Privacy Policy

1. Information we collect

• Account — name, email, phone number, address, state and country, date of birth. From you; or Google, Facebook or Apple if you sign in with them.
• Identity verification — whether you passed verification, the name and date of birth on your ID, the ID's expiry date and the verification date. From Stripe, Inc. (Stripe Identity), our verification provider.
• Biometric data — a scan of your face geometry, created when Stripe compares your selfie with your ID. urCircl does not receive it — Stripe processes it for us (see our Biometric Data Policy).
• Agreement information — agreement terms (amounts, dates, payment method and handles you enter, item descriptions and values), signatures, photos you attach, messages, payment and return records, disputes. From you and the other parties.
• Track Record and vouches — counts of agreements by status; vouches from counterparties; social links you add. Calculated by urCircl from agreement records; and from other users.
• Contacts (if you allow) — phone numbers of contacts you choose, converted to a coded form to check which are already on urCircl. From your device.
• Device and usage — device type, operating system, app version, push token, IP address, crash and performance data, in-app activity. From your device.
• Subscription — your plan and purchase status (never your card details). From Google Play and RevenueCat.
• Support and waitlist — messages to us, waitlist email, referral information. From you.

We do not collect bank account numbers, card numbers, or logins for payment apps.

2. How we use it

To provide urCircl (create, sign, store and export agreements; show records to the parties); to verify identity and prevent fraud, abuse and sanctions violations; to calculate and show Track Records as described in our Terms; to send account, security and agreement messages and, with consent, texts and marketing email; to process subscriptions; to secure, debug and improve urCircl; and to comply with law and protect rights.

3. Who receives it

• The other parties to your agreements see the agreement, your name, verification status and the records for that agreement. Your Track Record is visible only to people you are in an agreement or invitation with, and only if you allow it.
• Service providers that process data for us under contract: Supabase (hosting, database, authentication); Stripe (identity verification); Twilio (text messages and one-time codes); Resend (email); Expo and Google Firebase Cloud Messaging (push notifications); RevenueCat and Google Play (subscriptions); Netlify (website hosting); Zoho (support email). The app uses no advertising or analytics SDKs.
• Legal and safety — when required by law, subpoena or court order; to respond to sanctions-screening matches; to protect users or the public from fraud or harm.
• Business transfers — to a successor in a merger, acquisition or asset sale, subject to this policy.

We do not sell personal information, and we do not share it for cross-context behavioral (targeted) advertising. We never share Track Records with credit bureaus, employers, landlords, insurers or data brokers.

4. How long we keep it

• Account — while your account is open; deleted within 30 days after you delete it.
• Signed agreements, their audit trail and payment records — 7 years after the agreement closes, even if you delete your account, because the other party relies on them.
• Verification result — while your account is open, then 7 years if it is part of a signed agreement.
• Biometric data (at Stripe) — kept no longer than one year, or until you revoke consent. ID images and other non-biometric verification data (at Stripe) — up to 3 years, and redacted within days when you delete your account or verification.
• Coded contact numbers — not kept after the check runs.
• Logs and IP addresses — 12 months, unless part of an agreement's audit trail.
• Support messages — 3 years. Subscription records — 7 years. Marketing and waitlist — until you unsubscribe, or 2 years of inactivity.

5. Sensitive information

We treat government-ID information, biometric data and financial information about your agreements as sensitive. We process it only to provide urCircl, verify identity, prevent fraud and meet legal obligations, and only with your consent where the law requires it.

6. Security

We encrypt data in transit and at rest, limit staff access, require multi-factor authentication for administrative systems, and maintain a written information security program. No system is perfectly secure; if a breach affects you we will notify you as the law requires.

7. Your choices and rights

Wherever you live in the U.S., you can ask us to: access or get a copy of your personal information; correct it; delete it (subject to the agreement-record exception in Section 4); and withdraw consent for optional processing such as texts or contact matching. You can dispute Track Record items in the app. Send requests in the app (Settings → Privacy) or to privacy@urcircl.com. We will verify your identity, respond within 45 days, and tell you how to appeal if we decline. An authorized agent may make a request with your signed permission. We will not discriminate against you for exercising these rights. Residents of states with privacy laws (including California, Colorado, Connecticut, Virginia and others) have these rights under those laws, as applicable.

