Rayflow Privacy Policy

Effective Date: 05.05.2026

Company: HASHER COMPANY OÜ

Registry code: 16917232

Registered address: Vesivärava tn 50-201, Tallinn, 10152 Estonia

Privacy and legal notices: legal@rayflow.app

1. Introduction

This Privacy Policy explains how HASHER COMPANY OÜ, a company incorporated in Estonia with registry code 16917232 and registered address at Vesivärava tn 50-201, Tallinn, 10152 Estonia (“Rayflow”, “we”, “us”, or “our”), collects, uses, stores, shares, and protects personal data when you access or use the Rayflow website, mobile application, wallet interface, account features, stablecoin payment features, card-related features, earn-related features, withdrawal features, customer support, and any other functionality made available by Rayflow from time to time (together, the “Platform” or “Services”).

This Privacy Policy applies to personal data that we process as a controller in connection with the Platform. It should be read together with the Rayflow Terms of Service, any applicable risk disclosures, fee schedules, cookie notices, product notices, and service-specific terms.

Rayflow is designed as a non-custodial stablecoin payment application and software interface. Unless expressly stated otherwise, Rayflow does not hold your private keys, does not take custody of digital assets held in your self-custodial wallet, does not operate as a bank, does not provide deposit accounts, and does not provide regulated financial, investment, brokerage, or custody services.

Some features of the Platform may be provided, processed, supported, or made available through third-party service providers, such as wallet infrastructure providers, authentication providers, card program providers, payment providers, identity verification providers, sanctions screening providers, blockchain analytics providers, cloud hosting providers, analytics providers, customer support providers, and communication providers. Those third parties may process your personal data as our processors, as independent controllers, or as joint controllers, depending on the feature and legal arrangement.

If you do not agree with this Privacy Policy, you must not access or use the Platform.

2. Who Is Responsible for Your Personal Data

For the purposes of the EU General Data Protection Regulation (“GDPR”) and other applicable data protection laws, HASHER COMPANY OÜ is the controller of personal data that we determine the purposes and means of processing for.

You can contact us regarding privacy matters at:

Email: legal@rayflow.app
Support: support@rayflow.app
Address: HASHER COMPANY OÜ, Vesivärava tn 50-201, Tallinn, 10152 Estonia

Where a third-party provider acts as an independent controller, that provider is separately responsible for its own processing of your personal data. In those cases, the provider’s privacy notice will also apply to its processing.

3. Key Privacy Notice for Rayflow’s Non-Custodial Model

Rayflow is not designed to collect, store, or access your private key, seed phrase, or equivalent wallet recovery credentials, except where you voluntarily provide information to us, where a feature requires limited processing, or where a third-party wallet infrastructure provider processes wallet-related data in accordance with its own role and privacy terms.

Rayflow may allow you to create or access a self-custodial wallet using social login, email login, passkeys, embedded wallet technology, smart wallet technology, or other supported authentication methods. We may process account identifiers, login metadata, wallet public addresses, device information, security logs, and transaction-related data to operate the Platform, provide support, prevent fraud, and comply with legal obligations.

Public blockchain data, such as wallet addresses, transaction hashes, token transfers, smart contract interactions, and balances visible on public blockchain networks, may be publicly available and may be processed by Rayflow or third-party service providers to provide the Services, display transaction history, troubleshoot transactions, prevent fraud, support compliance checks, and maintain Platform security.

Rayflow does not control public blockchain networks. Information recorded on public blockchain networks may be permanent, public, and not capable of deletion by Rayflow.

4. Personal Data We May Collect

We collect only personal data that is reasonably necessary for the purposes described in this Privacy Policy. The categories of personal data we may collect depend on how you use the Platform and which features are available to you.

4.1 Account and Contact Data

name, display name, username, nickname, or profile identifier;
email address;
phone number, where required or provided;
country or region of residence;
account status, preferences, settings, consents, and communication preferences;
support requests, complaint records, and correspondence with us.

