Privacy Policy.

Controller and scope

INNOVAPPSOFT LLC is responsible for the processing described in this policy when it directly operates the service. “We,” “us,” and “our” refer to INNOVAPPSOFT LLC.

This policy covers account creation and administration, the wallet, KeyCoin, KeyStore purchases, payments, top-ups, eSIMs, gift cards, virtual numbers, withdrawals, P2P operations, profiles, statuses, support, and other ecosystem features.

By using the services, you acknowledge receiving this policy. When applicable law requires consent for an activity, we will request it specifically and separately.

Information you provide

We may collect your name, username, email address, telephone number, country, language, date of birth, profile image, preferences, seller or business information, and other data you enter into your account.

We also process information you submit when requesting support, filing a claim, participating in a P2P dispute, reporting a transaction, publishing a status or advertisement, communicating with another user, or submitting supporting documents.

You must provide accurate information and keep it current. Do not send passwords, 2FA codes, CVVs, or complete card details through messages, support, statuses, or fields not intended for that information.

Identity, KYC, and sensitive data

Where applicable, we may collect or receive legal name, date of birth, nationality, country, address, identity document, document images, selfie, video or liveness evidence, verification result, session identifiers, and related evidence.

Verification may involve biometric analysis or facial comparison performed by a specialized provider. We use this data to confirm identity, prevent impersonation, meet KYC/AML obligations, manage risk, and protect users.

KYC documents and images must not be posted in profiles, statuses, chats, or public areas. Access is limited to authorized personnel and providers who need them for verification, security, support, or compliance.

Transactions and payments

We process information about top-ups, purchases, internal transfers, balances, KeyCoin, P2P, deposits, withdrawals, refunds, disputes, chargebacks, fees, products, recipients, networks, withdrawal addresses, orders, and fulfillment status.

Payment data may be collected directly by payment processors or partner institutions. Depending on the method, we may receive a token, payment identifier, status, amount, currency, payment-method brand, last digits, and fraud signals instead of the full card number.

We retain transaction and reconciliation records to provide the service, resolve errors or disputes, prevent abuse, maintain accounting records, and comply with legal and regulatory requirements.

Technical data and automatic collection

When you visit the site or use the applications, we may receive IP address, date and time, device, model, operating system, browser, language, time zone, approximate country, app version, installation, session and notification identifiers, and activity or error logs.

We use this information to authenticate sessions, deliver notifications, maintain compatibility, diagnose failures, measure operation, detect fraud, block abusive access, and protect accounts and systems.

We do not use precise location, contacts, camera, microphone, photos, or other device permissions unless a feature requires them, the operating system allows them, and the applicable notice or permission has been presented.

Sources of information

We obtain data directly from you, your device, and your activity within the ecosystem.

We may also receive information from sign-in providers such as Apple or Google, KYC providers, payment processors, banks or partner institutions, digital-product providers, networks, carriers, fraud-prevention services, and official compliance or sanctions sources.

When another person sends you value, creates a transaction with you, or identifies you as a recipient, we may receive the minimum data required to record, notify, fulfill, and reconcile that transaction.

How we use information

We use information to create and protect accounts, authenticate users, process transactions, deliver products, manage balances, display history, provide support, communicate order status, and administer KeyCard BBM, KeyPay, KeyCoin, and KeyStore features.

We also use it to verify identity, prevent fraud and abuse, perform sanctions screening, monitor transactions, investigate alerts, resolve disputes, apply limits or holds, comply with legal duties, and answer valid government requests.

We may use aggregated or reasonably deidentified data to analyze performance, improve products, calculate metrics, and plan capacity. We do not attempt to reidentify data that has been irreversibly anonymized.

Legal bases and consent

Depending on the jurisdiction, we process data to perform our contract with you, comply with legal obligations, pursue legitimate interests such as security and fraud prevention, protect vital interests, establish or defend claims, and, where applicable, based on your consent.

When processing is based on consent, you may withdraw it for future uses. Withdrawal does not affect prior processing or information we must retain or process under another legal basis.

If certain information is required to provide a feature, verify identity, or comply with law, refusing to provide it may prevent us from enabling or maintaining that feature.

AML, sanctions, fraud, and decisions

We may compare identity and transaction data against official sanctions lists, fraud indicators, monitoring rules, and risk profiles. These processes may produce matches, scores, alerts, or review requests.

A name match or alert does not by itself prove unlawful activity. Where appropriate, we review additional information before taking a material measure and provide human review where required by applicable law.

