Privacy Policy

1. Privacy-by-Design

Lumens Money is built privacy-native from the ground up. All messages are end-to-end encrypted using AES-256-GCM via the Web Crypto API — Lumens cannot read your messages. Private keys for your Stellar wallet are generated and stored locally on your device; Lumens never accesses or stores them on our servers.

2. Information We Collect

We collect: (a) Registration data — name, email, phone number, country of residence; (b) KYC verification data — government ID metadata, selfie biometric (processed by Smile Identity / Ghana NIA, raw biometric data is not stored by Lumens); (c) Transaction metadata — amounts, timestamps, counterparty wallet addresses (never message content); (d) Device and usage data — app version, session data, crash diagnostics; (e) Chat metadata — message delivery status and timestamps (never message content, which remains E2EE).

3. How We Use Your Information

• To provide, maintain, and improve our services
• To process transactions and manage wallets
• To verify identity under FICA (SA), BoG AML directives (Ghana), and BNR requirements (Rwanda)
• To detect and prevent fraud and AML/CFT violations
• To communicate about your account, service updates, and regulatory changes
• To generate anonymized, aggregated product analytics

4. Data Residency

South Africa: All SA user data is stored on self-hosted Supabase infrastructure in Johannesburg, complying with POPIA 2013 and SARB requirements. Ghana: Ghana user data stored in Accra / AWS af-west-1 (planned), complying with Data Protection Act 843. Rwanda: Data processed under BoG–BNR passport agreement and BNR data localisation rules.

5. Data Sharing

We share data only with: (a) KYC providers — Smile Identity (SA), Ghana NIA (GH), NIDA (RW) — only as required for identity verification; (b) Payment processors — Paystack, VALR B2B, Zeepay — only transaction data required for settlement; (c) Regulators — FIC (SA), FIC Ghana, BoG, BNR, SARB — only when required by law and only the minimum required. We never sell personal data to third parties or use it for advertising.

6. Blockchain Transparency

Stellar blockchain transactions are public by design. Your wallet address and transaction amounts are visible on the public Stellar ledger (e.g. Stellar Expert). Lumens cannot make blockchain transactions private. We do not link your legal identity to your wallet address in any public disclosure or third-party data sale.

7. Your Rights (POPIA / Act 843 / BNR)

• Right to access your personal data held by Lumens
• Right to correct inaccurate or outdated data
• Right to deletion — subject to 5-year regulatory retention requirements under FICA and AML laws
• Right to data portability — request a machine-readable export
• Right to object to processing for direct marketing
• Right to lodge a complaint with the SA Information Regulator or Data Protection Commission Ghana

8. Retention Periods

Transaction records: 5 years as required by FICA (SA) and BoG AML regulations. KYC documents: 5 years post account closure. Chat metadata (delivery/timestamps): 12 months, then deleted. Message content: Never stored (E2EE — device-only). You may request deletion of non-regulatory data at any time via the app or at privacy@lumens.money.

9. Security

We use AES-256-GCM message encryption, PBKDF2 PIN-based key derivation, TLS 1.3 in transit, row-level security (RLS) on all database tables, and regularly commission third-party security audits. We follow responsible disclosure for vulnerability reports at security@lumens.money.

10. Contact

Privacy inquiries: privacy@lumens.money. SA Information Officer (POPIA): popia@lumens.money. Ghana Data Protection contact: dpo.gh@lumens.money