Privacy Policy
Fineyra — a brand operated by HONOMY ENTERPRISE LIMITED
Incorporated under the Business Corporations Act (British Columbia), Canada · incorporation number BC1504131 · business number 746166628BC0001
Registered as a money services business with FINTRAC · registration number C100000558 · foreign exchange dealing, dealing in virtual currency, payment service provider
Registered office: 580 Seaborne Avenue, Unit 2120, Port Coquitlam, British Columbia, V3B 0M3, Canada
Version 1.0 · Effective date: 9 November 2026 · Replaces all privacy terms previously published on fineyra.com
Introduction
HONOMY ENTERPRISE LIMITED (“Honomy”, “the Company”, “we”, “us”) operates the Fineyra brand. Fineyra is a trading name of the Company and not a separate legal entity. This Policy explains how we collect, use, disclose and protect your personal information when you use the Fineyra application, the website at fineyra.com and the related services (the “Services”).
This Policy applies the Company’s group privacy policy to the Fineyra product. It is consistent with the Honomy Enterprise Limited Privacy Policy, version 2.1, and differs from it only in that Fineyra is offered to individual consumers only: we do not onboard businesses through Fineyra and we do not collect business or beneficial-ownership information under this Policy.
The Company is subject to Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA), and complies with the data protection law of your country of residence where it applies to us. Where the EU General Data Protection Regulation applies to a user, we apply its standards; the Services are not offered in the European Economic Area. Our approach follows the principles of accountability, limiting collection and use, accuracy, safeguards, openness and individual access.
We never collect, hold or have access to your private keys, recovery phrase or password. The Fineyra wallet is self-custodial: the keys are generated and held on your side.
Definitions
“Personal Data” – Any information about an identified or identifiable individual: identifiers such as name, date of birth, government identification numbers, address, email and telephone number; online identifiers such as IP address and device identifier; and the documents collected for identity verification.
“Processing” – Any operation on Personal Data, including collection, use, storage, modification, disclosure, transfer, erasure and anonymisation.
“Controller and Processor” – The Company is the Controller of your Personal Data and determines the purposes and means of processing. Service providers acting on our documented instructions, such as our identity verification provider, are Processors. A partner that determines its own purposes under its own regulatory obligations — such as the licensed card issuer — acts as an independent Controller for those purposes.
“Issuing Partner” – The licensed card issuing and processing institution that issues and services the payment card, identified in the application and in the cardholder agreement presented to you before a card is issued.
“Privacy Officer” – The individual we have designated as accountable for compliance with this Policy and with applicable privacy legislation, reachable at [email protected].
Information we collect
We collect the following categories, directly from you, from the Issuing Partner, and through identity verification:
- Identity and contact details: full name, date and place of birth, nationality, country and address of residence, email address, telephone number.
- Identity documents: images of government-issued identification (passport, national identity card, driver’s licence), proof of address, and, where required by law, information on source of funds or source of wealth.
- Biometric verification data: a selfie or short video used solely to confirm that the identification document belongs to the person presenting it, processed by the verification provider.
- Financial and transactional data: public wallet addresses you use, top-up and withdrawal records, card transaction records including merchant, amount, currency and conversion rate, and card status.
- Technical and behavioural data: IP address, device identifiers, browser and operating system, approximate geolocation, login and session records, usage logs, and the referral or campaign through which you reached us.
- Support data: your messages to us and our replies.
We do not collect your private keys or recovery phrase, and we do not ask for them. Nobody acting for us will ever ask you for them.
How we use your information, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Opening and maintaining your account; making the wallet and the payment card available; processing top-ups, card transactions and withdrawals; customer support | Performance of a contract with you |
| Identity verification, sanctions, politically exposed person and adverse-media screening, ongoing monitoring, record keeping and regulatory reporting | Compliance with a legal obligation under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act and its regulations. This processing does not rely on consent and does not stop if consent is withdrawn |
| Establishing your eligibility, including nationality and country of residence, against our own policy and the rules of the Issuing Partner | Compliance with a legal obligation; performance of a contract |
| Fraud prevention, platform security, enforcement of our terms, establishing or defending legal claims | Legitimate interests |
| Service communications: transaction confirmations, security and policy notices, support responses | Performance of a contract; legitimate interests |
| Product improvement, analytics and troubleshooting, on aggregated or pseudonymised data | Legitimate interests |
| Marketing communications, newsletters and offers | Consent, which you may withdraw at any time |
| Accounting, tax and corporate record keeping | Compliance with a legal obligation |
We do not use Personal Data for any purpose incompatible with the purpose for which it was collected, and we do not sell Personal Data.
