Your data deserves plain language.

1. Who this policy applies to

This Privacy Policy applies to the Payonik mobile application, payonik.io and related services provided under the Payonik name (together, the “Services”). In this policy, “Payonik”, “we”, “us” and “our” refer to the operator identified as Payonik in the relevant app-store listing and service communications.

For privacy questions or requests, contact us at contact@payonik.com.

2. Data we collect

Account and profile data

We may collect your name, email address, phone number, date of birth, nationality, residential or billing address, occupation or employment information, preferred language and currency, and account status.

Identity and eligibility data

Where verification is required, we and our identity-verification or financial-service partners may process identity-document information, a facial image or liveness check, verification results, customer references, screening results and information required by know-your-customer, anti-money-laundering or sanctions rules. Some of this information may be collected directly by the verification partner through its hosted flow.

Card, wallet and transaction data

We may process wallet and card balances, masked card identifiers, card status, billing details, top-ups, merchant information, transaction amounts, currencies, dates, status and provider references needed to show and support your activity.

When supported, full card details are retrieved from the card-service provider only after an authenticated request and shown temporarily. Payonik is designed not to write a card security code to its application database, cache or logs. Sensitive card details are cleared from the app view when you hide them, leave the screen or the app moves to the background.

Device, session and security data

We may collect or generate IP address, user-agent information, session identifiers, refresh-token hashes, sign-in and sign-out times, app version, operating system, device permission state, security events and diagnostic information needed to operate and protect the Services.

If you enable App Lock, the app may keep its lock configuration and a protected PIN representation in device-secure storage. Face ID, Touch ID and fingerprint templates are handled by your device operating system; Payonik does not receive or store your biometric template.

Communications and support data

We process messages, support-request details and any information you choose to provide when you contact us. Please never send a password, PIN, full card number or card security code through support email.

Website data

Our web server may receive standard request information such as IP address, browser type, requested page, referring page and request time. The current website does not include advertising trackers or behavioural advertising cookies. If this changes, we will update this policy and provide any consent control required by law.

3. Where data comes from

We receive personal data:

• directly from you when you register, update your profile or contact support;
• automatically from your device and interactions with the Services;
• from identity-verification, card-program, payment and transaction partners; and
• from authorities or compliance sources where permitted or required by law.

4. Why we use personal data

We use personal data where necessary to:

• create, authenticate and maintain your account;
• provide wallet, virtual-card, balance and transaction features available to you;
• verify identity and assess eligibility for regulated or partner-provided services;
• prevent fraud, misuse, account takeover and other security threats;
• meet legal, regulatory, sanctions, accounting and record-keeping obligations;
• respond to support, privacy, complaint and account-deletion requests;
• diagnose faults and improve reliability and usability; and
• send service messages or notifications you request or that are necessary for the account.

Depending on your location and the activity, our legal basis may be performance of a contract, compliance with law, our or another party’s legitimate interests, protection of vital interests, or your consent. Where processing relies on consent, you may withdraw it at any time without affecting earlier lawful processing.

5. When we share data

We may share the minimum relevant data with:

• identity-verification and compliance providers;
• card-program, payment, wallet, banking and transaction-processing partners;
• hosting, database, security, communications and customer-support providers;
• professional advisers, auditors and insurers under appropriate duties; and
• courts, regulators, law enforcement or other parties where required or permitted by law.

These recipients may act as processors on our instructions or as independent controllers with their own legal obligations. We require service providers acting for us to protect personal data consistently with applicable law and their contracts. We do not sell your personal data and do not share it for cross-context behavioural advertising.

6. International transfers

Our providers and partners may process data in countries other than the one where you live. Where required, we use recognised transfer mechanisms and safeguards, such as adequacy decisions, standard contractual clauses and supplementary security measures.

7. Security

We use organisational and technical measures appropriate to the nature of the data and the risks involved. These include access controls, authenticated sessions, protected token storage, encryption in transit, limited display of sensitive card information, monitoring and provider due diligence. No system is completely secure, so you should protect your device and credentials and contact us promptly if you suspect misuse.

8. Retention and deletion

We keep data only for as long as needed for the purposes described above, including while your account is active and for periods necessary to meet financial, tax, anti-money- laundering, sanctions, fraud-prevention, dispute and legal-claims obligations. Retention periods depend on the type of record, the relevant service and applicable law.

When data is no longer required, we delete it or de-identify it. De-identified information may be retained where it cannot reasonably be linked back to you. Account closure does not override a legal duty to retain specific records; retained data remains restricted to the relevant purpose.

9. Your choices and rights

Depending on where you live, you may have rights to access, correct, export, restrict, object to or delete personal data, withdraw consent, and complain to a data-protection authority. You may update available profile details and preferences in the app or contact us to make a request.

We may need to verify your identity before fulfilling a request. Rights can be limited by law—for example, where records must be retained or disclosure would affect another person. We will explain any applicable limitation.

10. Notifications and device permissions

You control optional device permissions through the app and operating-system settings. Notification permission can be changed in device settings. Identity verification may ask for camera access within a partner flow when needed to capture a document or liveness check. Denying a permission may limit the feature that requires it but should not affect unrelated features.

11. Children

Payonik is not intended for children. You must meet the minimum age and eligibility rules shown during registration and required for the services available in your location. If we learn that a child’s data was collected contrary to applicable requirements, we will take appropriate steps to delete or restrict it.

12. Changes to this policy

We may update this policy as the Services, providers or legal requirements change. We will post the revised version here, update the date above and provide additional notice where a change materially affects your rights or is otherwise required.

13. Contact us

For privacy questions or rights requests, email contact@payonik.com. Please write “Payonik Privacy Request” in the subject line and do not include sensitive card credentials.