PRIVACY POLICY
1. INTRODUCTION AND SCOPE
1.1 Overview. This Privacy Policy ("Policy") describes how ARTCLUB 88 FINANCE CORPORATION (collectively, "ArtPay," "Company," "we," "us," or "our"), collects, uses, discloses, stores, and protects personal information when you access or use the Client website at https://artpay.co (the "Site"), application ArtPay (the "App"), and all services provided or facilitated thereby (collectively, the "Platform" or "Services").
1.2 Acceptance. By accessing or using the Platform, creating an Account, or otherwise providing information to us, you acknowledge that you have read, understood, and agree to the practices described in this Policy. If you do not agree to this Policy, you must immediately cease all access to and use of the Platform.
1.3 Infrastructure Partner and Technology. Platform technology is provided by SquareFi Inc., a Delaware corporation ("Technology Provider"), which supplies the technology layer only and is not a financial institution. Card program infrastructure, KYC/KYB verification checks, and AML compliance and monitoring are provided by BUYEASY TECHNOLOGY CO., LTD, a company incorporated in Ontario, Canada (the "Infrastructure Partner"), our sole Infrastructure Partner, together with its licensed financial partners (including card issuers) where applicable. All Cardholders must complete identity verification before a Card may be issued or used. We collect Customer Information through the Platform and transmit it to the Infrastructure Partner's verification flow (including tools such as Sumsub). The Infrastructure Partner performs verification checks, AML monitoring, and determines verification outcomes. The Infrastructure Partner does not itself act as the card issuer and does not have a direct contractual relationship with you unless required by applicable law.
1.4 Scope. This Policy governs personal information we collect through the Platform, including information submitted for KYC and KYB verification. All Cardholders must complete identity verification to receive or use a Card or Payment Services. Verification checks are performed by our Infrastructure Partner, BUYEASY TECHNOLOGY CO., LTD, not by us.
2. INFORMATION WE COLLECT
2.1 Information You Provide. We collect information you voluntarily provide, including: (a) account information such as full legal name, date of birth, email address, phone number, residential address, username, and password; (b) identity verification information such as government-issued identification documents, photographs, tax identification numbers, and other documentation required for verification; (c) business information for entity accounts such as registered business name, jurisdiction of incorporation, business address, nature of business, corporate documentation, and information about administrators and authorized users; (d) beneficial ownership information including names, dates of birth, addresses, identification documents, and ownership percentages of Ultimate Beneficial Owners; (e) financial information such as bank account details, payment card information, transaction history, and source of funds documentation; and (f) communications including records of correspondence with us, support inquiries, and feedback.
2.2 Information Collected Automatically. When you use the Platform, we automatically collect: (a) device information such as device type, operating system, unique device identifiers, browser type and version, and mobile network information; (b) usage information such as pages viewed, features used, clickstream data, session duration, and interaction patterns; (c) location information such as IP address, approximate geographic location, and time zone; and (d) log data such as access times, error logs, and diagnostic information.
2.3 Information from Third Parties. We may receive information from: (a) identity verification providers including results of identity checks, document verification, and fraud screening; (b) financial service providers including transaction data, account status, and compliance-related information; and (c) public sources including publicly available information for verification and compliance purposes.
2.4 Cookies and Tracking Technologies. We use cookies, pixels, and similar technologies to collect information about your use of the Platform, remember your preferences, and improve your experience. We use: (a) essential cookies required for Platform functionality and security; (b) analytics cookies to understand how users interact with the Platform; and (c) preference cookies to remember your settings. You may manage cookie preferences through your browser settings; however, disabling certain cookies may affect Platform functionality.
3. USE OF INFORMATION
3.1 Service Provision. We use your information to: (a) create and manage your Account; (b) provide and operate the financial services accessed through the Platform; (c) process and display transactions; (d) provide customer support; and (e) communicate with you about your Account and Services.
3.2 Compliance and Security. We use your information to: (a) collect and transmit Customer Information for KYC/KYB verification performed by our Infrastructure Partner, BUYEASY TECHNOLOGY CO., LTD; (b) support compliance with Anti-Money Laundering ("AML") laws and regulations applicable to the Infrastructure Partner; (c) detect, prevent, and investigate fraud, unauthorized access, and other illegal activities; (d) comply with legal obligations, court orders, and regulatory requests; and (e) enforce our Cardholder Terms of Service and protect our rights.
