1. Who We Are
ChekBuk is a product of Afria Technologies LLC ("we", "us"). This policy explains what personal information we collect, why, who gets it, how long we keep it and your rights.
Controller. We control the personal information in this policy. Some licensed financial partners also act as independent controllers of what they collect for their regulated services, so their privacy notices apply too. We'll point you to them where we can, including when you accept their terms in the app.
Privacy contact. privacy@chekbuk.com reaches our privacy team, including our data protection officer where one is appointed.
2. What This Covers
This policy covers the ChekBuk app (iOS and Android), chekbuk.com (including the waitlist), every ChekBuk service (wallets, conversions, transfers, deposits, withdrawals, stablecoin sends and receives, escrow) and your contact with us. It doesn't cover third-party sites or services we link to, or what our partners do under their own notices. Read it with our Terms of Service, Cookie Policy, Escrow Terms and E-Sign Consent.
ChekBuk is not a bank. We're a technology company. Balances are held and moved by our licensed financial partners.
3. What We Collect
| Category | Examples | Source |
|---|---|---|
| Account data | Name, chektag, email, phone, password (stored as a secure hash), date of birth, home address, country, preferences | You |
| ID documents and selfies (KYC) | ID images and details (number, nationality, expiry), selfies and short liveness video, verification results | You, our identity verification partner |
| Biometric information | Facial geometry from your selfie and ID photo, only to confirm it's you | Our identity verification partner, from your images |
| Device data | Device model, OS and version, app version, language, IP address, device identifiers, crash and diagnostic data | Your device, automatically |
| Push tokens | Apple or Google tokens that let us send notifications | Your device, the OS provider |
| Transaction data | Balances, deposits, withdrawals, conversions and quotes, transfers, fees, payout details (bank account, mobile money number, digital wallet email, external wallet address and network), counterparties, timestamps, status | You, our payment and financial partners, your use of ChekBuk |
| Country or region | From your IP address | Derived by us |
| Support messages | Messages, emails, attachments, call notes | You |
| Escrow messages and files | Messages, evidence, requirements and decisions in your escrows | You and other participants |
| Recipient lookups | The chektag, email or phone number you type to find someone, and the result | You |
| Waitlist email | Email you submit on our website | You |
| Screening and risk data | Sanctions, politically exposed person and fraud check results, risk scores, account flags | Our screening and identity partners, us |
No precise location, no address book. We don't collect precise location. We only work out your country or region from your IP address. We only see the recipient details you type, not your contacts.
Biometrics. To confirm it's you, our identity verification partner compares your selfie with your ID photo and checks a live person took it. This creates facial geometry data. Where the law requires, we ask your explicit consent in the app first. We use it only for identity verification, fraud prevention and legal requirements. We never use it for ads or sell it.
Other people's details. If you give us someone else's details (say, inviting a non-user to an escrow or paying by phone number), you confirm you may share them for that purpose.
4. Why We Use It
We use personal information only for these purposes. The last column is our legal basis under the GDPR or UK GDPR if you're in the European Economic Area (EEA) or UK. Similar bases apply under the African laws in Section 12.
| Purpose | What it involves | Legal basis |
|---|---|---|
| Run your account | Sign-up, sign-in, settings, chektag | Contract |
| Provide ChekBuk | Wallets, quotes, transfers, deposits, withdrawals, stablecoin sends and receives, escrow | Contract |
| Verify identity (KYC) | ID documents, liveness and face match, address checks | Legal obligation; explicit consent for biometrics where required |
| Anti-money laundering, sanctions, counter-terrorist financing | Sanctions screening (including OFAC lists), transaction monitoring, reporting to authorities, freezing or limiting accounts where required | Legal obligation |
| Fraud and security | Suspicious sign-ins, device checks, rate limits, abuse investigations | Legitimate interests (protecting users and ChekBuk); legal obligation where it applies |
| Escrow moderation and disputes | Reviewing requirements, evidence and messages; deciding release, refund or split | Contract; legitimate interests |
| Support | Questions, complaints, troubleshooting | Contract; legitimate interests |
| Service messages | Receipts, security alerts, changes to terms, account activity notifications | Contract; legal obligation |
| Improve ChekBuk | Error monitoring, performance, aggregated usage stats | Legitimate interests (improving our product) |
| Marketing | News and offers by email or push, if you opt in | Consent (optional; withdraw any time) |
| Waitlist | Telling you when ChekBuk reaches you | Consent |
| Legal compliance and our rights | Records, audits, lawful requests, enforcing our terms, legal claims | Legal obligation; legitimate interests |
Where we rely on legitimate interests, we've weighed them against your rights. Ask us about that balance, or object (Section 11). If you don't give us information the law requires, such as KYC details, we may not be able to open your account or offer some features.
5. Automated Decisions
Some decisions are made fully or partly by machines:
- Identity verification: document, liveness and face match checks. Result: approved, declined or sent for review.
- Screening: matching your details against sanctions lists (including OFAC) and politically exposed person lists.
