Privacy Policy

Last updated October 2, 2026

VouchEx processes personal data to provide authentication, KYC verification, fraud prevention, and customer support. This policy describes what we collect, how we use it, and your retention rights.

Data we collect

• Account identifiers (email, phone, username, device fingerprints)
• KYC artifacts from Sumsub / Signzy (ID images, liveness scores)
• Trade metadata, chat logs, and payment proof uploads
• Technical logs (IP, browser, approximate geo for risk scoring)

Encrypted data retention

Sensitive documents and payment proofs are stored encrypted at rest (AES-256 or equivalent) with keys managed in a segregated secrets service. Retention periods:

• KYC documents: life of account + 5 years for regulatory requests
• Trade chat & attachments: 7 years for AML audit trails
• Device approval tokens: 90 days unless revoked earlier

You may request export or deletion where law permits; some records must be retained for AML even after account closure.

Sharing

We share data with identity vendors, email providers (Resend), wallet infrastructure (Privy), and law enforcement when legally required. We do not sell personal data.