Privacy policy

When an account is created: email address, password (stored only in hashed form, never as plain text) and name.

At identity verification: country of residence, identity document number, an image of the identity document, and a proof of address.

In use: orders created, proposals sent and received, completed exchanges, wallet movements, and for withdrawals the IBAN given.

Automatically: technical records needed to run and secure the service, including the IP address and browser used when an identity document is opened by our team.

To provide the service — create an account, show orders, carry out exchanges and record movements. Basis: performance of the contract.

To verify identity before any exchange. Basis: legal obligation and fraud prevention.

To write to you about your account — registration confirmation, approval or refusal of verification, and the state of your exchanges. Basis: performance of the contract.

To keep the service secure and auditable, including logging who opened an identity document. Basis: legitimate interest in security and accountability.

There is no advertising, no sale of data, and no automated decision with legal effect: a verification is approved by a person.

Supabase — database, authentication and storage of identity documents.

Resend — transactional email.

Vercel — hosting for the web application.

Render — hosting for the service that carries out operations.

These providers process the data on Mocambio’s behalf and only for the purposes above. Beyond them, data is not shared with third parties except where a competent authority requires it.

Documents are held in a private store, are not reachable by public link, and are not used for any purpose beyond verifying identity and meeting the obligations that come with it.

Every time a document is opened by our team it is logged, with who opened it and when. That record exists so that restricted access is something you can check rather than something we assert.

Account and exchange data is kept for as long as the account exists.

The exact period for which identity documents are kept after an account closes is being settled with legal advice and will be stated here once it is fixed. Until then, documents are kept only for as long as they are needed for verification and the legal obligations attached to it.

You have the right to see the personal data held about you, to correct it, to ask for it to be deleted, to ask for processing to be restricted, to object to processing based on legitimate interest, and to receive your data in a portable format.

Write to contact@mocambio.com. Deleting data that is needed to meet a legal obligation may not be possible while that obligation stands, and in that case you will be told why.

You also have the right to complain to the competent supervisory authority.

When this policy changes in a way that affects the processing described above, the date at the top is updated and anyone with an account is told by email.