;
- the right to withdraw consent where processing relies on consent;
- the right to file a complaint with a supervisory authority or privacy regulator.
These rights are not absolute and may be limited where processing is needed to meet legal obligations, prevent fraud, protect security, keep records required by law, or where certain data is written to a blockchain beyond our practical control.
To exercise your rights, please reach out to us using the details set out in this Privacy Policy. We may ask for information needed to verify your identity before responding.
16. Marketing Choices
When we send marketing communications, you may opt out at any time by:
- clicking the unsubscribe link in the communication;
- adjusting your account settings, where available;
- reaching out to us directly.
Even after you opt out of marketing communications, we may still send you service, security, legal, compliance, or account-related messages where needed.
17. Children and Minors
Our Services are not meant for children, and we do not knowingly offer or provide our Services to individuals who are not legally allowed to use them under applicable law.
If we learn that we have gathered personal data from a child or minor in breach of applicable law or our programme rules, we may take steps to delete the data, restrict the account, or request additional information from the parent, guardian, or user, as appropriate.
18. Changes to This Privacy Policy
We may revise this Privacy Policy from time to time to reflect changes in our Services, legal requirements, partner arrangements, technology, or business operations.
When we make changes, we will post the updated version on our website and refresh the "Last updated" date above. Where the law requires it or where changes are material, we may give additional notice through the application, by email, or by other appropriate means.
Your continued use of the Services after an updated Privacy Policy takes effect may be treated as acknowledgement of the updated Policy, to the extent the law permits.
To exercise your rights or raise a question about this Privacy Policy, reach out to us at moo@cowcard.xyz or through the official Telegram bot.