Privacy Policy

1. Overview

This Privacy Policy explains what personal data Kultura collects when you use the app and the website at pay.kulturapay.com, why we collect it, who we share it with and the choices you have. It applies together with our Terms of Service.

2. Data we collect

• Account data: phone number, email address, password (stored hashed), language and app settings.
• Verification data: document type and issuing country, images of your document, a selfie and liveness video, and the data extracted from them (name, date of birth, document number, expiry).
• Payment data: top‑ups, balances, QR payments (merchant, amount, rate, fee, time), withdrawal addresses. We never store full card numbers; card processing is handled by a PCI DSS certified provider.
• Device and usage data: IP address, device model, browser, approximate location derived from IP or, with your permission, from your device (used to show local rates and offers), crash and diagnostic logs.
• Support data: messages you send us and the details needed to answer them.

3. How we use it

• To open and run your account and to process top‑ups, payments and withdrawals.
• To verify your identity and comply with anti‑money‑laundering, sanctions and other legal obligations.
• To prevent fraud, abuse and unauthorised access.
• To show you rates, merchants and services relevant to where you are.
• To improve the app and to answer your support requests.
• To send service messages (security alerts, receipts, changes to terms). Marketing messages are sent only with your consent and you can opt out at any time.

4. Identity verification

Verification is carried out by a regulated identity partner acting as our processor. Your document images and biometric data (face geometry derived from your selfie) are used only to confirm that you are the document holder and to detect fraud. Biometric data is processed with your explicit consent, which you give when starting verification, and is deleted by the partner once verification is complete except where retention is required by law.

5. Sharing

We share personal data only with: our identity‑verification, card‑acquiring, crypto‑custody and payment partners, to the extent needed to provide the Service; hosting, analytics and support tool providers under contract; and authorities where the law requires it. We do not sell personal data.

6. Retention

Account and transaction records are kept for as long as your account is open and for the period required by financial regulation afterwards (typically five years). Diagnostic logs are kept for up to 12 months. You may ask us to delete data that we are not obliged to keep.

7. Security

Data is encrypted in transit and at rest. Access is restricted to staff and partners who need it, protected by multi‑factor authentication and logged. Every payment requires your confirmation in the app. Please keep your credentials private and enable a device lock.

8. Your rights

Depending on where you live you may have the right to access, correct, delete or export your data, to object to or restrict certain processing, and to withdraw consent. You can exercise these rights in the app or by emailing us. You may also complain to your local data‑protection authority.

9. Cookies

The website uses only strictly necessary cookies and local storage needed for the pages to work. We do not use third‑party advertising cookies. If we add analytics in future, we will ask for your consent first where required.

10. Contact