Privacy Policy

Welcome to BitPulse. This Privacy Policy describes how BitPulse (“we,” “us,” or “our”) collects, uses, and protects your personal information when you use our platform to buy and sell USDT (a digital dollar stablecoin) and related services (the “Service”).

By using BitPulse, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree with this policy, please do not use our Service.

We are committed to protecting your privacy and ensuring the security of your personal information in compliance with Ghana’s Data Protection Act and international data protection standards.

2.1 Information required at registration

To create an account you provide:

• Email address — your primary identifier and the channel we use to send verification, password-reset, security-alert, and order-status emails.
• Password — stored only as a salted, one-way hash; we cannot read it back.
• Full name (optional at signup) — used for display in the app. Your legal name is collected separately at KYC time (see 2.2) for compliance screening.

A mobile phone number is not required to register. You may add one later under Settings if you want SMS notifications or want to use Mobile Money as a payment method.

2.2 Information you provide for KYC (identity verification)

Before you can trade, Ghanaian AML regulation requires us to verify your identity. You upload:

• Government-issued ID — front and back photographs of your Ghana Card, passport, or driver’s licence.
• Selfie — a current photograph of your face, used to confirm the ID document belongs to you.
• Full legal name exactly as it appears on your ID. Used to screen against international sanctions lists (see section ‘Sanctions screening’ below) and to match your account to your transaction history for AML reporting.

We do not require proof-of-address documents at this time. We do not request or store biometric templates beyond the selfie image itself.

2.3 Information you provide to transact

• Mobile Money account details when you add a payment method (network + phone number, verified by SMS OTP).
• Wallet addresses when you sell crypto to us or withdraw, plus the transaction hash to confirm an on-chain deposit.
• FATF travel-rule data for transactions at or above the regulatory threshold (currently GHS 11,700, roughly USD 1,000): beneficiary name, beneficiary relationship to you, and reason for the transfer.

2.4 Information we collect automatically

When you use the Service we automatically collect technical information needed to operate the platform safely:

• Device type, operating system, browser, and app version
• IP address and approximate country (derived from IP — used to detect new-country logins and to satisfy regulatory geo requirements)
• Session and authentication events (login successes, failures, password resets, 2FA challenges, account-deletion requests) — written to an append-only audit log
• Order and transaction history (amounts, asset, status, timestamps)
• Error logs and performance data, redacted of sensitive payload fields before they reach our error-tracking service

We use your personal information for the following purposes:

• Service delivery: Process orders, verify identity, facilitate transactions
• Communication: Send order confirmations, respond to inquiries, provide support
• Security: Detect fraud, prevent money laundering, protect against unauthorized access
• Legal compliance: Comply with Ghanaian laws, respond to legal requests
• Service improvement: Analyze usage, improve functionality, develop new features

We do not sell your personal information. We share specific data with specific third parties only to operate the Service, and only the minimum required for each purpose. The complete sub-processor list is in section 9 below.

Outside the sub-processor list, we disclose information only in these circumstances:

• Legal and regulatory requirements: when compelled by Ghanaian law, court order, or instruction from the Bank of Ghana, the Securities and Exchange Commission, or the Financial Intelligence Centre. We log every such disclosure.
• Anti-money-laundering and sanctions enforcement: if a transaction triggers our internal AML thresholds (e.g. FIC Currency Transaction Report at GHS 10,000) or if your name matches an OFAC, UN, or HMT sanctions list at KYC time, we file the required reports with the relevant authority.
• Fraud prevention: we may share transaction signals with payment providers (Mobile Money network operators) and law-enforcement when investigating confirmed fraud against you or against the platform.
• Business transfers: if BitPulse is acquired, merged, or sells substantially all assets, your information may transfer to the successor entity subject to the same privacy commitments described here. We will email you in advance of any such transfer.
• With your explicit consent: for anything else.

We protect your information with concrete technical controls, not just policy. The following measures are in production today:

5.1 In transit

• All traffic between you and BitPulse runs over HTTPS with TLS 1.2 or higher. Older TLS versions are refused at the edge.
• HTTP Strict Transport Security (HSTS) is enabled with a one-year duration so browsers refuse to talk to us over plain HTTP even if a network attacker tries to downgrade.
• Cross-origin protections (Content-Security-Policy, Cross-Origin-Resource-Policy, Referrer-Policy) restrict which other domains can read or include our resources.

5.2 At rest

• KYC document images are encrypted with AES-256-GCM at the application layer with a key we hold in our secret store, in addition to AWS S3’s own disk-level encryption. Even an attacker who obtained our database service-role key cannot read the raw image bytes without also obtaining the application-layer key.
• Two-factor session tokens held server-side during the brief 2FA window (between password entry and code entry) are also encrypted with AES-256-GCM so a database backup leak does not expose live login material.
• Passwords are stored only as salted, one-way bcrypt hashes managed by Supabase Auth; nobody at BitPulse can read your password back, including in the event of a database compromise.
• OTP codes emailed to you for login or payment-method verification are stored only as SHA-256 hashes server-side and expire after 10 minutes.
• Postgres and Storage backups inherit AES-256 disk-level encryption from our infrastructure providers.

5.3 Access control

• Customer data is segregated by user via row-level security; nobody other than your own authenticated session can read your own rows.
• Admin access to the platform requires a separate admin role, is rate-limited, is CSRF-protected, and is logged to an append-only audit log on every action.
• Database secrets and encryption keys live in a hosted secret store, are never committed to source control, and are rotated when staff with knowledge of them leave.

