Privacy policy

This Privacy policy describes how Green Cloud and Blockchain SARL (Moywa) processes the personal data of users of the Moywa services, in accordance with Regulation (EU) 2016/679 (GDPR) and with the French Data Protection Act (loi Informatique et Libertés).

Preamble — Data architecture

Moywa is a technical interface operated by Green Cloud and Blockchain SARL. Moywa's architecture rests on a principle of data minimisation: Moywa collects and stores only the strict minimum necessary for the service to operate, and delegates all identity verification (KYC/KYB) and the retention of identity data to its authorised partner in the European Union, Bridge Building S.A. (Luxembourg).

This Privacy policy describes only the processing carried out by Moywa (Green Cloud and Blockchain SARL). For the processing carried out by Bridge (identity data, KYC documents, etc.), the User is invited to consult Bridge's privacy policy, available on their website.

Article 1 — Data controller

The controller of the personal data collected through the Moywa services is:

For any question relating to the protection of personal data, the Data Protection Officer (DPO) may be contacted at: privacy@moywa.com.

Article 2 — Data collected and stored by Moywa

Moywa applies a strict principle of data minimisation. The only data stored by Moywa in its databases (hosted by Supabase, Frankfurt, EEA) are:

2.1 — Authentication data

• The User's email address (used as the login identifier);
• Hashed password (bcrypt) — Moywa never stores the password in clear text;
• If logging in through Google OAuth: display name and profile picture provided automatically by Google (the User may revoke that authorisation from their Google account);
• Strong authentication factor (TOTP) and hashed recovery codes;
• Session identifiers (JWT) and login logs.

2.2 — Technical references to Bridge

• bridge_customer_id — unique identifier provided by Bridge;
• bridge_kyc_status — status of the identity verification (approved / pending / refused);
• bridge_payment_id, bridge_transfer_id — identifiers of Bridge operations.

2.3 — Transactional data

• History of deposits, transfers, conversions, withdrawals (amounts, currencies, statuses, dates);
• Stablecoin balances (EURC, USDC) on the Solana blockchain;
• Beneficiaries that the User saves themselves in their address book (name, IBAN/wallet/email, country, currency);
• Beneficiaries of transfers to a mobile money account: the beneficiary's name, mobile money number, operator and country, entered by the User. When the User picks the beneficiary from the contacts on their phone, only the name and number of the chosen contact are read; the address book is never copied, transmitted or stored;
• Beneficiaries of transfers to a bank account through a transfer provider (in particular in Africa): the account holder's name, bank, account number and country, entered by the User;
• Subscription status (Free / EEA / PRO plan).

2.4 — Technical data

• Login IP address (short-lived logs for security purposes);
• Application logs (date, time, action, internal identifier);
• Essential session cookies (JWT in the browser's localStorage).

2.5 — Support communications (email only)

Requests sent through the support form are transmitted directly by email to support@moywa.com through our SMTP server. Attachments (screenshots, photos) are not stored in our databases: they are attached in memory to the outgoing email and transmitted immediately, without persistence. Only the ticket metadata (subject, date, send status) is retained for follow-up.

Article 3 — Data NOT collected by Moywa

In accordance with the minimisation principle, Moywa never collects or stores the following categories of data, which are managed exclusively by Bridge Building S.A. (Luxembourg, European Union) in its capacity as a provider of regulated services:

• Full legal surname, given name(s), date and place of birth;
• Nationality, country of residence, postal address;
• Your own telephone number as identity data (a beneficiary's mobile money number, however, is collected to carry out the transfer: see article 2.3);
• Identity documents (passport, national identity card, residence permit);
• Verification photographs / selfies;
• KYC/KYB documents (proof of address, company registration extract for businesses, etc.);
• Complete personal bank details (beyond what appears in the Bridge transfer instructions).

To exercise your rights over that data, you must contact Bridge directly in accordance with the terms of their privacy policy.

Article 4 — Purposes and legal bases of the processing

Note: the obligations to combat money laundering and terrorist financing (KYC, AML, reports to the competent financial intelligence units) are assumed by Bridge Building S.A. in its capacity as a provider of regulated services, under the supervision of the Commission de Surveillance du Secteur Financier (CSSF, Luxembourg). Moywa does not process data directly in that context.

