1. Data controller

• Vira app ("Vira", "we", "our") is the controller of the personal data you entrust to us when you use our services, our mobile app or our website.
• Vira is incorporated in Canada and registered with the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) as a money services business. Premium and multi-jurisdiction activities may be operated through our affiliate licensed at the Qatar Financial Centre.

2. Personal data we collect

• We strictly limit collection to what is necessary to provide our services, comply with the law and prevent fraud. We collect notably:
• • Identity data: first and last name, date of birth, nationality, photograph, official ID document (passport, driver's license, national ID card), residential address.
• • Contact data: phone number, email.
• • Financial data: IBAN, partial bank account number, transaction history, currencies held, beneficiaries.
• • Technical data: IP address, device type and version, advertising identifiers, connection logs, device fingerprint, session tokens.
• • Compliance data: AML/CFT risk score, sanctions screening result, source of funds, occupation, reason for transfer.
• • Biometric data (optional): fingerprint or Face ID used locally on your device via Passkey - never transmitted to our servers.

3. Purposes of processing

• Your data is processed to:
• • Create and manage your account, verify your identity (KYC) and comply with our regulatory obligations.
• • Execute transfer orders, currency conversions and virtual card payments.
• • Prevent and detect fraud, money laundering and terrorism financing.
• • Provide you with efficient and personalized customer service.
• • Improve our products, compile aggregated and anonymized statistics, and test our features.
• • Send you marketing communications with your consent - you can unsubscribe at any time.

4. Legal bases

• We only process your data when we have a valid legal basis, notably:
• • Performance of a contract to which you are a party (the Vira service agreement).
• • Compliance with a legal obligation (AML, taxation, responses to regulators).
• • Your explicit consent (marketing, non-essential cookies, biometric features).
• • Our legitimate interest in securing our platform and preventing fraud, balanced against your rights.

5. Recipients and partners

• Your data may be shared, only to the extent strictly necessary, with:
• • Our technical providers: cloud infrastructure, storage, authentication, identity verification, anti-fraud scoring.
• • Our payment partners and authorized cash-out agents in Algeria (the Vira Business agent network).
• • Competent regulatory authorities: FINTRAC (Canada), ANPDP (Algeria), QFC competent authority (Qatar) and any judicial authority in response to a lawful request.
• • Our legal advisors, accountants and auditors, bound by professional secrecy.
• We never sell your personal data. We do not share it for advertising purposes with third parties.

6. International data transfers

• Vira operates across several jurisdictions: your data may be transferred and processed in Canada, Algeria, Qatar and in other countries where our trusted providers are located.
• When a transfer occurs to a jurisdiction that does not provide an equivalent level of protection, we put in place appropriate safeguards: standard contractual clauses, reinforced contractual obligations and, where required by Quebec's Law 25, a privacy impact assessment prior to any transfer outside Quebec.

7. Data retention

• We retain your data for as long as necessary for the purposes for which it was collected, and for a minimum of:
• • 5 years after the closing of your account for transaction and identification data, in accordance with Canadian AML obligations.
• • 10 years for accounting and tax data.
• • Until withdrawal of your consent for marketing data.
• After these periods, your data is deleted or irreversibly anonymized.

8. Security

• We apply bank-grade technical and organizational security measures:
• • AES-256 encryption at rest and TLS 1.3 in transit.
• • Strong authentication through biometric Passkey, stored only on your device.
• • Segregated production environments, immutable audit logs, annual security reviews.
• • Incident response plan and notification procedure to authorities and data subjects in case of breach, in line with each jurisdiction's applicable deadlines (72 hours under Quebec's Law 25, without undue delay under Algeria's Law 18-07 and Qatar's PDPPL).

9. Cookies and trackers

• Our website and app use a limited number of cookies and similar technologies:
• • Strictly necessary cookies (session, security, language preference) - do not require consent.
• • Anonymized audience measurement cookies - only used after your explicit consent.
• We do not use third-party advertising cookies. You can change your preferences at any time through your browser or app settings.

10. Minors

• Vira is a money transfer service reserved for adults (18+). We do not knowingly collect data from minors. If you believe that a minor has provided us with their data, please contact us immediately and we will delete it.

11. Changes to this policy

• We may update this policy to reflect legal or functional changes to our services. Any material change will be notified by email and/or through the app, with reasonable notice before taking effect. The last update date appears at the top of this page.