Privacy Policy

When you create an account and sign in we collect your account address and, depending on the method you use, your email address and the basic profile details provided by your chosen identity provider, such as your name or picture. You may voluntarily add a username and additional contact details.

When you register a recipient for a cash withdrawal we collect the details needed to locate them and hand over the money: their name, identity document, phone number, locality and address. If you choose hand delivery, also the location of the delivery point; if you choose a transfer, the destination card details.

For each operation we keep the amounts, the fees applied, the delivery method and its status, along with references to transactions recorded on blockchains, which are public by their very nature. If you subscribe to TropyCash Pro, we also keep each subscription payment, the network and asset you used and the period it covers.

If you take part in Invite and earn, we keep the link between the referrer and the invited person, the code or link through which it was made, and each commission generated and claimed. The referrer only sees aggregate figures — how many people they invited, how many verified their identity and how much they have earned — never their invitees' details or operations.

As you browse the site, our hosting provider automatically logs technical data such as IP address, browser type and operating system, for security and usage measurement purposes.

While you create your account we keep a technical record of each step — whether it was completed or, if it failed, the type of error — along with your browser and operating system type, solely to help you if something goes wrong. It is deleted after 90 days.

If you verify your identity — required to send remittances delivered in cash or to a bank card — a specialist provider checks your identity document and a selfie. From that verification we keep the result and the data read from the document: name, date of birth, nationality, document type, number and expiry date and, if present, the address. We store them encrypted field by field and never store the photos or the video; those are kept by the provider under its own policy. To prevent the same person from verifying several accounts, the provider also compares your selfie and your document with earlier verifications made on our service.

If you withdraw money to your own bank account, we keep that account's details — the IBAN, or the routing and account numbers — the nickname you give it and the account holder's address. They are stored encrypted and the app only shows you the last four digits. A member of our team uses these details and your verified name to make the transfer.

If you request higher limits, you give us your country of tax residence, your address in that country, your tax ID, whether your activity is registered, your industry and at least one invoice, plus any certificates you choose to provide. A member of our team reviews them by hand. They are stored encrypted; the documents are deleted 30 days after your request is decided, and we keep the outcome, your tax ID and your address. If approved, that address appears in your settings and can no longer be changed there.

When you provide personal data to complete an operation, register a recipient or handle a refund, we understand that you consent to its processing solely for that specific purpose.

If at any point we needed to process your data for a different purpose, we would ask you expressly and you could decline without that affecting your use of the service.

You may withdraw your consent at any time by writing to info@tropycash.com. Note that certain processing is essential to providing the service, so withdrawing it may mean you can no longer use it.

We use the data to authenticate you, execute and track the operations you request, make delivery possible at the destination, respond to your enquiries, prevent fraud and misuse, and maintain and improve how the service works.

We do not sell or transfer personal data for advertising purposes, and we do not send marketing communications.

We may disclose your personal data when a law or a competent authority requires us to, or when it is necessary to investigate a breach of our terms of use or fraudulent use of the service.

To provide the service we rely on external providers, which process data only to the extent needed to perform their role:

Some of our providers may operate in jurisdictions other than yours, so your data could be subject to different regulations.

The site contains links to third-party services, such as blockchain explorers. Following them takes you off our site and this policy no longer applies: we are not responsible for the privacy practices of those services, whose policies we recommend you review.

Data is kept in a managed database that only our server can reach. Your browser never connects to it directly: external access is revoked and all connections are encrypted.

Your two-step verification secret, your identity verification data, your bank account details and the data of your limits request — including its documents — are stored encrypted. The rest of the data is protected through access control and our infrastructure provider's encryption at rest, rather than by encrypting each field individually. We state this precisely because the difference matters.

Your recovery phrases never reach our servers at any point. They are generated and used in isolation within your own browser and removed from memory once each operation ends.

No system is completely secure. We apply recognized security practices, but we cannot absolutely guarantee protection against every unauthorized access.

We use cookies and browser local storage so that the service works: keeping you signed in, remembering your preferences — such as language or currency — and retaining the settings of the tools we integrate. We do not use advertising or cross-site tracking cookies.

Your browser also stores data that avoids repeating work on every visit, such as the emails you have used to sign in or your account's addresses and public keys. Private keys are never stored.

Some of the third-party tools we integrate also store their own information in your browser, subject to their respective policies.

You can delete all of the above at any time from your browser settings. Doing so will sign you out and clear your saved preferences, without affecting your funds.

We keep your account data, the recipients you register and your operations for as long as the account exists, since the history must be able to reflect who each transfer was sent to. Ancillary technical records are deleted periodically.

When you delete a recipient it stops appearing in the application, though its record is kept so that completed operations still reflect their destination. If you want it effectively erased, request it by email.

You may request access to your data, its correction or its deletion, as well as raise a complaint, by writing to info@tropycash.com from the address linked to your account. These requests are handled manually, as soon as we are able to.

Two limits are beyond our control: information recorded on a blockchain is public and permanent, so it cannot be deleted, and we may need to retain records of operations already executed.

The service is not directed at minors. By using it you declare that you are of legal age in your place of residence. If we find that we have collected data from a minor without the appropriate authorization, we will delete it.

We reserve the right to amend this policy at any time. Changes take effect once published and the date of the latest revision appears at the top of the document. When a change is material, we will notify it inside the application.

For any question about this policy, write to us at info@tropycash.com.