Privacy Policy — Coinsfly

This Privacy Policy explains how Aurex Financial Technologies Inc., a corporation incorporated under the laws of British Columbia, Canada, Incorporation No. BC1535602, operating under the trading name Coinsfly (“Coinsfly”, the “Company”, “we”, “us”, or “our”), collects, uses, stores, discloses, protects, and otherwise processes personal information.

Coinsfly is registered as a Money Services Business, MSB, with the Financial Transactions and Reports Analysis Centre of Canada, FINTRAC, under registration number C100000967.

Registered office:

2-1130 Hachey Ave, Coquitlam, BC V3K 2H4, Canada

This Privacy Policy is designed to align with applicable Canadian privacy, anti-money laundering, counter-terrorist financing, and financial crime compliance requirements, including:

The Personal Information Protection and Electronic Documents Act, PIPEDA;
British Columbia’s Personal Information Protection Act, PIPA;
The Proceeds of Crime Money Laundering and Terrorist Financing Act, PCMLTFA;
FINTRAC guidance and reporting obligations applicable to money services businesses;
Applicable sanctions, tax, law enforcement, and regulatory obligations.

By accessing the Coinsfly website, creating an account, applying for services, using our platform, submitting documents, using a merchant gateway, communicating with us, or otherwise providing personal information to Coinsfly, you acknowledge that you have read and understood this Privacy Policy.

1. Scope of this Privacy Policy

This Privacy Policy applies to personal information processed in connection with:

The Coinsfly website;
The Coinsfly client dashboard;
The Coinsfly merchant gateway;
Account registration;
Login and security verification;
Identity verification and business verification;
Crypto purchase services;
Wire and card payment flows;
Wallet whitelisting;
Crypto withdrawals to approved external wallets;
Merchant crypto payment flows;
Compliance document uploads;
Customer support;
Marketing communications, where applicable;
Technical, security, and fraud-prevention operations.

This Privacy Policy applies to the following categories of individuals.

1.1 Website Visitors

Individuals who access or browse the Coinsfly website.

1.2 Applicants

Individuals or business representatives who begin the account opening process, regardless of whether the account is approved.

1.3 Registered Users

Individuals who create and use a Coinsfly account.

1.4 Business Users

Directors, officers, authorized representatives, employees, shareholders, beneficial owners, controllers, and related persons of a business applying for or using Coinsfly services.

1.5 Merchant Users

Merchants, merchant representatives, and merchant clients using or accessing the Coinsfly merchant gateway.

1.6 Beneficial Owners and Controllers

Individuals who ultimately own, control, benefit from, or exercise authority over an account, transaction, merchant, business, or payment activity.

1.7 Counterparties and Payment Participants

Individuals involved in payments, wallet transactions, banking flows, merchant payments, compliance checks, investigations, disputes, or support matters.

2. Important Product and Jurisdiction Notice

Coinsfly is not a bank and does not provide general banking services. Fiat payment methods are used to support crypto purchase and merchant crypto payment flows, subject to verification, eligibility, jurisdiction restrictions, payment provider availability, transaction limits, and compliance review.

Coinsfly does not market to or serve clients from the United Kingdom. This website and its content are intended for persons outside of the United Kingdom. Coinsfly does not solicit clients in the European Union. EU clients access and request services exclusively on their own initiative.

Access to certain services may be unavailable or restricted based on your location, nationality, residence, verification status, payment method, transaction activity, wallet risk, sanctions screening, or applicable law.

3. Key Definitions

For this Privacy Policy, the following terms apply.

3.1 Personal Information

“Personal Information” means information about an identifiable individual, including factual or subjective information, whether recorded or not. This may include identity data, contact data, financial data, transaction data, technical data, biometric data, and compliance data.

Personal Information generally does not include business contact information used solely for business communications.

3.2 Processing

“Processing” means any operation involving personal information, including collection, recording, storage, organization, use, access, review, analysis, disclosure, transfer, retention, deletion, or destruction.

