Privacy Policy

Known Distance is the data controller for Pzylo. References to “we”, “us”, or “Pzylo” mean Known Distance. If you use Pzylo through a business that integrates our technology (a “BaaS” integrator), that business is a separate controller for the data it collects from you, and its own privacy policy also applies.

In plain terms:

• Using the wallet does not require identity documents. Adding money with a card or bank does: our payment partners must know who is paying. That check is done by Sumsub, which keeps your ID photo and selfie; we keep only whether you were verified.
• When you add money through Transak, Sumsub can pass your verification result to Transak so you don't have to confirm who you are twice. The screen tells you before you continue.
• We never store your private keys. Your wallet is non-custodial — only your device can authorize transactions.
• Your fingerprint or face never reaches us. Biometrics stay in your device's secure hardware; we only receive a public cryptographic key.
• Wallet addresses and on-chain activity are public by nature of the blockchain and are pseudonymous — not tied to your identity unless you reveal it.
• We use Firebase for sign-in and notifications, and we keep limited security logs.

Account & identity. When you create an account we process the information from your chosen sign-in method (email and password, or Google sign-in via Firebase Authentication): your email address, and, where available, your name and profile photo. You may set a preferred display currency and interface language.

Wallet & blockchain data. For each smart wallet we store its public on-chain address, an optional label you choose, cached balances, the tokens and NFTs held, and a record of your transactions (hashes, status, type, and the recipient/amount that are, in any case, public on the blockchain). This data is pseudonymous: an address is not, by itself, your identity.

Passkeys (security keys). To secure your wallet we use passkeys (WebAuthn / P-256). We store the passkey's public key, its credential identifier, a signature counter, the transport types, and the domain it was registered for. We do not store, and never receive, your private key or your biometric data.

Identity verification (only to add money). If you add money with a card or bank, you are asked to confirm who you are with Sumsub, our verification partner. In Sumsub's screens you provide a photo of an identity document, a selfie with a liveness check, and details such as your name, date of birth, nationality, address and phone number. Sumsub holds these on our behalf. We store only the outcome: whether you are verified, pending or not approved, the date of the review, and the reason codes Sumsub gives when a review is not approved. We also give Sumsub your email and an internal identifier, so your verification can be matched to your account.

Buying crypto. When you add money we store a record of each purchase: the amount and currency, the crypto and network, the wallet it goes to, its status and the transaction hash. Your card or bank details are entered directly with the payment partner and never reach us.

Notifications. If you enable push notifications, we store the push token issued by Firebase Cloud Messaging for your device, so we can notify you about your transactions and approvals.

Contacts (your address book). If you add contacts, we store the alias, address, and network you enter. This is your personal address book — we do not build a directory of users, and we do not let you search for other people's accounts.

Business accounts (BaaS). If you create or join an organization, we store the organization name and description, members and their roles, and API keys (we store only a hash of each key — the key itself is shown once and never stored). Organizations may configure a webhook URL to receive event notifications.

Technical & security logs. Our servers keep audit logs of requests for security and troubleshooting, which include your IP address, browser/user-agent, the endpoint accessed, and timing. We use a lightweight session cookie (a simple flag) to keep you signed in, and store your profile and language preference in your browser's local storage.

By design, Pzylo does not collect or store:

• Copies of your identity documents or your verification selfie: these stay with Sumsub.
• Your card or bank details: these are entered with the payment partner.
• Private keys, seed phrases, or recovery secrets that could move your funds.
• Biometric data for signing in or approving transactions — your fingerprint or face never leaves your device's secure enclave.
• A searchable directory of users — there is no way to look up other people by email.

We process the data above to:

• Create and operate your wallet, and prepare and submit the transactions you authorize.
• Authenticate you and register/verify your passkeys.
• Show balances, tokens, NFTs, and history, and display values in your preferred currency.
• Send you notifications about transactions and approvals (if enabled).
• Confirm who you are before you add money, as our payment partners and anti-money-laundering rules require, and show you where each purchase is.
• Keep the service secure, prevent abuse, and meet legal obligations.
• Provide and bill the Banking-as-a-Service features to organizations that integrate Pzylo.

Where the GDPR applies, we rely on: performance of our contract with you (to provide the wallet, execute your instructions and process the purchases you ask for, including passing your verification result to the payment partner you chose); our legitimate interests (to keep the service secure and prevent fraud); compliance with legal obligations (including anti-money-laundering checks before adding money); and your consent (for push notifications and for the selfie check, which you can withdraw at any time, although we then cannot let you add money).

We share data only with providers that help us run Pzylo, and only as needed:

• Google Firebase — authentication (sign-in) and push notifications (Cloud Messaging).
• Sumsub — identity verification. It receives what you provide in its screens (ID photo, selfie, personal details) and your email, and processes it on our behalf.
• Payment partners for adding money — Transak, and Onramper together with the provider it connects you to. They receive your wallet address, the amount and currency, your email and your IP address, and collect your card or bank details themselves. With Transak, Sumsub can also pass your verification result. They act under their own privacy policies.
• Our blockchain infrastructure — a Web3 API and RPC node provider that broadcast your signed transactions and read on-chain state. These receive wallet addresses, passkey public keys, and transaction parameters.
• A message broker and price service used internally to process on-chain events and display fiat values.
• A secrets manager used to protect our own credentials.
• For business integrations, transaction events are delivered to the webhook URL the organization configures, signed with a shared secret.
• The public blockchain — transactions you authorize are, by nature, recorded publicly and permanently on-chain, outside our control.

Some of our providers (such as Google, Sumsub and our payment partners) process data outside your country, including in the United States and the United Kingdom. Where required, such transfers are covered by appropriate safeguards such as the European Commission's Standard Contractual Clauses.

We keep account and wallet data for as long as your account is active. When you delete your account we mark it deleted and stop using it for the service; we may retain limited records where necessary for security, dispute resolution, or legal compliance. Security logs are kept for a limited period. Identity verification records and purchase records may have to be kept for the period anti-money-laundering law requires, which can be several years after you stop using the service. Note that data already written to the public blockchain cannot be deleted by us or by anyone.

Depending on where you live (for example under the GDPR or the CCPA), you may have the right to access, correct, delete, or export your personal data, to object to or restrict certain processing, and to withdraw consent. You can manage your passkeys, contacts, and notifications in the app, and you can request account deletion. To exercise any right, contact us at the address below. We do not sell your personal data.

Pzylo is not directed to children under 16 (or the age required by your local law), and we do not knowingly collect their data.

Security is the core of the product: your wallet is non-custodial and protected by passkeys bound to your device, so transactions cannot be authorized without you. We use encryption in transit, store only hashes of sensitive secrets such as API keys, and keep audit logs. No system is perfectly secure, but we work to protect your data and keep the threat surface minimal.

We may update this policy from time to time. We will change the “Last updated” date above and, for material changes, provide a more prominent notice.