Privacy Policy

1 Introduction

This Privacy Policy applies to all users of Daisysim (the "Platform") and governs the collection, use, and disclosure of personal information when you use our services. By using the Platform, you consent to the practices described in this policy.

We take your privacy seriously and are committed to maintaining the trust you place in us when sharing your personal information.

2 Data We Collect

We collect only the information necessary to provide and improve our services. The categories of data we may collect include:

Category	Examples	Purpose
Account Data	Name, email address, password (hashed)	Account creation and authentication
Transaction Data	Deposit amounts, wallet balance, purchase history	Service delivery and billing
Usage Data	Numbers purchased, services used, API calls	Service improvement and fraud prevention
Technical Data	IP address, browser type, device information	Security, analytics, and debugging
Communications	Support tickets, emails sent to us	Customer support

We do not collect sensitive personal data such as government-issued ID numbers, biometric data, or payment card details (cryptocurrency transactions are handled on-chain and we only record confirmation of receipt).

3 How We Use Your Data

We use the personal data we collect for the following purposes:

To create and manage your account and authenticate your identity.
To process deposits, purchases, and maintain accurate wallet balances.
To deliver SMS verification codes and provide our core service.
To calculate and apply loyalty tier discounts automatically.
To communicate with you about your account, transactions, and support requests.
To send service-related notifications (we do not send marketing emails without consent).
To detect, investigate, and prevent fraudulent or abusive activity.
To comply with our legal obligations.
To improve and develop our Platform, services, and features.

4 Legal Basis for Processing

Where applicable data protection laws require a legal basis for processing personal data, we rely on the following:

Contractual necessity: Processing required to deliver the services you have requested, such as account creation, wallet management, and number purchases.
Legitimate interests: Processing necessary for our legitimate business interests, such as fraud prevention, security, and service improvement — provided these do not override your privacy rights.
Legal obligation: Processing required to comply with applicable laws and regulations.
Consent: Where we rely on your consent (e.g. optional communications), you may withdraw it at any time by contacting us.

5 Data Sharing & Disclosure

We do not sell, rent, or trade your personal data to third parties for marketing purposes. We may share your data only in the following limited circumstances:

Service providers: Trusted third-party vendors who assist in operating the Platform (e.g. hosting, payment processing, email delivery) under strict confidentiality obligations.
Legal requirements: When required by law, court order, or governmental authority, or to protect the rights, property, or safety of Daisysim, our users, or others.
Business transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred to the acquiring entity, subject to the same privacy protections.
With your consent: We may share data with third parties when you have explicitly consented to such sharing.

We never share your SMS codes, verification history, or wallet balance with any third party except as required by law or as outlined above.

6 Data Retention

We retain personal data only for as long as necessary to fulfil the purposes outlined in this policy, or as required by law. Specifically:

Account data is retained for the duration of your account and up to 2 years after closure.
Transaction records are retained for up to 5 years to comply with financial record-keeping requirements.
SMS codes and activation records are retained for 12 months and then anonymised or deleted.
Support communications are retained for up to 2 years.
Technical/log data is retained for up to 90 days for security and debugging purposes.

Upon account deletion, we will delete or anonymise your personal data within 30 days, except where retention is required by law.

7 Cookies & Tracking

We use a minimal set of cookies necessary to operate the Platform. We do not use advertising or tracking cookies.

Session cookies: Required for authentication — they expire when you close your browser.
Preference cookies: Store your theme preference (light/dark mode) and similar settings.
CSRF tokens: Security tokens that protect against cross-site request forgery attacks.

You can disable cookies in your browser settings, but this may affect the functionality of the Platform. We do not use third-party analytics or advertising cookies.

8 Security

We implement industry-standard security measures to protect your personal data, including:

All data transmitted between your browser and our servers is encrypted using TLS/HTTPS.
Passwords are stored using strong one-way hashing algorithms and are never stored in plain text.
Access to personal data is restricted to authorised personnel on a need-to-know basis.
We conduct regular security reviews and promptly address identified vulnerabilities.
API keys are stored in hashed form and can be regenerated at any time from your dashboard.

While we take all reasonable precautions, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security of your data.

9 Your Privacy Rights

Depending on your location, you may have the following rights regarding your personal data:

Right of access: Request a copy of the personal data we hold about you.
Right to rectification: Request correction of inaccurate or incomplete data.
Right to erasure: Request deletion of your personal data ("right to be forgotten").
Right to restrict processing: Request that we limit how we use your data in certain circumstances.
Right to data portability: Request a structured, machine-readable copy of your data.
Right to object: Object to processing based on legitimate interests or for direct marketing.
Right to withdraw consent: Where processing is based on consent, withdraw it at any time.

To exercise any of these rights, contact us at the details below. We will respond within 30 days. We may need to verify your identity before processing your request.

10 Children's Privacy

Daisysim is not directed at children under the age of 18. We do not knowingly collect personal data from anyone under 18. If we become aware that a child under 18 has provided us with personal data, we will take immediate steps to delete that information and close the associated account.

If you believe a child has created an account on our Platform, please contact us immediately.

11 Third-Party Links

Our Platform may contain links to third-party websites or services. This Privacy Policy does not apply to those external sites. We are not responsible for the privacy practices of third-party platforms and encourage you to review their privacy policies before providing any personal data.

12 Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will:

Update the "Last Updated" date at the top of this page.
Notify registered users via email or an in-platform notification.
Provide at least 7 days' notice before material changes take effect.

Your continued use of the Platform after any changes constitutes your acceptance of the revised policy.

13 Contact Us

If you have any questions about this Privacy Policy, wish to exercise your data rights, or have a privacy concern, please contact us. We aim to respond to all enquiries within 2 business days.