Privacy Policy for D'Fi Financial Services

Facts: What Does D'Fi Do With Your Personal Information?

If sharing practices change, D-Fi Financial Technologies LLC will update this notice and provide any legally required choice mechanisms.

What Information We Collect

• Identifiers and account data: name, email, phone number, username, cash handle, and account credentials.
• Social sign-in data: the Google or Facebook account identifier, name, and email address returned when you authorize an optional social sign-in.
• Profile pictures: images you choose to upload and the storage references needed to display them across the app.
• Financial information: balances, transaction records, payment method metadata, Stripe customer IDs, cardholder IDs, virtual card status, and Treasury/payment transfer records.
• Identity verification data: date of birth, SSN, address details, and identity verification session results handled through Stripe Identity.
• Crypto and wallet data: wallet addresses, blockchain transaction hashes, and crypto transfer activity for supported assets.
• Operational and security data: IP/device signals, login or verification event logs, fraud/risk indicators, and API request metadata.
• Communications data: support messages plus verification and security communications (email/SMS/push).

How We Collect Information

• Directly from you when you sign up, complete KYC, link payment rails, or submit support requests.
• From Google or Facebook when you choose social sign-in and approve the provider's authorization screen, and directly from you when you upload a profile picture.
• From your transactions with us and with integrated financial service providers.
• From service providers and counterparties that support identity checks, payments, messaging, and blockchain operations.
• From your device and app events needed for security, fraud prevention, and service reliability.

How We Use and Share Information

• To open and service accounts, process card and transfer operations, and operate crypto and USDD workflows.
• To authenticate users, perform KYC/AML checks, and prevent fraud, abuse, and unauthorized access.
• To communicate account and security notices (for example, verification codes, confirmations, and alerts).
• To engage in joint marketing arrangements with other financial companies where permitted by law and consistent with this notice.
• To share with our affiliates for their everyday business purposes related to your transactions, experiences, and creditworthiness where permitted by law.
• To comply with legal obligations, court orders, law enforcement requests, and regulatory requirements.
• To work with processors and infrastructure providers such as payment processors, identity vendors, SMS/email providers, cloud hosting/storage providers, and analytics/security tooling under contractual confidentiality and data protection obligations.

We do not sell nonpublic personal information.

Google and Facebook Sign-In

Social sign-in is optional. When you choose Google or Facebook, we use the provider account identifier, name, and email address to authenticate you and set up or identify your D'Fi early-access account. We do not receive your provider password. Provider authorization tokens are used during authentication and are not retained by the current sign-in integration; D'Fi uses its own account-session cookies afterward.

Our sign-in flow does not request permission to post to your social account, read private messages, or access your contacts, and it does not automatically import your social-network profile picture. It does not send your account balances, financial transaction history, or wallet recovery information to Google or Facebook for sign-in.

The provider may process information about your sign-in under its own privacy policy. You can manage D'Fi's authorization through your provider's account settings. Revoking that authorization does not by itself delete your D'Fi account or previously received account information and may prevent future social sign-in. Contact support@dfi.cash for account-access or deletion requests.

Social sign-in and website early-access registration do not by themselves complete app onboarding, grant SMS consent, or open a financial account or crypto wallet.

Profile Pictures and Visibility to Other Users

If you upload a profile picture, D'Fi may display it with your username or cash handle in public or other user-facing areas across the app, including profiles, user or recipient listings, payment requests, and transaction interactions where your profile appears. Other app users may view, save, or take screenshots of that picture. Do not upload a picture you wish to keep private or that contains confidential documents or sensitive personal information.

We use cloud storage and service infrastructure to host and display profile pictures. Public visibility within the app does not mean that every storage file is made publicly accessible on the internet. A publicly visible picture does not make your login credentials, identity-verification documents, account balances, or private financial records publicly visible.

You may replace your picture in the app or request removal by contacting support@dfi.cash. Copies saved by other people are outside our control. Backup copies and records may remain for the retention purposes described below. The permission you grant for hosting and displaying your picture is described in our Terms & Agreement.

Non-Custodial Wallets

D'Fi assigns decentralized, non-custodial crypto wallets at signup. You control the private keys, seed phrases, and recovery details for those wallets. D'Fi does not store, manage, or control wallet access, and we cannot recover funds if wallet credentials are lost, deleted, forgotten, or compromised.

Your responsibility includes keeping recovery phrases, backup files, and other access credentials secure and available so you can restore your wallets when needed.

How D'Fi Protects Information

We maintain administrative, technical, and physical safeguards designed to protect nonpublic personal information. These include access controls, authenticated service integrations, encryption in transit, role-based permissions, and monitoring/logging controls. No system is guaranteed to be completely secure.

United States Data Storage and Retention

D'Fi stores and retains account records in the United States for tax reporting, financial recordkeeping, legal compliance, and related regulatory obligations.

We retain information for as long as needed to provide services, meet financial recordkeeping obligations, resolve disputes, enforce agreements, and satisfy legal/regulatory duties. Certain account, transaction, and identity verification records may be retained after account closure as required by law.

Retention periods depend on the type of record and the applicable legal requirement. Retained information remains subject to our privacy safeguards and is used only for the applicable retention purposes. Records no longer needed for a lawful retention purpose are deleted or de-identified as appropriate.

Requesting Account and Personal Data Deletion

To request account closure or deletion of personal data, email support@dfi.cash with the subject "Data Deletion Request." Include your registered email address or username and the scope of your request. We may ask for information needed to verify that you are the account holder. Do not email passwords, wallet recovery phrases, private keys, or full identity documents.

We review verified requests and delete or de-identify information that is eligible for deletion under applicable law. We may retain records required for tax reporting, financial recordkeeping, identity-verification compliance, legal obligations or legal holds, fraud prevention, dispute resolution, or other legally permitted purposes. This is not a blanket refusal of deletion requests: we will explain applicable exceptions and respond within the time required by applicable law.

Account closure does not automatically erase legally retained records, and backup copies may remain until they are removed under the applicable backup and retention process. Records retained for tax and legal purposes are stored in the United States and remain subject to our privacy protections.

Revoking Google or Facebook authorization does not itself delete data previously received by D'Fi. Use the contact above to request deletion of your D'Fi account information, including social sign-in information and uploaded profile pictures where eligible. This does not delete your Google or Facebook account, public blockchain records, or copies independently retained by other users.

Former Customers

We continue to protect former customers' nonpublic personal information under this policy and applicable law.

Children's Privacy

D'Fi financial services are intended for users age 18 and older. We do not knowingly offer financial products to children.

State and Other Rights

Depending on where you live, you may have additional rights under state privacy laws (for example, rights to request access, correction, or deletion of certain personal data). Those rights are subject to legal exceptions, including financial recordkeeping and fraud prevention requirements.

Changes to This Privacy Policy

We may update this policy from time to time. We will update the date at the top of this page and provide additional notice when required by law.

Questions and Contact

Email: support@dfi.cash

Web: https://dfi.cash

Legal entity: D-Fi Financial Technologies LLC

Mailing address: 4801 Glenwood Avenue Suite 200 PMB 302, Raleigh, NC 27612.