Table of Contents
- Introduction
- Information We Collect
- Legal Basis for Processing (GDPR)
- How We Use Your Information
- Data Sharing and Disclosure
- International Data Transfers
- Important Legal Clarification
- Data Security
- Data Retention
- Your Rights
- Children's Privacy
- Data Breach Notification
- Third-Party Websites
- Cookies and Tracking
- Changes to This Policy
- Contact Us
Introduction
Elytra (we, us, or our) operates the Elytra platform (the Service), a digital system that facilitates automated data exchange between third-party payment services such as Natcash and Wise. Elytra does not handle, store, or transfer money. It acts solely as a communication and request automation layer between verified financial partners.
This Privacy Policy explains how we collect, use, and protect your personal and transactional information. By using our Service, you acknowledge and agree to the terms described below.
Elytra complies with international privacy laws including the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA/CPRA), the UK Data Protection Act, and other applicable frameworks. For GDPR purposes, Elytra acts as the data controller, and our Data Protection Officer (DPO) can be contacted at dpo@elytra.app.
Information We Collect
We collect and process limited information necessary to process automated requests and maintain service reliability:
- Identity Data: Full name and email address.
- Linked Account Identifiers: External account identifiers needed for integrations (for example, phone for Natcash and email for Wise).
- Transaction Metadata: Request identifiers, timestamps, amounts, and linked Natcash/Wise reference numbers (for audit tracking only).
- Technical Data: IP address, browser type, device info, OS version, and access logs.
- Account Data: Username, encrypted password, preferences, and API tokens (never shared publicly).
- Cookies: Functional and analytical cookies used for session stability and optional analytics.
We do not collect sensitive financial data such as credit card numbers or bank account details, as all payments are handled directly by Natcash and Wise.
Legal Basis for Processing (GDPR)
Under GDPR, we process data on the following bases:
- Consent: For optional features like analytics or marketing.
- Contract: To fulfill requests and provide the Service.
- Legitimate Interests: For security, fraud prevention, and service improvements (balanced against your rights).
- Legal Obligation: For compliance with laws (e.g., audit logs).
How We Use Your Information
Elytra uses your information exclusively for operational and technical purposes:
- To initiate verified automated requests between APIs.
- To confirm transactions with Natcash and Wise via secure protocols.
- To ensure the accuracy and reliability of data exchanges.
- To provide user support and respond to inquiries.
- To comply with security and regulatory requirements, including AML/KYC verifications through our partners.
- To improve the stability and security of the Service.
Data Sharing and Disclosure
Elytra does not sell, rent, or monetize personal data. We share limited information only when necessary for service operation:
- Natcash (Digicel Haiti): To confirm and validate incoming payment notifications, in accordance with their privacy policy.
- Wise (UK/EU): To relay transfer instructions and validate delivery statuses, as per their global privacy notices.
- Hosting and Infrastructure Providers: AWS, Vercel, or similar secure platforms.
- Legal Authorities: Only in compliance with valid legal requests or obligations.
For AML and KYC purposes, shared data with partners like Natcash and Wise may be used to verify identities and prevent fraud, as required by financial regulations.
International Data Transfers
If data is transferred outside the EEA (e.g., to US servers), we use Standard Contractual Clauses (SCCs) or other approved mechanisms to ensure adequate protection. We conduct transfer impact assessments as required.
Important Legal Clarification
Elytra is not a financial institution, remittance company, or custodial wallet. It does not:
- Custody user funds as a licensed bank or e-money issuer.
- Offer foreign exchange or investment products.
- Replace the terms of Natcash, Wise, or other providers.
Elytra may still orchestrate transfer request lifecycle events (including retries, status updates, and refund/cancel workflows) while financial settlement remains dependent on third-party providers.
Data Security
- All communications are encrypted via HTTPS/TLS.
- API connections use signed requests and verified webhooks.
- Access is limited to authorized personnel only.
- We perform backups and security monitoring for operational resilience.
While Elytra does not process payment card data, our integrations with Natcash and Wise ensure compliance with PCI-DSS standards for any relevant data handled by partners.
Data Retention
- Request and access logs are generally retained up to 12 months.
- Transaction and audit metadata may be retained up to 5 years for compliance and traceability.
- Account deletion requests are processed through an anonymization workflow and may retain legally required records.
Your Rights
Under GDPR and similar laws, you have the right to:
- Access and review your stored data.
- Request correction or deletion of data (right to be forgotten).
- Withdraw consent to data processing.
- Request export (portability) of your data, where technically available and legally applicable.
- Object to processing based on legitimate interests.
- Lodge a complaint with a supervisory authority (e.g., CNIL in France).
For California residents under CCPA/CPRA, you have additional rights including opting out of any data sales (though we do not sell data) and non-discrimination for exercising rights.
Contact us at privacy@elytra.app to exercise your rights. We respond within 1 month (extendable if complex).
Children's Privacy
Our Service is not intended for children under the age of 18. We do not knowingly collect personal information from children under 18. If we become aware that we have collected personal information from a child under 18, we will take steps to delete such information promptly.
If you are a parent or guardian and believe your child has provided us with personal information, please contact us at privacy@elytra.app.
Data Breach Notification
In the event of a data breach that may affect your personal data, we will notify you and relevant authorities as required by law (e.g., within 72 hours under GDPR). We maintain an incident response plan to handle such events efficiently.
Third-Party Websites
Our Service may contain links to third-party websites, such as Natcash or Wise. We are not responsible for the privacy practices or content of these external sites. We encourage you to review their privacy policies before providing any information.
Changes to This Policy
This Privacy Policy may be updated to reflect service or legal changes. You will be notified of any significant updates before they take effect.
Contact Us
Questions or requests? Contact us at privacy@elytra.app.