Effective Date: Aug 28, 2025
This Privacy Policy explains how Decaf, Inc. and any subsidiaries and affiliated companies (“Decaf,” “we,” or “us”) collect, use, and disclose information about you (“you” or “your”).
This Privacy Policy applies when you:
- Use the Decaf Wallet application for interacting with the Stellar and Solana Networks (the “Wallet Services”),
- Visit the Decaf website located at https://decaf.so or successor sites,
- Apply for, are issued, or use a Decaf Card (the “Card Services”),
- Contact our customer service team, engage with us on social media, or otherwise interact with us.
For Card Services, this Privacy Policy should be read together with the Decaf Cardholder Agreement, the E-Sign & Electronic Communications Notice, and, where applicable, the GLBA Privacy Notice provided by the Card Issuer (Third National, Inc.).
We may update this Privacy Policy from time to time. If we make changes, we will revise the date at the top of this policy and, in some cases, provide you with additional notice. We encourage you to review this Privacy Policy regularly.
1. Stellar and Solana Networks
The Wallet Services allow you to generate, authorize, submit, and broadcast transactions on the Stellar and Solana Networks, distributed ledger networks powered by open-source protocols. This Privacy Policy does not apply to any information transmitted to those networks.
Transaction information broadcast to the Stellar or Solana Networks includes your public address, public key of the receiver, transaction amount, date/time, and any other data you include. Due to the nature of blockchain technology, this information is public, permanent, and cannot be deleted.
2. Collection of Information
We collect the following types of information:
2.1 Information You Provide
We collect information you provide directly to us when you create a Decaf account, apply for a Decaf Card, fill out a form, request support, or otherwise communicate with us. This may include:
- First and last name, email address, phone number, profile photo, login credentials from third-party services (e.g., Google, Apple).
- For Decaf Card: government identification (passport, driver’s license), date of birth, address, Social Security number (for U.S. cardholders), and other information required for identity verification and regulatory compliance.
2.2 Information We Collect Automatically
- Wallet Services: IP address, device identifiers, public key information, transaction details (deposits, withdrawals, transfers, exchanges).
- Card Services: card number, expiration date, CVV, merchant name, merchant category code (MCC), transaction amount, time/date, location, spending/credit limit, repayment activity, and collateral balances.
2.3 Information From Other Sources
We may receive information from third parties, such as credit bureaus, card networks (e.g., Visa), fraud prevention partners, analytics providers, or social media platforms.
2.4 Information We Derive
We may derive or infer information about you, such as approximate location from IP address, or spending patterns from transaction history.
3. Use of Information
We use the information we collect to operate and improve Wallet and Card Services, including to:
- Provide, issue, and service your Decaf Card and Wallet account;
- Process payments and transactions, including through card networks and blockchain networks;
- Verify your identity and comply with KYC, AML, and sanctions screening requirements;
- Set, monitor, and adjust card spending or collateral limits;
- Provide periodic billing statements and account notices;
- Detect, investigate, and prevent fraud, unauthorized use, or suspicious activity;
- Send service-related communications (e.g., security alerts, transaction confirmations);
- Respond to inquiries and provide customer support;
- Comply with legal and regulatory obligations;
- Carry out any other purpose described at the time of collection.
4. Sharing of Information
We may share your information in the following circumstances:
- Card Issuer (Third National, Inc.): To issue, service, and manage the Decaf Card.
- Card Networks (e.g., Visa, Mastercard): To process, authorize, and settle transactions.
- Service Providers: With vendors supporting services like card manufacturing, transaction processing, fraud detection, collections, and customer support.
- Blockchain Networks: With Stellar and Solana, as transactions are publicly recorded.
- Regulators & Law Enforcement: As required by law or regulation.
- Professional Advisors: With lawyers, auditors, or consultants.
- Business Transfers: In connection with mergers, acquisitions, or financing.
- Aggregated/De-Identified Data: Which cannot reasonably identify you.
Note: U.S. cardholders will also receive a GLBA Privacy Notice from the Issuer describing legally required sharing and opt-out rights.
5. Advertising and Analytics
We permit analytics providers (such as Google Analytics) to collect information about your use of Wallet and Card Services to help us analyze usage and improve performance.
We may also work with third parties to serve targeted ads. You can opt out of Google Analytics at https://tools.google.com/dlpage/gaoptout/ and out of interest-based advertising at www.aboutads.info/choices.
6. Transfer of Information to Other Countries
Decaf operates globally and may transfer your information to countries outside your home jurisdiction, including the United States. These jurisdictions may not provide the same data protection standards as your home country.
7. Your Choices
- Account Information: You may update account details in the Decaf App.
- Paper Copies: Cardholders may request paper statements or disclosures at no cost by contacting support@decaf.so.
- Push Notifications: You can disable push notifications in your device settings.
- Electronic Communications: You may withdraw consent to electronic delivery as described in our E-Sign Notice.
8. Additional Disclosures for Individuals in Europe
If you are located in the EEA, UK, or Switzerland, you have specific rights regarding your personal data, including the right to access, correct, erase, restrict, or object to certain processing. You may also lodge a complaint with your local Data Protection Authority.
We retain personal data for as long as necessary to provide services and comply with legal obligations. If you wish to delete your account, contact us at support@decaf.so.
9. Contact Us
For questions about this Privacy Policy or our data practices, please contact us at:
📧 support@decaf.so