- Fraud and risk: scoring sign-ins, transactions and payout requests. A transaction may be delayed, declined or held, or an account limited.
If one of these significantly affects you (for example, declined verification or a restricted account), email support@chekbuk.com. A person will review it, and you can give your side and contest it. Sanctions or anti-money laundering rules sometimes stop us telling you why.
6. Who We Share It With
We share personal information only as set out here. Providers working for us must protect it and use it only to serve us.
| Recipient | Why |
|---|---|
| Licensed financial partners | Hold and move balances, process conversions, provide stablecoin custody, and meet their own legal duties including KYC and anti-money laundering checks |
| Identity verification partner | Verify identity, run liveness and face match, screen against sanctions lists |
| Payment and payout partners | Process card, bank and mobile money deposits and withdrawals and bank and digital wallet payouts; check the payout name matches your verified name |
| Cloud hosting providers | Host our app, website, databases and backups |
| Error monitoring providers | Find and fix crashes and bugs |
| Analytics providers | Understand overall use, without cross-site tracking |
| Email, SMS and push providers | Send codes, receipts, alerts and, if you agree, marketing |
| Professional advisers | Lawyers, auditors, accountants and insurers, under confidentiality |
| Authorities and regulators | Law enforcement, regulators, courts, tax authorities and financial intelligence units, when the law requires it of us or our partners, or to prevent fraud or protect safety |
| People you transact with | Whoever you pay or request money from sees your name and chektag. Escrow participants see the escrow's details, requirements, messages and attachments |
| Corporate transaction parties | A buyer, successor or investor in a merger, acquisition, financing, reorganisation or asset sale, under confidentiality and this policy |
Partner terms. Some features are provided by our partners, and you'll be asked to accept their terms in the app before you use them.
Escrow. The payer, beneficiary and any delegates see an escrow's terms, requirements, messages, attachments and status. ChekBuk moderates every escrow and sees all of it, to check requirements and settle disputes. Don't post anything in escrow messages you don't want others to see. See our Escrow Terms.
Blockchains are public. Stablecoin sends to external wallets go on a public blockchain. Wallet addresses and amounts are public and permanent, and we can't change or delete them.
We don't sell your data. We don't sell your personal information, share it for cross-context behavioural advertising, or use it to target ads to you elsewhere.
7. International Transfers
Our main systems are hosted in the United States. Some partners process data in other countries, so your information may be handled outside your country, including where data laws differ.
When we move data out of the EEA, UK, Ghana, Nigeria, Kenya or another country with transfer rules, we use appropriate safeguards. These include European Commission standard contractual clauses, the UK International Data Transfer Addendum, adequacy decisions or other locally recognised mechanisms. Email privacy@chekbuk.com for a copy.
8. How Long We Keep It
We keep personal information only as long as we need it, including for legal, regulatory, tax and accounting needs. Anti-money laundering law makes us keep financial and identity records for at least 5 years after your account closes, or longer if a law, regulator or court order requires it.
| Data | Retention |
|---|---|
| ID documents, KYC and screening records | At least 5 years after your account closes |
| Transaction and escrow records, including escrow messages and attachments | At least 5 years after your account closes |
| Biometric data | Only as long as needed to finish verification and meet legal requirements |
| Account data | While your account is open, then as needed for the records above |
| Support messages, device data and logs | Only as long as needed, longer if tied to a dispute, claim or security investigation |
| Push tokens | Until you sign out, uninstall or the token expires |
| Marketing preferences | Until you withdraw consent, plus a short time to record your opt-out |
| Waitlist email | Until you join, unsubscribe or we close the waitlist |
Then we delete or anonymise it. Anything we can't delete straight away, such as backups, stays securely isolated until we can.
9. How We Protect It
We use encryption in transit (and at rest for sensitive data), secure on-device storage for login tokens, role-based staff access, monitoring for suspicious activity, multi-factor and device checks for sensitive actions, and contract terms for our providers.
No system is fully secure, so keep your password, device and codes private. ChekBuk staff will never ask for your password or a one-time code. If you think your account is compromised, email support@chekbuk.com straight away. If a breach affects you, we'll tell you and the authorities where the law requires.
10. Your Choices
Marketing. Only if you opt in or the law allows. Opt out any time with the unsubscribe link, your in-app settings or by contacting us. You'll still get receipts, security alerts and important account notices.
Push notifications. Switch them on or off in your device or app settings. We may still send important service messages by email or in the app.
Cookies. Our website uses only essential cookies and local storage. See our Cookie Policy.
Children. ChekBuk is for people 18 or over. We don't knowingly collect information from anyone younger. If we find we have, we'll close the account and delete it unless the law requires us to keep it. Tell us at privacy@chekbuk.com.
11. Your Rights
Depending on where you live, you may have the right to:
- Access: get a copy of your information.
- Correction: fix inaccurate or incomplete information.
- Deletion: have your information deleted.
