Privacy Policy

1. Information we collect

Account information: your phone number, email address, display name, and the language you use the app in.

Identity verification (KYC): when required for card issuance or higher limits, your national identity information, an ID photo or scan, and a selfie or liveness capture, submitted through the app and reviewed by our operations team.

Financial and transaction data: your Toman wallet balance and ledger history; deposit and withdrawal records, including the bank tracking references you submit for card-to-card deposits and the Sheba/IBAN you register for withdrawals; card order and recharge history; and, for your virtual card, its masked number and transaction history synced from the Card Issuer.

Card detail data: where an operator has recorded your card's full number, expiry, and CVV after issuance, that data is stored encrypted at rest (AES-256-GCM) and is decrypted only at the moment you request to view it, after you enter your own card PIN. PayFar staff cannot view your decrypted card number or CVV through the admin panel, only the masked form and the fact that detail has been recorded.

Communications: support tickets and their attachments, live-chat transcripts where you use that channel, and the notifications and transactional emails we send you.

Device and usage data: IP address, device and browser information, and basic usage logs, collected automatically for security, fraud prevention, and service reliability.

2. How we use this information

To create and operate your account, wallet, and card; to process deposits, withdrawals, and card transactions; to verify your identity where required by law or by our risk controls; to detect and prevent fraud, unauthorized access, and abuse; to send you transactional notifications (in-app and by email, in your selected language) about things that happen to your account, a deposit reviewed, a withdrawal processed, a security event; to respond to support requests; and to meet our legal and regulatory obligations, including anti-money-laundering recordkeeping.

We do not sell your personal information, and we do not use your identity documents or card details for advertising.

3. Who we share information with

The Card Issuer, to the extent necessary to open, fund, and operate your card, this is the same upstream partner described in our Terms of Service.

Service providers who deliver parts of the service on our behalf: SMS providers (for one-time codes), email providers (for transactional email), and our hosting and infrastructure providers. These providers process data under our instructions and only for the purpose of providing their service to us.

Banks and payment rails, to the extent necessary to move money you have asked us to move (a withdrawal, a deposit confirmation).

The card network (Visa) and its processors receive transaction data as an inherent part of processing card payments; this happens under the Card Issuer's program and rules, not under PayFar's control.

Authorities, where we are legally required to disclose information, for example, in response to a lawful request from a competent Iranian authority, or where required by anti-money-laundering law.

We do not share your identity documents, decrypted card number, or CVV with any party except as strictly necessary for the purposes above.

4. How we protect your information

Your login credentials are hashed, never stored in plain text. Your full card number and CVV, once recorded, are encrypted at rest with a dedicated key, separate from other encryption keys we use, and are only ever decrypted server-side, on demand, after your card PIN is verified, never at rest, never in logs.

Access to sensitive operations in our admin tools requires a second authentication factor (an authenticator app) in addition to a password, and sensitive admin actions are logged in an internal audit trail. Passwords and PINs are never visible to PayFar staff, only their hashed form.

No system is perfectly secure, and we cannot guarantee absolute security. If we become aware of a breach affecting your personal information, we will notify you and the relevant authority as required by applicable law.

5. How long we keep information

We keep account and transaction data for as long as your account is active, and for a period after closure as required by anti-money-laundering recordkeeping obligations and our own legal, tax, and dispute-resolution needs. Identity verification documents are retained under the same regulatory retention rules. Support attachments and chat transcripts are retained as long as reasonably necessary to resolve and, if needed, revisit your request.

6. Your rights and choices

You can review and update most of your account information directly in the app (Profile, Security). You can ask us, through Support, to provide a copy of the personal information we hold about you, or to correct inaccurate information; we will respond as required by applicable law.

You can ask us to delete your account and associated personal information, but we may need to retain certain records, transaction history and KYC documents in particular, for as long as required by anti-money-laundering and other financial-recordkeeping law, even after account closure. Where retention is required, we will restrict further use of that data to what the legal obligation requires.

You can switch the app's language at any time; notifications and transactional emails will follow whichever language is active when they are generated, and past in-app notifications re-render in whichever language you are currently using.

7. Cookies and similar technology

The PayFar landing site (payfar.org) uses basic analytics to understand traffic and improve the site; the PayFar app uses only the technical storage necessary to keep you signed in and remember your preferences (like language and whether balances are hidden). We do not use third-party advertising trackers.

8. Children

PayFar is not directed at, and may not be used by, anyone under 18. If we learn that we have collected information from someone under 18, we will close the account and delete the information, except where retention is legally required.

9. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated policy in the app and on payfar.org with a new "last updated" date, and for material changes we will make a reasonable effort to notify you directly.

10. Contact

Questions about this Privacy Policy, or requests concerning your personal information, can be sent to support@payfar.app or through the Support section of the app.