Privacy Policy

1. Who we are

The controller for the processing described here is Fianto ("Fianto", "we"). Contact us at support@fianto.xyz. For a request about your personal data, put "Privacy request" in the subject so it reaches the right person. Section 11 says how quickly we answer.

2. Whose data, and our role

3. Data on public blockchains

Solana is a public blockchain. When you sign a permission or a payment is collected, your wallet address, the permission, the amounts and the times are recorded on it permanently, and anyone can read them. That record is created by the transaction itself, which you sign, not by a database Fianto controls.

Because of this, correcting or erasing personal data recorded on the blockchain is not technically feasible, for us or for anyone else. Your rights to rectification and erasure (see section 11) apply to the copies we hold off the blockchain, and we will act on them there, but they cannot change what is on Solana.

What we do to limit the link between you and on-chain data: we do not put your name, email or other identifiers on the blockchain; we keep off-chain records that link a wallet to a person to what we need; and payers can use a wallet that is not linked to their identity elsewhere. If you are not comfortable with a permanent public record, do not pay or sign in with a wallet.

4. What we collect and where it comes from

From visitors

• Technical data: IP address, browser and device type, pages requested, and the time. Needed to deliver the site and protect it.
• Cookie choices, and, only if you allow them, analytics data. See the Cookie Policy.
• What you send us, such as a message to support.

From merchants and their team

• Account data: name, email address, password (stored in hashed form), the secret shared with your authenticator app for two-factor sign-in (stored encrypted; we do not ask for a phone number to sign in), the receiving wallet address and the signed message that proves it is yours, team members and their roles.
• Business details you type at setup: whether you are a company, an unregistered business or an individual; the name on your checkout; the person responsible; country, website and what you sell; for a company, its legal name, registration number and everyone who owns 25% or more with their country of residence; for an individual, date of birth and nationality. Nothing is uploaded at this stage.
• Verification data: when you move to a higher level, identity checks of the person responsible and of owners, screening of them against lists of politically exposed persons and against adverse media, and a company registry check. Documents and selfies are handled on our verification provider's own page, which asks for your consent to compare your face with your ID. Fianto's own systems keep the result, the session reference and the report, not the images; the provider keeps what its own terms and the law require.
• Screening results against sanctions lists, which can include information about criminal offences where the law allows it.
• Security signals: IP addresses and device and browser characteristics, used to detect linked or abusive accounts.
• Product and payment settings, API usage, webhook logs, and the acceptance record for our Terms: version, time, method and device.
• Billing data for our own fees, when fees start.
• Communications with us, and whether you want product emails.

From payers

• Wallet data: your wallet address, the permission you signed, your payments, and whether a charge would succeed, read from the blockchain.
• Optional contact data: an email address, if the merchant's page asks for one and you give it, for receipts and reminders.
• Order data the merchant passes to us, such as an order reference.
• Sign-in data for My subscriptions: the signed sign-in message, which records that you accept the Terms, and technical data.
• We do not collect identity documents, names or dates of birth from payers.

5. Why we use it, and our legal basis

Our legitimate interests are running a secure, lawful service and improving it; we have weighed them against your rights, and you can object (section 11). Merchants must give us account and verification data to use Fianto; without it we cannot provide the Services. Payers do not have to give an email address.

6. Verification, screening and automated decisions

We check merchants' businesses and owners, and screen merchants, owners and wallet addresses against sanctions lists, when they join and afterwards. A possible match is flagged automatically and can pause collections or a payment while it is reviewed. A person at Fianto reviews every possible match before we refuse or end a service because of it, and records the decision. You can ask a person to look at the decision again, give your view and contest the outcome by writing to support@fianto.xyz with "Screening review" in the subject. The law may stop us from telling you why.

7. Who we share it with

We do not sell personal data, and we do not share it for cross-context advertising. We share it only with:

• Merchants: a payer's wallet, payments, optional email and order reference go to the merchant they pay.
• Service providers who process it for us under contract, listed below.
• Authorities, when the law requires it, including sanctions reporting.
• A buyer or successor of our business, under the same protections.

We will update this list at least 14 days before a new provider starts processing merchants' customer data, or sooner where needed urgently for security or continuity (see our Terms, Schedule 3).

8. International transfers

Our providers may process data outside the country where you are. When data leaves the Abu Dhabi Global Market, the EEA or the UK, we rely on an adequacy decision by the relevant authority (the ADGM Commissioner of Data Protection recognises, among others, the EEA and the UK), on a recognised certification such as the EU-US Data Privacy Framework, or on standard contractual clauses approved by the relevant authority. Ask us for a copy of the safeguard that applies.

9. How long we keep it

10. Security

We use encryption in transit, access limited to people who need it, logging, and reviews of our providers. We never have the private keys to a merchant's or payer's wallet. If a breach puts your rights at high risk, we will tell you without undue delay, and we will tell merchants without undue delay and, where feasible, within 72 hours of becoming aware of a breach affecting their customers' data.

11. Your rights

Depending on where you live, you can ask us to: give you a copy of your data; correct it; delete it; restrict or object to how we use it, including for our legitimate interests; move it to another service; and not make decisions about you based solely on automated processing. Where we rely on consent, you can withdraw it at any time, without affecting what we did before.

Write to support@fianto.xyz with "Privacy request" in the subject. We may need to confirm it is you, for example by asking you to sign a message with your wallet. We answer within one month, or tell you within that month if we need up to two more. If we process the data for a merchant, we will pass your request to them and help them answer. The limits on blockchain data in section 3 apply.

You can complain to the ADGM Commissioner of Data Protection, or to the data protection authority where you live or work. We would like the chance to fix it first.

12. Regional notes

European Economic Area and United Kingdom

The legal bases in section 5 are those of the GDPR and UK GDPR. You can complain to your local supervisory authority, for example the ICO in the UK.

United States

Where a US state privacy law applies to us, you have the rights it gives, including to know, delete and correct, and to opt out of the sale or sharing of personal data. We do not sell or share personal data for advertising, and we treat a Global Privacy Control signal from your browser as an opt-out of any optional cookies. We will not treat you differently for using these rights.

Republic of Korea

If you are in Korea, section 8 describes the overseas transfers of your data, and section 7 lists the providers we entrust with processing it. At the end of the periods in section 9, data is destroyed by secure deletion so that it cannot be recovered. The safety measures we use are in section 10, and you can refuse cookies as described in section 13. We act on a request to access, correct, delete or stop processing your data within 10 days. The person responsible for privacy is Fianto's privacy officer, reachable at support@fianto.xyz with "Privacy request" in the subject.

13. Cookies

We use cookies and similar storage that the site needs to work, and, only with your consent, analytics cookies. We do not use advertising cookies. The Cookie Policy lists each one, and you can change your choice at any time from Cookie settings at the foot of every page.

14. Children

Fianto is for people aged 18 and over. We do not knowingly collect data from children. If you think a child has given us data, tell us and we will delete what we can.

15. Changes to this policy

If we change what we collect, why we use it, who controls it, or how you can use your rights, we will tell merchants and signed-in users by email or in the dashboard before the change takes effect, and publish the new version here with its date. Earlier versions are listed below.

16. Contact

Privacy questions and requests: support@fianto.xyz, with "Privacy request" in the subject.