- Restriction: limit how we use it.
- Objection: object to use based on legitimate interests, and to direct marketing any time.
- Portability: get what you gave us in a structured, machine-readable format.
- Withdraw consent: where we rely on it. This doesn't affect earlier use.
- Human review: of a significant automated decision (Section 5).
The law limits some rights. For example, we can't delete records we must keep for anti-money laundering, and we may not be able to disclose sanctions or suspicious activity reports.
How to ask. Email privacy@chekbuk.com or use the app's privacy options where available. We'll verify your identity first, usually from the email or phone number on your account, and reply within the legal time limit. Most requests are free. Where the law allows, we may charge a reasonable fee or refuse a clearly unfounded or excessive request.
12. Regional Rights
These add to the rest of this policy, depending on where you live.
12.1 EEA and UK
The GDPR or UK GDPR applies. Our legal bases are in Section 4, transfers in Section 7, and your rights in Section 11, including the right not to be subject to solely automated decisions with legal or similarly significant effects (subject to legal exceptions). Biometric data is special category data: we process it only with your explicit consent or under another lawful condition.
You can complain to a supervisory authority, especially where you live or work or where you think a breach happened. In the UK that's the Information Commissioner's Office. We'd like the chance to fix things first at privacy@chekbuk.com.
12.2 California and Other US States
The California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA"), gives California residents these rights. Other US state privacy laws give similar rights, and you can use them the same way.
What we collected in the last 12 months, from the sources in Section 3, for the business purposes in Section 4:
| CCPA category | Examples | Disclosed for a business purpose to |
|---|---|---|
| Identifiers | Name, chektag, email, phone, IP address, device identifiers | Service providers, financial partners, authorities when required |
| Customer records (Cal. Civ. Code 1798.80) | Address, date of birth, ID details, bank or payout account details | Service providers, financial partners |
| Protected classification characteristics | Age, nationality (from ID) | Identity verification partner, financial partners |
| Commercial information | Transactions, balances, conversions, escrow records | Service providers, financial partners, people you transact with |
| Biometric information | Facial geometry for liveness and face match | Identity verification partner |
| Internet or network activity | App usage, logs, crash data | Hosting, error monitoring, analytics providers |
| Geolocation data | Country or region only | Service providers, financial partners |
| Audio, electronic or visual information | ID images, selfies, escrow attachments | Identity verification partner, escrow participants |
| Professional or employment information | Occupation or source of funds, if asked for compliance | Financial partners, authorities when required |
| Inferences | Risk and fraud scores | Financial partners, authorities when required |
Sensitive information. We collect government ID details, login credentials, financial account details and biometrics. We use and disclose them only for CCPA-permitted purposes such as providing the service, verifying identity, security and fraud prevention, never to infer characteristics about you.
Your rights. Subject to exceptions, you can:
- know what we collect, use and disclose, and access it;
- delete what we collected from you;
- correct inaccurate information;
- opt out of sale or sharing. We don't sell or share personal information as the CCPA defines those terms, haven't in the last 12 months, and don't knowingly sell or share data of anyone under 16;
- limit use of sensitive information (this doesn't apply in practice, as we only use it for permitted purposes); and
- not be discriminated against: no denied service, different prices or worse service for using your rights.
Global Privacy Control. We treat a GPC signal as a valid opt-out of sale or sharing (see our Cookie Policy).
Authorised agents. An agent can ask for you. We may ask for proof and ask you to verify your identity directly.
How to ask. Email privacy@chekbuk.com, subject "California privacy request" (or name your state).
Financial exemption. Some financial-service information falls under the federal Gramm-Leach-Bliley Act and the California Financial Information Privacy Act, and is exempt from parts of the CCPA. We handle it under those laws and our partners' financial privacy notices.
12.3 Ghana
The Data Protection Act, 2012 (Act 843) applies. You can access and correct your information and object to some processing. You can complain to the Data Protection Commission of Ghana.
12.4 Nigeria
The Nigeria Data Protection Act, 2023 and its regulations apply. Your rights include access, correction, erasure, restriction, objection, portability and rights about automated decisions. You can complain to the Nigeria Data Protection Commission (NDPC).
12.5 Kenya
The Data Protection Act, 2019 and its regulations apply. Your rights include being told how your data is used, access, objection, correction and deletion. You can complain to the Office of the Data Protection Commissioner (ODPC).
12.6 Elsewhere
Other countries may give you similar rights. Email privacy@chekbuk.com and we'll respond under the law that applies to you.
13. Changes
When we update this policy, we change the "Last Updated" date. For material changes we'll give you at least 30 days' notice by email or in the app, unless the law or our partners require a change sooner. Where the law requires, we'll ask your consent. Past versions are available on request.
14. Contact Us
- Privacy: privacy@chekbuk.com
- Support and account issues: support@chekbuk.com, or in the app
- General: hello@chekbuk.com
- Legal notices: legal@chekbuk.com
To raise a complaint, see our Complaints Policy.