1. Controller
Sam White Ltd., 19, St. Mark Street, Valletta VLT 1362, Malta. Privacy requests: via the support form in the signed-in area of the app.
2. Data we process
Account data: name, e-mail address, password (hashed), language preference, time of registration.
Onboarding data: first name, last name, date and place of birth, nationality, mobile number, residential address. We pass this data to our partner to open your account and verify your identity.
Identity verification (KYC): identity documents and selfies are checked by the partner or its service provider (Sumsub). We only store the result (status, tier), never document images.
Usage data: technical event logs from our partner (e.g. account status, payment notifications) and server logs with IP address, browser type and timestamp.
3. Purposes and legal bases
Providing the account and the app (Art. 6(1)(b) GDPR – performance of a contract).
Transfer to the partner for account opening, identity verification and anti-money-laundering (Art. 6(1)(b) and (c) GDPR – legal obligations of the partner).
Security, abuse and fraud prevention and error analysis (Art. 6(1)(f) GDPR – legitimate interest).
E-mail communication about your account, e.g. password reset (Art. 6(1)(b) GDPR).
4. Recipients
Striga Technology OÜ, registered in Estonia, licensed as a Virtual Asset Service Provider (FVT000439); payment accounts and cards are issued by its regulated banking and card partners. The partner is an independent controller for processing within its financial services; its privacy policy applies in addition.
Hosting and database: Vercel Inc. (USA) and Neon Inc. (USA) as processors under standard contractual clauses. Transfers to third countries only take place with appropriate safeguards under Chapter V GDPR.
5. Cookies and local storage
We only use strictly necessary cookies: a session cookie for sign-in and a cookie for your language choice. There is no tracking and there are no advertising cookies.
6. Retention
We keep account data for as long as your account exists. Data the partner must retain under anti-money-laundering rules is subject to its statutory periods (usually five to ten years after the end of the contract). Server logs are deleted after 30 days at the latest.
7. Your rights
You have the right of access, rectification, erasure, restriction of processing, data portability and objection (Art. 15–21 GDPR), and the right to lodge a complaint with a supervisory authority. Contact us via the support form in the app.
8. Changes
We update this policy when our processing changes. The current version is always available in the app.