> For the complete documentation index, see [llms.txt](https://aipaywithcrypto.gitbook.io/whitepaper/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://aipaywithcrypto.gitbook.io/whitepaper/ai-pay-with-crypto-whitepaper/13-apc-legal/13.2-apc-privacy-policy.md).

# 13.2 APC PRIVACY POLICY

 

For APC applications, websites, payment products, and related services

### 13.2.1. Introduction and Scope

APC ("APC," "we," "us," or "our") is committed to protecting the privacy and security of individuals who use or interact with APC products and services. This Privacy Policy explains how we collect, use, disclose, store, transfer, and protect personal data, and the choices and rights that may be available to you.

This policy applies when you access or use APC mobile applications, websites, wallets, merchant portals, point-of-sale and QR payment services, online checkout, settlement services, card-related services, customer support, promotions, and other products or services that link to this policy (collectively, the "Services"). It also applies to merchants, business representatives, developers, prospective users, and visitors who interact with APC.

Some Services may be delivered by licensed or authorized partners, including identity-verification providers, custodians, virtual-asset service providers, payment institutions, card issuers or program managers, banks, liquidity or conversion providers, and fiat settlement providers. Their separate privacy notices may apply when they independently determine how personal data is processed.

By using the Services, you acknowledge that you have read this Privacy Policy. Where consent is the required legal basis, APC will request consent separately and will not treat acknowledgment of this policy as consent.

### 13.2.2. APC’s Service and Custody Model

APC operates a mixed service model. Certain user-wallet functions may be non-custodial, meaning APC does not hold or control the user’s private keys or digital assets. Other services, including custodial merchant-wallet functions or partner-enabled custody, conversion, card, and settlement services, may involve regulated partners. The exact model depends on the product, transaction, jurisdiction, and partner terms shown to you.

For a non-custodial wallet, loss of a private key, seed phrase, recovery credential, or access device may prevent recovery of assets. APC does not request that users disclose seed phrases or private keys through customer support. Even where APC cannot control the wallet or blockchain transaction, APC

may process accounts, devices, security, transaction, and support data needed to operate the interface, detect abuse, and meet legal obligations.

### 13.2.3. Personal Data We Collect

#### 13.2.3.1 Information You Provide

#### **Identity and Verification Data**

To satisfy legal requirements or enable regulated features, APC or its verification partners may collect:

* Full legal name, date of birth, nationality, sex or gender where legally required, and residential address;
* Government-issued identification documents and document identifiers; 
* Selfie images, facial geometry templates, liveness results, or other biometric verification data where permitted;
* Tax identification, occupation, source-of-funds, source-of-wealth, expected activity, and beneficial-ownership information where required;
* Phone number, email address, and other verification or contact details;
* Sanctions, politically exposed people, adverse-media, fraud, and risk-screening results.

#### Accounts, Profile, and Business Data

* Username, profile name, password or authentication credentials, referral code, language, and communication preferences; 
* Merchant or business name, registration records, licenses, operating address, settlement details, authorized representatives, beneficial owners, and business activity;
* Developer registration details, API credentials, webhook settings, and integration information; 
* Eligibility, tier, campaign, rewards, referral, or program-participation information.

#### Financial and Transaction Data

* Wallet addresses, digital-asset type and amount, payment amount, transaction status, fees, quotes, and timestamps;
* Fiat payment, bank, card, settlement, beneficiary, merchant, invoice, order, refund, or chargeback information, as applicable;
* Payment instructions, transaction purpose, counterparty information, and supporting documents required for compliance;
* Spending rules, limits, whitelists, validity periods, confirmation settings, and authorization records used for AI-agent or delegated-payment features.

#### Communications and Support

* Support tickets, chat or email correspondence, call records where lawful and disclosed, survey responses, and complaints;
* Screenshots, transaction references, logs, files, and other materials you voluntarily submit for investigation or troubleshooting.  

#### 13.2.3.2 Information Collected Automatically

Device and Network Data

* IP address, device or advertising identifier where permitted, device model, manufacturer,

operating system, browser, app version, language, time zone, mobile carrier, and approximate region;

* Session timestamps, login events, crash reports, performance data, referral URLs, page or screen activity, and feature interactions;
* Cookie, local-storage, tag, pixel, SDK, and similar-technology data, as described in the APC Cookie Policy.

#### Security and Integrity Data

To protect accounts, wallets, payment sessions, merchant systems, and transaction integrity, APC may detect or derive information about rooted or jailbroken devices, emulators, virtual environments, unauthorized debugging or hooking tools, runtime injection, memory tampering, unusual network behavior, bot activity, replay attempts, nonce use, failed authentication, and other fraud or cybersecurity indicators.

#### Location Data

APC may infer an approximate region from an IP address. With device permission and where needed for a feature, fraud control, merchant discovery, or legally required transaction verification, APC may collect more precise location data. You can manage device permissions through your operating-system settings, although disabling them may limit relevant features.

