# Privacy Policy

Effective date: 2026-02-27

This Privacy Policy explains how the Provider collects, uses, stores, shares, and protects personal data when you register for or use the Money Transfer System (the "Service").

**Data Controller / Contact**

- Controller: [add Provider name and contact email]
- Data location: application data stored in `src/money_transfer_crew/data/app.db` (SQLite) on the Provider’s servers or hosting environment.

1. Personal Data Collected

- Account registration: full name, email address, password (stored as a salted scrypt hash), source country, source currency.
- Transaction data: receiver full name, destination country, destination currency, send amount (USD equivalent), buyer/exchange rate, fees, destination amount, transfer purpose, transfer ID, status, timestamps.
- Session data: Session cookies (server-side sessions using `APP_SESSION_SECRET`) and session-stored pending transfer details while in-process.
- Technical data: IP address, browser/UA string, request timestamps, server logs (typical for web hosting).

2. How We Use Your Data

- Provide and maintain the Service (account creation, authentication, quoting, transaction recording).
- Process transfer quotes and record confirmed transfers.
- Security and fraud prevention (account protection, KYC where required).
- Communication: transactional emails (if an email provider is configured).

3. Data Sharing and Third Parties

- Payment/FX/KYC Providers: necessary details may be shared with external providers to execute transfers and meet compliance requirements.
- Rate APIs: the Service fetches FX rates from public or configured rate providers (observed call to open.er-api.com).
- Email / Notifications: if an email provider (e.g., SendGrid) is configured, minimal data may be sent to deliver transactional emails.
- Law enforcement / legal requests: disclosure may occur where required by law.

4. Data Retention

- Account and transaction records are retained in `src/money_transfer_crew/data/app.db` until deleted. Retention may be extended for legal or compliance reasons.

5. Security Measures

- Passwords are stored as salted hashes using `hashlib.scrypt`.
- Sessions are protected via `starlette` SessionMiddleware using `APP_SESSION_SECRET`. Change the default session secret in production and keep secrets out of source control.
- Use HTTPS, secrets management, and secure hosting in production.

6. Your Rights

- Access, rectification, deletion, portability: contact the Provider to exercise these rights.

7. International Transfers

- Data may be processed or stored in jurisdictions other than your own (hosting providers, third-party APIs). The Provider will use appropriate safeguards as required by law.

8. Children

- The Service is not directed to children under the age of 13. The Provider does not knowingly collect personal data from children.

9. Changes to this Policy

- The Provider may update this Privacy Policy; the updated policy’s Effective Date will be posted.

10. Breach Notification

- In the event of a data breach, the Provider will notify affected users and authorities as required by applicable law.