4.2 Identity Verification and Compliance Data

Where required for card-related features, payment features, withdrawals, higher limits, earn-related features, fraud prevention, sanctions screening, legal compliance, or other restricted functionality, we or our third-party providers may collect and process:

full legal name;
date of birth;
nationality, country of residence, and address;
government-issued identity documents, such as passport, national ID, or driving licence;
selfies, liveness checks, facial images, or biometric verification data where required by a provider and permitted by law;
source of funds, source of wealth, occupation, income range, expected activity, or other due diligence information;
sanctions screening, politically exposed person screening, adverse media screening, fraud risk scores, and compliance review outcomes;
records of verification attempts, approvals, rejections, restrictions, and monitoring decisions.

4.3 Wallet, Blockchain, and Transaction Data

wallet public addresses and smart wallet addresses;
transaction hashes, transaction timestamps, blockchain network information, token symbols, token amounts, and transaction status;
deposit, withdrawal, transfer, payment, conversion, earn-related, and card-related transaction records;
app balance data, displayed balance data, estimated fiat values, and activity history;
recipient identifiers such as nicknames, QR codes, wallet addresses, memos, tags, or payment references;
fraud, abuse, security, and transaction monitoring signals;
public blockchain analytics information associated with wallet addresses or transactions.

4.4 Card, Payment, and App Balance Data

Where card-related or payment-related features are available, Rayflow or third-party providers may process:

card application status, eligibility status, limits, restrictions, and card settings;
card transaction data, including merchant category, merchant name, transaction amount, currency, authorization status, settlement status, refunds, reversals, chargebacks, and fees;
payment account, virtual account, app balance, or stablecoin-based unit data where made available by a provider;
records needed to show balances, transaction history, receipts, notifications, spending activity, withdrawals, and support information.

Rayflow does not store full card numbers, card security codes, or payment credentials unless expressly stated and permitted by law. These details are typically processed by regulated or specialized third-party payment and card providers.

4.5 Device, Technical, and Usage Data

IP address;
device model, operating system, browser type, app version, language, time zone, device identifiers, advertising identifiers where permitted, and push notification tokens;
log-in information, authentication events, session information, crash logs, diagnostics, and security logs;
pages, screens, buttons, features, and flows used within the Platform;
referral source, attribution data, campaign data, and analytics events;
approximate location derived from IP address or device settings, and precise location only where required for a feature and where you have permitted it.

4.6 Contacts and Recipient Data

If you choose to use nickname, QR, contact discovery, or peer-to-peer transfer features, we may process limited data needed to identify intended recipients, reduce misdirected payments, prevent fraud, and display relevant transfer information. Where the Platform requests access to your device contacts, we will do so only where permitted by your device settings and applicable law.

4.7 Marketing and Communication Data

email preferences, notification preferences, and marketing consents;
records of emails, in-app messages, push notifications, and other communications sent to you;
campaign engagement data, such as opens, clicks, and unsubscribe status;
survey responses, feedback, waitlist entries, and product research responses.

4.8 Special Category Data

We do not intentionally collect special category data unless it is necessary for a specific feature, verification process, legal obligation, fraud prevention process, accessibility purpose, or other permitted purpose under applicable law. Where biometric data is processed for identity verification, liveness checks, or fraud prevention, it is usually processed by a specialized third-party provider and only where a lawful basis exists, including explicit consent where required.

5. How We Collect Personal Data

We may collect personal data:

directly from you, when you create an account, provide information in the app, contact support, join a waitlist, complete verification, use a feature, submit a request, or communicate with us;
automatically from your device or use of the Platform, including through cookies, SDKs, logs, analytics tools, security tools, and similar technologies;
from public blockchain networks, including public wallet address and transaction information;
from third-party providers, including authentication providers, wallet infrastructure providers, card providers, payment providers, KYC providers, sanctions screening providers, fraud prevention providers, blockchain analytics providers, cloud providers, customer support tools, and analytics providers;
from publicly available sources, where necessary for fraud prevention, compliance, legal claims, sanctions screening, business protection, or security.

6. Why We Use Personal Data and Our Legal Bases

We process personal data only where we have a lawful basis under applicable data protection laws. The table below describes the main purposes for which we process personal data.

Purpose	Categories of data	Legal basis
To create, maintain, and manage your Rayflow account	Account data, contact data, authentication data, device data	Performance of a contract; legitimate interests in operating the Platform
To provide wallet interface functionality and display wallet-related information	Wallet public addresses, blockchain data, device data, usage data	Performance of a contract; legitimate interests in providing and improving the Services
To process transfers, withdrawals, app balance activity, card-related activity, and other transaction-related features	Transaction data, wallet data, app balance data, card/payment data, recipient data	Performance of a contract; legitimate interests in executing user instructions and preventing errors
To provide card-related, payment-related, earn-related, and restricted features where available	Account data, KYC data, compliance data, card/payment data, transaction data	Performance of a contract; compliance with legal obligations; legitimate interests; consent where required
To perform identity verification, sanctions screening, fraud prevention, risk controls, and compliance checks	KYC data, biometric verification data where applicable, compliance data, transaction data, device data, blockchain analytics data	Compliance with legal obligations; legitimate interests in preventing fraud and abuse; explicit consent where required for biometric data
To protect the Platform, users, and third parties from fraud, unauthorized access, abuse, security incidents, and illegal activity	Device data, security logs, transaction data, wallet data, IP address, risk signals, support records	Legitimate interests; compliance with legal obligations
To provide customer support and handle complaints	Account data, contact data, support messages, transaction records, device data, troubleshooting information	Performance of a contract; legitimate interests; compliance with legal obligations
To send service communications, security alerts, legal notices, and transaction notifications	Contact data, account data, transaction data, notification tokens, preferences	Performance of a contract; legitimate interests; compliance with legal obligations
To send marketing communications, waitlist updates, product announcements, and promotional messages	Contact data, marketing preferences, campaign engagement data	Consent where required; legitimate interests where permitted by law
To improve, test, monitor, and analyze the Platform	Usage data, analytics data, device data, crash logs, aggregated or pseudonymized data	Legitimate interests in improving and securing the Platform; consent where required for cookies or tracking
To comply with legal, tax, accounting, regulatory, court, law enforcement, or supervisory authority obligations	Account data, identity data, transaction data, compliance data, support records, correspondence	Compliance with legal obligations; legitimate interests in establishing, exercising, or defending legal claims

We may share personal data with third parties where necessary to provide, secure, improve, or support the Platform, or where required by law. We do not sell your personal data.

Third parties may include:

wallet infrastructure providers, including embedded wallet, MPC, smart wallet, key management, signing, and authentication infrastructure providers;
authentication providers, including social login, email login, passkey, device authentication, and account recovery providers;
card program and payment providers, including card issuing, processing, payment authorization, payment settlement, fraud controls, chargeback, and transaction monitoring providers;
identity verification and KYC providers, including document verification, liveness check, biometric verification, sanctions screening, politically exposed person screening, and adverse media screening providers;
blockchain infrastructure and analytics providers, including RPC providers, node providers, indexers, blockchain explorers, risk scoring tools, and transaction monitoring providers;
swap, routing, bridge, conversion, liquidity, and transaction execution providers, where such third-party services are made available through or linked from the Platform;
cloud hosting, database, security, monitoring, and infrastructure providers;
analytics, attribution, and product improvement providers;
customer support, email, SMS, push notification, and communication providers;
professional advisers, including lawyers, auditors, accountants, consultants, insurers, and compliance advisers;
public authorities, courts, regulators, law enforcement, tax authorities, sanctions authorities, and dispute resolution bodies, where required or permitted by law;
business transfer parties, where we are involved in a merger, acquisition, financing, reorganization, sale of assets, insolvency, or similar transaction.

Where third-party providers process personal data on our behalf, we require them to process personal data only for specified purposes, to protect it appropriately, and to comply with applicable data protection laws. Where third-party providers act as independent controllers, they are responsible for their own processing and their own privacy notices may apply.

Rayflow may make third-party services available through the Platform. If you choose to use such services, you acknowledge that the third-party provider may collect and process your personal data in accordance with its own terms and privacy policy.

8. Automated Decision-Making, Profiling, and Risk Controls

We and our third-party providers may use automated systems to support identity verification, sanctions screening, fraud prevention, transaction monitoring, account security, card eligibility, risk scoring, suspicious activity detection, and abuse prevention.

These systems may analyze account data, identity data, device data, transaction data, blockchain data, location signals, risk signals, behavioral signals, and information from third-party databases or public sources.

