Privacy, Data Protection & GDPR

Plain-language answers to what FurlPay stores, what it deliberately does not, and how to exercise your data rights.

What we store

• Account data: email, verification tier, region, security settings.
• Financial records: your transactions and balances — retained as required by financial regulation, which overrides deletion for these records.
• Support tickets: what you write to support, kept per-account with a bounded history.

What we deliberately do not store

• Passwords — none exist. Sign-in is one-time codes and passkeys.
• Your recovery phrase — FurlPay never asks you to provide one. The web wallet-signing path can use a remote signing service; see the signing disclosure for the custody model.
• Secrets pasted into support tickets — card numbers, recovery phrases, and API keys are stripped automatically before a ticket is stored or emailed, keeping only safe fragments like a card's last four digits.

Secrets never come back out

API responses never include authenticator secrets, session tokens, private keys, or full card numbers — responses are stripped server-side as a hard rule, not a UI choice.

Your GDPR rights

• Access / export: request a copy of your data via a Support Center ticket in the KYC category.
• Rectification: profile fields are self-service; verified-identity fields change via a KYC re-submission.
• Deletion: the web account settings include a deletion flow that requires re-authentication. Some records may be retained or pseudonymized where required for security, disputes or legal record-keeping. Review the Delete your FurlPay account. If you cannot sign in, open a ticket and we will verify ownership before acting.

KYC-category tickets are mirrored into an internal compliance feed on creation, so a data request is visible to the compliance team immediately, not whenever a mailbox gets read.