Privacy Policy

CashiPro ("we", "us", "our") operates a peer-to-peer (P2P) cryptocurrency exchange platform, together with related direct-exchange, wallet, merchant, referral, and support features (collectively, the "Platform"). This Privacy Policy explains what information we collect, why we collect it, who we share it with, how long we keep it, and the choices and rights you have.

By creating an account or otherwise using the Platform, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with it, please do not use the Platform.

1. Information We Collect

Account information: full name, email address, phone number, country, password (stored as a one-way hash, never in plain text).
Identity verification (KYC): government ID documents (CNIC, passport, or national ID), a selfie photo, a short liveness video, and — for merchant accounts — a bank statement, as required by our identity-verification obligations. See Section 2 for how these documents are specifically protected.
Financial information: bank account or mobile wallet (JazzCash, Easypaisa, NayaPay, SadaPay) details you add for P2P settlement, and cryptocurrency deposit/withdrawal addresses and transaction history.
Wallet & transaction data: your available and locked USDT balances, escrow activity, deposit/withdrawal network and transaction hashes, P2P order history, direct-exchange trade history, and internal transfers.
Communications: live chat messages and attachments, support ticket messages and attachments, dispute evidence you submit, and any correspondence with our support team.
Usage information: device type, browser, IP address, approximate location derived from IP, login timestamps, and activity logs, collected for security and fraud prevention.
Notification data: if you use our mobile apps, a device push-notification token so we can deliver account alerts.

2. Identity Verification (KYC)

Know Your Customer ("KYC") verification is mandatory before you can trade, deposit, or withdraw on CashiPro. This is a legal requirement for virtual asset service providers, not an optional feature.

Documents are uploaded directly to CashiPro's secure servers and stored under an access-controlled, non-guessable file path — they are never made publicly browsable.
Only you, and administrators specifically authorized to review verifications, can access your KYC documents. Administrator access to KYC data is itself permission-gated and logged.
If your verification is rejected, previously submitted documents are cleared from the record once a decision is made, and you are asked to resubmit fresh documents — old rejected files are not silently retained alongside new ones.
KYC data may be shared with regulators or reported through lawful channels (for example Pakistan's Financial Monitoring Unit) where required by applicable Anti-Money-Laundering / Counter-Financing-of-Terrorism (AML/CFT) law.

3. How We Use Your Information

To create and manage your account and process P2P trades, direct-exchange trades, deposits, withdrawals, and internal transfers.
To verify your identity and comply with anti-fraud, sanctions-screening, and anti-money-laundering obligations.
To operate escrow, releasing or refunding locked USDT according to the outcome of a trade or dispute.
To communicate with you about your account, transactions, security alerts, and support requests — including by email and, where enabled, push notification.
To detect, investigate, and prevent fraud, disputes, chargebacks, and abuse of the Platform.
To calculate and pay referral rewards where you participate in our referral program.
To improve the Platform's reliability, security, and usability.

4. Legal Basis for Processing

We process your information on the following bases:

Basis	Examples
Performance of a contract	Operating your account, executing trades, escrow, withdrawals.
Legal obligation	KYC/AML verification, sanctions screening, regulatory reporting, recordkeeping.
Legitimate interest	Fraud prevention, platform security, service improvement.
Consent	Optional marketing communications and push notifications, where applicable.

5. Who We Share Information With

We do not sell your personal information. We share information only where necessary to operate the Platform or comply with the law:

Regulators & law enforcement: where required by applicable law, court order, or a lawful request, including AML/CFT reporting obligations.
Banking & payment partners: to the extent needed to confirm or investigate a fiat settlement you initiated as part of a trade.
Service providers: email delivery, SMS/OTP delivery, cloud hosting, and blockchain-analytics or sanctions-screening providers who act only on our instructions and under confidentiality obligations.
Other trade party: during a P2P trade, your merchant name/rating and the payment details relevant to that specific trade are visible to the counterparty — this is inherent to how P2P settlement works.
Successors: in the event of a merger, acquisition, or asset sale, subject to the same privacy commitments described here.

