finlxo.
Open an account
HomePrivacy policy
Legal

Your data, plainly explained.

This policy describes the personal information Finlxo collects, why we need it, who we share it with, and the choices you have. It covers the website, the wallet and the public payment pages.

Effective November 6, 2026 Last updated November 6, 2026

Finlxo is a payment wallet, not a bank. Card payments are processed by Stripe. We do not sell personal data, and we do not use your KYC documents for marketing.

1. Who we are

Finlxo ("Finlxo", "we", "us") operates the website at finlxo.com, the signed-in wallet and the public payment pages at /u/username. For the purposes of applicable data protection law, Finlxo is the controller of the personal data described in this policy.

Questions about privacy can be sent to security@finlxo.com or through our contact page.

2. What we collect

Account information

  • your full name, email address, phone number, date of birth and country;
  • your username, password hash and hashed security answer;
  • your address, city, state or province, postal code and optional tax ID;
  • your profile picture, if you choose to upload one; and
  • marketing consent, if you opt in.

Identity verification (KYC)

  • the type and number of the identity document you provide;
  • images of the front and back of that document, where applicable;
  • a live selfie captured through your camera or uploaded as a fallback; and
  • the review decision, rejection reason and review dates.

We do not ask for a Social Security Number through this website. Identity documents are stored outside the public web root and are only served to signed-in administrators through an access-controlled route.

Payment and wallet information

  • the amount and currency of payments made to your payment link;
  • payment status, notes added by the payer, and the Stripe PaymentIntent reference;
  • withdrawal amount, currency, destination wallet address, transaction hash and review status;
  • your available balance, calculated from successful payments and withdrawals; and
  • support messages you send to us.

Technical and fraud-prevention information

  • IP address, browser user agent and a browser fingerprint generated on the payment page;
  • timestamps, pages visited and actions taken in the wallet;
  • Stripe risk level, risk score and card fingerprint returned by Stripe; and
  • records of blocked IP addresses, fingerprints and user agents.

We do not receive or store your full card number, CVC or card expiry date. Those details are submitted directly to Stripe.

3. Why we use it

  • To create and operate your account. Authenticate you, show your balances, process payment links and record withdrawals.
  • To verify identity. Review your KYC documents before enabling payments and withdrawals.
  • To process payments. Create Stripe PaymentIntents, confirm results and keep an accurate transaction history.
  • To prevent fraud and abuse. Apply velocity limits, block repeated failed attempts and review unusual activity.
  • To provide support. Respond to your messages, investigate issues and resolve disputes.
  • To meet legal obligations. Keep records required by tax, anti-money-laundering and payment-partner rules.
  • To improve the service. Understand which features are used and fix problems, using aggregated or de-identified information where possible.

Where the GDPR or similar law applies, we rely on the following legal bases:

  • Contract. To provide the wallet, payment pages and withdrawals you ask for.
  • Legal obligation. To verify identity, keep records and respond to lawful requests.
  • Legitimate interests. To secure the service, prevent fraud, enforce our terms and improve our product. We balance these interests against your rights.
  • Consent. For optional marketing emails. You can withdraw consent at any time.

5. Who we share with

We share personal data only where it is necessary:

  • Stripe. Card payments, payment method data and fraud signals are processed by Stripe under its own privacy terms. Stripe receives the payment amount, currency, metadata and technical signals needed to process the card.
  • Hosting and infrastructure providers. Our web host and database provider process data on our instructions to run the service.
  • Professional advisers. Lawyers, accountants and auditors, where necessary and under confidentiality obligations.
  • Authorities. Courts, regulators or law enforcement where we are legally required to disclose information.
  • Successors. A buyer or successor in a merger or sale of the business, subject to this policy.

We do not sell personal data, and we do not share KYC documents with advertisers. Public payment pages show the recipient's name and username so a payer can confirm who they are paying. They do not show the recipient's email, phone, address or identity documents.

6. Cookies

We use a small number of essential cookies, including the finlxo_session cookie that keeps you signed in and protects forms against cross-site request forgery. Stripe may set its own fraud-prevention cookies when you open a payment page. For details, see our Cookie Policy.

7. How long we keep it

  • Account data. While your account is open, then for as long as needed to meet legal, tax and accounting obligations.
  • KYC records. For the period required by applicable identity and anti-money-laundering rules, after which they are deleted or anonymised.
  • Payment and withdrawal records. For the period required for tax, accounting and dispute resolution.
  • Fraud and block records. For as long as needed to protect the service; temporary blocks expire automatically.
  • Support messages. For as long as needed to resolve the matter and keep a record of our response.

When data is no longer needed, we delete it or turn it into aggregated information that cannot reasonably identify you.

8. How we protect it

We use HTTPS, hashed passwords, hashed security answers, CSRF protection, role checks, upload validation and access-controlled document delivery. KYC files are blocked from direct public access and served only to administrators. Access to production systems is limited to people who need it.

No method of transmission or storage is completely secure. If you believe your account has been compromised, contact security@finlxo.com immediately.

9. Your rights

Depending on where you live, you may have the right to:

  • access a copy of the personal data we hold about you;
  • correct information that is inaccurate or incomplete;
  • delete information that we no longer need to keep;
  • restrict or object to certain processing;
  • receive your data in a portable format;
  • withdraw marketing consent at any time; and
  • complain to your local data protection authority.

Some rights are limited by legal record-keeping duties. To make a request, email security@finlxo.com from the address on your account. We may ask for reasonable proof of identity before acting. We aim to respond within one month.

10. International transfers

Finlxo and its providers may process data in countries other than the one where you live. Where we transfer personal data out of the European Economic Area or the United Kingdom, we use appropriate safeguards such as standard contractual clauses or an adequacy decision. You can ask us for more information about the safeguards we use.

11. Children

The service is for adults. We do not knowingly collect personal data from anyone under 18. If you believe a child has created an account, contact us and we will close it and delete the data.

12. Changes

We may update this policy when the service or the law changes. The effective date at the top of the page will change, and material updates will be communicated by email or in the wallet. Continued use after an update means you accept the revised policy.

13. Contact

Privacy questions and requests: security@finlxo.com. General support: support@finlxo.com or the contact page.