2,2
Jun 24, 2026
This Privacy Policy explains how Qaay collects, uses, stores, shares, protects, and retains personal data when you access or use the Platform, including the website, mobile interfaces, account features, wallet, portfolio, market, swap, borrow, lend, earn, support, verification, security, and related services.
Qaay is committed to handling personal data responsibly, transparently, and only for legitimate purposes connected to the operation, security, compliance, and improvement of the Platform.
1. Scope of This Policy
This Privacy Policy applies to personal data processed when you:
This Policy does not apply to third-party websites, external wallets, blockchain networks, exchanges, payment providers, or services that are not controlled by Qaay.
2. Personal Data We Collect
Qaay may collect the following categories of personal data, depending on how you use the Platform.
2.1 Account and Contact Data
This may include:
Qaay does not store plain-text passwords. Passwords are protected using industry-standard security measures, including hashing and other technical controls.
2.2 Verification and Compliance Data
Where required for verification, security, fraud prevention, sanctions screening, AML/CTF checks, eligibility, or access to specific features, Qaay may collect:
If image-based verification is used, it is used to confirm identity, reduce fraud, and protect the Platform. Qaay does not use identity images for advertising or unrelated profiling.
2.3 Transaction and Platform Activity Data
This may include:
2.4 Risk, Security and Technical Data
Qaay may collect and process:
Qaay does not collect precise GPS location unless it is clearly requested for a specific feature and permitted under applicable law.
2.5 Communications Data
When you contact Qaay or interact with support, Qaay may process:
2.6 Cookies and Similar Technologies
Qaay may use cookies, pixels, local storage, SDKs, analytics tools, and similar technologies for security, functionality, performance, analytics, preferences, fraud prevention, and marketing where permitted.
More information is provided in the Cookie section of this Policy.
3. How We Use Personal Data
Qaay uses personal data for the following purposes.
3.1 To Provide and Operate the Platform
This includes:
3.2 To Verify Identity and Eligibility
This includes:
3.3 To Manage Risk and Protect the Platform
This includes:
3.4 To Improve Products and Services
This includes:
Where possible, Qaay uses aggregated, anonymized, or de-identified data for analytics and product improvement.
3.5 To Communicate With You
This includes:
You can opt out of marketing communications where required by law. Service, security, compliance, and account-related messages may still be sent because they are necessary for the operation and protection of your account.
3.6 To Comply With Legal and Regulatory Requirements
This includes:
4. Legal Bases for Processing
Depending on the context, Qaay processes personal data under one or more of the following legal bases.
Purpose
Typical Data
Legal Basis
Account creation and access
Account and contact data
Contract performance
Platform features and transactions
Transaction and platform activity data
Contract performance
Support and service communications
Account, support, and communication data
Contract performance or legitimate interests
Identity verification and compliance checks
Verification and compliance data
Legal obligation, contract performance, or legitimate interests
Sanctions, AML/CTF and fraud prevention
Verification, transaction, wallet, technical, and risk data
Legal obligation or legitimate interests
Credit status, risk controls, and collateral monitoring
Transaction, collateral, market, account, and risk data
Contract performance and legitimate interests
Security monitoring
Technical, security, device, and usage data
Legitimate interests and legal obligation where applicable
Product improvement and analytics
Usage, technical, and aggregated data
Legitimate interests or consent where required
Marketing communications
Contact and preference data
Consent or legitimate interests where permitted
Non-essential cookies and similar technologies
Cookie and device data
Consent where required
Where Qaay relies on legitimate interests, it does so to operate, secure, improve, and protect the Platform, while taking reasonable steps to respect user rights and expectations.
Where processing is based on consent, you may withdraw consent at any time. Withdrawal of consent does not affect processing that took place before withdrawal.
5. Automated Systems, Risk Scoring and Protective Actions
Qaay may use automated or system-assisted processes to support account operation, pricing, risk management, collateral monitoring, credit status, fraud prevention, security, compliance, and transaction controls.
These systems may help calculate or assess:
Automated systems are used to keep the Platform secure, consistent, fast, and responsive to market conditions. They may also help prevent fraud, reduce losses, maintain liquidity, and protect users.
Where a system-assisted decision materially affects your access, transactions, collateral, obligations, or account features, you may contact support to request clarification or review, unless the action is required by law, sanctions, urgent security needs, fraud prevention, or immediate risk-control requirements.
Qaay does not use risk scoring for unrelated advertising or for selling user profiles to advertisers.
6. Identity Images and Verification Checks
Where identity images or selfies are required, Qaay uses them for identity verification, fraud prevention, account security, compliance checks, and protection of the Platform.
Qaay does not use identity images for marketing, unrelated profiling, or public display.
Where verification technology involves image comparison or similar checks, Qaay uses such processing only for verification and security purposes and only where permitted by applicable law.
7. When We Share Personal Data
Qaay may share personal data with trusted third parties where necessary for the purposes described in this Policy. These may include:
Qaay does not sell personal data.
Third parties are expected to process personal data only for authorized purposes and with appropriate confidentiality, security, and data protection safeguards.
8. International Data Transfers
Qaay and its service providers may process or store personal data in countries other than your country of residence, including countries outside the EEA or in other regions with different data protection laws.
Where required, Qaay implements appropriate safeguards for international transfers, such as adequacy decisions, Standard Contractual Clauses, contractual protections, technical safeguards, access controls, and other measures designed to protect personal data.
You may request general information about the safeguards applied to international transfers through the available privacy or support contact channel.
9. Data Retention
Qaay retains personal data only for as long as reasonably necessary for the purposes described in this Policy, unless a longer retention period is required or permitted by law.
Typical retention periods include:
Data Category
Typical Retention
Account data
For as long as the account is active, and for a reasonable period after closure where needed for legal, security, dispute, or recordkeeping purposes
Transaction and financial records
For the period required for accounting, legal, tax, compliance, AML/CTF, dispute, or audit purposes
Verification and KYC data
For the period required by applicable compliance, fraud prevention, sanctions, AML/CTF, legal, or recordkeeping obligations
Security logs and technical records
Usually retained for a limited period, unless needed for investigations, security purposes, fraud prevention, legal, or other compliance purposes
Support communications
For as long as necessary to handle the request and maintain reasonable business records
Marketing preferences
Until you unsubscribe, withdraw your consent, or the data is no longer required
Cookie and analytics data
According to the type of cookie, your consent settings, and applicable retention periods
Qaay may retain limited information after account closure where necessary to comply with legal obligations, prevent fraud, resolve disputes, enforce agreements, maintain security, or protect its legitimate interests.
Where data is no longer required, Qaay will delete, anonymize, or securely restrict such data in accordance with applicable requirements.
10. Security
Qaay implements technical and organizational measures designed to protect personal data against unauthorized access, loss, misuse, alteration, disclosure, or destruction.
These measures may include encryption, access controls, password hashing, monitoring, logging, secure infrastructure, internal policies, staff access restrictions, vendor controls, and incident response procedures.
No online service can guarantee absolute security. You are responsible for keeping your login details, devices, email account, authentication methods, and wallet credentials secure.
11. Your Privacy Rights
Depending on your location and applicable laws, you may have the right to:
Some rights may be limited where Qaay must retain or process data for legal, security, fraud prevention, compliance, dispute, or legitimate business reasons.
Qaay may need to verify your identity before responding to a privacy request.
12. Cookies and Similar Technologies
Qaay may use cookies and similar technologies to operate the Platform, secure accounts, remember preferences, measure performance, understand usage, improve services, and support marketing activities where permitted.
12.1 Types of Cookies and Technologies
Type
Purpose
Consent
Strictly necessary
Required for login, security, session management, fraud prevention, and core Platform functionality
Usually not required
Functional
Used to remember preferences such as language, region, or interface settings
May require consent depending on applicable law
Performance and analytics
Used to help understand usage, errors, speed, and service quality
Consent may be required
Marketing and targeting
Used to support personalized content, campaign measurement, or promotional activity
Consent required where applicable
12.2 Managing Cookies
Where required, Qaay will ask for consent before using non-essential cookies or similar technologies. You may manage or withdraw your cookie consent through the cookie settings available on the Platform, where provided, or through your browser settings.
Blocking some cookies may affect the Platform's functionality, security, or user experience.
13. Marketing Communications
Qaay may send marketing communications where permitted by law. You may unsubscribe or opt out of marketing messages at any time through the available unsubscribe link, preference settings, or support channels.
Opting out of marketing does not stop service-, account-, risk-, security-, compliance-, or transaction-related communications.
14. Children and Minors
Qaay is intended only for users who are at least 18 years old, or older where a higher minimum age requirement applies in their jurisdiction.
Qaay does not knowingly provide services to children or minors who are not legally permitted to use the Platform. If Qaay becomes aware that a user does not meet the eligibility requirements, it may restrict or close the account and take appropriate steps regarding related data.
15. Blockchain and Public Networks
Some Platform activities may involve the use of blockchain networks. Blockchain transactions may be public, permanent, and outside Qaay's control.
Personal data should not be placed directly on public blockchain networks unless you understand the consequences. Qaay may not be able to delete or modify data recorded on a public blockchain.
16. Third-Party Links and Services
The Platform may include links, integrations, or references to third-party services. Qaay is not responsible for the privacy practices, security, content, or terms of third-party services that it does not control.
You should review the privacy notices and terms of any third-party service before using it.
17. Changes to This Privacy Policy
Qaay may update this Privacy Policy from time to time to reflect product changes, legal requirements, security practices, risk controls, operational improvements, or regulatory developments.
Where changes are material, Qaay will take reasonable steps to notify users through the Platform or via other appropriate channels.
If you continue to use the Platform after an updated Privacy Policy becomes effective, you acknowledge and agree that the updated Privacy Policy applies to your use of the Platform.
18. Contact and Privacy Requests
You may submit privacy-related questions, requests, or concerns through the privacy or support contact channels made available on the Platform.
Qaay will review privacy requests in accordance with applicable laws and may request additional information to verify your identity before responding.