8. Do Not Track and cookies

The app does not use advertising cookies or cross-app tracking. Our websites use only cookies needed to run them. Because we do not track you across other sites, we do not change our practices in response to browser Do Not Track signals; we honor Global Privacy Control signals as an opt-out of any sale or sharing.

9. Children

urCircl is not for anyone under 18. If we learn an account belongs to someone under 18, we delete it.

10. Users outside the United States

urCircl is operated from the United States and stores and processes all data there. In the United States, agreements are offered as legally binding; in the other countries where urCircl is available they are offered in "record only" mode (see our Terms). Wherever you use urCircl, your information is transferred to and processed in the U.S. by us and the service providers in Section 3. The U.S. may not provide the same level of data protection as your home country; where the law requires it we rely on appropriate safeguards for the transfer, as described in Section 11.

11. European Economic Area, United Kingdom & Switzerland (GDPR)

If you are in the EEA, the UK or Switzerland, this section applies and the General Data Protection Regulation (GDPR), the UK GDPR and the Swiss FADP give you additional rights.

Controller. Raqs Enterprise LLC (dba urCircl), Pennsylvania, USA, is the controller of your personal data; contact privacy@urcircl.com.

Legal bases. We process your data to perform our contract with you (creating, signing, storing and exporting the agreements you make, and providing your account); with your consent (optional texts and marketing, contact matching, and the biometric identity check run by Stripe (Stripe Identity) — you may withdraw consent at any time without affecting prior processing); for our legitimate interests (securing urCircl, preventing fraud and abuse, and improving the service), balanced against your rights; and to comply with legal obligations (sanctions screening, lawful requests, and tax/record-keeping).

Direct applicability (Article 3(2)). Because urCircl offers its services to users in the EEA, the UK and Switzerland, the GDPR/UK GDPR/FADP apply directly to our processing under Article 3(2), even though we have no establishment there. When you provide your data directly to us, that is not a restricted "transfer" under Chapter V, so we do not rely on Standard Contractual Clauses to legitimise our own collection of it.

Onward transfers to processors. Your data is processed in the U.S. Where your data is onward-transferred to one of our processors (Section 3) outside the EEA/UK/Switzerland, we rely on the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum / Swiss equivalent) together with technical and organizational safeguards; a copy of the relevant mechanism is available at privacy@urcircl.com.

Your rights. In addition to the rights in Section 7, you may request access, rectification, erasure, restriction of processing, and data portability; object to processing based on legitimate interests; and withdraw consent. We do not subject you to a decision based solely on automated processing that produces legal effects. To exercise any right, email privacy@urcircl.com.

Representative & complaints. If we are required to designate an EU/UK Article 27 representative we will do so and name them here; until then, direct all requests to privacy@urcircl.com. You also have the right to lodge a complaint with your local supervisory authority (EEA), the UK Information Commissioner's Office (ICO), or the Swiss FDPIC.

Retention is described in Section 4.

12. Financial privacy (GLBA / Regulation P)

urCircl is a record-keeping tool — not a bank, lender, money transmitter or other financial institution — and we do not believe we are a "financial institution" subject to the Gramm-Leach-Bliley Act (GLBA) or its Regulation P. To the extent GLBA or Regulation P is nevertheless found to apply to any of our activities, this Privacy Policy serves as our privacy notice under it: we collect nonpublic personal information only to provide the service you request, verify identity, prevent fraud, and meet legal obligations (Sections 1-2); we do NOT disclose it to nonaffiliated third parties except as Regulation P permits (for example, to our service providers to perform the service, at your direction, or as required by law — Section 3); and we do not sell it or share it for marketing. Because we do not share nonpublic personal information in a way that would trigger a Regulation P opt-out, no opt-out is required; you retain the choices and rights in Sections 7 and 11.

13. Changes

We will notify you in the app and by email before material changes take effect. Previous versions are available on request at privacy@urcircl.com.

14. Contact

privacy@urcircl.com · Raqs Enterprise LLC, c/o Republic Registered Agent LLC, 239 4th Ave, Ste 1401, Pittsburgh, PA 15222.