Privacy Policy

Information we collect

We collect the following categories of information so we can provide the service and meet our legal obligations:

• Account information. Your email address and a securely hashed version of your password. We never store your password in plain text.
• Identity and verification data (KYC). To comply with anti-money-laundering (AML) and know-your-customer laws, we collect your identity details, images of your government identity documents, and biometric and liveness data used to confirm you are a real person. This verification is carried out by our identity partner, Sumsub, which processes the documents and biometric checks on our behalf.
• Wallet information. Blockchain wallet addresses associated with your account. Your self-custody wallet is created and secured through our wallet partner, Privy; you control your own keys and funds.
• Card information. If you use a prepaid Visa card, related card data is handled by our card issuing partner, Interlace.
• Transaction history. Records of your transfers, card activity, payouts and related details.
• Device, usage and log data. Information about how you use the app and website, device identifiers, log data and your IP address.

Why we collect it

• · To provide, operate and maintain the service you ask for.
• · To meet our legal and regulatory obligations, including AML and identity-verification requirements.
• · To detect, prevent and investigate fraud, abuse and security threats, and to keep your account safe.

Partners and processors we share data with

Vav works through licensed and specialist partners to deliver the service. We share only the information each partner needs to perform its role, and each partner is responsible for its own handling of that data under its own privacy terms:

• · Sumsub — identity verification, document checks and biometric/liveness checks.
• · Privy — self-custody wallet infrastructure.
• · Interlace — prepaid Visa card issuing.
• · Fin.com — bank payouts.

We may also disclose information where required by law, regulation, legal process, or a lawful request from a public authority.

How long we keep your data

As a financial service, we are required by anti-money-laundering and other applicable laws to retain certain records — in particular your verified identity information and your transaction history — for a set period after your account is closed. These records are kept only for as long as the law requires and are then removed. Other personal data not subject to a legal retention obligation is removed when you delete your account.

Your rights and choices

Depending on where you live, you may have the right to access, correct, or request deletion of your personal data, and to object to or restrict certain processing. You can permanently delete your account and associated data at any time — see our account deletion page for how deletion works and what is retained. To exercise any other right, contact us using the details below.

How we protect your data

We encrypt data in transit and at rest, and we store account passwords only as Argon2id hashes — never as plain text. We apply technical and organisational safeguards to protect your information, though no method of transmission or storage is ever completely secure.

International data transfers

Vav operates from Hong Kong and works with partners located in different countries. Your information may therefore be processed and stored outside the country in which you live. Where we transfer data internationally, we take steps to ensure it remains protected.

Children

Vav is not intended for anyone under 18 years of age, and we do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, please contact us so we can remove it.

Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date above and, where appropriate, notify you in the app or by email.