3.3 Improvement and Analytics. We use your information to: (a) analyze usage patterns and improve the Platform; (b) develop new features and services; (c) conduct research and analytics; and (d) personalize your experience.
3.4 Communications. We use your information to: (a) send service-related notices and updates; (b) respond to your inquiries; and (c) send marketing communications where you have provided consent or as otherwise permitted by law.
4. DISCLOSURE OF INFORMATION
4.1 Infrastructure Partner. We disclose your information to our Infrastructure Partner, BUYEASY TECHNOLOGY CO., LTD, and, where required, its licensed financial partners, to perform KYC/KYB verification checks, AML compliance and monitoring, card issuance and Payment Services, and to deliver the card program infrastructure underlying the Services. Such disclosures are made under this Policy and applicable law.
4.2 Service Vendors. We disclose information to vendors who assist us in operating the Platform, including: (a) cloud hosting providers; (b) analytics services; (c) identity verification providers; (d) customer support tools; and (e) payment processors. Such vendors are contractually obligated to protect your information and use it only for the purposes for which it was disclosed.
4.3 Legal and Compliance. We may disclose your information: (a) to comply with applicable laws, regulations, or legal processes; (b) in response to requests from government authorities or law enforcement; (c) to protect our rights, privacy, safety, or property, or that of our users or third parties; and (d) in connection with investigations of suspected fraud, illegal activity, or violations of our Cardholder Terms of Service.
4.4 Business Transfers. In connection with any merger, acquisition, reorganization, sale of assets, or bankruptcy, your information may be transferred to the acquiring or successor entity.
4.5 With Consent. We may disclose your information for other purposes with your explicit consent.
4.6 No Sale of Personal Information. We do not sell your personal information to third parties.
5. DATA RETENTION
5.1 Retention Period. We retain your personal information for as long as necessary to: (a) provide Services and maintain your Account; (b) comply with legal and regulatory obligations, including AML record-keeping requirements of at least five (5) years after Account closure; (c) resolve disputes and enforce agreements; and (d) meet audit and compliance requirements.
5.2 Deletion. When retention is no longer required, we shall securely delete or anonymize your information in accordance with our data retention policies and applicable law.
6. DATA SECURITY
6.1 Security Measures. We implement appropriate technical and organizational measures to protect your information, including: (a) encryption of data in transit and at rest; (b) access controls and authentication mechanisms; (c) regular security assessments and monitoring; and (d) employee training on data protection.
6.2 No Guarantee. While we implement reasonable security measures, no method of transmission over the Internet or method of electronic storage is completely secure. We cannot guarantee the absolute security of your information.
6.3 Breach Notification. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will follow our incident response procedures and notify affected individuals and the relevant supervisory authorities as and when required by applicable law, without undue delay.
7. YOUR RIGHTS AND CHOICES
7.1 General Rights. Subject to applicable law and certain exceptions, you may have the right to: (a) access and obtain a copy of the personal information we hold about you; (b) request correction of inaccurate or incomplete information; (c) request deletion of your personal information; (d) request a copy of your data in a structured, machine-readable format; (e) request restriction of processing in certain circumstances; (f) object to processing based on legitimate interests; and (g) withdraw consent where processing is based on consent.
7.2 GDPR Rights. If you are located in the European Economic Area or United Kingdom, you have rights under the General Data Protection Regulation ("GDPR") and applicable local law, including the rights set forth in Section 7.1. Our legal bases for processing include: (a) performance of a contract; (b) compliance with legal obligations; (c) legitimate interests; and (d) consent.
7.3 CCPA/CPRA Rights. If you are a California resident, you have rights under the California Consumer Privacy Act ("CCPA") and California Privacy Rights Act ("CPRA"), including the right to: (a) know what personal information we collect, use, and disclose; (b) request deletion of your personal information; (c) opt-out of the sale or sharing of your personal information; (d) correct inaccurate personal information; (e) limit use of sensitive personal information; and (f) non-discrimination for exercising your rights. We do not sell your personal information.
