Demonstration service. AegisPay is a technical demo and is not a live financial product. This policy is a realistic template describing how a deployment of AegisPay would handle personal data. Do not enter real identity documents, card numbers or other sensitive personal data into the demo.
1. Overview
This Privacy Policy explains what personal data AegisPay (the “Service”) collects, why we collect it, and the choices you have. It should be read together with our Terms of Service.
2. Data we collect
Account data
Email address, display name and the credentials you set when registering.
Verification data
Information you submit to raise your verification tier, where enabled.
Transaction data
Wallet balances, transfers, conversions and the ledger entries that record them.
Technical data
Session tokens and basic request metadata needed to operate and secure the Service.
3. How we use data
- To operate wallets, process transfers and maintain the double-entry ledger.
- To authenticate you and keep your account secure.
- To apply risk, velocity and compliance controls.
- To respond to support requests you send us.
4. Legal bases
Where data-protection law applies, we rely on performance of our contract with you (to provide the Service), our legitimate interests (to secure and improve the Service), legal obligations (compliance), and your consent where we ask for it.
5. Sharing
We do not sell your personal data. In a production deployment, data may be shared with service providers who process it on our behalf, with partners strictly to complete a transaction you initiate, and with authorities where legally required. Partner access is server-to-server only and never exposes your data to other customers.
6. Cookies & local storage
The Service uses session storage in your browser to keep you signed in. It does not set advertising or cross-site tracking cookies. Clearing your browser storage signs you out.
7. Security
Passwords are stored only as salted hashes, never in plain text. Access to the API is split between short-lived customer sessions and server-to-server partner keys, each scoped to what it needs. Transport is expected to be served over HTTPS in any public deployment.
8. Retention
Account and ledger records are retained while your account is active and for as long afterwards as needed to meet legal, accounting and dispute-resolution requirements, after which they are deleted or anonymised.
9. Your rights
Depending on where you live, you may have the right to access, correct, export or delete your personal data, and to object to or restrict certain processing. You can exercise these rights through our contact page.
10. International transfers
Where data is processed outside your country, a production deployment would use appropriate safeguards (such as standard contractual clauses) to protect it.
11. Children
The Service is not directed to anyone under 18, and we do not knowingly collect data from children.
12. Changes & contact
We may update this policy; the “last updated” date reflects the current version. Questions can be sent through our contact page.