#### 13.2.3.3 Blockchain and Public-Ledger Data

Public blockchains may record wallet addresses, transaction hashes, token balances, smart-contract interactions, timestamps, and related information permanently and publicly. APC may obtain, index, analyze, or display this data to provide transaction history, payment verification, balance monitoring, routing, compliance screening, reconciliation, or settlement support.

APC does not control public blockchains and generally cannot alter, erase, or reverse information recorded on them. A wallet address may become personal data when linked or reasonably linkable to an individual or account.

#### 13.2.3.4 Information From Other Sources

APC may receive information from identity and compliance providers, payment and settlement partners, merchants, banks, card partners, blockchain analytics providers, fraud-prevention services, public databases, regulators, law-enforcement authorities, marketing or referral partners, app stores, and other users or counterparties. We may combine this information with data already held where permitted by law.

#### 13.2.4. How We Use Personal Data

* Purpose Examples

Provide and administer Services

Authenticate and secure

Comply with law

Operate delegated or agent payments

Support and communicate

Improve and develop

Prevent loss and enforce terms

Marketing

* Create accounts; provide wallet interfaces; process QR, checkout, POS, settlement, card, refund, rewards, and merchant functions; display balances and transaction status.
* Verify users and devices; protect keys and sessions; detect bots, account takeover, tampering, malware, replay attempts, fraud, and cyberattacks.
* Perform KYC/KYB, AML/CTF, sanctions and PEP screening, travel-rule or transaction monitoring duties, tax or reporting obligations, and lawful requests.
* Apply user-defined budgets, limits, whitelists, validity periods, confirmation rules, freezes, notifications, and auditable authorization records.
* Resolve requests, investigate transactions, provide confirmations and security alerts, and notify users about material service or policy changes.
* Measure performance, diagnose errors, test features, conduct research, and improve product, security, accessibility, and user experience.
* Investigate disputes, misuse, prohibited activity, claims, refunds, or chargebacks and
* establish, exercise, or defend legal rights.
* Send promotions or measure campaigns where permitted, subject to consent or optout rights. APC does not sell personal data for money.

#### 13.2.5. Legal Bases for Processing

The legal basis depends on the data, purpose, service, and jurisdiction. Where applicable, APC relies on one or more of the following:

* Performance of a contract or steps requested before entering into a contract;
* Compliance with legal and regulatory obligations;
* Legitimate interests, such as securing the Services, preventing fraud, improving products, communicating with business contacts, and enforcing rights, where those interests are not overridden by individual rights;
* Consent, including for certain biometrics, precise location, marketing, cookies, or optional features where required;
* Protection of vital interests or performance of tasks in the public interest where recognized by applicable law;
* Other lawful grounds available under the privacy law that governs the processing.

Where processing is based on consent, you may withdraw consent at any time. Withdrawal does not affect processing already performed lawfully and may prevent APC or a partner from providing a feature that requires the relevant data.

#### 13.2.6. Automated Processing and AI-Agent Features

APC may use automated tools to detect fraud, screen transactions, assess security signals, apply transaction limits, route a payment, or determine whether additional verification or human confirmation is required. AI-agent or delegated-payment tools may process the instructions, permissions, categories, merchant restrictions, budgets, validity periods, and escalation rules that you configure.

APC does not authorize an AI agent to exceed the authority granted by the user or authorized business representative. Where a decision produces legal or similarly significant effects and applicable law provides a right to human review, explanation, or contest, APC will provide an appropriate process or direct you to the responsible partner.

#### 13.2.7. How We Share Personal Data

APC does not sell personal data for money. We may disclose personal data as reasonably necessary to the following recipients:

* Affiliates and group companies that support the Services, subject to appropriate access and contractual controls;
*  Identity-verification, AML, sanctions, blockchain analytics, fraud, cybersecurity, customer support, communications, hosting, analytics, and professional-service providers;
* Banks, payment institutions, card issuers or program managers, custodians, VASPs, liquidity providers, conversion providers, fiat settlement providers, acquirers, merchants, beneficiaries, and transaction counterparties;
* Blockchain networks, smart contracts, validators, nodes, bridges, or other decentralized infrastructure when you initiate or authorize an on-chain transaction;
* Regulators, courts, tax authorities, law enforcement, and other public bodies where disclosure is required or legally permitted;
* Actual or prospective parties to a merger, financing, acquisition, reorganization, asset sale, insolvency, or similar transaction, subject to appropriate confidentiality and legal safeguards;
* Other persons at your direction, with your consent, or as reasonably necessary to complete a transaction you request.

A recipient may act as APC’s processor or service provider, a joint controller, or an independent controller, depending on the service and applicable law. Independent recipients are responsible for their own privacy notices and legal obligations.

#### 13.2.8. International Data Transfers

APC operates across multiple jurisdictions. Personal data may be processed in a country different from where you reside, including locations used by APC, its affiliates, cloud providers, compliance providers, and transaction partners.

