Privacy Policy

Flowa Pay Inc. ("we", "us"), operator of Xchangely, is responsible for personal information we handle. Registered office: 997 Seymour St., Suite 250 – #1605, Vancouver BC V6B 3M1, Canada. Privacy contact: support@xchangely.io. We handle personal information in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and, where it applies to customers in the EU/EEA, the EU General Data Protection Regulation (GDPR).

• Identity and verification data: name, date of birth, residential address, nationality, government-issued identity document, proof of address, and the results of identity and database checks.
• Contact data: email address and any contact details you provide.
• Transaction data: your orders, amounts, the crypto-asset and network, your destination wallet address, and payment confirmation details.
• Source-of-funds information where we are required to request it.
• Technical data: device, log and usage data, and cookies (see our Cookie Notice).

We collect this information from you directly, from your identity-verification process, and from our payment partner in the course of processing your payment.

We use personal information to: verify your identity and onboard you; provide and deliver the service; meet our legal obligations as a registered MSB (anti-money-laundering, know-your-customer, sanctions screening, record-keeping and reporting); detect and prevent fraud and financial crime; provide support; and improve and secure the service. Our lawful bases include performance of our contract with you, compliance with legal obligations, and our legitimate interests in operating a secure and compliant service. Some information is required by law — if you do not provide it, we cannot serve you.

We share personal information only as needed to run the service and meet our obligations, including with: our regulated payment partner (which performs identity verification, issues your deposit details and processes your bank payment); our identity-verification provider; and regulators and authorities (including FINTRAC) where required or permitted by law. We do not sell your personal information. We do not display advertising.

We are based in Canada. Some processing — in particular payment-card and payment processing by our payment partner — takes place outside Canada, including in the European Union. Where information is processed outside your country, we take steps to ensure a comparable level of protection by contract, and your information may be accessible to authorities in those jurisdictions in accordance with their laws.

We keep records and personal information for at least the period required by law (records connected to our MSB obligations are retained for a minimum of five years from the relevant date), after which we securely delete or destroy them unless a longer retention period or legal hold applies.

We apply administrative, technical and physical safeguards proportionate to sensitivity, including access on a least-privilege basis, multi-factor authentication, encryption of sensitive data in transit and at rest where practicable, and access logging. No system is perfectly secure, but we work to protect your information and to respond to incidents as the law requires.

Subject to law, you may request access to, or correction of, your personal information, and (where applicable, including under GDPR) request erasure, restriction, portability, or object to certain processing, and lodge a complaint with a supervisory authority. Some rights are limited where we must retain information by law — and we are prohibited by law from confirming or denying the existence or content of a suspicious-transaction report. To exercise your rights, contact support@xchangely.io.

See our Cookie Notice for how we use cookies and similar technologies.

We may update this policy; material changes will be notified through the site or by email.