Privacy Policy

2.1.1 Account and profile information

We collect information needed to create and manage your account, such as your name, email address, phone number, username or U-tag (your unique U-Topia username used to receive payments), and information you choose to add to your profile.

If you use password-based sign-in, we process your password to authenticate you. Passwords are protected using a one-way password hash rather than stored in readable form.

2.1.2 Identity verification information

Some features require identity verification. Depending on the service and your location, you may be asked to provide:

• Your legal name, date of birth, nationality, and country of residence.
• Your residential address and, where necessary, proof of address.
• A government-issued identity document and its identifying details.
• A selfie, video, or liveness check.
• Information about your occupation, source of funds, or source of wealth when additional checks are required.

Identity verification providers may process facial images or biometric information to check that an identity document belongs to the person submitting it. We explain the relevant verification process and provide any required notice or consent request before that processing takes place.

2.1.3 Wallet, transaction, and payment information

We process information associated with the wallet and financial features you use. This can include wallet addresses, selected networks and assets, balances, transaction amounts, recipient addresses, transaction identifiers, fees, timestamps, and transaction status.

For card features, relevant information can include your cardholder details, billing or delivery address, card status, limited card identifiers, spending limits, purchases, refunds, and disputes.

2.1.4 Support and communications

When you contact us, we collect your contact details, the content of your request, and information you submit to help us investigate it. This may include screenshots or relevant transaction references.

Please avoid including unrelated identity documents or sensitive financial information in ordinary support messages. Use the secure method we provide when such information is necessary.

2.1.5 Preferences and subscriptions

We collect the choices you make about notifications, marketing, optional permissions, and privacy settings. We may also collect feedback or survey responses you choose to provide.

When you use the Services, we collect technical information needed to operate them and protect your account. This may include:

• Your IP address.
• Device model, operating system, browser type, and app version.
• Language and time-zone settings.
• Sign-in activity and security events.
• Error reports, crash information, and performance measurements.
• Information about the screens or features you use and whether an action succeeds or fails.
• A notification identifier used to deliver push notifications, if enabled.

We use these records to understand service performance, investigate problems, and identify potentially unauthorized activity.

We may infer an approximate location from your IP address. This is different from accessing your device's precise GPS location.

We do not collect MAC addresses, UDIDs, or advertising identifiers.

We may receive information from:

• Sign-in providers, when you choose a supported sign-in method.
• Wallet infrastructure providers, to provide wallet functionality and transaction updates.
• Identity verification and screening providers, to verify identity and assess applicable compliance requirements.
• Card and payment providers, to provide the financial features you request.
• Public blockchain networks, to retrieve balances, transactions, and confirmation status.
• Other users, when they send you a payment or interact with your account through an available feature.

We combine this information with your account information when necessary to provide the relevant service, maintain accurate records, or protect against fraud.

If you choose Google or Apple sign-in, we receive information authorized through that sign-in process.

• Google: Your account identifier, email address, name, and profile image, where provided.
• Apple: Your account identifier, email address or private relay email address, and your name when Apple provides it.

We do not receive your Google or Apple account password through these sign-in methods.

We use the information to create or authenticate your U-Topia account. We do not access unrelated content from your sign-in account unless you separately authorize a feature that requires it.

If you choose to use contact discovery, we request permission to access phone numbers in your address book to help you find existing U-Topia users.

Phone numbers are used only to find matching users and are not stored after matching. Contact names are not uploaded.

You can decline contact access and still use available alternatives, such as searching by username.

You can withdraw device permission through your phone's settings. Withdrawing permission stops future access.

Some features may request device permissions, such as:

• Camera access for scanning QR codes or completing identity checks.
• Photo access when you choose to upload an image.
• Contacts access for optional contact discovery.
• Notification permission for account and transaction updates.

Permission is requested in connection with the relevant feature. You can manage it through your device settings.

