Minipay Privacy Policy

Effective date: 10 September 2026

Last updated: 10 September 2026

中文

Silk Harbor Inc ("we", "us" or "our") understands how important your personal information is to you and is committed to protecting it. This Privacy Policy explains how we collect, use, store, share and protect your personal information when you use the Minipay mobile application and related services (the "Services"), and the rights you have in relation to that information.

Please read this Privacy Policy carefully before using the Services. By starting to use the Services, you confirm that you have read and agreed to this Privacy Policy.

1. Who we are

The Services are operated by Silk Harbor Inc, with its registered address at 1500 N Grant St Ste M, Denver, CO 80203-1859, United States.

The Services are available to users in Asia (excluding mainland China), the Middle East, North America and South America, and provide multi-currency accounts, payment cards, transfers, merchant payments, cross-border remittance and digital asset related services.

If you have any questions about this Privacy Policy, please contact us at minipay@mini-pay.io.

2. Information we collect

We only collect personal information that is necessary for the purposes described in this Privacy Policy.

2.1 Account and identity information

• Registration and login: email address, password, verification codes, and a referral code where applicable.
• Identity verification: full name, gender, date of birth, nationality, occupation, phone number, country or region of residence and full address.
• Identity documents: document type, document number and expiry date, and where applicable residence permit type and supporting documents.
• Document images: photographs of the front and back of your identity document, and a photograph of you holding your document.
• Third-party sign-in: if you choose to sign in with a Google account, we receive the account identifier and email address provided by Google.

2.2 Financial and transaction information

• Bank card or other payment account details that you link to the Services.
• Account balances, asset details, transaction history, transfer records and currency exchange records.
• Recipient details you provide when using cross-border remittance services, such as the recipient's name, account number and address.
• Recipient name, contact number and mailing address you provide when applying for a physical card.

2.3 Digital asset information

• Blockchain addresses you use within the Services and the corresponding on-chain transaction records.
• Records of deposits, withdrawals and transfers of digital assets.

2.4 Device and log information

• Device model, operating system version, app version, system language and region settings.
• IP address, access times, operation logs and security event records.
• App crash and performance logs used to diagnose and fix faults.

2.5 Information used only after you grant permission

• Camera: to capture identity documents for verification and to scan payment QR codes. Accessed only when you actively trigger it in the app.
• Photo library: to select identity document images for verification. Accessed only when you actively select an image in the app.
• Fingerprint or face recognition: for quick authentication on your device. Biometric data is processed by your device's operating system; we do not access, upload or store it.

3. How we use information

• To provide and maintain accounts, cards, transfers, currency exchange, payments, remittance and digital asset features.
• To complete identity verification and to comply with anti-money laundering (AML), counter-terrorist financing (CTF) and sanctions screening obligations.
• To identify transaction risks, monitor account security and prevent abnormal activity.
• To handle your enquiries, complaints, disputes and customer support requests.
• To send you service-related notices, security alerts and necessary account notifications.
• To comply with applicable laws and regulations, regulatory requirements and valid orders from judicial authorities.

4. How we share information

We do not sell your personal information. To achieve the purposes described above, we share information within the necessary and minimum scope with the following categories of partners:

The named service providers are listed in the Appendix below. We enter into data protection agreements with our partners requiring them to handle your personal information in accordance with this Privacy Policy and applicable law.

5. International transfers

Our servers are located in Singapore, and your personal information is primarily stored and processed there.

In addition, parts of the Services are provided by partners outside Singapore, and your personal information may be transferred to and processed in their locations, as listed in the Appendix below. We rely on lawful transfer mechanisms permitted by applicable law — such as standard contractual clauses and data protection impact assessments — to ensure that overseas recipients provide a level of protection no lower than that described in this Privacy Policy.

6. How long we keep information

We retain your personal information only for as long as necessary to fulfil the purposes described in this Privacy Policy, in accordance with applicable law and regulatory requirements.

When you delete your account, we will delete or anonymise your personal information. However, transaction records and identity information that we are required to retain under anti-money laundering and other laws will be deleted after the statutory retention period expires (5 years).

7. How we protect information

We apply industry-standard security measures to protect your personal information, including:

• Encrypting data in transit using HTTPS/TLS;
• Encrypting sensitive information such as identity data and document images at rest;
• Applying access controls and the principle of least privilege;
• Requiring employees and partners to observe confidentiality obligations;
• Monitoring and responding to abnormal access and security incidents.

Please note that no method of transmission over the internet or method of storage is completely secure. If a personal data breach occurs, we will notify you and report to regulators as required by law.

8. Your rights

To the extent permitted by applicable law, you have the following rights in relation to your personal information:

• Access and correction: you can view and update your profile in the "Me" section of the app. To correct other information, please contact us using the details below.
• Withdraw consent: you can disable camera, photo library or biometric permissions in your device settings. Withdrawal does not affect processing carried out before the withdrawal.
• Delete your account: you can submit a request via Profile → Edit Profile → Delete Account or by emailing minipay@mini-pay.io. See our Account Deletion Notice for details.
• Complaints: you can contact us at minipay@mini-pay.io. We will respond within 15 business days.

9. Minors

The Services are intended only for users aged 18 or over who have full legal capacity. We do not knowingly collect personal information from minors. If we learn that we have collected a minor's personal information without verifiable parental consent, we will delete it promptly.

10. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you through in-app notices or email, and update the "Last updated" date at the top of this page.

Please review the latest version before using the Services. If you continue to use the Services after a change takes effect, you accept the revised Privacy Policy.

11. Contact us

Company: Silk Harbor Inc
Registered address: 1500 N Grant St Ste M, Denver, CO 80203-1859, United States
Email: minipay@mini-pay.io

Appendix: list of third-party service providers

To help you understand who we share information with, we list our current service providers below:

We will update this page when the list changes.