Automated checks may result in a verification request, additional due diligence, transaction delay, transaction rejection, feature restriction, account limitation, or other risk control measure. Where required by applicable law, you may have the right to request human review, express your point of view, contest a decision, and obtain meaningful information about the logic involved.

9. Cookies, SDKs, Analytics, and Similar Technologies

We may use cookies, software development kits (SDKs), pixels, local storage, device identifiers, analytics tools, crash reporting tools, attribution tools, and similar technologies to operate the website and app, keep you logged in, remember preferences, measure performance, detect fraud, improve the Platform, understand usage, and support marketing where permitted.

These technologies may collect device data, usage data, IP address, browser data, app events, referral information, campaign attribution, crash logs, and interaction data.

Where required by law, we will ask for your consent before using non-essential cookies or similar technologies. You can manage cookies through your browser settings and, where available, through our cookie consent tool. You can manage mobile tracking, advertising identifiers, push notifications, and app permissions through your device settings.

Disabling cookies or app permissions may affect the availability or functionality of some features.

10. Marketing Communications

We may send you marketing communications, waitlist updates, product announcements, and promotional messages where you have consented or where we are otherwise permitted by law to do so.

You can opt out of marketing communications at any time by using the unsubscribe link in our emails, changing your preferences where available, or contacting us at legal@rayflow.app.

Even if you opt out of marketing communications, we may still send you service-related messages, such as security alerts, transaction notifications, legal notices, account messages, support responses, and important updates about the Platform.

11. International Transfers

We are based in Estonia, but the Platform may be supported by service providers located in other countries. Your personal data may be transferred to, stored in, or processed in countries outside your country of residence, including outside the European Economic Area (“EEA”).

Where we transfer personal data outside the EEA, we will use appropriate safeguards where required by law, such as adequacy decisions, the European Commission’s Standard Contractual Clauses, contractual protections, technical and organizational safeguards, or another lawful transfer mechanism.

12. Data Security

We implement appropriate technical and organizational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or unauthorized access.

These measures may include encryption in transit, access controls, authentication controls, logging, monitoring, secure software development practices, infrastructure security, least-privilege access, vendor due diligence, confidentiality obligations, and incident response procedures.

The security of your account also depends on you. You are responsible for securing your device, email account, social login account, passkeys, passwords, PINs, biometric authentication, wallet recovery methods, and any other access or recovery method used with the Platform.

No method of transmission over the Internet, blockchain network, or electronic storage is completely secure. We cannot guarantee absolute security.

13. Data Retention

We retain personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy, including to provide the Platform, maintain account records, comply with legal obligations, prevent fraud, resolve disputes, enforce agreements, and establish, exercise, or defend legal claims.

Retention periods may vary depending on the type of data, the feature used, the legal basis for processing, the sensitivity of the data, applicable legal obligations, and whether a complaint, dispute, investigation, or legal claim exists.

Data category	Typical retention approach
Account and contact data	For as long as your account is active and for a reasonable period after closure for legal, security, support, and dispute purposes.
Identity verification, KYC, AML, sanctions, and compliance data	For as long as required by applicable legal, regulatory, AML, sanctions, tax, accounting, or recordkeeping obligations, and for a reasonable period thereafter where permitted or required.
Transaction, wallet, app balance, card, and payment records	For as long as necessary to provide transaction history, support, compliance, accounting, fraud prevention, dispute resolution, and legal claim handling.
Support and complaint records	For as long as necessary to respond to your request, maintain service records, improve support, and protect legal rights.
Security logs, device logs, fraud signals, and technical logs	For a limited period necessary for security, diagnostics, fraud prevention, and platform reliability, unless longer retention is required for investigation or legal reasons.
Analytics and product usage data	Where possible, retained in aggregated or pseudonymized form. Aggregated data that does not identify you may be retained indefinitely.
Marketing data	Until you withdraw consent or opt out, and thereafter limited suppression records may be kept to respect your opt-out request.

Where personal data is no longer required, we will delete, anonymize, or securely retain it in accordance with applicable law. Backup copies may remain for a limited period before being overwritten or deleted according to our backup procedures.

Please note that Rayflow cannot delete, alter, or remove data recorded on public blockchain networks.