If you enable fingerprint or facial authentication to unlock the app, your device performs the biometric check. U-Topia receives only the authentication result and does not receive or store the device's biometric template.

Local device authentication is separate from a selfie or facial verification conducted during identity verification.

Our website uses cookies or similar technologies to maintain sessions, protect sign-in, and remember choices.

We use Google Analytics to measure website performance. We ask for your consent through our cookie banner before using these analytics cookies, and we honor the choice you make there. See our Cookies Policy for details.

You can reject non-essential cookies and still use our website. Essential cookies are always active because they are needed for secure sign-in and basic website functions.

Wallet addresses and blockchain activity can be personal information when linked to you.

When a transaction is submitted to a public blockchain, information such as the sending and receiving addresses, asset, amount, and transaction time may become publicly accessible.

Public blockchain records are maintained by the network. They may be copied, analyzed, and retained by people and organizations outside U-Topia.

Deleting your U-Topia account does not delete public blockchain transactions. We can consider deletion of personal information in systems we control, subject to applicable exceptions, but cannot erase or alter an immutable blockchain record.

Some information is necessary to provide a requested feature or meet a legal requirement. For example, you may need to complete identity verification before accessing a card or other regulated service.

If you do not provide required information, we may be unable to provide that feature.

Optional choices, such as receiving promotional messages or enabling contact discovery, are separate. Declining them does not prevent you from using unrelated features.

We use information to:

• Create and manage your account.
• Authenticate you and support account recovery.
• Provide wallet functionality and display balances.
• Facilitate transfers and display transaction status.
• Provide available payment and card features.
• Maintain the records needed to operate those features.

We use information from relevant providers to conduct identity verification, sanctions screening, anti-money laundering checks, and other checks required for the services offered.

Additional information may be requested when a transaction or account requires further review.

We also use relevant records to meet applicable reporting, accounting, audit, and recordkeeping obligations.

We use account, device, and transaction information to detect suspicious activity, investigate unauthorized access, prevent fraud, and protect the Services.

These checks can result in a request for additional verification or a temporary restriction while an issue is reviewed.

We use information to respond to questions, resolve technical problems, investigate complaints, and handle relevant transaction or card disputes.

We may send essential messages about verification, account security, transactions, service interruptions, and legal or policy changes.

These messages are separate from marketing.

We use necessary technical and usage information to identify errors, measure reliability, and improve features.

Where analytics require consent, we use them in accordance with your choice.

We may produce aggregated or de-identified statistics. We apply safeguards appropriate to the information and do not treat data as anonymous merely because your name has been removed.

If you subscribe to promotional updates or otherwise authorize marketing where required, we use your contact details and communication preferences to send relevant U-Topia news or offers.

You can unsubscribe using the instructions in a message or by contacting us.

After you unsubscribe, we may still send necessary account, security, transaction, and legal communications. We do not treat promotional offers as essential service messages.

Identity verification, security, and compliance checks may use automated tools to identify mismatches, suspicious patterns, or risk indicators.

If a decision to reject, suspend, or restrict an account is made solely by automated processing and has a legal or similarly significant effect on you, you can request human review of that decision.

Where applicable law provides a right to challenge an automated decision, you can contact us using Section 13.

Relevant categories include:

Providers acting on our instructions are subject to appropriate contractual restrictions. Providers that determine their own purposes may process information under their own privacy notices.

Our providers include:

• Dynamic, for wallet infrastructure: Dynamic Privacy Policy.
• ZeroDev, for supporting wallet transaction functionality: ZeroDev Privacy Policy.
• Sumsub, for identity verification: Sumsub Service Privacy Notice.
• Rain, which issues and provides our cards, for card services: Rain Privacy Policy.

Provider notices supplement this policy for processing those providers perform. They do not replace U-Topia's responsibility to explain its own practices.

When you send a payment, information needed to complete or identify the transaction may be available to the recipient.

Blockchain transactions also disclose information to the relevant network, as explained in Section 2.8.