5.4 Audit trail

Every meaningful event on your account — login success, login failure, password reset, KYC submission, KYC approval or rejection, sanctions screening, account deletion, withdrawal — is written to an append-only audit log. The log cannot be modified or deleted from the application; it can only be appended to. This gives us (and you, on request) a faithful history of who did what with your account.

5.5 Honest disclosure

No security control is perfect. The measures above represent best practice for a fintech platform at our scale but they do not constitute a guarantee against every possible attack. If we detect or are notified of a security incident affecting your information, we will follow the breach-response process described in our internal runbook and notify you within 72 hours where the law or the severity of the incident requires it.

We retain your information in line with Bank of Ghana AML requirements: financial transaction records and the KYC information backing them are kept for at least five years after your account closes. Specific classes:

• KYC document images (ID front/back, selfie) — deleted from our storage at the moment you delete your account. The metadata row stays for the 5-year retention window but no longer references any image file.
• KYC metadata (status, timestamps, submission count, anonymised name) — retained five years after account closure, then purged by an automated retention sweep.
• Order and transaction history — retained five years after account closure to satisfy AML reporting obligations.
• Audit log — retained five years; append-only and tamper- resistant.
• Sanctions-screening history — retained five years for clear/cleared records, indefinitely if a confirmed sanctions match was found.
• Login OTP codes, password-reset tokens, payment-method OTP codes— deleted from our systems within minutes of expiry.

When you delete your account (see section 7), your personal identifying fields (name, email, phone, display name) are immediately anonymised; the records retained for AML purposes no longer point back to you as a named person.

Under Ghana’s Data Protection Act 2012 (Act 843), you have the following rights:

• Access: request a copy of the personal information we hold about you.
• Correction: request correction of inaccurate or incomplete data. You can update most fields yourself from the Settings area of the app.
• Deletion: request deletion of your personal information. You can initiate this yourself in-app at Settings → Security → Delete account. The in-app flow requires you to re-enter your password (and your 2FA code if enabled), removes your KYC images from our storage immediately, anonymises your personal fields, and invalidates all of your sessions. Records retained for the 5-year AML window are kept in anonymised form.
• Objection: object to processing of your information for purposes other than the core operation of the Service and compliance.
• Portability: request a machine-readable export of your account data (orders, transactions, KYC metadata).
• Withdrawal of consent: withdraw consent for processing where consent (and not contract or legal obligation) is the lawful basis.

To exercise any right that isn’t covered by the in-app self-service flow, email privacy@bitpulsegh.com with “Privacy request” in the subject line. We respond within 30 days, in line with the Data Protection Act.

We use cookies and similar tracking technologies to:

• Remember your preferences and settings
• Analyze how you use our Service
• Provide personalized content
• Improve security and prevent fraud

You can control cookies through your browser settings. However, disabling cookies may affect the functionality of our Service.

We use the following sub-processors to run the Service. Each has access only to the specific data needed for its role and is contractually or commercially bound by industry-standard data-protection terms. We review this list periodically and update it here when it changes.

The Service may contain links to other third-party websites we do not control. We are not responsible for their privacy practices — please read their own privacy policies before sharing any information with them.

BitPulse is required to confirm that no customer appears on international sanctions lists before they trade. When you submit KYC documents, and again when an admin reviews them, we screen your legal name against:

• The U.S. Treasury Office of Foreign Assets Control Specially Designated Nationals list (OFAC SDN)
• The United Nations consolidated sanctions list
• The UK HM Treasury financial sanctions list (when activated)

Screening is automated and uses the same name-matching approach as commercial AML tools (exact and fuzzy name match against a daily-refreshed copy of each list). The result of every screen is logged for compliance audit. If your name matches a list entry, an admin reviews the match manually before any decision is made — an automatic system does not block your account on its own. If a confirmed match is found, we are required to file a Suspicious Transaction Report with the Financial Intelligence Centre and to freeze the account; we cannot legally disclose to you that this has happened.

BitPulse’s primary infrastructure runs in the European Union (Frankfurt region) to take advantage of GDPR-aligned data-protection law. Your account data, KYC documents, transaction history, and audit log are stored in the EU.

Some sub-processors operate globally (see section 9): Vercel’s edge network terminates HTTPS traffic at the geographically closest point of presence, CoinGecko and Alchemy run price endpoints across multiple regions, and Google Analytics may process aggregate signals outside the EU. In each case, the data transferred is either non-personal (anonymous price data) or aggregated such that you cannot be identified from it.

Where personal data does cross borders, we rely on the standard contractual clauses, model contracts, or equivalent adequacy decisions appropriate to the jurisdiction, in accordance with the Data Protection Act.

Our Service is not intended for individuals under 18 years of age. We do not knowingly collect personal information from children. If we become aware that we have collected information from a child, we will take steps to delete it immediately.

We may update this Privacy Policy from time to time. We will notify you of any material changes by:

• Posting the updated policy on our website
• Sending an email to your registered email address
• Displaying a notice when you log in

Your continued use of the Service after changes become effective constitutes acceptance of the updated Privacy Policy.

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

• Email: privacy@bitpulsegh.com
• Support email: support@bitpulsegh.com
• Website: bitpulsegh.com
• Address: Accra, Ghana · Headquarters

For data protection inquiries or to exercise your privacy rights, please email privacy@bitpulsegh.com with “Privacy Request” in the subject line.