Article 5 — Recipients of the data

The data stored by Moywa may be disclosed to the following recipients, strictly to the extent necessary for the purpose of the processing:

5.1 — Moywa's technical processors

• Supabase Inc. (eu-central-1 region, Frankfurt, Germany, EEA) — Hosting of the database and authentication service. Moywa's main processor.
• 1&1 IONOS SE (Germany, EEA) — Hosting of the application server (VPS) and SMTP service for sending emails (notifications, support).
• Stripe Payments Europe Ltd. (Ireland, EEA) — Card payment processing for subscriptions (Stripe processes card data under its own policy).

5.2 — Regulated partner (separate data controller)

Bridge Building S.A. — 26 Boulevard Royal, L-2449 Luxembourg (European Union).

Bridge Building S.A. is a regulated service provider, authorised and supervised by the Commission de Surveillance du Secteur Financier (CSSF, Luxembourg) under:

• a crypto-asset service provider (CASP) authorisation granted under Regulation (EU) 2023/1114 (MiCA), under number N00000012;
• an electronic money institution (EMI) authorisation granted under the Luxembourg Act of 10 November 2009 on payment services, under number W00000024.

Those authorisations benefit from the European passport and cover the 27 Member States of the European Union.

Bridge acts as a separate data controller for identity data, KYC, and regulated financial operations. Moywa transmits to Bridge the User identifier (email, bridge_customer_id) in order to trigger the operations requested by the User. Identity data (name, address, documents) is entered directly by the User on the Bridge interface, and stored at Bridge.

5.3 — Providers of transfers to a mobile money account or a bank account

To carry out a transfer to a mobile money account, or to a bank account through a transfer provider, Moywa transmits to a payment provider authorised in the destination country — and, through it, to the beneficiary's mobile money operator or bank — the data needed for that transfer:

• the beneficiary's name, mobile money number, operator and country;
• for a bank account: the account holder's name, bank, account number and country;
• the amount, currency and reference of the transfer;
• where the provider requires it under its own regulatory obligations, the sender's identity as established by their identity verification (name, country and contact details).

Moywa chooses the provider at the time of the transfer, according to the availability of the beneficiary's operator or bank. These providers act as separate controllers for their own obligations. The list of providers to which data has been transmitted can be obtained on simple request at privacy@moywa.com.

5.4 — Legally empowered authorities

Upon lawful request (judicial authority, ACPR, CNIL, tax administrations), Moywa may be required to transmit the data it holds. The AML/CFT obligations (reports to financial intelligence units, etc.) are, by contrast, assumed by Bridge, under the supervision of the CSSF.

No data is sold, rented or transferred to third parties for commercial purposes.

Article 6 — Transfers outside the European Union

All of Moywa's main processors and those of its partner Bridge (Supabase, IONOS, Stripe, Bridge Building S.A.) are located in the European Union or the European Economic Area (EEA). No systematic transfer of data to a third country (outside the EU/EEA) takes place in the normal operation of the Moywa services, with the sole exception of the transfers of article 5.3 described below.

Transfers to a mobile money account or to a bank account through a transfer provider. The transfer providers of article 5.3 and the beneficiaries' mobile money operators and banks are established outside the European Union, in particular in Africa. Transmitting the data of article 5.3 to these countries is necessary to carry out the transfer requested by the User, within the meaning of article 49.1.b and article 49.1.c of the GDPR. It only takes place at the time of a transfer, and only for that transfer.

If the User logs in through Google OAuth, the data exchanged with Google (email, display name) may transit through Google infrastructure; that processing is governed by Google's privacy policy and subject to the European Commission's standard contractual clauses.

Article 7 — Retention periods

Upon closure of the account, Moywa's data is deleted except for data subject to a legal retention obligation (transactions and accounting data). The data held by Bridge is governed by their own retention policy.

Article 8 — Your rights over your personal data

In accordance with articles 15 to 22 of the GDPR, you have the following rights concerning the data stored by Moywa:

• Right of access (art. 15) — Obtain a copy of the data concerning you;
• Right to rectification (art. 16) — Correct inaccurate data (e.g. email);
• Right to erasure (art. 17) — Request deletion of the account (subject to the legal obligations to retain transactions);
• Right to restriction of processing (art. 18);
• Right to portability (art. 20) — Receive your data in a structured format;
• Right to object (art. 21);
• Right to withdraw your consent at any time;
• Right to give post-mortem directives (art. 40-1 of the French Data Protection Act).

