1. Who we are and what this policy covers
This policy explains how Baz collects, uses, shares and protects your personal information when you use the Baz mobile wallet app, its website and its customer support (together, "Baz").
"Baz", "we", "us" and "our" mean Bazik.io LLC, 2125 Biscayne Blvd, Ste 204 #26341, Miami, FL 33137, United States, which controls your personal information. "You" means anyone who downloads, signs up for or uses Baz, including people who receive money through Baz without an account.
By using Baz you agree to the practices in this policy. If you do not agree, please do not use the app.
2. Information we collect
We collect only what we need to run a safe, regulated wallet.
| Category | Examples |
|---|---|
| Identity | Full name, date of birth, nationality, photo, selfie, ID document (CIN/NIF, passport, driver's licence) |
| Contact | Phone number, email, postal address |
| Account and login | PIN or password (stored hashed), device binding, security settings |
| Financial | Wallet balance, transaction history, linked bank accounts, cards or mobile-money accounts, amounts, sender and recipient details |
| Device and technical | Device model, OS, app version, IP address, device identifiers, crash logs |
| Location | Approximate location from IP; precise GPS location only with your permission |
| Contacts (optional) | Phone contacts you choose to share so you can send money to them |
| Usage | Screens viewed, features used, session times |
| Communications | Support chats, calls, emails, WhatsApp or SMS messages with us |
Where it comes from: directly from you; automatically from your device; from people who send you money or receive money from you; from banks, mobile-money operators and merchants that complete your transactions; and from identity-verification, fraud-prevention and sanctions-screening providers.
Your selfie and face match are used only to verify your identity and prevent fraud.
3. How we use your information
We use your information to run your wallet, keep it secure and meet our legal duties. We never sell your personal information.
| Purpose | What it means | Legal basis |
|---|---|---|
| Run your wallet | Open your account, hold your balance, send, receive, pay and top up | Contract with you |
| Verify your identity (KYC) | Check your ID and selfie before you can transact, and set your limits | Legal obligation |
| Prevent fraud and financial crime | Monitor transactions, screen against sanctions lists, report suspicious activity when required | Legal obligation; legitimate interest |
| Security | Protect your account, detect unauthorised logins, bind your device | Contract; legitimate interest |
| Support | Answer questions and resolve disputes | Contract |
| Improve Baz | Analyse usage, fix bugs, build new features | Legitimate interest |
| Messages to you | Receipts, security alerts and service notices (always); offers and news (only if you opt in) | Contract; consent |
| Legal and regulatory | Keep records and answer lawful requests from the Banque de la République d'Haïti (BRH), UCREF, courts or other authorities | Legal obligation |
Automated decisions. We use automated checks to approve sign-ups, set limits and flag fraud. If one blocks your account or a transaction, you can ask a person to review it.
4. How we share your information
We share your information only when needed to run Baz, protect users or follow the law.
People you transact with — the person or merchant you pay or receive from sees what they need, such as your name, phone number and the amount.
Financial partners — banks, mobile-money operators, card networks and cash-in/cash-out agents that move your funds.
Service providers — cloud hosting and database, identity verification, SMS, WhatsApp and email delivery, analytics, support and security tools. They may use your data only to serve us.
Authorities — regulators (such as the BRH), financial-intelligence units (such as UCREF), tax authorities, courts and police, when the law requires it.
Business transfers — a buyer or successor if our business is merged or sold, under this same policy.
With your consent — anyone else you ask us to share with.
We do not sell or rent your personal information, and we do not share it with advertisers.
5. Retention, security and international transfers
Retention. We keep your information while your account is open, then only as long as the law or a legitimate need requires.
| Data | How long we keep it |
|---|---|
| Identity (KYC) and transaction records | At least 5 years after the account closes or the transaction date, or longer if anti-money-laundering law requires |
| Account and contact data | While the account is open, plus 5 years |
| Support communications | 3 years after the case closes |
| Device, usage and log data | Up to 24 months |
| Marketing preferences | Until you withdraw consent |
When data is no longer needed, we delete or anonymise it.
Security. We use encryption in transit (TLS) and at rest, hashed PINs and passwords, strict database access controls, multi-factor authentication for staff, audit logging and regular security testing. No system is perfectly secure: keep your PIN private and tell us at once if you think your account is compromised.
International transfers. Bazik.io LLC is based in the United States, and our servers and some providers are outside Haiti, for example in the United States or the European Union. When we transfer data abroad, we use contracts and safeguards that keep it protected to the standard in this policy.
6. Your rights and choices
Contact us (section 10) to make any of these requests. We answer within 30 days and may first verify your identity.
Access — get a copy of the information we hold about you.
Correction — fix wrong or incomplete details; most can be changed in the app.
Deletion — ask us to delete your data; records we must keep by law (section 5) stay until that period ends.
Objection and restriction — object to or limit processing based on our legitimate interests.
Portability — download your transaction history as CSV or PDF.
Withdraw consent — turn off marketing, location or contacts access at any time.
Human review — ask a person to review an automated decision that affects you.
Complain — contact us first; you may also contact the relevant authority.
7. App permissions
Baz asks for device permissions only when a feature needs them. You can turn each one off in your phone settings.
| Permission | Why Baz asks | If you say no |
|---|---|---|
| Camera | Scan your ID, take a selfie, scan QR codes to pay | You cannot verify your identity or pay by QR |
| Contacts | Pick a contact to send money to | Type the phone number instead |
| Location | Find nearby agents and merchants; fraud checks | Search manually; some limits may apply |
| Notifications | Payment receipts and security alerts | You will not get instant alerts |
| Biometrics (Face ID / fingerprint) | Unlock the app; your phone keeps the biometric, Baz never receives it | Use your PIN |
8. Children
Baz is for people aged 18 and over. We do not knowingly open accounts for minors. If we learn a minor has an account, we close it and delete data we are not required to keep.
9. Changes to this policy
We may update this policy as Baz or the law changes. We will post the new version with its effective date and notify you in the app before material changes take effect.
10. Contact us
Email: privacy@bazik.io
Phone / WhatsApp: +509 3292 2626
Address: Bazik.io LLC, 2125 Biscayne Blvd, Ste 204 #26341, Miami, FL 33137, United States
Data protection contact: Zeblinx, HQ
This policy is available in English, French and Haitian Creole. If versions differ, the French version prevails.