Privacy Policy

Effective date: 30 June 2026

1. Introduction

This Privacy Policy explains how LurraPay Inc. ("LurraPay", "we", "us", or "our") collects, uses, shares, and protects personal data when you visit https://lurrapay.com (the "Site"), create an account, or use our products and services (together, the "Services").

LurraPay Inc. is the data controller responsible for the personal data described in this Policy, except where stated otherwise. Our registered address is 60 Nexus Way, 6th Floor, Camana Bay, PO Box 30745, Grand Cayman, KY1-1203, Cayman Islands.

This Policy applies to individual (consumer) users, to people acting on behalf of business customers, and to visitors to the Site. It should be read together with our Terms and Conditions and our Cookie Policy.

Region-specific information for the EEA and UK, the Cayman Islands, and the United States (including California) is set out in Sections 13 to 15.

2. Important context: LurraPay and our Licensed Partners

LurraPay is a financial-technology platform. It is not a bank, does not hold customer funds, and is not itself a licensed financial institution. The regulated services you access through LurraPay (including virtual accounts, on-ramp and off-ramp, swaps, payments, and identity verification) are provided by regulated third-party partners, currently including Iron (a MoonPay company) and MoonPay and their affiliates (together, "Licensed Partners").

When you use those regulated services, the relevant Licensed Partner generally acts as an independent data controller of your personal data for the purpose of providing its regulated service and meeting its own legal, regulatory, anti-money-laundering, and compliance obligations. The Licensed Partner's own privacy policy governs that processing. We encourage you to read the privacy policies of Iron and MoonPay (published on iron.xyz and moonpay.com). This Policy describes only LurraPay's own processing.

3. Personal data we collect

We collect the following categories of personal data:

Identity and verification data: name, date of birth, nationality, gender, photographs of government-issued identity documents (such as passport or national ID), selfie or "liveness"/biometric verification images, and other information needed to verify your identity and, for businesses, to verify the entity and its beneficial owners and representatives (KYC/KYB). Much of this verification is carried out by Licensed Partners or specialist verification providers; where it passes through or is collected via our interface, we may process it as described in this Policy.

Contact data: email address, postal address, telephone number, and similar contact details.

Account and profile data: login credentials, account settings, preferences, and verification status.

Financial and transaction data: Virtual Account identifiers, balances and transaction records (as displayed to you), payment instructions, source and destination details, currency and Crypto-Asset details, blockchain/wallet addresses, and fee information. Funds and assets themselves are held and processed by Licensed Partners, not by LurraPay.

Technical and usage data: IP address, device and browser information, device identifiers, operating system, log data, pages viewed, referring URLs, approximate location derived from IP, and similar information collected automatically (see Section 7).

Communications data: the content of, and metadata about, your communications with us, including emails, chat messages, support tickets, and (where applicable) recorded telephone calls.

Marketing and preference data: your marketing preferences and your interactions with our communications.

We may also process special-category / sensitive data to a limited extent, principally biometric data used for identity verification and information that may reveal data relevant to sanctions or politically-exposed-person (PEP) screening. We process such data only where permitted by law, for example with your explicit consent or because processing is necessary for reasons of substantial public interest (such as the prevention of money laundering and fraud).

4. How we collect personal data

We collect personal data:

(a) directly from you: when you sign up, complete verification, use the Services, contact us, or subscribe to communications;

(b) automatically: through cookies and similar technologies and from your use of the Site and Services (see Section 7 and our Cookie Policy);

(c) from Licensed Partners and service providers: including identity-verification, KYC/KYB, fraud-prevention, and sanctions/PEP-screening providers, which may return verification results, risk scores, and related data to us; and

(d) from other third parties and public sources: such as sanctions and watchlists, public registers, and, for business customers, corporate registries.

5. How we use personal data and our legal bases

We use personal data for the purposes below. Where EU/UK GDPR applies, the relevant legal basis is shown.

To provide and operate the Services: creating and managing your account, enabling access to Licensed Partner services, displaying balances and transactions, and providing support. Legal basis: performance of a contract; legitimate interests.

To verify your identity and onboard you: KYC/KYB, age verification, and related checks. Legal basis: compliance with a legal obligation; performance of a contract; substantial public interest (for any special-category data); explicit consent where required.

To prevent and detect financial crime: anti-money-laundering, counter-terrorist-financing, sanctions and PEP screening, fraud prevention, and transaction monitoring. Legal basis: compliance with a legal obligation; legitimate interests; substantial public interest.