We may limit, hold, decline, review, or suspend transactions when necessary for security, compliance, fraud investigation, sanctions, disputes, or ecosystem protection.

When we share information

We do not sell or rent personal information. We share only what is reasonably necessary to provide, protect, and fulfill the services.

We may share data with payment processors, partner financial institutions, identity and KYC providers, hosting and infrastructure, security, communications, support, operational analytics, top-ups, eSIMs, gift cards, virtual numbers, networks, carriers, withdrawal services, and other providers described in the External Providers Policy.

We may also disclose information to authorities, regulators, courts, advisers, auditors, or parties to a dispute when required by law, valid process, a legitimate security interest, fraud investigation, or the need to establish, exercise, or defend rights.

We require service providers to handle information for the contracted service and according to their applicable duties. Their own terms and policies may also govern processing they perform as independent controllers.

International transfers

INNOVAPPSOFT LLC and its providers may process information in the United States and other countries where they operate, maintain infrastructure, or use subprocessors.

Those countries may have privacy rules different from those in your place of residence. Where applicable law requires it, we will use contractual mechanisms or other recognized safeguards for international transfers.

A provider’s location may change for redundancy, security, support, or service availability.

Retention and deletion

We retain information for the stated purpose, while an account remains active, and afterward when required for legal, regulatory, accounting, tax, contractual, security, fraud-prevention, or dispute-resolution purposes.

Where BSA/AML requirements apply, certain transaction, investigation, report, KYC, screening, and supporting records may be retained for at least five years or for a longer period required by law.

After the applicable period, we reasonably delete, anonymize, or isolate information. Backups may remain for limited recovery cycles before secure deletion.

Security

We apply reasonable technical, administrative, and physical measures based on the nature of the information and risk, such as encryption in transit, access controls, separation of duties, audit logs, monitoring, backups, and network protections.

We limit access to personal information to those with an operational, support, security, or compliance need. We review permissions and seek to ensure that providers protect information processed on our behalf.

No method is completely secure. Use a unique password, protect your device and 2FA codes, keep the application updated, and notify us immediately if you suspect unauthorized access.

Cookies, communications, and marketing

We use cookies and similar technologies to maintain sessions, remember language or preferences, protect access, operate features, measure performance, and prevent fraud. The Cookies Policy provides additional information.

We may send necessary messages about security, transactions, service changes, support, or compliance. These are not marketing messages and may continue while you have an account or pending transaction.

We send promotions by email, notification, or another channel when a valid legal basis exists. You may withdraw consent or use the available unsubscribe mechanism; this does not stop operational or legal communications.

Your rights and choices

Depending on applicable law, you may request confirmation, access, correction, deletion, restriction, objection, portability, or a copy of certain data, withdraw consent, and request review of certain automated decisions.

If applicable law grants rights concerning sale, targeted advertising, sharing, or sensitive data, we will provide the required choices and mechanisms. We currently state that we do not sell personal information for money.

We may verify your identity before responding and deny or limit a request where law permits or requires us to retain information, protect another person, prevent fraud, preserve legal privilege, or comply with BSA/AML. We will not discriminate against you for exercising a protected right.

Submit a request through official support or email [email protected]. You may also complain to the competent data-protection authority where that right applies.

Children

Financial, balance, P2P, and identity-verification services are not directed to children and require the minimum age stated in our Terms and applicable law.

We do not knowingly collect information from children under 13 without legally required authorization. If we learn that an account belongs to an unauthorized minor, we may restrict it and delete information except where retention is required for security, fraud prevention, or law.

A parent or guardian who believes a child provided us information should contact [email protected].

External services and corporate changes

Our sites and applications may link or redirect to external services. When you leave a surface operated by INNOVAPPSOFT LLC, the relevant provider may collect information under its own policy.

If INNOVAPPSOFT LLC is involved in a reorganization, financing, acquisition, merger, asset sale, or business transfer, information may be disclosed or transferred as part of that transaction, subject to confidentiality and applicable law.

We will provide notice when a change of control results in a material change to the controller or processing purposes.

Changes and contact

We may update this policy to reflect changes in products, providers, practices, security, or laws. The current version will show its update date and will be published on this page.

When a change is material, we may communicate it through the application, website, email, or another appropriate channel before it becomes effective where law requires.

To exercise rights, withdraw marketing consent, report an incident, or ask a privacy question, use official support or email [email protected].