Who We Are
ZendFi ("we", "us", "our") is a cross-border payments infrastructure platform that enables merchants to accept multi-currency payments and settle in USDC or local currency. Our service is accessible at zendfi.tech.
This Privacy Policy explains what data we collect when you use ZendFi, how we use it, who we share it with, and your rights over it. By using our services, you agree to the practices described here.
Information We Collect
We collect information necessary to provide payment infrastructure services:
- Identity data — full name, business name, email address, phone number
- Account data — login credentials (stored as hashed values), account preferences
- Payment data — wallet addresses, transaction amounts, currencies, payment status
- Business data — merchant category, country of operation, settlement preferences
- Technical data — IP address, device type, browser, API usage logs, timestamps
- Communication data — messages sent via WhatsApp OTP, support correspondence
We do not collect or store full card numbers, CVVs, or unencrypted financial credentials.
How We Use Your Information
We use collected data strictly to operate and improve our services:
- Verifying your identity during onboarding and login (OTP authentication)
- Processing and settling cross-border payments on your behalf
- Communicating transaction statuses, receipts, and account notifications
- Detecting and preventing fraud, security breaches, and unauthorized access
- Complying with applicable financial regulations and legal obligations
- Improving platform reliability, performance, and features
We do not use your data for advertising. We do not sell your data to third parties.
Who We Share Data With
To deliver our services, we work with the following infrastructure partners. Each partner processes only the data necessary for their specific function:
We may also disclose your data to law enforcement or regulatory bodies when required by law, or to protect the rights and safety of ZendFi and its users.
How Long We Keep Your Data
We retain your data for as long as your account is active or as required to provide our services. Transaction records are retained for a minimum of 5 years to comply with financial regulations. OTP codes are invalidated immediately after use or upon expiry (10 minutes), and are never stored in plaintext.
Upon account deletion, we will anonymize or delete personal data within 30 days, except where retention is required by law.
How We Protect Your Data
We implement industry-standard security measures including:
- TLS encryption for all data in transit
- Encrypted storage for sensitive credentials via AWS Secrets Manager
- Hashed OTP codes — never stored in plaintext
- Role-based access controls on all internal systems
- Continuous monitoring and alerting via AWS CloudWatch
No system is completely immune to breaches. In the event of a data breach that affects your personal information, we will notify you promptly in accordance with applicable law.
Your Rights Over Your Data
Regardless of where you are located, you have the right to:
- Access the personal data we hold about you
- Request correction of inaccurate or incomplete data
- Request deletion of your account and associated personal data
- Withdraw consent for data processing where consent is the legal basis
- Lodge a complaint with your local data protection authority
To exercise any of these rights, contact us at the address below. We will respond within 30 days.
Cookies & Tracking
Our platform uses minimal cookies strictly necessary for session management and security. We do not use tracking cookies, advertising pixels, or third-party analytics that profile your behaviour across other websites.
Updates to This Policy
We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page and notify active users via email or in-app notice where the changes are material. Continued use of ZendFi after any update constitutes acceptance of the revised policy.
Get in Touch
For any privacy-related questions, data requests, or concerns: