privacy policy

Privacy Policy

Last updated 14 September 2026

a·card processes personal information under South Africa's Protection of Personal Information Act and, for US users, the California Consumer Privacy Act as amended and the Gramm-Leach-Bliley Act where it applies to financial products.

01 — Who we are

a·card is the responsible party and business for personal information processed through A-CARD, A-MERCHANT and AFP. Our Information Officer and Privacy Officer can be reached at hello@a-card.cc.

02 — What we collect

Account information. Name, email, organisation, role, authentication data. Passwords and session tokens stored only as irreversible hashes.

Verification information. Identity document details, national identifiers, liveness capture, proof of address; for businesses, registration number, EIN, directors and beneficial owners.

Screening results. Sanctions, OFAC, PEP and adverse-media outcomes, and the decisions taken on them, including who took them.

Transaction information. Amounts, currency, merchant, category, timestamps, authorization outcomes and decline reason codes. We do not store full card numbers.

Merchant information. Catalogue items, prices, stock levels, operating hours, order history, fulfilment performance.

Technical information. IP address, device and browser characteristics, request logs, for security, fraud prevention and debugging.

03 — Why

To provide the service: issuing cards, authorising payments, matching buyers to suppliers, settling orders.

To meet legal obligations: FICA and BSA due diligence, sanctions screening, transaction monitoring, record-keeping and reporting. We cannot provide the service without this, and cannot delete it while retention obligations apply.

To prevent fraud and abuse, including misuse of agent credentials.

To improve the service, using aggregated and de-identified data.

We do not sell or share personal information as those terms are defined under the CCPA and CPRA, and we do not use your transaction data to train third-party models.

04 — Who we share it with

IDENTITY & SCREENINGVerification and screening data for KYC, KYB and AML

ISSUER & NETWORKSCardholder and transaction data, to issue and settle

RAILS & PSPsPayment instructions and counterparty details, to move funds

AUTHENTICATIONAccount identity and login events, SSO and MFA

CLOUDEncrypted data at rest, to host the service

MERCHANTSOrder details necessary to fulfil what you ordered

REGULATORSAs lawfully required

Data may be processed in South Africa, the United States and the European Union. Cross-border transfers are made under contractual terms requiring protection comparable to POPIA.

05 — Sharing data with our Custody Partner

Because funds you deposit are held by our issuing partner under their financial services license, we share certain personal information with them as necessary to open and maintain your funds custody arrangement, including identity information you provide during registration or verification, transaction data needed for their regulatory reporting and anti-money-laundering obligations, and any information required to respond to a lawful request from a regulator or law enforcement body with authority over them.

Our Custody Partner processes this information under their own privacy policy and regulatory obligations. We are not responsible for their handling of your data once shared, except as set out in our data-sharing agreement with them.

Where identity verification is performed by our Custody Partner as part of their own regulatory compliance program, they act as an independent controller of that data, not as our processor. Questions about how they use identity data for compliance purposes should be directed to them by email.

06 — Retention

Verification records, transaction records and screening outcomes are retained at least five years after the end of the business relationship, the period required by both South African financial-intelligence legislation and the US Bank Secrecy Act. Operational logs are kept for a shorter defined period. At the end of a retention period, records are deleted or irreversibly de-identified.

07 — Your rights

Know what we hold, and get a copy.

Correct what is inaccurate or out of date.

Delete what we are not legally required to keep.

Object to or limit processing not necessary for the service or required by law.

Not be discriminated against for exercising any of these rights.

Complain to the Information Regulator of South Africa or your state Attorney General.

Requests to hello@a-card.cc. We respond within 30 days, extendable to 45 under CCPA where permitted, and will tell you plainly if a legal retention obligation prevents us doing what you asked.

08 — Security

Encryption in transit and at rest, private networking, least-privilege access, full audit logging, credentials stored only as hashes. If a breach affects your personal information we will notify you, the Information Regulator, and any US state authority whose law requires it, within the time each requires.

09 — Cookies

Strictly necessary cookies for sign-in and session security, plus limited analytics. No advertising or cross-site tracking cookies. You can refuse non-essential cookies without losing access.

10 — Changes

Material changes are posted here and notified to account holders by email at least 14 days before they take effect.

11 — Contact

Information Officer: hello@a-card.cc.