Privacy notice
This notice explains what information stoq collects about you, why, who sees it, how long we keep it, and the choices you have. The data controller is HRT DIGITAL LLC, 2201 Menaul Blvd NE, Suite A, Albuquerque, NM 87107, United States, operating as stoq. For anything about your data, email [email protected]. We do not sell your data, we do not show advertising, and the app contains no advertising or tracking SDKs.
1. What we collect and where it comes from
Account: your email address, and if you sign in with Google or Apple, the name and identifier those services share with us through Privy, our identity provider. Identity verification: your name, date of birth, home address, country, the type and number of your identity document, and the photos of it you submit. Financial activity: your USDC balance, deposits, card purchases, transfers, cashback, stock holdings, STOQ holdings, card details and limits, and the status of your cards. Wallet addresses: the address of the wallet created on your device, and the deposit address we create for you. Device and usage: your device model and operating system, the app version, your IP address, and a log of requests to our servers. Optional: a profile photo you choose, and a push notification token if you turn notifications on. We receive this information from you, from Privy, from Google or Apple when you sign in with them, from our card partner when your card is live, and from the public Solana blockchain.
2. What stays on your device
Your wallet's private key is created and stored in your device's secure storage and is never sent to us. Face ID and Touch ID checks are performed by your device; we never receive biometric data. Your passcode is stored only on the device. Identity document photos are kept on the device so you can review them, and sent to us once when you submit.
3. Why we use your information
To run your account, balance, card and cashback, which is the contract between us. To verify your identity and prevent fraud and financial crime, which the law and our card partner require. To keep the service secure and detect misuse, which is our legitimate interest and yours. To show your activity and send notifications about it. To respond to support requests. Where we rely on your consent, for example for notifications or a profile photo, you can withdraw it at any time in the app or in your device settings without affecting the rest of the service.
4. Who we share it with
Privy, Inc. (United States), which operates sign-in and holds your email and sign-in identifiers under its own privacy policy. Railway Corporation, which hosts our servers and database in the European Union (Netherlands). Our card partner, which receives the information needed to issue your card, process payments and meet its legal duties, including identity verification results and document images where required. Issuers of tokenized stocks, where delivery requires it. Apple, when you add a card to Apple Wallet or use App Store services, under Apple's privacy policy. Authorities, courts and regulators where the law requires. Professional advisers under confidentiality. Every recipient is bound to protect your data to a standard at least equal to this notice. We do not share your data with advertisers or data brokers.
5. Information on the blockchain
Deposits, withdrawals, trades and cashback deliveries are recorded on the Solana blockchain, which is public and permanent. Your wallet address, your deposit address and the amounts moved are visible to anyone and cannot be deleted by us or by you. We do not publish your name alongside them.
6. International transfers
Our servers and database are in the European Union. Privy processes sign-in data in the United States, and some partners may be outside your country. Where data leaves the European Economic Area or the United Kingdom we rely on safeguards recognised by law, such as standard contractual clauses, and you can ask us for a copy.
7. How long we keep it
Account and financial records: for the life of your account and five years after it closes, as financial regulation requires. Identity verification results, document type and number: for the same period. Identity document images: on your device until the check completes or you remove them; on our servers for as long as the check and the law require, after which they are deleted. Deposit wallet keys: for as long as the wallet may hold funds, under encryption, so that we can move funds for you. Server request logs: 90 days. Sign-in sessions: 90 days from the last sign-in. Everything else is deleted or anonymised when it is no longer needed.
8. Security
Data travels over encrypted connections. Deposit wallet keys are encrypted at rest with a key held only on our servers, and every export of such a key is recorded. Card details are shown in the app only after a device check and hidden again automatically. Access to personal data inside stoq is limited to people who need it to do their job and is logged. No system is perfectly secure; if a breach affects you we will tell you and the relevant authority as the law requires.
9. Your rights and choices
You can see most of your data in the app under Profile. You can ask us to access, correct, export or delete your data, to restrict or object to some uses, and to withdraw consent, by emailing [email protected] or, for deletion, from Security in the app. Deleting your account removes your personal data except the records we must keep by law, which are then kept only for that purpose. If you are in the European Economic Area, the United Kingdom or Switzerland you also have the right to complain to your data protection authority. If you are a California resident you have the right to know, delete and correct, and to opt out of sale or sharing; we do not sell or share personal information as those laws define it, and we do not discriminate against you for exercising your rights.
10. Automated decisions
Identity verification results are produced by our verification partner's automated checks together with human review. If your application is refused you can ask us to review it by contacting support, and you can provide further information.
11. Children
stoq is for adults. We do not knowingly collect data from anyone under 18, and we close any account we learn belongs to a minor and delete its data except where the law requires us to keep it.
12. Changes and contact
We will tell you in the app before a material change to this notice takes effect, and keep earlier versions available on request. Contact: [email protected], or stoq, 2201 Menaul Blvd NE, Suite A, Albuquerque, NM 87107, United States.
Questions? Email [email protected].