To ensure security and integrity: protecting the Site, Services, accounts, and users, and investigating misuse. Legal basis: legitimate interests; legal obligation.

To communicate with you: service, transactional, and administrative messages, and responding to your requests. Legal basis: performance of a contract; legitimate interests; legal obligation.

For marketing: sending you updates, offers, and information about our products where you have asked to receive them or where otherwise permitted. Legal basis: consent; legitimate interests (where permitted). You can opt out at any time (see Section 6).

For analytics and improvement: understanding how the Site and Services are used and improving them. Legal basis: legitimate interests.

To comply with legal and regulatory obligations: including record-keeping, responding to lawful requests from authorities, and reporting obligations. Legal basis: legal obligation.

For corporate transactions and to establish, exercise, or defend legal claims. Legal basis: legitimate interests; legal obligation.

Where we rely on legitimate interests, we have considered that those interests are not overridden by your rights and interests; you may ask us for more information about that assessment.

6. Marketing communications

Where you have opted in, or where otherwise permitted by law, we may send you marketing communications about LurraPay. You can withdraw consent or opt out at any time by using the unsubscribe link in our emails or by contacting privacy@lurrapay.com. Opting out of marketing does not affect service, transactional, or legally required communications.

7. Cookies, analytics, and similar technologies

We use cookies and similar technologies on the Site to keep it working and to remember your preferences. We set only strictly-necessary cookies and use cookie-free analytics; we do not use functional, analytics, or marketing cookies, so there is no cookie-consent tool to manage. Full details, including the categories we use and how to control them, are in our Cookie Policy.

Our analytics is provided by Plausible, which is cookie-free and does not identify individual visitors. We also use Google Search Console, which reports on aggregate search performance (such as search queries, impressions, and clicks) and does not set cookies on your device to track individual visitors on the Site. The specific cookies we use, their purposes, and their durations are described in our Cookie Policy.

8. How we share personal data

We share personal data with:

Licensed Partners: Iron, MoonPay, and their affiliates, to enable the regulated services you request and to meet their compliance obligations. As noted in Section 2, they generally act as independent controllers for those purposes.

Service providers / processors: including identity-verification and KYC providers, fraud-prevention and screening providers, cloud hosting and infrastructure, communications and analytics providers, and professional advisers, who process personal data on our behalf under appropriate contracts.

Regulators, authorities, and law enforcement: where we are required or permitted by law to disclose, including to comply with AML/CTF and sanctions obligations or to respond to lawful requests.

Corporate transactions: to potential or actual buyers, investors, or successors (and their advisers) in connection with a merger, acquisition, financing, reorganization, or sale of assets, subject to appropriate confidentiality.

Others with your consent or at your direction.

We do not sell your personal data for money. Please also see the US/California disclosures in Section 15 regarding "sale" and "sharing" as those terms are defined under California law.

9. International transfers

We are based in the Cayman Islands and our Licensed Partners and service providers operate in multiple countries, including the EEA, the UK, and the United States. This means your personal data may be transferred to, and processed in, countries other than your own, which may have different data-protection laws.

Where we transfer personal data from the EEA or UK to a country that has not been recognized as providing an adequate level of protection, we put in place appropriate safeguards, such as the European Commission's Standard Contractual Clauses (and the UK Addendum / International Data Transfer Agreement), or rely on another lawful transfer mechanism. You can request more information about these safeguards using the contact details in Section 16.

10. Data retention

We keep personal data only for as long as necessary for the purposes set out in this Policy, including to provide the Services, and then for as long as required to meet our legal, regulatory, accounting, and record-keeping obligations and to establish, exercise, or defend legal claims. In particular, anti-money-laundering and related laws typically require identity-verification and transaction records to be retained for a minimum period after the end of the customer relationship (generally at least five years, or the longer minimum period required by applicable law). When personal data is no longer needed, we delete or anonymize it. Detailed retention periods are set out in our internal retention schedule, available on request.

11. Security

We maintain technical and organizational measures designed to protect personal data against unauthorized access, loss, misuse, or alteration, including encryption in transit, access controls, and monitoring. No system is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your account credentials confidential (see our Terms and Conditions). If we become aware of a personal-data breach, we will notify you and the relevant authorities where required by law.