How to exercise your rights with Moywa: send your request to privacy@moywa.com. A simple identity check may be requested (confirmation from the account email). Moywa replies within 1 month (extendable by 2 months if the request is complex).

Remedies: in the event of disagreement, you may lodge a complaint with the CNIL (3 Place de Fontenoy — TSA 80715 — 75334 Paris Cedex 07, or online at www.cnil.fr).

Article 9 — Data security

Moywa implements appropriate technical and organisational measures to ensure the security of the data stored:

• Encryption of data in transit (TLS 1.3) and at rest (AES-256, managed by Supabase);
• Mandatory two-factor strong authentication (2FA / SCA) to access the account;
• Password hashing with bcrypt (Supabase Auth);
• Separation of environments (production isolated);
• Notification of data breaches to the CNIL within 72h (art. 33 GDPR).

Article 10 — Cookies and trackers

10.1 — In the Moywa application

The Moywa application uses only essential technical cookies necessary for the service to operate (JWT session in localStorage, authentication, security). No advertising, third-party analytics or profiling cookie is placed there, whether you use the mobile application or the logged-in part of the website.

Essential technical cookies do not require prior consent (art. 82 of the French Data Protection Act, recital 30 of the ePrivacy Directive).

10.2 — On the public moywa.com website

The public pages of the website (home, countries, pricing, help, account creation) may place a Meta advertising tracker (Facebook pixel), the purpose of which is to measure the effectiveness of our advertising campaigns — in particular the number of account creations resulting from them.

• Legal basis: your consent (art. 6.1.a GDPR and art. 82 of the French Data Protection Act).
• Placement: only after your explicit acceptance through the banner displayed on your first visit. As long as you have not replied, no tracker is placed — the absence of a reply does not amount to acceptance.
• Refusal: you may refuse with one click on the same banner. The refusal is kept and the website remains fully usable.
• Recipient: Meta Platforms Ireland Limited, joint controller for advertising audience measurement.
• Retention period: 13 months maximum for the tracker, in accordance with the CNIL's recommendation.
• Withdrawal of consent: at any time, by clearing your browser's site data for moywa.com, or by writing to privacy@moywa.com.

We also keep, for the duration of your visit and without any cookie, the campaign parameters present in the address (utm_source, utm_medium, utm_campaign, utm_content, utm_term), in order to attribute an account creation to the campaign that prompted it. Those parameters are stored in your browser's session memory and disappear when it is closed.

Article 11 — Amendments to the Policy

This Privacy policy may be amended to reflect legal, technical or organisational changes. Any substantial amendment is notified to the User by email. The version in force is always accessible from the Moywa application and the moywa.com website.

Version 1.2 updates the references to the regulated partner: the services previously provided by Bridge Building Sp. z o.o. (Poland) are now provided by Bridge Building S.A. (Luxembourg), authorised as a CASP under MiCA and as an electronic money institution by the CSSF.

Version 1.3 — 25 July 2026: update of the publisher's identification details.

Version 1.4 — 16 September 2026: article 10 now distinguishes the application, where no advertising tracker is placed, from the public website, where a Meta pixel may be placed after explicit consent. The previous wording stated that no advertising cookie was placed and relied on that sentence to justify the absence of a consent banner; it is corrected at the same time as the banner goes live.

Version 1.5 — 18 October 2026: transfers to a mobile money account. Article 2.3 describes the beneficiary's data and the reading of a single phone contact, article 4 adds the corresponding purpose, the new article 5.3 describes the transfer providers that receive this data, and article 6 the transfer outside the European Union that the transfer requires. Article 3 is clarified: a beneficiary's mobile money number is collected, which the previous wording seemed to exclude.

Version 1.6 — 20 October 2026: transfers to a bank account through a transfer provider (in particular in Africa). Article 2.3 describes the data of a bank account beneficiary (account holder's name, bank, account number, country), article 4 adds the corresponding purpose, article 5.3 now covers these transfers and their recipients, article 6 the transfer outside the European Union that they require, and article 7 the retention of these beneficiaries when the User saves them.

Article 12 — Contact

• For any question relating to the processing of your data by Moywa: privacy@moywa.com (Data Protection Officer)
• For any question relating to the data held by Bridge (identity, KYC): see the Bridge privacy policy on their official website.
• For any other question: support@moywa.com