API Privacy Policy
This policy explains how KemyCard handles personal data in the API partner programme: the data of partners and their team, and the data of the customers and cardholders that partners serve through the API. Each section opens with a plain-language summary.
- Two kinds of data. Data about partners, who use our API, and data about their customers, who receive cards and other products through it.
- We verify cardholders ourselves. Identity document, liveness check and proof of address are collected through our hosted link, for our own legal obligations.
- We do not sell personal data. We share it only with the service providers and banking partners that make the products work, and with authorities when the law requires it.
- Encrypted and restricted. Sensitive data is encrypted at rest, API keys are stored as hashes, and access is limited to authorized staff.
- Kept as the law requires. Identity and transaction records are kept 5 years after the end of the relationship, as required for Money Services Businesses.
- You have rights. Access, correction, deletion, objection and more, depending on where you live. Write to [email protected].
Table of contents
- Who we are and scope
- Our role for each type of data
- Data about partners
- Data about your customers
- Why we use the data and on which legal basis
- Who receives the data
- International transfers
- How we protect the data
- How long we keep the data
- Your rights
- California residents
- Cookies on the API website and dashboard
- Your duties towards your customers
- Children
- Changes to this policy
- Contact
Who we are and scope
Kemite Group, LLC, the company behind KemyCard, is responsible for the data described here. This policy covers the API, the API website and the partner dashboard.
The KemyCard API is provided by Kemite Group, LLC, a limited liability company registered in the State of Delaware, United States (Delaware file number 20250007719), with its principal office at 111b South Governors Ave, STE 23648, Dover, DE 19904, USA ("KemyCard", "we", "us"). In the United States, KemyCard is registered with FinCEN as a Money Services Business.
This API Privacy Policy applies to personal data processed in connection with the KemyCard API, the API website (kemycard.dev and the API pages of kemycard.com), the partner registration and the partner dashboard. It applies to:
- partners: the individuals who apply for or hold an API partner account, and the representatives, directors and beneficial owners of partner companies ("you");
- customers: the end users of our partners, for whom a partner creates a customer record, a card, a wallet or another product through the API, also called cardholders;
- visitors of the API website.
The use of KemyCard's consumer applications is covered by the KemyCard Privacy Policy. The use of the API is also governed by the API Terms of Service.
Our role for each type of data
For partner data, we decide how it is used. For customer data, the partner runs its own product and we run identity verification and the card programme for our own legal obligations: each of us is responsible for its own part.
Partner data
KemyCard is the controller of the personal data of partners and visitors: we decide why and how it is processed.
Customer data
The partner decides to offer our products to its customers, collects their data and submits it to us through the API. The partner is the controller of the data it processes for its own product and its relationship with its customers, under its own privacy notice.
KemyCard verifies the identity of every customer itself, through its hosted verification link, decides whether a verification is approved, and must meet its own anti-money laundering, sanctions, fraud prevention and record-keeping obligations, as well as the requirements of its banking partners and of the card networks. For these purposes, KemyCard processes customer data as an independent controller, under this policy. When KemyCard only carries out a partner's instructions, for example by sending the partner the events of its customers through webhooks, it does so to provide the Services to that partner.
Data about partners
What you give us when you apply, what we collect when we verify you, and what your use of the API and the dashboard generates.
| Category | Examples |
|---|---|
| Application | Account type, name or company name, website, contact email, estimated volume, products of interest and planned integration, entered in the access request form. |
| Identity and contact | First and last name, date of birth, email, phone number, residential address, job title. |
| Identity verification | Identity document, face images and liveness check result, proof of address and the outcome of the verification, including the data read from the documents. |
| Company | Legal and trading name, registration and tax numbers, country and date of incorporation, business address, industry, business documents, support contact details, and the identity of representatives and beneficial owners. |
| Account and security | Login email, password (stored only as a hash), two-factor authentication settings, API key prefixes (keys are stored only as hashes), allowed IP addresses, webhook endpoints, sign-in and security events. |
| Usage | API request logs (date, endpoint, status, duration, mode, IP address, user agent, request identifier, error codes and the content of requests and responses), webhook deliveries. |
| Financial | Plan and billing history, ops balance deposits with their sending address and blockchain transaction, fees, withdrawals. |
| Communications | Support tickets and their attachments, emails and other messages with us. |
| Website | Pages visited, device and browser data, IP address, cookie identifiers, as described in Cookies on the API website and dashboard. |
We collect this data from you, from your use of the Services, from our identity verification providers, and where relevant from public registers, sanctions lists and fraud prevention sources.