7.4 PIPEDA Rights (Canada). If your personal information is processed under Canadian jurisdiction, the Personal Information Protection and Electronic Documents Act ("PIPEDA") and applicable provincial privacy laws govern that processing. We rely on consent, performance of a contract, or compliance with legal obligations as the basis for processing. Subject to legal and contractual restrictions, you may withhold or withdraw consent and request access to or correction of your personal information. If you have a privacy concern that we are unable to resolve, you may contact the Office of the Privacy Commissioner of Canada (OPC).
7.5 Other Jurisdictions. If you are located in another jurisdiction with applicable data protection laws, you may have additional rights under those laws.
7.6 Exercising Rights. To exercise any of your rights, submit a request to [email protected]. We shall respond within the timeframe required by applicable law and may require verification of your identity prior to processing your request.
7.7 Marketing Opt-Out. You may opt out of marketing communications at any time by: (a) clicking "unsubscribe" in any marketing email; or (b) contacting us at [email protected]. You shall continue to receive transactional and service-related communications.
7.8 Automated Decision-Making. We may use automated tools for identity verification, sanctions screening, fraud detection, and risk scoring as part of providing the Services and meeting our regulatory obligations. Where an automated decision produces a legal or similarly significant effect concerning you, we provide, where required by applicable law, information about the logic involved and its significance, and a means to request human review.
8. INTERNATIONAL DATA TRANSFERS
8.1 Transfer Locations. Your information may be transferred to and processed in countries other than your country of residence, including the United States, where data protection laws may differ from those in your jurisdiction.
8.2 Safeguards. When we transfer data internationally, we implement appropriate safeguards as required by applicable law, including standard contractual clauses approved by relevant authorities.
9. CHILDREN'S PRIVACY
The Platform is not intended for individuals under eighteen (18) years of age or the age of majority in their jurisdiction, whichever is greater. We do not knowingly collect personal information from children. If we become aware that we have collected information from a child, we shall promptly delete such information.
10. CHANGES TO THIS POLICY
10.1 Modifications. We may update this Policy from time to time by posting the revised Policy on the Platform and updating the "Last Updated" date. Material changes shall be communicated via email or Platform notification where required by law.
10.2 Continued Use. Your continued use of the Platform after changes become effective constitutes acceptance of the updated Policy.
10.3 Version Control. We maintain version control and update logs for this Policy for at least five (5) years. Previous versions are available upon request to [email protected].
11. CONTACT INFORMATION
Privacy Inquiries:
ARTCLUB 88 FINANCE CORPORATION
ArtPay
Email: [email protected]
General Support:
Email: [email protected]
For inquiries regarding how your personal information is processed, please contact us using the details above.
SCHEDULE A. HOW THE ARTPAY APP HANDLES YOUR DATA
A.1 This Schedule. This Schedule A forms part of this Policy. It describes, for the ArtPay mobile app for iOS and Android, exactly what we collect, which providers see it, what stays on your phone and how long we keep it. If it conflicts with Sections 1 to 11, those Sections prevail. "ARTCLUB" means ARTCLUB 88 FINANCE CORPORATION, a company incorporated in British Columbia, Canada (registry code BC1443242; FINTRAC money services business No. M23048467; 44322 Yale Rd, Unit 3B #277, Chilliwack, British Columbia, V2R 4H1, Canada), the controller of your personal information. "Our Partner" means the Infrastructure Partner, BUYEASY TECHNOLOGY CO., LTD.
A.2 What we collect. Most of it you give us yourself; the rest comes from your phone, our Partner or the way you use the app:
• Contact details. Phone number and email address. You give them at sign-up and in settings. Used for sign-in by SMS code, emails and account recovery.
• Identity details. First and last name, date of birth, nationality, gender, country and address of residence, document type, number and dates. Used for identity verification and card issuance, as required by our Partner and the card issuer.
• Identity documents. Photos of your ID document (both sides), a selfie, a short liveness video and the machine-readable zone of the document, captured by your phone camera through the SDK of an identity verification provider or our own capture screen. We do not store them: they pass through our server in memory and go to our Partner.
• Device details. Device name, platform, a public key generated on the device, push token, app version, user agent and country. Used to link your phone to your account, send push notifications and block sign-in from an unknown device.
