Privacy Policy

1. Who handles your data

CryptoCardex is operated by IZIPAY Solutions Group, Suite C, Level 7, World Trust Tower, 50 Stanley Street, Central, Hong Kong. We decide what is collected and why, which makes us the controller of your data.

2. What we collect

We have built the service so that it asks for as little as possible. In practice that means:

What you give us

• your email address and a password, which is stored only as a cryptographic hash and is never readable by us
• the postal address, but only if you order the metal card, because it has to be sent somewhere
• anything you write to us in a support message

What the service produces

• your card numbers, their expiry and their balances
• your transactions: amount, currency, date and the merchant name as the card network reports it
• your top ups: the chain, the amount, the deposit address and the transaction hash

What your browser sends

• your IP address when you log in or register, which we record to spot account takeovers
• your device time zone and browser language, used to work out which country to show prices for
• the page you arrived from and the link you arrived by, kept for ninety days

3. Why we hold it

• To run the service. Without an email we cannot give you an account, and without card and transaction data we cannot show you a balance.
• To keep accounts safe. IP and device signals let us notice when someone logs in who should not.
• To meet the law. Financial records have to be kept, and we have to be able to answer a lawful request about them.
• To answer you. Support messages are kept so that the next person who reads your case knows what happened before.

4. Who else sees it

We do not sell your data, and we do not share it for anyone else's advertising.

It reaches other parties only where the service cannot work otherwise:

• The card issuer. To create a card and settle its transactions, the issuer receives what it needs for that card.
• The card network. A payment cannot be authorised without passing through it.
• Our email provider. To deliver the messages you ask for, such as a confirmation code.
• Authorities. Where a law or a valid order requires it, and only to the extent required.

These pages also load fonts from Google and brand icons from a public icon service. Those requests tell the provider your IP address, which is unavoidable with any externally hosted file. They set no cookies on these pages.

5. How long we keep it

• Account and transaction records: while your account exists, and afterwards for as long as financial record keeping law requires.
• Login and IP records: kept for security review, then removed.
• Attribution data: ninety days.
• Support correspondence: kept while it is useful for handling your case.

When an account is closed, we remove what we are free to remove and keep only what the law makes us keep.

6. Your rights

You can ask us to show you what we hold about you, to correct it if it is wrong, to delete it, or to send it to you in a portable form. Write to [email protected] and we will answer within thirty days.

There is one limit worth stating plainly: we cannot delete financial records we are legally required to retain, and we will say so rather than quietly ignore the request.

7. How it is protected

The site runs over encrypted connections only. Passwords are stored as hashes, never as text. Card numbers and security codes are not held in a readable form on our side: they are requested from the issuer when you ask to see them, and are shown to you only after a confirmation step.

Access to systems that hold customer data is restricted and logged. No system is perfect, and we will tell you directly if something happens that affects you.

8. How to reach us

Write to [email protected] with "Privacy" in the subject line, or see our contact page.