Scope and data controller
Pay212 is the project name used on this website. The operator’s legal identity, address and dedicated privacy contact have not yet been published. This policy is neither a compliance certificate nor evidence of regulatory authorisation. Those details must be completed so that you can effectively exercise your rights. Do not send identity documents or sensitive information through the project’s social channels.
Browsing and account data
Reading the website does not require an account. Your browser saves your language preference. When you authenticate, the service processes, depending on your chosen method, your public wallet address and network, email or phone number, account identifier, creation and login dates, and security events. Hosting and other requested providers may receive your IP address and technical request information. Their logs and backups have their own retention periods.
Essential cookies and local storage
Session cookies keep you signed in and expire after 8 hours. Cookies used for wallet login, email or SMS codes, two-factor authentication and passkey login expire after 5 minutes. Over HTTPS they are Secure, HttpOnly and SameSite=Strict. Your language preference remains in local storage until changed or you clear site data. The wallet connector may retain connection information. This version includes no advertising tool. Blocking essential cookies may prevent sign-in.
Wallets, signatures and public records
Connecting a wallet shares its public address and selected network. A connection or authentication signature alone does not transfer crypto-assets. Other signatures or contract approvals may authorise different operations. Always review the request in your wallet. Pay212 does not request your private key or recovery phrase. Blockchain transactions are public, may be linked to your identity and generally cannot be erased by Pay212.
Purposes and applicable grounds
Data is used to create and protect your account, verify sign-ins, deliver codes you request, limit abuse and provide the features you select. Depending on applicable law and the service terms, grounds may include providing a requested service, a documented legitimate security interest, an identified legal obligation, or consent for an optional feature. Browsing is not blanket consent. The operator must confirm the final legal grounds. This version implements no marketing mailings.
Recipients and international transfers
Authorised service administrators may access data necessary for their duties. Hosting and database arrangements depend on the operator’s configuration. If the corresponding services are enabled, Resend receives login email recipients and content, Twilio receives numbers and SMS verification data, and WalletConnect receives connection and relay information. OpenAI and Sumsub are described below. Visiting an external link also shares some technical data with that website. Providers may process data abroad. The actual countries, contracts and safeguards, including any required CNDP formalities or European safeguards, remain to be confirmed. This page does not claim transfer authorisation has been obtained.
Assistant and artificial intelligence
The assistant is optional. Local FAQ mode does not need to send a conversation to OpenAI. When AI mode is enabled and you submit a message, the server sends OpenAI your language, message and at most the last six messages in the conversation. Pay212 does not record them in its account database. The request disables API response storage, which does not guarantee the provider keeps no security logs or records. Do not enter credentials, codes, documents or sensitive data. The assistant has no account access and makes no identity-verification decision.
Identity verification, when enabled
KYC is disabled by default and requires operator activation. When offered, Sumsub’s interface collects identity documents directly and, depending on the flow, images, video and liveness data. Pay212 retains applicant identifiers, selected document type, verification status and dates, and event references without storing document images in this application. Camera or microphone use belongs only to the flow that requests them. Before activation, the operator must specify the grounds, necessity, retention, countries and process for challenging a result. Signing in with Face ID or a passkey is not KYC verification.
Authentication and security
For passkeys, Pay212 stores a credential identifier, public key, label and authenticator technical information. Biometrics used by Face ID or your device are not sent to Pay212 in this flow. The TOTP two-factor secret is encrypted on the server, while recovery codes and session tokens are stored as hashes. The service includes origin checks, request protections and rate limits. These measures reduce some risks without guaranteeing freedom from compromise. Protect your device and never share login codes.
Retention and current limits
Sessions expire after 8 hours and authentication challenges after 5 minutes. A cleanup scheduled every 15 minutes removes expired sessions and challenges, OTP counters inactive for more than a day and authentication events older than 30 days while the server operates normally. Passkeys are deleted when removed, and the TOTP secret when you disable that protection. Account data, KYC references, daily counters and backups do not yet have a complete automated retention schedule in this version. The 30-day period does not apply to all your data. The operator must finalise the full schedule and account-closure process.
Rights, requests and complaints
Moroccan Law 09-08 provides information, access, correction and objection rights under its conditions. Where GDPR applies, you may also have erasure, restriction and portability rights, a right to withdraw consent and rights concerning some automated decisions. Legal exceptions can limit deletion. Withdrawing consent does not affect earlier lawful processing. A private operator contact is still needed to receive and follow up on requests. Depending on your circumstances, you can complain to Morocco’s CNDP or the competent EU supervisory authority. Never publish supporting documents in a community group.
Choices and updates
You can browse public pages without registration, sign out, revoke other sessions, remove a passkey and clear site data in your browser. Signing out does not delete your account or public blockchain records. Account and crypto-asset features are intended for adults with legal capacity to enter contracts. New collection, advertising or sensitive features require appropriate information before use. This page’s date identifies the version you read. A policy update does not replace consent where consent is required.
The operator must complete its legal identity, privacy contact, processing countries and full retention schedule. No CNDP, GDPR or security certification is claimed.