• Network details. IP address, recorded with sessions, SMS codes and consents as evidence of who acted.
• Financial details. Balances, transactions, deposit and withdrawal addresses, bank account details (IBAN) and recipient name, sender name of incoming bank transfers, merchant name and amount of card purchases, last four digits and expiry of your card. Used to provide the Services and to keep the records anti-money-laundering (AML) law requires.
• Support messages. What you write and attach in the in-app support chat.
• Consents. Which document you accepted, its version, the date and your IP address. Kept as proof of consent.
• Technical data. Errors, logs and performance data with internal identifiers, without names or contact details. Used to fix errors and keep the Services running.
A.3 Identity verification and card documents. You photograph your ID document twice, and the two sets travel different routes. (a) At sign-up the check runs inside the app through the SDK of a verification provider engaged by our Partner, such as Sumsub. The photos, the selfie and the liveness video go from your phone directly to that provider and then to our Partner; our servers never receive them, only the result of the check. (b) For your card, the card issuer requires photos of both sides of your ID document and a selfie, taken on our own capture screen. On your phone, Google ML Kit reads the machine-readable zone of the document and checks that a live face is in the frame. The images are then sent through our server, where they stay in memory for one request and are never written to disk, to our Partner and on to the card issuer. Where our Partner already holds your verification photos, we may forward them back to it as card documents, also in server memory only. We do not keep photos of your document, your selfie, your liveness video or your document number on our systems.
A.4 Legal bases. Opening and running your account, executing deposits, withdrawals, transfers and card payments, notifying you about money movements and answering support requests: performance of our contract with you. Verifying your identity, issuing a card and keeping records required by law: legal obligation under anti-money-laundering and know-your-customer law. Keeping your account secure, fixing errors, detecting fraud and enforcing this Policy and our Cardholder Terms of Service: our legitimate interests. Marketing emails: your consent, which you can withdraw at any time. We do not use your information for third-party advertising.
A.5 Our Partner. BUYEASY TECHNOLOGY CO., LTD receives everything needed to verify you, run your wallet, issue your card and execute transfers: name, email, phone, date of birth, nationality, gender, address, document number and dates, document photos and selfie, withdrawal addresses, bank details and amounts. It returns verification results, transaction data, card details (which pass through to your phone and are not stored by us) and the sender name of incoming bank transfers. Our Partner works with its licensed financial partners, including the card issuer, which compares your face with your document, and banks. SquareFi Inc. operates the technology through which this data flows and sees the same information in transit.
A.6 Identity verification providers. Sumsub and, for some users, another verification provider chosen by our Partner run inside our app on its behalf. During a check they collect document photos, a selfie, video and voice for the liveness check, your location and device details, directly from your phone. Sumsub's usage analytics are switched off in our app; the other provider's SDK does not offer such a setting.
A.7 Our service providers. The companies below process information on our instructions and under a data processing agreement:
• DigitalOcean runs our servers, database and backups. It holds the whole database and sees server traffic. Backups are kept for up to 12 months.
• Cloudflare provides network security, DDoS protection and the proxy in front of our API, and hosts the app's static resources. It sees all traffic between the app and our servers, including your IP address, your PIN and SMS codes when you enter them, and your card number and CVV when you view them. Cloudflare is certified under PCI DSS Level 1.
• Twilio delivers SMS: your phone number and the text of the message. United States and European Union.
• Twilio SendGrid delivers email: your email address and the text of the message. United States and European Union.
• Google (Firebase Cloud Messaging) and Apple (APNs) deliver push notifications: your push token and the text of the notification. United States.
• Intercom runs the support chat: an internal user identifier, device details, and everything you write or attach. United States.
• Sentry collects error reports and logs with internal identifiers, amounts, device model and OS. No name, phone, email, IP or card number. European Union.
• Slack and Telegram carry alerts to our team with internal identifiers, amounts and error codes, without names or contact details.
A.8 Our staff and authorities. Authorised employees see your profile, balances, transactions, devices and card status in an internal panel with restricted access; every opening of a customer record is written to an immutable audit log. We disclose information to FINTRAC and other regulators, law enforcement and courts when the law requires it, and to our Partner and its banks answering a lawful request for information.
