Privacy Policy

Introduction

Surf ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application and services that enable you to convert cryptocurrency to local currency.

Surf is a financial technology company, not a bank. Crypto services are provided through decentralized protocols and licensed partners. Your keys never leave your device—we cannot see your balances or spending.

Information We Collect

Information You Provide

• Email address (for waitlist and account notifications)
• Device information for app functionality
• Transaction metadata necessary for processing conversions

Information We Do NOT Collect

• Private keys — Your keys never leave your device
• Wallet balances — We cannot see how much crypto you hold
• Spending history — Your transactions remain private
• Personal financial data — We do not track or store your financial information

How We Use Your Information

We use the limited information we collect to:

• Process crypto-to-cash conversions through our platform
• Communicate important updates about our services and your account
• Provide customer support when you reach out to us
• Comply with legal obligations and regulatory requirements
• Improve and optimize our services

Data Security

We implement industry-standard security measures to protect your information. Our non-custodial architecture means your private keys are stored locally on your device and encrypted—we never have access to them.

While we strive to use commercially acceptable means to protect your data, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.

Third-Party Services

Our services integrate with decentralized protocols and licensed financial partners to process conversions. These third parties have their own privacy policies, and we encourage you to review them.

We work with local payment systems including VietQR, PromptPay, PIX, and other regional QR code payment networks. Transaction processing through these networks is subject to their respective privacy practices.

Identity Verification and Biometric Data

To comply with financial "Know Your Customer" (KYC) and anti-money-laundering (AML) regulations, Surf requires a one-time identity verification. This verification is performed by our third-party identity-verification provider, Didit (https://didit.me).

During verification, Didit collects a photo of your government-issued ID and a selfie, and uses facial-recognition (biometric) technology to perform a liveness check and to confirm the selfie matches the ID. This biometric processing is carried out entirely by Didit within its own system.

Surf does not access your device camera for this purpose, and Surf does not collect, receive, or store your selfie, your ID images, or any facial-recognition template, faceprint, or other biometric identifier. Surf receives only the verification result (approved or declined) together with the standard identity details you provide (such as name and address).

Didit processes biometric data solely to verify your identity. Per Didit's policy, selfies are processed in memory and deleted immediately after processing, and Didit does not retain raw biometric data. Didit's infrastructure is EU-based and independently certified (SOC 2 Type II, ISO 27001, GDPR). Didit's handling of your data is governed by its own privacy policy (https://didit.me/terms/privacy-policy/).

Surf retains only your verification status for as long as required by applicable KYC/AML recordkeeping laws. You may request deletion of your data as described in "Your Rights" below.

Data Retention

We retain your information only for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required by law. When data is no longer needed, we securely delete or anonymize it.

Your Rights

Depending on your location, you may have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Object to or restrict certain processing activities
• Data portability where applicable

Children's Privacy

Our services are not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a minor, please contact us immediately.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date. You are advised to review this Privacy Policy periodically for any changes.

Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us:

• X (Twitter): @SurfCashX
• Telegram: Join our community