Where required, APC will use legally recognized safeguards such as adequacy decisions, standard contractual clauses, ASEAN model contractual clauses, data-processing agreements, certifications, approved contractual provisions, transfer impact assessments, or another lawful transfer mechanism.

APC will apply data minimization and supplementary technical or organizational safeguards where appropriate.

#### 13.2.9. Data Security

APC uses administrative, technical, and organizational measures designed to protect personal data against unauthorized access, loss, misuse, alteration, or disclosure. Depending on the Service, these measures may include:

* Encryption in transit and at rest where appropriate, secure API authentication, access controls, logging, monitoring, and environment segregation;
* Device secure storage such as iOS Secure Enclave or Android Keystore for supported non-custodial wallet functions;
* Application hardening, code obfuscation, anti-debugging, root or jailbreak detection, runtime integrity checks, and fraud monitoring;
* Vendor due diligence, contractual confidentiality, incident response, vulnerability management, backup, and recovery processes;
* Data minimization, role-based access, retention controls, and prompt clearing of sensitive information from memory where technically appropriate.

No system is completely secure. You are responsible for protecting your device, account credentials, authentication factors, private keys, seed phrases, and recovery information. Contact APC immediately if you suspect unauthorized access or fraudulent activity.

#### 13.2.10. Data Retention

APC retains personal data only for as long as reasonably necessary for the purposes described in this policy, including providing Services, maintaining security, resolving disputes, enforcing agreements, and meeting legal, accounting, tax, AML/CTF, and regulatory obligations.

Identity, compliance, and financial records are commonly subject to retention periods of approximately five to seven years after a transaction or relationship ends, but the exact period may be shorter or

longer depending on the jurisdiction, record type, investigation, litigation hold, or partner obligation.

Security logs, support records, account data, biometrics, analytics, and marketing records should follow separate documented retention schedules based on need and legal requirements.

Public blockchain records may remain available indefinitely and are not controlled by APC. When deletion is not legally or technically possible, APC may restrict processing, de-identify data, or retain only what is required.

#### 13.2.11. Your Privacy Rights

Depending on your jurisdiction and subject to legal exceptions, you may have rights to:

* Request access to or a copy of your personal data;
* Request correction of inaccurate or incomplete data;
* Request deletion or erasure;
* Restrict or object to certain processing;
* Withdraw consent;
* Receive certain data in a portable format;
* Opt out of direct marketing, targeted advertising, or the sale or sharing of personal data where those concepts apply;
* Request information about international transfers or recipients;
* Request human review of qualifying automated decisions;
* Complain to a competent data protection authority;
* Not be discriminated against for exercising applicable privacy rights.

To exercise a right, contact APC using the details in Section 14. APC may need to verify your identity and authority before acting. A request may be denied or limited where an exception applies, including legal retention, fraud prevention, protection of other persons, privileged information, or a request that is manifestly unfounded or excessive. Authorized agents may submit requests where permitted and properly documented.

#### 13.2.12. Marketing, Notifications, and Cookies

APC may send transactional or service communications such as login alerts, transaction confirmations, security notices, support responses, and material policy updates. These are not marketing and may be necessary to operate the Services.

Promotional communications will be sent where permitted by law. You may unsubscribe using message control or account settings but may continue to receive necessary service communications.

Push notifications may be managed through device or app settings.

APC websites and web applications may use cookies and similar technologies. The APC Cookie Policy explains the categories, purposes, duration, and available controls.

#### 13.2.13. Children and Minimum Age

The Services are not directed to anyone under 18 or the higher minimum age required for the relevant financial or digital-asset service. APC does not knowingly open accounts for or provide regulated

Services to children. If APC learns that a child’s personal data was collected contrary to applicable law, APC will take appropriate steps to delete or restrict it.

####  13.2.14. Third-Party Links and Services

The Services may link to or integrate websites, wallets, merchants, decentralized applications, blockchains, payment pages, app stores, or services operated by others. APC does not control their privacy or security practices. Review the relevant third party’s terms and privacy notice before providing information or connecting a wallet.

#### 13.2.15. Changes to This Privacy Policy

APC may update this Privacy Policy to reflect legal, regulatory, technical, security, or product changes.

The "Last updated" date will identify with the latest revision. Where required, APC will provide additional notice or request consent before a material change takes effect. Continued use does not replace consent where consent is legally required.

#### 13.2.16. Regional Privacy Information

Where applicable, this policy is intended to operate consistently with major privacy frameworks, including the EU and UK GDPR, Thailand and Singapore PDPA requirements, Brazil’s LGPD, and other national privacy laws in markets where APC operates. Local supplements may be provided when a jurisdiction requires additional disclosures, representatives, response periods, appeal rights, or regulator information.

For California and other US state residents, APC will provide applicable notice and opt-out rights concerning sale, sharing, targeted advertising, profiling, or sensitive-data processing. Where required,

APC will honor recognized opt-out preference signals such as Global Privacy Control. APC must complete a jurisdictional applicability assessment before making final US state-law representations.