14. Your Data Protection Rights

Subject to applicable law and certain limitations, you may have the following rights regarding your personal data:

Right of access — to request a copy of the personal data we hold about you;
Right to rectification — to request correction of inaccurate or incomplete personal data;
Right to erasure — to request deletion of personal data in certain circumstances;
Right to restriction — to request restriction of processing in certain circumstances;
Right to object — to object to processing based on legitimate interests and to object to direct marketing;
Right to data portability — to receive certain personal data in a structured, commonly used, machine-readable format;
Right to withdraw consent — where processing is based on consent, to withdraw consent at any time;
Rights relating to automated decision-making — where applicable, to request human review or contest certain automated decisions that produce legal or similarly significant effects.

Withdrawing consent does not affect the lawfulness of processing based on consent before withdrawal.

Some rights may be limited where we need to retain or process data to comply with legal obligations, complete transactions, prevent fraud, maintain security, resolve disputes, enforce agreements, or establish, exercise, or defend legal claims.

15. How to Exercise Your Rights

To exercise your privacy rights, contact us at legal@rayflow.app.

Please clearly describe the right you wish to exercise and the personal data or account to which your request relates. We may ask you to provide information necessary to verify your identity and protect your account from unauthorized requests.

We will respond to your request within the period required by applicable law. Under GDPR, we generally respond within one month of receiving your request. This period may be extended where permitted by law, for example if the request is complex or if we receive multiple requests.

You also have the right to lodge a complaint with a data protection supervisory authority. For Estonia, the supervisory authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon). You may also contact the supervisory authority in your country of residence or place of work, where applicable.

16. Children’s Privacy

The Platform is not intended for children or for individuals under the age of 18, or under the age of legal majority in their jurisdiction if higher. We do not knowingly collect personal data from children.

If you believe that a child has provided personal data to us, please contact us at legal@rayflow.app so that we can take appropriate steps.

17. Third-Party Links and Services

The Platform may contain links, integrations, SDKs, APIs, or references to third-party websites, applications, wallets, payment services, blockchain networks, protocols, smart contracts, card services, exchanges, bridges, routers, liquidity providers, analytics tools, or other services that are not operated by Rayflow.

We are not responsible for the privacy practices, security, content, availability, or processing activities of third-party services. You should review the privacy policies and terms of any third-party services you use.

18. Blockchain Networks and Public Data

When you use blockchain-related features, transaction information may be recorded on public blockchain networks. Public blockchain data may include wallet addresses, smart contract addresses, transaction hashes, token amounts, timestamps, and other transaction details.

Public blockchain data may be visible to anyone, may be copied, indexed, analyzed, and stored by third parties, and may not be capable of deletion or modification. Your use of blockchain networks is subject to the characteristics and risks of those networks.

Rayflow may process public blockchain data to provide the Platform, display balances and transaction history, process user instructions, troubleshoot issues, protect users, prevent fraud, support compliance, and improve the Platform.

19. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our Platform, technology, legal requirements, third-party providers, business operations, or data processing practices.

If we make material changes, we may notify you by posting the updated Privacy Policy on our website, through the app, by email, or by other reasonable means. The updated version will become effective on the date stated at the top of the Privacy Policy, unless otherwise stated.

Your continued use of the Platform after the updated Privacy Policy becomes effective means that you acknowledge the updated Privacy Policy.

20. Contact Us

If you have any questions about this Privacy Policy, how we process personal data, or how to exercise your rights, please contact us:

Company: HASHER COMPANY OÜ
Registry code: 16917232
Address: Vesivärava tn 50-201, Tallinn, 10152 Estonia
Website: https://rayflow.app
Support: support@rayflow.app
Privacy and legal: legal@rayflow.app

21. Practical Summary

This summary is provided for convenience only and does not replace the full Privacy Policy.

Rayflow is designed as a non-custodial stablecoin payment application and software interface.
We process personal data to create accounts, provide wallet interface functionality, support app balance and payment features, perform security checks, provide support, and comply with legal obligations.
Some features may require identity verification, sanctions screening, fraud checks, and third-party provider processing.
We do not intentionally collect or store your private key or seed phrase.
Public blockchain data may be permanent, public, and outside Rayflow’s control.
We do not sell your personal data.
You can contact us at legal@rayflow.app to exercise your privacy rights.