1Who is responsible
[Company legal name], [Registered address], is responsible for the personal data described here. You can reach us at contato@nowpay.com.br, and about identity documents at compliance@nowpay.com.br.
2What we collect
Account details: name, date of birth, phone, email, nationality and country of residence, language.
Verification: identity documents, proof of address or bank account, and the result of our checks.
Money: balances, top-ups, payments, conversions, withdrawals, wallet addresses and bank details you use, and the merchants you pay.
Device and usage: basic technical data needed to keep your session safe and the Service working. We do not sell your data and we do not use advertising trackers in the app.
3Why we use it
To open and run your account and carry out what you ask us to do; to verify your identity and prevent fraud, money laundering and sanctions breaches, as the law requires; to answer your questions; and, if you agree, to send you news about NowPay. You can stop marketing emails at any time.
4Who we share it with
Only with those who need it to provide the Service: our licensed payment, exchange, custody and card partners, identity-verification and email providers, hosting providers, and authorities when the law requires it. Each of them must protect your data.
Some of these partners are outside your country. When data leaves your country we use the safeguards the law requires.
5How long we keep it
For as long as your account is open, and afterwards for the period financial and anti-money-laundering laws require (often five years or more). Then we delete or anonymise it.
6Your rights
Depending on where you live (for example under Brazil’s LGPD or the EU GDPR), you can ask to access, correct, delete or receive a copy of your data, object to some uses, and withdraw consent. Some data must be kept by law even if you ask us to delete it. Write to contato@nowpay.com.br; you can also complain to your data protection authority.
7Security
Data is encrypted in transit, documents are kept in private storage, and staff access is limited, logged and protected by two-factor sign-in.