Privacy Policy

WB Exchange Digital Systems (“WB Exchange”, “we”, “our”) is the data controller responsible for the personal information collected through our mobile app, website, and Telegram services. This Privacy Policy applies to all of those Services.

We collect the following categories of information:

• Account information — your name, email address, phone number, date of birth, and password (stored as a hash).
• KYC and verification data — government-issued ID, proof of address, selfie or liveness capture, and the results of our identity-verification checks. Face and biometric data is handled separately and is described in full in section 3 below.
• Financial and transaction data — your wallet addresses, bank account details, transaction history, gift card submissions, biller account numbers, balances, and the currencies you transact in.
• Communications — messages you send to support, chat transcripts, and the content of calls with our team.
• Device and usage data — IP address, device identifiers, operating system, app version, language settings, crash logs, and the pages or features you interact with.
• Location — we do not collect your device’s GPS or network location. We log the IP address you connect from (noted under “Device and usage data” above) solely for security, fraud prevention, and audit purposes.

Identity verification requires us to confirm that you are a real, live person and that you are the person shown on your identity document. This section explains exactly how your face data is handled, because we treat it as the most sensitive data we touch.

What we collect and how. When you start identity verification, our identity-verification provider, Smile Identity, captures a photograph of your government-issued identity document and a short selfie or liveness capture of your face. On supported Apple devices this capture may use the device's TrueDepth camera, which reads facial geometry and depth in order to confirm that a live person is present rather than a photograph, mask, or screen replay. Capture takes place on your device, inside Smile Identity's software, and is transmitted directly to Smile Identity.

What it is used for. Face data is used for one purpose only: to confirm that a live person is present and to match your face against the portrait on the identity document you submit, so that we can meet our Know Your Customer and anti-money-laundering obligations. It is used for nothing else.

What we never do with it. We do not use face data for advertising or marketing. We do not use it to build a profile of you, to identify you across other services, or to train models. We do not sell, rent, or license it. We do not share it with any third party other than Smile Identity, who perform the verification on our behalf, and regulators or law enforcement where we are legally compelled to disclose.

What WB Exchange itself stores. We do not receive or store your face images, your liveness capture, or any facial depth or geometry data. Our systems record only the outcome of the check — whether it passed, the date, the document type and country, the document number, and a reference number for the verification job. Your face data is held by Smile Identity under their own retention policy, and Smile Identity is contractually required to provide the same or equal protection of your data as is set out in this Policy.

Consent. We ask for your explicit consent in the app before any face data is captured or disclosed to Smile Identity, and we record the moment you gave it. Verification is started by you and you may decline it, though without it we cannot lift the limits on your account or allow withdrawals.

Retention and deletion. Face data is kept only for as long as is reasonably necessary to complete the verification you asked for. We delete it, and instruct Smile Identity to delete it, as expeditiously as possible and in no case later than when you delete the WB Exchange app or ask us to delete it. You can request deletion from inside the app under Profile, or by emailing support@wbexchange.com. The outcome of a check — whether it passed, the date, the document type and number, and a job reference — is not face data and is retained as part of your regulated KYC file for the period set out in Data Retention below.

We use your information to:

• Create and operate your account;
• Verify your identity and meet our KYC/AML obligations;
• Process trades, gift card redemptions, bill payments, and withdrawals;
• Detect and prevent fraud, account takeovers, and other security incidents;
• Respond to support requests and resolve disputes;
• Send you transactional alerts (e.g., trade confirmations, security notices);
• Send you marketing communications about new features — only where you have opted in, and you can withdraw consent at any time;
• Improve our Services through aggregated and anonymized analytics;
• Comply with our legal obligations and enforce our Terms.

Identity verification is automated. When you submit your identity document and liveness capture, Smile Identity's systems check that a live person is present and compare your face against the portrait on the document, returning a pass or fail without a person reviewing it in the first instance. That result sets your verification tier, which in turn determines your transaction limits and whether you can withdraw. Some checks are additionally referred for human review, and the reviewed outcome replaces the automated one.

This is the only automated decision we make that has a material effect on you. We do not profile you to set prices, to rank or score you, or to target you with advertising. If an automated check goes against you, you may resubmit, and you can ask a person to review it by emailing support@wbexchange.com.

We rely on the following legal bases:

• Contract — to provide the Services you have signed up for;
• Legal obligation — to satisfy regulatory and anti-financial-crime requirements;
• Legitimate interests — to protect our platform from fraud and to improve our products;
• Consent — for optional things like marketing emails or precise location, which you can withdraw at any time.

We share personal information only with:

• Service providers — our identity-verification provider Smile Identity, payment processors, banking partners, cloud hosting, customer support tooling, and analytics platforms. Each operates under contract and data-protection terms that require them to provide the same or equal protection of your data as is set out in this Policy;
• Liquidity and gift-card partners — only the transaction-specific data required to fulfil your order;
• Regulators and law enforcement — where we are legally required to disclose, including suspicious activity reports;
• Acquirers or successors — in the event of a merger, acquisition, financing, or sale of assets, subject to the protections of this Policy.

We do not sell your personal information. We do not share your contact details with third-party marketers.

Our website uses cookies and similar technologies to keep you signed in, remember your preferences, measure usage, and protect against fraud. We use Zoho PageSense on our website to understand how pages are used so we can improve them. You can control cookies through your browser settings, but disabling them may break parts of the site. We do not use third-party advertising cookies, and we do not share your data with advertising networks.

We keep personal information only for as long as we need it for the purposes described in this Policy. KYC records and transaction history are retained for the period required by financial-services regulations — generally five (5) to seven (7) years after account closure. Other data is deleted or anonymized when it is no longer needed.

We protect your information with industry-standard safeguards: encryption in transit (TLS) and at rest, multi-factor authentication, biometric login support, role-based access controls, hardware-secured cold storage for crypto assets, and continuous monitoring of our infrastructure. No system can be guaranteed 100% secure, but we work continuously to reduce risk.

Depending on where you live, you may have the right to:

• Access the personal information we hold about you;
• Correct inaccurate or incomplete information;
• Request deletion of your data, subject to our legal obligation to retain certain records;
• Object to or restrict certain processing;
• Receive a portable copy of your data;
• Withdraw consent where processing is based on consent;
• Lodge a complaint with your local data-protection authority.

To exercise any of these rights, contact us at support@wbexchange.com. We will respond within thirty (30) days.

The Services are not intended for anyone under the age of 18. We do not knowingly collect information from minors. If you believe a minor has provided us with information, please contact us so we can delete it.

Some of our service providers operate outside your country of residence. When we transfer personal information across borders, we put in place safeguards such as standard contractual clauses and provider certifications to ensure your information remains protected.

We may update this Privacy Policy from time to time. When we make material changes, we will notify you through the app, by email, or by updating the “Last updated” date above. Please review the Policy periodically.

For questions about this Policy or our data practices, reach us at support@wbexchange.com.