A.9 International transfers. Our providers are in Canada, the United States, the European Union and other countries. When we transfer information out of the European Economic Area, the United Kingdom or Switzerland, we rely on the European Commission's standard contractual clauses (and the UK addendum) or on an adequacy decision; Canada is covered by an EU adequacy decision for commercial organisations. Our Partner and the identity verification providers may store your verification data in countries of their choice under their own agreements with us.
A.10 What stays on your phone. Face ID, Touch ID and fingerprint unlock the app and the card details screen; the operating system tells the app only "yes" or "no", and we never receive your fingerprint or face. Google ML Kit reads the document and detects a face on the device; the images do not leave your phone through ML Kit, which sends usage metrics about the library to Google. Secure storage (Keychain, Keystore) holds your session token, your device's private key and a device identifier; your PIN is never stored on the phone. App storage holds your first name for the lock screen, up to eight withdrawal drafts and your display settings. A copied card number stays in the clipboard for 60 seconds and is not synced to your other devices. Screenshots are blocked and the app preview in the app switcher is blurred.
A.11 Permissions. The app asks for the camera (document and selfie photos, support chat), the microphone (liveness video, support chat), location while the app is open (a step of identity verification), photos and files (attachments), NFC on Android (reading a biometric passport chip), Face ID or biometrics (unlocking the app and card details) and notifications. The app does not use the Advertising ID, background location, SMS, call logs, contacts or calendar, and does not ask for App Tracking Transparency permission.
A.12 Notifications. Push notifications tell you about card purchases (merchant name and amount), deposits and withdrawals, card declines and the status of your identity check; Apple and Google deliver them and can read the text. Purchase confirmation codes are never sent by push. SMS carry your sign-in code and security warnings and never contain names or amounts. Emails confirm your address, warn about a new device, a pause on withdrawals or account closure, and inform you about changes to our documents; they contain no amounts.
A.13 Error reporting and exchange rates. Names, phone numbers, email addresses and IP addresses are removed by a filter before technical data leaves our systems. Two exceptions: a crash in the native part of the app bypasses the filter and may carry raw device data, and the reason a card issuer gives for declining a card is passed on unfiltered. The app shows approximate values using rates our server fetches from Yahoo Finance; nothing about you is sent there.
A.14 Automated checks. We run our own automated risk checks on withdrawals and account activity, using the destination address, the amount, your device and sign-in history. A check can pause a withdrawal or your account until a member of our staff reviews it; a person takes the final decision. Our Partner and its banks screen you against sanctions and politically exposed persons lists and may ask, through us, for documents such as proof of the source of funds; we pass such requests through the support chat or from [email protected]. If your verification is rejected, contact [email protected] to have it reviewed by a person. We do not use third-party fraud-scoring, third-party device fingerprinting or external artificial-intelligence services to profile you.
A.15 Retention. While your account is open: sessions and SMS codes are deleted 30 days after use; sign-in attempt counters and email queue entries after 24 hours; card document uploads not attached to a card, held by our Partner, after 24 hours. When you close your account (in the app under Settings), we delete your phone number, email address and its history, name, date of birth, nationality, gender, devices, sessions, push tokens, notification history, PIN, second factor, backup codes, purchase confirmation codes and cardholder name. We keep transactions, verification results, consents and the action log as anti-money-laundering law requires, and events from our Partner and manual review cases so support can return any remaining balance. Database backups are kept for up to 12 months.
A.16 Security. All traffic between the app and our servers is encrypted (TLS). Your card number and CVV are never stored, logged or cached by us. Your PIN is stored only as a slow, salted hash (argon2id). Every money-moving action is confirmed by a signature from the private key in your phone's secure storage plus your PIN. Staff see only what their role allows, and access to production systems is limited to named engineers.
A.17 Where to complain. Canada: Office of the Privacy Commissioner of Canada. European Economic Area: the data protection authority of your country. United Kingdom: Information Commissioner's Office. California: California Privacy Protection Agency. Brazil: Autoridade Nacional de Proteção de Dados (ANPD). Australia: Office of the Australian Information Commissioner. We answer requests under Section 7.6 within 30 days and do not charge for them unless they are repeated or clearly unfounded.