Last updated 12 January 2026
The short version. We collect what we need to move your money and satisfy financial regulators — nothing more. We do not sell your data and we never will. Your ID photos go to a verification partner and are not visible to Payvio staff. You can get a copy of everything we hold, and delete what the law lets us delete.
What we collect
| Category | Examples | Why |
|---|---|---|
| Identity | Name, date of birth, address, government ID, last four of SSN | Legally required to verify you before money transmission |
| Contact | Phone number, email | Receipts, delivery updates, account recovery, security alerts |
| Financial | Card and bank details, transaction history, balances | To take payment and move money |
| Recipient | Names, bank or wallet details, your relationship to them | To pay them, and because regulators require the relationship |
| Device | Device model, OS, app version, IP address | Fraud detection and debugging |
| Usage | Screens visited, features used, crash reports | To find what is broken and what is confusing |
What we do not do
We do not sell your personal information. We do not share it with advertisers or data brokers. We do not use your transaction history to target you with third-party marketing. Under the CCPA we have not sold or shared personal information for cross-context behavioural advertising in the preceding twelve months, and we do not intend to.
Who we share it with
- Identity verification partners — your ID photos and selfie go here for checking. Payvio staff cannot view your ID photos.
- Payout partners and receiving banks — the recipient's details and the amount, which is how the money arrives.
- Payment processors and our partner bank — to take your payment and hold balances.
- Regulators and law enforcement — where legally compelled, including suspicious activity reports we are required to file and are usually prohibited from telling you about.
- Service providers — hosting, error monitoring, customer-support tooling, all under contract and prohibited from using your data for their own purposes.
How long we keep it
Transaction and identity records: five years after your account closes, as required by the Bank Secrecy Act. Support conversations: three years. Device and usage data: 24 months. Marketing preferences: until you change them.
Your rights
Wherever you live in the US, you can ask us to:
- Give you a copy of what we hold — in the app under Terms & privacy → Download my data, or by emailing privacy@payvio.com. We respond within 45 days.
- Correct anything wrong. Some identity fields are locked because they were verified against your ID; contact support and we will correct them with evidence.
- Delete what is not subject to the five-year retention rule. We will tell you specifically what we must keep and why.
- Opt out of marketing at any time. Security and transaction notifications cannot be switched off — they are part of the service.
California residents have these rights under the CCPA/CPRA and may also designate an authorised agent. We will not discriminate against you for exercising any of them.
Security
Data is encrypted in transit and at rest. Access is role-based and logged. Card numbers are tokenised by our processor and never stored on our servers. We run external penetration tests annually and publish the summary on request. If we suffer a breach affecting your data, we will notify you and the relevant regulators as required, and we will tell you what happened rather than issue a non-statement.
Found a vulnerability? Email security@payvio.com. We will respond within one business day and we do not pursue good-faith researchers.
Children
Payvio is for adults. We do not knowingly collect data from anyone under 18, and we delete it if we discover we have.
Changes and contact
We will email you before any material change to this policy. For anything privacy-related, including a formal request, write to privacy@payvio.com or to the Data Protection Officer at our San Francisco address.