Privacy Policy
1. Controller
The controller of personal data processed through universecard.io and app.universecard.io is [Universe Card legal entity] ("Universe Card", "we"). Contact: support@universecard.io.
2. What we collect
- Account data — name, business name, email, country, team members you invite, and sign-in identifiers (including Google or Telegram account identifiers if you sign in with them).
- Verification data — identity documents, company documents, UBO declarations and liveness checks, collected and processed through accredited identity-verification providers, plus the results of sanctions and PEP screening.
- Financial data — top-ups, balances, card and transaction records, payout instructions, invoices.
- Technical data — IP address, device and browser information, and security logs for the cabinet and admin interfaces.
The public website uses no analytics or advertising trackers. The only third-party request the site makes is to Google Fonts.
3. Why we process it
- To provide the service (contract performance): accounts, cards, top-ups, payouts, support.
- To meet legal obligations: KYC/KYB, sanctions screening, transaction monitoring, record-keeping and reporting under applicable AML/CTF law — see the AML & CTF statement.
- Legitimate interests: fraud and chargeback prevention, platform security, service improvement.
- With your consent, where required (e.g. product announcements).
4. Who we share it with
We share data only as needed to run the service: card issuers and payment processors, identity-verification and screening providers, banking and crypto settlement partners, cloud infrastructure providers (including Cloudflare, which hosts the site, application and API), accounting and support tooling, and authorities where the law requires. We do not sell personal data.
5. International transfers
Our providers may process data outside your country. Where data protected by GDPR/UK GDPR is transferred internationally, we rely on adequacy decisions or standard contractual clauses.
6. Retention
Account, verification and transaction records are retained for as long as your account is active and then for the period required by AML law (typically five years after the relationship ends, longer where an authority requires it). Security logs are kept for shorter, defined periods.
7. Your rights
Subject to applicable law you may request access, correction, deletion, restriction, portability, or object to processing, and withdraw consent where processing is based on it. Verification and transaction records that we must keep by law are exempt from deletion until the retention period ends. Write to support@universecard.io; you can also complain to your supervisory authority.
8. Security
Data in transit is encrypted (TLS). Access to the back office is restricted to authorised staff behind single sign-on with enforced multi-factor authentication, is role-limited, and every administrative action is written to an immutable audit log.
9. Changes
We will post updates on this page and, for material changes, notify account owners in the cabinet.