We may disclose information to competent authorities when required by applicable law or a valid legal process.

We may also disclose information where legally permitted and necessary to investigate fraud, protect people, or establish, exercise, or defend legal claims.

If U-Topia is involved in a merger, acquisition, restructuring, or transfer of a business, relevant information may be disclosed to advisers and prospective or actual parties to the transaction, subject to appropriate safeguards.

We provide notice where required if responsibility for your information changes.

We do not sell your personal information or share it for cross-context behavioral advertising. We do not disclose your personal information to third parties for their own direct marketing.

Keep your device and account secure, use available authentication protections, and report suspicious activity promptly.

Our support team will never ask you to disclose your seed phrase, recovery phrase, private key, password, or one-time verification code through email, chat, phone, or a support form.

You may need to enter a password or verification code into an official authentication screen. That is different from disclosing it to a person claiming to provide support.

Do not send wallet secrets or verification codes to someone who contacts you unexpectedly.

Contact support@u-topia.com with the subject “Privacy Request.”

Tell us which right you want to exercise and provide enough information to identify the relevant account.

We respond within 30 days of receiving a request. Where applicable law allows a longer period, we explain any permitted extension.

We may need to verify your identity proportionately before disclosing, changing, or deleting information. We will not ask you to send a private key, recovery phrase, password, or one-time verification code to support.

We use information supplied for verification only as necessary to handle the request, protect against fraud, and maintain required records.

Requests are generally handled without charge. If applicable law allows a fee or refusal in exceptional circumstances, we explain the reason.

You can request account deletion through Profile > Settings > Delete Account, or by emailing support@u-topia.com with the subject “Delete Account.”

Before deleting your account, transfer any remaining digital assets out of your wallet. Deleting your account also closes any linked U-Topia card.

Once you confirm account deletion, you immediately lose access to your wallet through U-Topia, and this cannot be undone.

We delete your account information within 30 days of your request, except information we must retain as described in Section 7.

Deleting an account does not automatically erase information we must retain to meet legal obligations or resolve disputes.

It also does not erase public blockchain records or automatically delete records held by providers acting independently.

We explain limitations when responding to your request. Uninstalling the app does not, by itself, delete your account.

You can unsubscribe from marketing through the instructions in a message or by contacting us.

You can manage device notification permissions in your phone's settings. Turning off push notifications does not prevent essential communications from reaching you through other available channels.

You can change camera, contacts, photo, and notification permissions through your device settings.

You can manage cookie preferences through your browser settings.

If you have concerns about our handling of your information, contact us so we can investigate.

You can also contact the relevant data protection authority where applicable. You do not need our permission to do so.

If the California Consumer Privacy Act, as amended by the California Privacy Rights Act, applies, the following table summarizes relevant categories described in this policy.

Retention periods are set out in Section 7.

Where applicable, California residents can request information about collection and disclosure, access to specific information, correction, and deletion.

California residents can also opt out of sale or sharing for cross-context behavioral advertising and limit certain uses of sensitive personal information where the law provides that right.

We do not discriminate against you for exercising applicable privacy rights.

Requests can be submitted through Section 13. We respond within 45 days of receiving a request. Where permitted, we may extend this period once by a further 45 days, and we explain any extension.

Our actual sale and sharing practices are described in Section 5.6.

Where applicable law requires it, a recognized Global Privacy Control signal is treated as an opt-out request for covered sale or sharing.

We use sensitive personal information only for purposes permitted by law, such as verification, security, and compliance.

An authorized agent may submit a request on your behalf. We may request proof of authorization and proportionate verification as permitted by law.

People covered by other privacy laws may have additional access, correction, deletion, portability, objection, opt-out, or appeal rights.

Contact us to exercise a right. We assess the request under the law that applies. If we decline a request, you can reply to our response to ask for a review of that decision, and you can also contact the relevant supervisory authority.

Nothing in this policy removes a mandatory privacy right provided by applicable law.