MothPrivacy Policy
1. Introduction
This Privacy Policy explains how Hong Kong Yunmo Technology Co., Limited (the "Company", "we", "us") collects, uses, discloses, stores and protects your Personal Data when you use the MothCard-branded services, website and mobile application (the "Services"). By using the Services, you agree to this Privacy Policy and any updates we may issue from time to time.
"Personal Data" means any information relating to an identified or identifiable individual. It does not include anonymized data.
2. What Personal Data We Collect
We may collect and process the following categories of Personal Data:
| Category | Examples |
|---|---|
| Identity data | Name, ID documents, photo, gender, date of birth, nationality |
| Contact data | Phone number, email, residential address |
| Financial data | Transaction history, wallet activity, payment information |
| Device data | Device model, OS version, identifiers (IDFV, ANDROID_ID, IDFA, GAID), device and network settings, and device integrity signals used for fraud prevention |
| Network and location data | IP address, network type, approximate location (coarse precision, collected only with your permission) |
| Usage data | App interaction, feature usage, push interaction statistics |
Device permissions
The App asks for the permissions below. You can refuse any of them, and change your choice later in your device settings; refusing a permission only disables the feature that relies on it.
- Camera — to photograph your identity documents for verification, and to scan QR codes when you top up or send funds.
- Photo library — to upload an existing photo of your identity documents, and to save images such as referral posters to your album.
- Notifications — to alert you about transactions, card status and security events.
- Biometrics (Face ID, Touch ID or fingerprint) — to sign in to the App. The check is performed by your device; your biometric data stays on the device and is never sent to us.
- Approximate location — to identify your country or region so that we show only the cards available to you. We request coarse precision only, and do not collect your location in the background.
- Advertising tracking (iOS) — if you allow tracking, your advertising identifier is used to measure campaign performance and to personalise advertising. You can withdraw this at any time in your device settings.
3. How We Use Your Personal Data
We process your Personal Data for purposes including but not limited to:
- Verifying your identity and onboarding, including KYC and AML checks
- Providing and managing your account, Digital Wallet and MothCard
- Processing payments and providing transaction records
- Detecting and preventing fraud, misuse or security threats
- Complying with legal obligations, regulatory investigations or law enforcement requests
- Analytics, audits, customer support and service optimization
- Marketing and promotional campaigns, subject to your consent where required
- Identifying your country or region from your approximate location, so that we can recommend the card products available to you and avoid showing products that cannot be issued where you are. This is optional, and you can turn location access off at any time in your device settings
4. Legal Basis for Processing (EEA and UK Residents)
If you are located in the European Economic Area ("EEA") or the United Kingdom, our legal basis for collecting and using your Personal Data depends on the data concerned and the context. We rely on one or more of the following:
- Performance of a contract — to provide the Services you request.
- Consent — where you have given us consent, for example for marketing. You may withdraw consent at any time.
- Legal obligation — to comply with KYC, AML and other regulatory requirements.
- Legitimate interests — for fraud prevention, security and service improvement, where not overridden by your rights.
For users outside the EEA and UK, including Hong Kong residents, we process Personal Data in accordance with the Personal Data (Privacy) Ordinance (Cap. 486, Laws of Hong Kong) and other applicable laws.
5. Disclosure of Your Data
We may share your Personal Data with:
- Our affiliates, subsidiaries, employees or authorized representatives
- Third-party service providers, such as KYC and AML vendors, card issuing and processing providers, payment processors and custodians
- Marketing and analytics partners, including Google Firebase, Meta and Adjust
- Legal, regulatory or government authorities as required by law
- Potential acquirers or investors in a merger or restructuring
6. International Transfers
Due to the global nature of our Services, your data may be transferred to and stored in locations outside your home jurisdiction, including Hong Kong. We ensure such transfers comply with applicable data protection laws and implement appropriate safeguards. For EEA and UK residents, transfers outside the EEA and UK are made under appropriate safeguards, such as Standard Contractual Clauses, where required.
7. Data Retention
We retain your Personal Data only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy legal, regulatory, accounting or reporting requirements.
- KYC and AML records — retained for the period required by applicable anti-money-laundering laws, typically five to seven years after the end of the customer relationship.
- Transaction records — retained as required by applicable law and for dispute resolution.
- Account data — retained while your account is active, and after it is closed for as long as needed to meet the record-keeping periods above.
When Personal Data is no longer needed, we will securely delete or anonymize it.
8. Your Rights
We aim to take reasonable steps to let you access, correct, or delete your Personal Data, or limit its use.
If you are an EEA or UK resident, you have the following rights under the GDPR and UK GDPR:
| Right | Meaning |
|---|---|
| Access | Obtain a copy of the Personal Data we hold about you. |
| Rectification | Have inaccurate or incomplete data corrected. |
| Erasure | Request deletion of your data, subject to legal retention obligations. |
| Restriction | Request that we restrict processing of your data. |
| Data portability | Receive your data in a portable format. |
| Objection | Object to our processing of your data. |
| Withdraw consent | Withdraw consent at any time where processing is based on consent. |
To exercise your rights, contact us at privacy@mothcard.io. We may verify your identity before responding. We will respond within the timeframe required by applicable law; under the GDPR this is generally within one month.
You can also delete your account yourself in the App, under Profile. Deleting your account ends your access and closes your cards; records we are required to keep by law are retained for the periods set out in section 7.
Residents outside the EEA and UK, including Hong Kong, may exercise applicable rights under local law, such as access and correction under the Hong Kong PDPO, via the same contact.
If you are not satisfied with how we have handled your Personal Data, you may lodge a complaint with your data protection authority. In the EEA and UK this is your local supervisory authority; in Hong Kong it is the Office of the Privacy Commissioner for Personal Data (PCPD).
9. Cookies
On our website we use cookies and similar technologies. You can manage them in your browser settings; disabling them may affect your experience.
The App does not use cookies. It uses software development kits and the device and advertising identifiers described in section 2. You can manage the related permissions in your device settings.
10. Data Security
We implement industry-standard security measures, including encryption and access controls, to protect your Personal Data. However, no system is completely secure, and we cannot guarantee absolute protection.
11. Third-Party Links
Our platform may contain links to third-party sites and services. We are not responsible for their content or privacy practices. Please review their policies separately.
12. Children's Data
The Services are not intended for individuals under 18. We do not knowingly collect Personal Data from minors. If we learn that we have collected such data, we will delete it.
13. Changes to This Policy
We may update this Privacy Policy from time to time. The updated version takes effect upon posting. We encourage you to review it periodically. Material changes may be notified through the App or by email.
14. Language
This Privacy Policy may be available in multiple languages. In case of any discrepancy, the English version prevails.
15. Contact Us
For any questions about this Privacy Policy or to make a data-related request, email privacy@mothcard.io with the subject line "PRIVACY REQUEST".