3.3 Sensitive Personal Information

“Sensitive Personal Information” includes information that may create higher risk if misused, including government identification documents, biometric or liveness data, financial information, source of funds information, sanctions or PEP screening results, wallet risk scores, and compliance investigation records.

3.4 KYC

“KYC” means Know Your Customer procedures used to verify an individual’s identity and assess eligibility.

3.5 KYB

“KYB” means Know Your Business procedures used to verify a business, its ownership, representatives, directors, controllers, business activity, and risk profile.

3.6 AML/CTF

“AML/CTF” means anti-money laundering and counter-terrorist financing controls.

3.7 PEP

“PEP” means Politically Exposed Person and may include certain family members or close associates, depending on applicable law and compliance requirements.

3.8 Whitelisted Wallet

A “Whitelisted Wallet” means an external crypto wallet address submitted by a user, screened by Coinsfly or its service providers, and approved for withdrawals.

4. Personal Information We Collect

Coinsfly collects only the personal information that is reasonably necessary for our services, compliance obligations, security, fraud prevention, and business operations.

4.1 Account Registration Data

When you create an account, we may collect:

Email address;
Password or password-related authentication data;
Phone number;
Account type;
Language preference;
Account creation date;
User ID or client UID;
Login credentials and authentication metadata;
Consent records;
Terms acceptance records;
Declaration confirmations.

We do not store your password in plain text.

4.2 Identity Verification Data

For KYC and compliance purposes, we may collect:

Full legal name;
Middle name, if applicable;
Former names or aliases, if required;
Date of birth;
Nationality;
Country of residence;
Residential address;
Government-issued identification document;
Passport, national ID, driver’s licence, or other accepted identification;
Identification number;
Document issue date;
Document expiry date;
Issuing country or authority;
Selfie image;
Liveness verification data;
Facial comparison results;
Verification decision;
Verification status;
Rejection reason, if applicable;
Compliance notes.

Identity verification may be performed through third-party verification providers, including Sumsub or other approved KYC/KYB/AML service providers.

4.3 Business Verification Data

For business, corporate, and merchant accounts, we may collect:

Legal entity name;
Trading name;
Registration number;
Incorporation country;
Registered address;
Operating address;
Business activity;
Website;
Industry category;
Expected transaction volume;
Source of funds;
Source of wealth, where required;
Directors’ details;
Officers’ details;
Authorized representatives’ details;
Shareholders’ details;
Ultimate beneficial owner details;
Ownership structure;
Corporate documents;
Certificate of incorporation;
Articles, bylaws, or constitutional documents;
Proof of business address;
Licences or regulatory permissions, if applicable;
Merchant gateway application information;
Compliance approvals and internal risk notes.

4.4 Contact and Communication Data

We may collect:

Email address;
Mobile phone number;
Mailing address;
Support messages;
Chat messages;
Complaint records;
Call notes;
Email correspondence;
Verification communications;
Notification delivery records;
Customer support attachments;
Communication preferences.

4.5 Financial and Economic Data

For compliance, risk assessment, limits, and transaction monitoring, we may collect:

Source of funds information;
Source of wealth information;
Payslips;
Bank statements;
Tax returns or tax declarations;
Loan agreements;
Sale agreements;
Proof of income;
Proof of address;
Employment information;
Occupation;
Employer details;
Expected activity;
Account limits assigned by Compliance;
Supporting documents requested by Compliance;
Deposit or payment references;
Bank account details used in payment flows;
Payment method details;
Card-related tokenized or masked payment data;
Payment provider references.

Coinsfly does not intentionally store full card numbers where payments are processed by a regulated acquiring or card processing provider. Card data should be handled by the acquirer or payment processor according to their own security standards.