Data about your customers
The partner sends us the customer's identity and contact details. The customer then completes our identity verification and proof of address. Card and transaction data is generated when the products are used.
| Category | Examples | Source |
|---|---|---|
| Identity and contact | First and last name, date of birth, email, phone number, full residential address, the partner's reference for the customer. | The partner |
| Identity verification | Government-issued identity document, face images and liveness check result, verified name and date of birth, verification status and reasons for a rejection. | The customer, through our hosted link |
| Proof of address | A document that proves the residential address, issued less than 3 months ago, and the outcome of its review. | The customer or the partner |
| Cards | Card number, expiry date and CVV (stored encrypted), card status, balance, limits, 3-D Secure requests. | Our banking partners |
| Transactions | Card authorizations, settlements, declines, refunds and fees, with the merchant, amount, currency, date and balance; wallet deposits and withdrawals with blockchain addresses; payouts with the beneficiary's name and bank details; virtual account deposits. | Banking partners, blockchains, the partner |
| Compliance | Results of checks against sanctions lists, fraud and risk signals, restrictions. | KemyCard and its providers |
The liveness check compares face images with the photo of the identity document. In some jurisdictions this is biometric data, which is special category data under the GDPR. It is used only to verify identity and prevent fraud.
Why we use the data and on which legal basis
To provide the API and the cards, to meet our legal obligations, to keep the Services secure, and, if you agree, to send you news about the API.
The legal bases below are those of the EU and UK General Data Protection Regulation (GDPR), for people located in the European Economic Area or the United Kingdom.
| Purpose | Legal basis |
|---|---|
| Review applications, open and manage partner accounts, provide the API, the dashboard and support | Performance of a contract, or steps taken at your request before entering into it |
| Create customers, issue and manage cards and other products, process transactions, payouts and fees | Performance of the contract with the partner; for customers, our legitimate interest in providing the products they requested, and the contracts of our banking partners |
| Verify the identity of partners and customers, screen against sanctions lists, monitor transactions, report to authorities, keep records | Legal obligations (anti-money laundering, sanctions, record-keeping); for face images used in the liveness check, explicit consent given in the verification flow or reasons of substantial public interest where the law allows it |
| Prevent fraud, abuse and card testing, secure our systems, keep API and security logs | Legitimate interest in protecting the Services, our partners, customers and banking partners; legal obligations |
| Handle refunds, disputes and complaints, establish and defend legal claims | Legitimate interest; legal obligations |
| Send service messages (security alerts, low balance, plan renewal, changes to the API or to our terms) | Performance of a contract; legitimate interest |
| Send news and offers about the API to partners and applicants | Legitimate interest for existing partners, consent where the law requires it; you can unsubscribe at any time |
| Measure the audience of the API website and our advertising | Consent, given through the cookie banner |
| Improve the Services using aggregated or de-identified statistics | Legitimate interest |
We do not make decisions based solely on automated processing that produce legal effects for you without human review, except where the law allows it; our compliance team reviews the verifications and alerts that require it. If you do not provide the data required for verification, we cannot open an account or issue a card.
International transfers
We are a US company with partners and customers worldwide, so data is processed in several countries. We protect transfers with recognised safeguards.
KemyCard is based in the United States and our partners and customers are located in many countries. Personal data may therefore be processed in the United States, in the European Union and in other countries where we or our service providers and banking partners operate, which may not offer the same level of protection as your country. When we transfer personal data from the European Economic Area, the United Kingdom or Switzerland to a country that is not recognised as adequate, we rely on appropriate safeguards, such as the European Commission's standard contractual clauses, or on another lawful transfer mechanism. You can ask us for information on these safeguards.
How we protect the data
Encryption of sensitive data, hashed keys and passwords, restricted access, two-factor authentication and monitoring.
- Encryption. Sensitive data, such as card details and identity documents, is encrypted at rest with modern algorithms (XSalsa20-Poly1305 and AES-256) and stored in encrypted storage. Data is encrypted in transit with TLS.
- Secrets. API keys and passwords are stored only as hashes; a key is shown to you once, when it is created. The private keys of crypto wallets are encrypted and never returned by the API.
- Access control. API keys only work from the IP addresses the partner declares. The partner dashboard offers two-factor authentication and closes inactive sessions. Internal access is limited to authorized staff who need it.
- Webhooks. Each webhook delivery is signed with HMAC-SHA256, with a secret specific to each endpoint.
- Monitoring. We log and monitor access and security events to detect and respond to incidents.
No system is completely secure. If a personal data breach is likely to put your rights at risk, we will notify you and the competent authorities as required by law. Partners are responsible for the security of their own systems, of their API keys and of the card data they display (see Your duties towards your customers).
