Privacy Policy

Effective as of May 6, 2026

1. Introduction

SavaPay ("we," "us," or "our") operates the SavaPay mobile application (the "App") available on iOS and Android platforms. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile wallet services, including digital payments, cryptocurrency transactions on the Stellar blockchain, and related financial services.

By accessing or using the App, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy. If you do not agree with the terms of this Privacy Policy, please do not access or use the App.

SavaPay is incorporated in the State of Georgia, United States, and operates primarily in the United States and African markets including the Democratic Republic of Congo, Ghana, and other regions. This Privacy Policy is designed to comply with applicable data protection laws, including the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and other relevant privacy regulations.

2. Information We Collect

We collect information that you provide directly to us, information that is generated automatically when you use the App, and information from third-party sources. The types of information we collect depend on how you interact with our services.

2.1 Personal Information

When you create an account or use our services, we may collect the following personal information:

  • Full legal name (first name, last name, and middle name where applicable)

  • Email address

  • Phone number (including country code)

  • Date of birth

  • Nationality and country of residence

  • Physical address (street address, city, state/province, postal code, country)

  • Profile photograph

  • Preferred language and currency

2.2 Identity Verification Data (KYC)

To comply with Know Your Customer (KYC), Anti-Money Laundering (AML), and Bank Secrecy Act (BSA) regulations, we collect identity verification documents and data, including:

  • Government-issued photo identification (passport, national ID card, or driver's license)

  • Selfie photographs for biometric verification and liveness detection

  • Proof of address documents (utility bills, bank statements, or government correspondence)

  • Document metadata (document number, issue date, expiration date, issuing authority)

  • Verification status and results from our identity verification providers

2.3 Financial Information

When you use our payment and financial services, we collect:

  • Transaction history (amounts, dates, recipients, senders, transaction status)

  • Stellar blockchain wallet addresses (public keys)

  • Bank account details (account number, routing number, bank name) when linked

  • Mobile money account details (MTN MoMo and other mobile money providers)

  • Account balances and wallet information

  • Payment method information

  • Currency conversion and exchange rate data

2.4 Device and Technical Data

We automatically collect certain technical information when you access or use the App:

  • Device model, manufacturer, and hardware specifications

  • Operating system type and version (iOS or Android)

  • App version and build number

  • Internet Protocol (IP) address

  • Unique device identifiers and push notification tokens

  • Unique device identifiers

  • Network information (Wi-Fi, cellular carrier, connection type)

  • Time zone and locale settings

2.5 Usage Data

We collect information about how you interact with the App through our analytics and performance monitoring services:

  • Screen views and navigation patterns

  • Feature usage frequency and duration

  • App session duration and frequency

  • Interaction events (button taps, form submissions, search queries)

  • Error logs and crash reports

  • Performance metrics (app load times, response times)

2.6 Communications Data

When you communicate with us or use our communication features, we collect:

  • Support ticket content, subject, and attachments

  • In-app messages and correspondence

  • Email communications with our support team

  • Feedback and survey responses

3. How We Use Your Information

We use the information we collect for the following purposes:

3.1 Provide and Maintain Services

  • Create and manage your SavaPay account

  • Facilitate digital payments, money transfers, and cryptocurrency transactions

  • Process mobile money transactions (MTN MoMo and other providers)

  • Maintain your wallet balances and transaction records

  • Enable communication between users for payment purposes

3.2 Process Transactions

  • Execute send, receive, and exchange transactions on your behalf

  • Process Stellar blockchain transactions and manage wallet operations

  • Facilitate currency conversions and cross-border transfers

  • Generate transaction receipts and confirmations

3.3 Identity Verification and Fraud Prevention

  • Verify your identity in compliance with KYC regulations

  • Screen against sanctions lists (including OFAC) and politically exposed persons databases

  • Detect and prevent fraudulent transactions and unauthorized access

  • Monitor for suspicious activity patterns

  • Protect the security and integrity of our platform

3.4 Legal and Regulatory Compliance

  • Comply with AML, BSA, and KYC requirements

  • File Suspicious Activity Reports (SARs) and Currency Transaction Reports (CTRs) when required

  • Respond to legal process, subpoenas, and government requests

  • Maintain records as required by financial regulations

3.5 Notifications

  • Send push notifications regarding transaction updates, security alerts, and account activity

  • Deliver service announcements and important account notices

  • Provide marketing communications (with your prior consent)

3.6 Service Improvement

  • Analyze usage patterns to improve App functionality

  • Identify and resolve technical issues using crash reporting and performance monitoring tools

  • Develop new features and optimize existing services

  • Conduct internal research and analysis

3.7 Customer Support

  • Respond to your inquiries, requests, and support tickets

  • Resolve disputes and troubleshoot technical problems

  • Provide personalized assistance based on your account history

4. Legal Basis for Processing

In accordance with the GDPR and other applicable data protection laws, we process your personal data based on the following legal grounds:

4.1 Contract Performance

Processing is necessary to perform our contract with you, including providing wallet services, processing transactions, managing your account, and delivering the core functionality of the App.