The payment card programme
The payment card is issued by the Issuing Partner, not by us. For the card programme, identity verification and screening of cardholders are carried out by the Issuing Partner. To enable issuance and operation of the card we transfer to that partner the identity and contact data it requires for its own verification and regulatory obligations, and we receive from it verification outcomes and card statuses, the transaction data we need for customer support and for our own monitoring obligations, and compliance notices.
The Issuing Partner acts as an independent Controller for the purposes of its own obligations as issuer, and processes your data under its own privacy notice, which is presented to you with the cardholder agreement. We remain Controller for the purposes set out in this Policy. Where identity verification of a cardholder is carried out by the Issuing Partner, we obtain and retain the information relied upon for that verification, as required of a registered money services business in Canada, under a written agreement concluded with that partner before we begin to rely on it.
Recipients of personal data
- The Issuing Partner and the processors involved in authorising, clearing and settling card transactions, and the card scheme.
- Identity verification provider: Sumsub (Sum & Substance), acting as our Processor for document authentication, biometric matching and screening, where verification is carried out by us.
- Blockchain analytics providers, for screening of the wallet addresses from which funds reach you, where that screening is carried out by us.
- Third-party service providers whose services are offered through the application — for example the purchase or sale of virtual currency, an exchange, or an optional product that pays a return. Each provides its service to you under its own terms and privacy policy, as its own Controller.
- Cloud, hosting, communications and security providers supporting our infrastructure.
- Analytics providers, operating on technical and aggregated data.
- Professional advisers — legal, audit and accounting — under duties of confidentiality.
- Regulators, law enforcement and courts, where disclosure is required by law, including reporting to the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC).
- A successor of the business, in the event of a reorganisation or sale, under confidentiality obligations and with no reduction of your rights.
Every Processor is engaged under a written agreement that limits processing to our documented instructions and imposes confidentiality and security obligations. We screen partners and vendors before engagement and keep records of those checks.
Data retention
| Category | Retention period | Basis |
|---|---|---|
| Identity verification records, including documents, verification results and the information relied upon | 5 years after the end of the business relationship | PCMLTFA |
| Transaction records, including virtual currency transfers and card transactions | 5 years from the date of the transaction | PCMLTFA |
| Reports filed with FINTRAC and their supporting records | 5 years from the date of filing | PCMLTFA |
| Ongoing monitoring, screening results and risk assessment records | 5 years after the end of the business relationship | PCMLTFA |
| Accounting and tax records | 6 years from the end of the relevant tax year | Income Tax Act (Canada) |
| Customer support correspondence | 24 months from the last contact | Legitimate interests |
| Technical, access and security logs | 12 months | Legitimate interests, security |
| Marketing preferences and consent records | Until consent is withdrawn, plus 24 months | Accountability |
Records required under the PCMLTFA are kept in machine-readable form and can be produced to FINTRAC within 30 days of a request. On expiry of the applicable period, Personal Data is deleted or irreversibly anonymised, unless retention remains necessary to resolve a dispute, to comply with a legal obligation, or to establish or defend legal claims.
International data transfers
We are established in Canada, and your Personal Data is processed in Canada and in other countries where our partners and providers operate — including the Issuing Partner, the verification provider, and cloud and analytics providers. While your data is in another country it may be accessible to the courts, law enforcement and national security authorities of that country under its law.
We transfer data only where appropriate legal safeguards are in place: contractual protections consistent with PIPEDA, and, where the GDPR applies to a user, standard contractual clauses approved by the European Commission or a valid adequacy decision. A list of the categories of recipients and the countries in which they operate is available on request from the Privacy Officer.
Automated processing
Parts of onboarding use automated processing: document authentication and biometric matching, screening against sanctions, politically exposed person and watch lists, screening of wallet addresses, and an automated risk score that determines the level of due diligence applied. An automated result alone does not produce a final decision to refuse or terminate a relationship: outcomes adverse to you are reviewed by our compliance function before they take effect, and you may contact us to put your point of view and to ask for the decision to be reviewed. Where the law restricts what we may tell you — including the prohibition on disclosing that a report has been or may be made to FINTRAC — we may be unable to give you the reason for a decision.
