Privacy Policy

This Privacy Policy explains how Cryptomo ("Cryptomo", "we", "us") collects, uses, discloses and protects personal information. We comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). It applies to merchants and their team members, people who pay through our checkout pages ("Payers"), and visitors to https://cryptomo.net.

1. Personal information we collect

Merchants and team members

• Account details: name, email address, password (stored only as a secure hash), language, phone or messaging contact if you give it to us, and two-factor authentication settings.
• Business details: business name, website, country, ABN or company number, address, and store settings.
• Identity verification (KYC) information: full name, date of birth, residential address, identity documents and the results of verification checks, information about directors and beneficial owners, and, where needed, information about the source of funds. Identity documents can contain sensitive details (such as a photo); we collect them only because the law requires it or with your consent.
• Payment and payout information: invoices, balances, withdrawal addresses and transaction hashes.
• Security and usage information: IP address, browser and device information, sign-in history and actions taken in the dashboard (our audit log).
• Messages you send us through support tickets, email, the contact form, the chat assistant, WhatsApp or Telegram.

Payers

• Invoice details the merchant gives us, such as an order number, description, amount and, sometimes, your email address.
• Information from your payment: the coin and network you chose, the sending wallet address, the transaction hash and the amount. This information is also public on the blockchain.
• Your IP address, browser language and the time you used the checkout page, used for security, fraud prevention and to show the page in your language.

Visitors: pages visited, referral links used and the information described in our Cookie Policy, and any message you send us.

We do not collect card or bank account details. You can browse our website without telling us who you are, but we cannot open an account, process payments or answer a complaint anonymously.

2. How we collect it

Mostly directly from you. We also collect information from merchants about their customers, automatically when you use our website and service, from public blockchains, from identity-verification and fraud-prevention services, and from public registers such as the ABN Lookup and ASIC registers.

3. Why we use it

• To provide the service: create and secure accounts, show checkout pages, detect and match payments, credit balances, process withdrawals and send receipts and notifications.
• To meet our legal obligations, including identifying and verifying customers, monitoring transactions and reporting to AUSTRAC under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), screening against sanctions lists, keeping records, and meeting tax obligations.
• To prevent, detect and investigate fraud, scams, security incidents and misuse of the service.
• To answer questions, provide support and handle complaints.
• To improve and fix the service, using mostly aggregated or de-identified information.
• To send service messages you cannot opt out of (for example security alerts and changes to these policies) and, with your consent, news about Cryptomo. Every marketing email has an unsubscribe link, as required by the Spam Act 2003 (Cth).

4. Who we share it with

• The merchant you pay: if you are a Payer, the merchant sees your invoice and payment details.
• Service providers who help us run Cryptomo: website hosting and backups, email delivery, blockchain data providers (they receive wallet addresses and transaction hashes so we can detect payments), exchange-rate providers, identity-verification providers, and messaging services if you contact us through WhatsApp or Telegram. They may only use the information to provide their service to us.
• Regulators, law enforcement and courts, such as AUSTRAC, the Australian Taxation Office and the police, where the law requires or allows it.
• Professional advisers (lawyers, accountants, auditors) and, if our business is sold or restructured, a buyer who agrees to protect the information.

We do not sell personal information.

5. Information sent outside Australia

Some of our service providers store or process information outside Australia, including in the United States, Singapore and countries of the European Union. We take reasonable steps to make sure they protect it in line with the APPs.

6. Blockchain information is public

Wallet addresses, amounts and transaction hashes are recorded permanently on public blockchains by the networks themselves. We cannot change or delete information on a blockchain.

7. How we protect it

We use encrypted connections (HTTPS), encryption of stored secrets, hashed passwords, two-factor authentication, access controls, audit logs and regular backups. Only people who need the information for their work can see it. If a data breach is likely to cause serious harm, we will notify affected people and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme.

8. How long we keep it

We keep identity-verification and transaction records for at least 7 years after our relationship with a customer ends, because the AML/CTF Act requires it. Chat conversations are deleted after 30 days. Other information is kept only as long as we need it for the purposes above or as required by law, and then deleted or de-identified.

9. Automated decisions

We use automated checks to protect the service, for example rate limits, fraud and risk rules, and checks that an amount or network matches an invoice. These checks can automatically hold a payment for review, delay a withdrawal or ask for more verification. A person reviews the case before we close an account or refuse to release funds. You can ask us how a decision about you was made.

10. Access and correction

You can ask for access to the personal information we hold about you and ask us to correct it. Most account details can be updated in your dashboard. For anything else, email mail@cryptomo.net. We will respond within 30 days and will not charge you for making a request. In limited cases the law allows or requires us to refuse (for example where giving access would reveal that we made a report to AUSTRAC); if so, we will tell you why where we can.

11. Complaints

If you think we have mishandled your personal information, contact our privacy officer at mail@cryptomo.net. We will acknowledge your complaint and respond within 30 days. If you are not satisfied, you can complain to the OAIC: www.oaic.gov.au, phone 1300 363 992.

12. Children

Cryptomo is not intended for people under 18 and we do not knowingly open accounts for them.

13. Changes to this policy

We may update this policy. The date at the top shows when it last changed, and we will tell merchants about important changes by email or in the dashboard.

14. Contact

Privacy officer, Cryptomo. Email: mail@cryptomo.net.