Privacy Policy

Last updated: 2 July 2026 · GDPR (Regulation (EU) 2016/679)

1. Who we are

slate ("we") is the data controller for the personal data described here. For any privacy request, contact privacy@slate.example.

2. Data we process

• Account data: your name and email address.
• Identity (KYC): details read from the ID/passport you upload (name, date of birth, document number, nationality, expiry). The uploaded image is processed and not stored.
• Financial data: accounts, balances, and transactions.
• Security data: hashed password and transaction PIN, 2FA secret, session records, and rate-limiting/IP data used to prevent abuse.

Sensitive fields are encrypted at rest (AES-256-GCM); passwords and PINs are hashed with Argon2id and are never stored in plaintext.

3. Purposes & lawful bases

• Providing the service (accounts, payments) — performance of a contract (Art. 6(1)(b)).
• Identity verification & fraud prevention — legal obligation and legitimate interests (Art. 6(1)(c), (f)).
• Security & abuse prevention — legitimate interests (Art. 6(1)(f)).
• Consent for optional processing, which you may withdraw at any time (Art. 6(1)(a)).

4. Sharing & transfers

Data is stored in the EU (Turso, EU region). We use the European Central Bank (via Frankfurter) for exchange rates and, if you use it, the external Apekaner network for interbank payments. These receive only the data necessary for the specific operation.

5. Retention

We keep account and transaction data for the life of your account and for the period required by applicable law. When you delete your account, personal data is erased promptly, subject to legal retention obligations.

6. Your rights

Under the GDPR you have the right to access, rectify, erase, restrict, object to, and port your data, and to withdraw consent. You can:

• Export your data (portability) from Settings → Your data.
• Delete your account (erasure) from Settings → Your data.
• Contact us for any other request.

You also have the right to lodge a complaint with your local data protection supervisory authority.

7. Cookies

We use a single strictly-necessary, encrypted, httpOnly cookie to keep you signed in. We do not use advertising or tracking cookies.

This is a demonstration project; slate is not a real bank.