How long we keep the data
Verification and transaction records: 5 years after the end of the relationship, as the law requires. Other data: only as long as it is useful, within the limits below.
| Data | Retention |
|---|---|
| Identity verification, proof of address and transaction records of partners and customers | 5 years after the end of the relationship or after the transaction, as required of Money Services Businesses by the US Bank Secrecy Act (31 CFR 1010.430), or longer if another law, an investigation or a legal claim requires it |
| Partner account, contract, billing and ops balance records | For the life of the account, then 5 years after its closure |
| Access requests that did not lead to an account | 2 years after the last contact |
| API request logs and webhook deliveries | Up to 24 months, unless needed longer for an investigation or a legal claim |
| Support tickets and communications | For the life of the account, then 5 years after its closure |
| Marketing preferences | Until you unsubscribe or withdraw your consent; we keep a record of the opt-out |
| Cookies | As stated in the cookie banner; the dashboard session ends when you sign out or after a period of inactivity |
| Test mode data | For the life of the account; it may be deleted at any time |
At the end of these periods, data is deleted or irreversibly de-identified.
Your rights
You can ask to access, correct or delete your data and more. Some data must be kept by law, even if you ask us to delete it.
Depending on where you live, you have the right to:
- access your personal data and obtain a copy;
- correct inaccurate or incomplete data;
- delete your data, unless we must keep it, in particular under the record-keeping obligations described above;
- restrict or object to certain processing, including at any time to direct marketing;
- data portability, for data you gave us under a contract or your consent;
- withdraw your consent at any time, without affecting processing already carried out;
- complain to your data protection authority, in particular in the EU country where you live or work.
To exercise your rights, write to [email protected]. We may ask you to prove your identity. We answer within one month, which may be extended where the law allows it. Customers of a partner can also contact the partner, which will forward the request to us when it concerns data we hold. We will not discriminate against you for exercising your rights.
California residents
Californians have specific rights under the CCPA. We do not sell personal information.
If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA), gives you the right to know which personal information we collect, use and disclose, to access and delete it, to correct it, and to opt out of its sale or sharing for cross-context behavioural advertising, without discrimination.
In the last 12 months, we have collected the categories of personal information described in this policy: identifiers, personal records, commercial and financial information, internet and network activity, geolocation derived from IP addresses, sensitive personal information (government identifiers, account credentials, biometric information used for the liveness check), and professional information. We use them for the purposes described in Why we use the data and on which legal basis and disclose them to the categories of recipients described in Who receives the data. We use sensitive personal information only for the purposes permitted by the CCPA, such as verifying identity, preventing fraud and providing the Services.
We do not sell personal information. Advertising cookies on the API website are used only with your consent; if they amount to "sharing" under the CCPA, you can opt out at any time through the cookie settings. To exercise your rights, write to [email protected]; you may use an authorized agent, and we will verify your request. Some of these rights do not apply to information covered by the Gramm-Leach-Bliley Act or kept to meet legal obligations.
Your duties towards your customers
Partners must tell their customers that their data is shared with KemyCard, submit only accurate data, and protect what goes through their own systems.
As a partner, you must, under the API Terms of Service and the law that applies to you:
- inform your customers, before you submit their data, that it is shared with KemyCard and its service providers to provide the products, verify their identity and meet legal obligations, for example by linking to this policy from your own privacy notice;
- have a valid legal basis to submit their data to us, and submit only accurate data that the API requires;
- keep your API keys secret, restrict your allowed IP addresses to your own servers and verify the signature of webhooks;
- never store or log the card number, expiry date or CVV returned by
GET /cards/{code}/sensitive, and protect them while you display them; - forward to us without delay any request from a customer that concerns the data we hold, and tell us without delay about any security incident affecting customer data.
Children
The API, partner accounts and cards are for adults only.
The Services are not intended for people under 18. Partners and their account holders must be at least 18, and partners must not submit the data of a minor. If we learn that we hold the data of a minor without a legal basis, we will delete it, subject to our legal obligations.
Changes to this policy
We publish every new version here, and tell partners by email or in the dashboard when a change is material.
We may update this policy to reflect changes in the Services or in the law. We publish the new version on this page with a new date and version number. If a change materially affects how we use personal data, we notify partners by email or in the dashboard before it takes effect, and partners must inform their customers where needed.
Contact
For any privacy question or request: [email protected].
111b South Governors Ave, STE 23648, Dover, DE 19904, USA
Delaware file number 20250007719
Email: [email protected]
Please mention "Privacy" in the subject of your message. Partners can also open a ticket from the Support section of the dashboard.