Privacy policy — Yerba Tsede

1. Who is responsible

BABG TECH LTD, a company registered in England and Wales under number 17276222, with its registered office at 128 City Road, London EC1V 2NX, United Kingdom, is the controller of the personal data described here. In this policy, "we" means BABG TECH LTD and "Yerba Tsede" means the service we operate.

For any question about this policy, or to exercise a right described in section 7, use the contact page and mark your message as a data protection request.

2. What we collect

Identity data — name, date of birth, nationality, and the identity document you provide during verification.
Contact data — email address, phone number, postal address.
Company data, for business accounts — registered name, company number, registered address, and details of directors and beneficial owners.
Financial data — your account balance, the payments you make and receive, the rails used, and the counterparties involved.
Technical data — IP address, device and browser information, and timestamps of your sessions.
Correspondence — messages you send us and our replies.

3. Why we use it, and on what basis

To provide the service and operate your account — necessary for the performance of our contract with you (UK GDPR and GDPR Article 6(1)(b)).
To verify your identity, screen payments, and prevent financial crime — necessary to comply with our legal obligations and those of our partners (Article 6(1)(c)), and in the substantial public interest for special category data where applicable.
To keep accounting and transaction records — legal obligation (Article 6(1)(c)).
To secure the service and investigate misuse — our legitimate interests in running a service that is not abused (Article 6(1)(f)).
To answer you when you contact us — performance of the contract, or our legitimate interest in responding to enquiries.

We do not sell personal data, and we do not use it for advertising or profiling that produces legal effects for you.

4. Who else processes it

Running payments requires partners. Each receives only what it needs:

Banking Circle — banking partner for European and UK settlement.
Lead Bank — banking partner for US settlement.
Circle — issuer of USDC, the asset in which balances are held.
Identity verification, screening, hosting, error monitoring and email providers — acting on our instructions under written contracts.

These partners are independent controllers for the parts they are legally responsible for, in particular identity verification and payment screening. Their own privacy notices apply to those activities.

5. Where it is held

Personal data is hosted in the European Union or the European Economic Area. Where a partner processes data outside the EEA or the UK, the transfer relies on an adequacy decision or on standard contractual clauses with additional safeguards.

6. How long we keep it

Account and identity records — for the life of the account, then five years after it closes, as required by anti-money-laundering rules.
Transaction records — five years from the transaction, for the same reason.
Technical logs — up to twelve months.
Correspondence — up to three years after the exchange ends.

When you delete your account, your profile is removed. The records above are retained for the periods stated because we are required to keep them — this is the exception to erasure in Article 17(3)(b).

7. Your rights

Access — a copy of the personal data we hold about you.
Rectification — correction of data that is wrong or incomplete.
Erasure — deletion, subject to the retention obligations in section 6.
Portability — a machine-readable copy of the data you gave us.
Objection and restriction — to processing based on our legitimate interests.
Withdrawal of consent — where processing relies on consent, at any time, without affecting what was done before.

You can delete your account yourself from inside the product. For anything else, contact us; we answer within one month.

8. Complaints

If you are not satisfied with how we handle your data, you can complain to the UK Information Commissioner's Office (ico.org.uk), or to the supervisory authority of the EU or EEA country where you live, work, or where you believe the problem occurred. We would rather you told us first — see the complaints page.

9. Cookies and local storage

This site uses no advertising or analytics cookies. The product stores your session and your preferences locally in your browser because it cannot work otherwise.

10. Changes

We may update this policy. The date at the top shows when it last changed. If a change materially affects you, we tell you by email or in the product before it takes effect.