6. Live Chat, Support Tickets & Disputes

Messages you send through Live Chat or a Support Ticket, and any files or images you attach, are stored so our support and compliance teams can assist you and so a record exists if the matter needs to be revisited. When a P2P order is disputed, both the buyer and seller may be asked to submit evidence (screenshots, payment references, bank statements); this evidence is visible to the administrator reviewing the dispute and is retained as part of the dispute record, as described in Section 9.

7. Referral Program Data

If you refer other users, we record the referral relationship (referrer and referred account) and the reward amounts paid, so that referral rewards can be calculated and audited correctly. We do not share your referral earnings history with anyone other than you and authorized administrators.

8. How We Protect Your Information

Passwords are never stored in plain text — only a one-way cryptographic hash is kept.
All connections to the Platform are encrypted in transit (HTTPS/TLS).
Identity documents are stored with restricted, permission-gated access, as described in Section 2.
Sensitive actions (large withdrawals, escrow release) are protected by additional verification steps such as one-time codes.
Administrator access to sensitive sections of the Platform (KYC, disputes, wallets, withdrawals) is itself access-controlled through a role-based permission system, so that only authorized staff can view a given category of data.

No system can be guaranteed 100% secure, but we continuously work to protect your information using industry-standard practices.

9. Data Retention

Data	Retention
Account & profile information	For as long as your account is active, plus a reasonable period afterward.
KYC documents	For as long as required by applicable AML/CFT recordkeeping law, and cleared upon a rejection decision as described in Section 2.
Transaction & trade records, ledger entries	Retained long-term for audit, dispute, and regulatory purposes, consistent with recordkeeping obligations for virtual asset service providers.
Chat messages & dispute evidence	Retained for as long as needed to resolve the matter and for a reasonable period afterward for audit purposes.
Security & access logs	Retained for a limited period sufficient for fraud investigation and security monitoring.

Where you close your account, we retain the minimum information legally required (primarily transaction and verification records) and delete or anonymize the rest within a reasonable period.

10. Your Rights

Subject to applicable law, you may:

Request a copy of the personal information we hold about you.
Ask us to correct inaccurate or outdated information (for example through the Name Change or Contact Change request flows in your account).
Request account closure, subject to any legal record-retention obligations described in Section 9.
Withdraw consent for optional communications (for example marketing emails or push notifications) at any time, without affecting service-related communications we are required to send you.
Object to or ask us to restrict certain processing, where applicable law allows.

To exercise any of these rights, contact us using the details in Section 18.

11. Cookies & Similar Technologies

We use strictly necessary session cookies to keep you securely logged in and to protect your account against cross-site request forgery. We do not use third-party advertising or cross-site tracking cookies. Disabling cookies in your browser will prevent you from logging in, since sessions depend on them.

12. Automated Screening & Monitoring

To meet our AML/CFT obligations, deposits, withdrawals, and trades may be subject to automated transaction monitoring and sanctions/watchlist screening. A flagged transaction may be held pending manual review by our compliance team. This is a standard, legally required control for virtual asset platforms and is not intended as, and does not by itself constitute, an accusation of wrongdoing.

13. Children's Privacy

CashiPro is not directed at, and may not be used by, anyone under 18 years of age. We do not knowingly collect personal information from minors. If we become aware that a minor has created an account, we will close it and delete the associated personal information, subject to any legal retention requirement.

14. International Data Transfers

Some of our service providers (for example cloud hosting or email delivery) may process data outside Pakistan. Where this occurs, we require providers to protect your information to a standard consistent with this Privacy Policy.

15. Data Breach Notification

If a security incident occurs that is reasonably likely to result in a risk to your rights and information, we will notify affected users and, where legally required, the relevant regulator, without undue delay, along with guidance on steps you can take to protect yourself.

16. Third-Party Links

The Platform may link to third-party websites or services (for example a blockchain explorer to view a transaction). We are not responsible for the privacy practices of those third parties; please review their own privacy policies.

17. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal reasons. Material changes will be highlighted on the Platform. Continued use of CashiPro after changes are posted constitutes acceptance of the updated policy.