4.2 Legal Obligation

Processing is necessary to comply with legal obligations to which we are subject, including KYC and AML regulations, tax reporting requirements, financial record-keeping obligations, and responding to lawful requests from regulatory authorities.

4.3 Legitimate Interests

Processing is necessary for our legitimate interests, including fraud prevention and security, service improvement and analytics, internal administration, and protecting our legal rights. We balance these interests against your fundamental rights and freedoms.

4.4 Consent

Where required by law, we obtain your explicit consent before processing certain data, including marketing communications, optional analytics, and non-essential push notifications. You may withdraw your consent at any time without affecting the lawfulness of processing prior to withdrawal.

5. Information Sharing and Disclosure

We do not sell your personal information to third parties. We may share your information in the following circumstances:

5.1 Third-Party Service Providers

We share information with trusted third-party service providers who assist us in operating the App and delivering our services. These providers are contractually obligated to protect your data and use it only for the purposes we specify:

  • Infrastructure and cloud hosting partners (authentication, data storage, cloud functions)

  • Push notification delivery partners

  • Identity verification and KYC service providers

  • Payment processors and mobile money operators (MTN MoMo and others)

  • Stellar blockchain network (for cryptocurrency transactions)

  • Cloud infrastructure and hosting providers

  • Fraud detection and prevention services

5.2 Law Enforcement and Regulatory Bodies

We may disclose your information to law enforcement agencies, regulatory authorities, courts, or other governmental bodies when we are legally required to do so, when we believe disclosure is necessary to protect our rights or the safety of others, or when we receive valid legal process such as subpoenas, court orders, or regulatory requests.

5.3 Business Transfers

In the event of a merger, acquisition, reorganization, bankruptcy, or sale of all or a portion of our assets, your personal information may be transferred as part of that transaction. We will notify you via the App or email of any change in ownership or use of your personal information, as well as any choices you may have regarding your information.

5.4 With Your Consent

We may share your information for other purposes with your explicit consent or at your direction.

6. Blockchain Transactions

SavaPay utilizes the Stellar blockchain network to facilitate certain cryptocurrency transactions. It is important that you understand the following characteristics of blockchain technology:

  • Blockchain transactions are recorded on a public, distributed ledger. Once a transaction is confirmed on the Stellar network, the transaction details (including wallet addresses, amounts, and timestamps) are publicly visible and accessible to anyone.

  • Your Stellar wallet address (public key) is visible on the blockchain. While wallet addresses are pseudonymous, they may be linked to your identity if associated with your SavaPay account by authorized parties.

  • Blockchain transactions are irreversible. Once a transaction is confirmed on the Stellar network, it cannot be undone, modified, or deleted. This is an inherent characteristic of distributed ledger technology.

  • We cannot delete or modify transaction data recorded on the Stellar blockchain, as this data exists outside our control on a decentralized network. Requests for data deletion under applicable privacy laws will be honored to the extent technically feasible, but cannot extend to on-chain data.

7. Data Retention

We retain your personal information for as long as necessary to fulfill the purposes described in this Privacy Policy, comply with our legal obligations, resolve disputes, and enforce our agreements. Specific retention periods are as follows:

  • Active account data: Retained for the duration your account remains active and in good standing.

  • Financial transaction records: Retained for a minimum of five (5) to seven (7) years after the transaction date, as required by applicable financial regulations and tax laws.

  • KYC and identity verification documents: Retained in accordance with AML regulations, typically for a minimum of five (5) years after the termination of the business relationship or after the date of an occasional transaction.

  • Account deletion requests: Non-regulated personal data will be deleted or anonymized within ninety (90) days of a verified account deletion request.

  • Blockchain transaction data: Permanently recorded on the Stellar blockchain and cannot be deleted due to the inherent nature of distributed ledger technology.

  • Analytics and usage data: Retained in aggregate or anonymized form for service improvement purposes.

8. Data Security

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. Our security measures include:

  • Encryption of data in transit using Transport Layer Security (TLS) protocols

  • Encryption of data at rest using industry-standard encryption algorithms

  • Role-based access controls limiting data access to authorized personnel only

  • Regular security assessments, penetration testing, and vulnerability scanning

  • Secure authentication mechanisms including PIN protection and session management

  • Monitoring and logging of system access and data processing activities

  • Incident response procedures for potential data breaches

While we strive to protect your personal information, no method of electronic transmission or storage is completely secure. We cannot guarantee the absolute security of your data. You are responsible for maintaining the confidentiality of your account credentials, PIN, and any other authentication factors.

9. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal information:

  • Right of Access: You have the right to request a copy of the personal information we hold about you and information about how it is processed.

  • Right to Rectification: You have the right to request correction of any inaccurate or incomplete personal information we hold about you.

  • Right to Erasure: You have the right to request deletion of your personal information, subject to legal and regulatory retention requirements. Certain data required for compliance with financial regulations cannot be deleted upon request.

  • Right to Data Portability: You have the right to receive your personal information in a structured, commonly used, and machine-readable format, and to transmit that data to another controller.

  • Right to Withdraw Consent: Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing conducted prior to withdrawal.

  • Right to Object: You have the right to object to the processing of your personal information based on legitimate interests or for direct marketing purposes.

  • Right to Restrict Processing: You have the right to request that we restrict the processing of your personal information in certain circumstances.

  • Right to Lodge a Complaint: You have the right to lodge a complaint with a supervisory authority in your jurisdiction if you believe our processing of your personal information violates applicable data protection laws.

To exercise any of these rights, please contact us at hello@SavaPay.io. We will respond to your request within thirty (30) days of receipt. We may request additional information to verify your identity before fulfilling your request. In certain cases, we may charge a reasonable fee or refuse requests that are manifestly unfounded or excessive.

10. Children's Privacy

SavaPay is not directed to individuals under the age of eighteen (18). We do not knowingly collect personal information from children under 18. If we become aware that we have inadvertently collected personal information from a child under 18, we will take immediate steps to delete such information from our systems. If you believe that a child under 18 has provided us with personal information, please contact us at hello@SavaPay.io so that we can take appropriate action.

11. International Data Transfers

SavaPay is based in the United States, and your personal information is primarily processed and stored on servers located in the United States. If you access our services from outside the United States, please be aware that your information may be transferred to, stored, and processed in the United States and other countries where our service providers operate.

For transfers of personal data from the European Economic Area (EEA), United Kingdom, or Switzerland to countries that have not been deemed to provide an adequate level of data protection, we rely on appropriate safeguards, including Standard Contractual Clauses approved by the European Commission, to ensure your data is protected in accordance with applicable data protection laws.

Our infrastructure partners operate data centers in various regions worldwide. Data processed through these services may be stored in data centers outside your country of residence. Our partners maintain appropriate safeguards for international data transfers in accordance with applicable data protection laws.

12. Cookies and Tracking Technologies

As a mobile application, SavaPay does not use traditional browser cookies. However, we utilize the following tracking technologies and identifiers within the App:

  • Analytics services collect usage data, session information, and user engagement metrics to help us understand how the App is used and to improve our services.

  • Crash reporting services collect crash reports, error logs, and device state information to help us identify and fix technical issues.

  • We collect unique device identifiers for analytics, notification delivery, and fraud prevention purposes.

  • Our push notification service collects device tokens and interaction data for notification delivery and engagement tracking.

You may limit the collection of certain tracking data by adjusting your device settings, including resetting your advertising identifier or opting out of personalized advertising through your device's privacy settings.

13. Push Notifications

SavaPay uses a third-party push notification service to deliver push notifications to your device. Push notifications are an important part of our service and are used to keep you informed about account activity and security events.

13.1 Types of Notifications

  • Transactional notifications: Alerts about incoming and outgoing payments, transaction confirmations, and account activity updates.

  • Security notifications: Alerts about login attempts, suspicious activity, password changes, and other security-related events.

  • Marketing notifications: Promotional messages about new features, offers, and services (sent only with your prior consent).

13.2 Data Shared with Notification Partners

To deliver push notifications, we share the following information with our notification delivery partner:

  • Device push notification token (APNs token for iOS, FCM token for Android)

  • Notification interaction data (delivery confirmation, open events)

  • Device type and operating system version

  • App version and language preference

13.3 Opting Out

You may opt out of receiving push notifications at any time by adjusting the notification settings on your device (Settings > Notifications > SavaPay on iOS, or Settings > Apps > SavaPay > Notifications on Android). Please note that disabling transactional and security notifications may affect your ability to stay informed about important account activity and potential security issues.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or for other operational reasons. When we make material changes to this Privacy Policy, we will notify you through the App, via email, or through other appropriate communication channels prior to the changes taking effect.

We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your information. The "Effective as of" date at the top of this Privacy Policy indicates when it was last revised. Your continued use of the App after any changes to this Privacy Policy constitutes your acceptance of the updated terms.

15. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

  • Email: hello@SavaPay.io

  • Company: SavaPay

  • Location: Georgia, United States

We will acknowledge receipt of your inquiry and endeavor to respond within thirty (30) days. For data protection inquiries from EU residents, you may also contact your local supervisory authority.