12. Your rights

Subject to the law applicable to you, you may have some or all of the following rights in relation to your personal data: to access it; to have it corrected; to have it erased; to restrict or object to its processing; to data portability; to withdraw consent (without affecting prior processing); and not to be subject to certain solely automated decisions. You also have the right to lodge a complaint with a data-protection authority.

To exercise your rights, contact privacy@lurrapay.com. We may need to verify your identity before responding, and we will respond within the time required by applicable law. Some rights are not absolute and may be subject to exemptions, for example where we are legally required to retain data for anti-money-laundering purposes. Region-specific details are in Sections 13 to 15.

Automated decision-making. Some onboarding, fraud-prevention, and screening processes (carried out by us or our Licensed Partners and providers) involve automated checks, which may affect whether you can access the Services. Where a decision producing legal or similarly significant effects is based solely on automated processing, you have the rights described in Section 13. You can contact us to request human review, express your view, or contest a decision.

13. EEA and UK (GDPR / UK GDPR)

If you are in the European Economic Area or the United Kingdom, the following applies in addition to the rest of this Policy.

The controller of your personal data is LurraPay Inc. (contact details in Section 16). Privacy requests and questions should be directed to privacy@lurrapay.com.

The legal bases on which we rely are set out in Section 5. You have the rights of access, rectification, erasure, restriction, objection (including to direct marketing at any time), portability, and withdrawal of consent. Where processing is based on legitimate interests, you have the right to object on grounds relating to your particular situation.

You have the right to lodge a complaint with your local supervisory authority. In the UK, this is the Information Commissioner's Office (ICO, ico.org.uk). In the EEA, it is the supervisory authority in your country of residence, place of work, or where the alleged infringement occurred.

International transfers are addressed in Section 9.

14. Cayman Islands (Data Protection Act, 2021)

LurraPay Inc. is established in the Cayman Islands and processes personal data in accordance with the Cayman Islands Data Protection Act, 2021 (the "DPA") and its data-protection principles. As a data subject under the DPA you have rights broadly equivalent to those described in Section 12, including rights to be informed about how your data is processed, to access your data, to require correction or to stop processing that is likely to cause damage or distress, and rights in relation to direct marketing and automated decision-making.

If you are not satisfied with how we handle your personal data, you may complain to the Office of the Ombudsman of the Cayman Islands (ombudsman.ky).

15. United States and California (CCPA / CPRA)

If you are a US resident, this Section provides additional disclosures. If you are a California resident, the California Consumer Privacy Act, as amended by the CPRA, gives you specific rights.

In the preceding 12 months we may have collected the categories of personal information described in Section 3 (including identifiers, financial information, internet/network activity, geolocation, and sensitive personal information such as government identifiers and biometric data), from the sources in Section 4, for the purposes in Section 5, and disclosed them to the categories of recipients in Section 8.

Subject to verification and legal exceptions, California residents have the right to: know and access the personal information we have collected; know what is disclosed and to whom; correct inaccurate personal information; delete personal information; opt out of the "sale" or "sharing" of personal information; limit the use of sensitive personal information; and not be discriminated against for exercising these rights.

We do not sell personal information for monetary consideration, and we do not share identifiers or online activity with advertising partners. To the extent any disclosure is nonetheless considered "sharing" or a "sale" under California law, you can opt out via your account settings at https://lurrapay.com/account/profile or by contacting privacy@lurrapay.com. You may use an authorized agent to submit requests. We will not discriminate against you for exercising your rights.

16. How to contact us and complain

For any privacy question, to exercise your rights, or to make a complaint, contact:

LurraPay Inc., Privacy
60 Nexus Way, 6th Floor, Camana Bay
PO Box 30745, Grand Cayman
KY1-1203, Cayman Islands
Email: privacy@lurrapay.com

If your query relates to a regulated service provided by a Licensed Partner, or to data for which a Licensed Partner is the controller, we may direct you to that partner. You also have the right to complain to the relevant data-protection authority as described in Sections 13 to 15.

17. Children

The Services are not directed to, and may not be used by, anyone under 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact privacy@lurrapay.com and we will take appropriate steps to delete it.

18. Third-party links and services

The Site and Services may link to or integrate third-party websites and services (including Licensed Partners and blockchain networks). We are not responsible for the privacy practices of third parties. Their processing is governed by their own privacy policies, which you should review.

19. Changes to this Policy

We may update this Policy from time to time. We will post the updated version on the Site and update the "Last updated" date, and, where required by law or where changes are material, provide additional notice. Your continued use of the Services after the changes take effect indicates acceptance of the updated Policy.