Data security
We apply technical and organisational safeguards appropriate to the sensitivity of the data: encryption in transit and at rest, strict role-based access on a need-to-know basis, two-factor authentication, logging and monitoring, regular security review, and backups held in secure facilities. Identity documents are captured and stored on the infrastructure of the verification provider or of the Issuing Partner rather than in our own systems. Personnel with access to Personal Data are screened before engagement and trained on their obligations. No method of transmission or storage is completely secure, and you are responsible for keeping your credentials, device and recovery material safe.
Data breach notification
We maintain a breach response procedure and keep a record of every breach of security safeguards. Where a breach creates a real risk of significant harm to an individual, we report it to the Office of the Privacy Commissioner of Canada and notify the affected individuals as soon as feasible. Where the GDPR applies, we notify the competent supervisory authority within 72 hours of becoming aware of the breach and inform affected individuals where the breach is likely to result in a high risk to their rights.
Cookies and similar technologies
fineyra.com uses cookies and similar technologies that are strictly necessary to operate the site and keep your session secure, together with analytics cookies that help us understand how the site is used. Non-essential cookies are set only with your consent, which you may give or refuse when you first visit the site and change at any time through the cookie controls on the site or in your browser settings.
Blockchain and transparency
The Services involve public blockchain networks. Transaction details, including amounts and sending and receiving addresses, are publicly visible and permanently recorded, and cannot be amended or erased by us or by anyone else. Blockchain records are pseudonymous and do not contain your name; we do not place personal identifiers on-chain. Off-chain we associate wallet activity with your profile, and we keep that linkage confidential. A request for erasure cannot extend to data recorded on a public blockchain.
Your rights
- Access — confirmation of whether we process your Personal Data, a copy of it, and information about purposes, categories, recipients and retention.
- Rectification — correction of inaccurate or incomplete data.
- Erasure — deletion of data that is no longer necessary, unless we are required by law to retain it. Records held under the PCMLTFA cannot be deleted before the end of the statutory period.
- Restriction — limitation of processing in defined circumstances.
- Portability — receipt of the data you provided in a structured, commonly used, machine-readable format.
- Objection — to processing based on legitimate interests, and to direct marketing at any time.
- Withdrawal of consent — at any time, without affecting the lawfulness of processing carried out before withdrawal. Withdrawal does not apply to processing we are legally required to perform.
- Complaint — to us, and to a supervisory authority: the Office of the Privacy Commissioner of Canada, or the data protection authority of your country of residence.
Requests should be sent to [email protected]. We respond within 30 days under PIPEDA, and within one month where the GDPR applies; we may extend that period by a further two months for complex or voluminous requests, telling you the reason within the first month. We may ask you to verify your identity before acting on a request, and we may refuse a request that is manifestly unfounded or excessive, explaining why. Data held by the Issuing Partner as an independent Controller should be requested from that partner; we will tell you how, and will pass your request on where we can.
Children’s privacy
The Services are intended for users who are at least 18 years old, or the age of majority in their jurisdiction, whichever is higher. We do not knowingly collect Personal Data from minors; if we become aware that we hold such data, we delete it.
Changes to this Policy
We may update this Policy to reflect a change in law, in our processing practices, in our partners, or in guidance from supervisory authorities. The version number and effective date at the top of this document reflect the latest revision. We publish the current version at fineyra.com and, where a change materially affects your rights, we notify you directly.
Contact
HONOMY ENTERPRISE LIMITED — trading as Fineyra · Privacy Officer
580 Seaborne Avenue, Unit 2120, Port Coquitlam, British Columbia, V3B 0M3, Canada
Privacy: [email protected] · Product and support: [email protected] · Company: [email protected]
Office of the Privacy Commissioner of Canada — priv.gc.ca · 30 Victoria Street, Gatineau, Quebec, K1A 1H3.
HONOMY ENTERPRISE LIMITED · incorporation number BC1504131 · business number 746166628BC0001 · MSB registration number C100000558 · © 2026 Honomy Enterprise Limited. All rights reserved.
Version 1.0 — first version issued under Honomy Enterprise Limited. Replaces the privacy policy previously published on fineyra.com under a different operating entity. Consistent with the Honomy Enterprise Limited Privacy Policy version 2.1 of 9 November 2026, and narrower than it in that Fineyra serves individual consumers only and collects no business or beneficial-ownership information.