4.6 Payment, Transaction, and Ledger Data

We may collect and process:

Transaction ID;
Order ID;
Date and time;
Transaction type;
Payment method;
Fiat currency;
Crypto asset;
Crypto network;
Amount;
Exchange rate;
Quote reference;
Payment status;
Provider reference;
Banking reference;
Merchant reference;
Blockchain transaction hash;
Wallet address;
Network fee;
Transaction status;
Rejection reason;
Refund or dispute information;
Chargeback or recall information;
Ledger entries;
Balance records;
Frozen balance records;
Withdrawal queue records;
Transaction history;
Audit trail.

4.7 Crypto Wallet and Blockchain Data

When you use wallet-related features, we may collect:

External wallet addresses;
Wallet network;
Crypto asset;
Wallet ownership declarations;
Wallet whitelist status;
AML wallet screening result;
Risk score;
Blockchain transaction hashes;
Public blockchain metadata;
Network confirmation data;
Blockchain explorer references;
Withdrawal destination address;
Merchant wallet destination;
Wallet approval or rejection records.

Blockchain data is generally public, permanent, and not controlled by Coinsfly. Once a transaction is recorded on a public blockchain, Coinsfly cannot erase or modify it.

4.8 Merchant Gateway Data

When a customer uses a merchant gateway link, we may collect:

Merchant ID;
Merchant name;
Gateway link reference;
Customer account information;
Order ID;
Payment amount;
Crypto asset;
Network;
Selected payment route;
Destination wallet selection;
Whether funds are directed to the merchant wallet or customer account;
Email OTP and SMS OTP verification status;
Payment status;
Blockchain TxID where applicable;
Merchant order status;
Dispute, refund, recall, or chargeback status;
Merchant client relationship data.

We may share limited payment-related information with the relevant merchant, as described in this Privacy Policy.

4.9 Technical, Device, and Security Data

We may automatically collect:

IP address;
Device type;
Device ID or device fingerprint;
Browser type;
Operating system;
Time zone;
Language;
Screen resolution;
Session identifiers;
Login history;
Failed login attempts;
Authentication events;
OTP request and verification records;
Referral source;
Pages viewed;
Buttons clicked;
Activity timestamps;
Error logs;
API request logs;
Security event logs;
VPN, proxy, or TOR detection signals;
Geolocation derived from IP address;
Suspicious activity indicators.

4.10 Cookies and Tracking Data

We may collect cookie and similar technology data, including:

Essential cookies;
Session cookies;
Authentication cookies;
Security cookies;
Preference cookies;
Analytics cookies;
Marketing cookies, where permitted and consented to.

More details are provided in the Cookies section below.

5. How We Collect Personal Information

Coinsfly may collect personal information directly from you, automatically through your use of the platform, or from third parties.

5.1 Directly from You

We collect information when you:

Create an account;
Complete forms;
Upload documents;
Submit identity verification;
Add a wallet address;
Make a purchase;
Request a withdrawal;
Use a merchant gateway;
Contact support;
Subscribe to communications;
Respond to compliance requests.

5.2 Automatically

We collect technical and usage information when you:

Visit the website;
Log in;
Use the dashboard;
Request OTPs;
Interact with platform features;
Use a merchant gateway;
Trigger security or compliance systems.

5.3 From Service Providers

We may receive information from:

Sumsub or other KYC/KYB/AML providers;
Banks and payment providers;
Card acquirers and processors;
Liquidity providers;
Blockchain analytics providers;
Blockchain RPC providers;
Email and SMS providers;
Fraud prevention vendors;
Hosting and infrastructure providers;
Customer support providers.

5.4 From Public or Blockchain Sources

We may collect or analyze public data, including:

Public blockchain records;
Sanctions lists;
Government registers;
Business registries;
Adverse media sources;
Public compliance databases;
Publicly available company information.

6. Legal Grounds and Purposes for Processing

Canadian privacy law generally requires organizations to collect, use, and disclose personal information for purposes that a reasonable person would consider appropriate in the circumstances, with valid consent unless an exception applies.

Coinsfly processes personal information for the following purposes.