Privacy Policy
Effective Date: May 6, 2026
Last Updated: May 6, 2026
ExtoLabs, LLC (“Company,” “we,” “our,” or “us”) respects your privacy and is committed to protecting your personal information.
This Privacy Policy explains how we collect, use, disclose, store, and protect your information when you use the ExtoPayPula mobile application and related services (the “Services”).
This policy is intended to comply with applicable data protection and financial services laws, including the Data Protection Act of Botswana, applicable Google Play policies, and internationally recognized privacy principles.
1. Information We Collect
We may collect the following categories of information:
A. Personal Identification Information
- Full name
- Date of birth
- National ID number or passport number
- Residential address
- Phone number
- Email address
- Citizenship or nationality
- Facial image or selfie photographs
B. Financial and Transaction Information
- Payment account details
- Bank account information
- Transaction history
- Merchant/payment recipient details
- Device wallet identifiers
C. KYC / AML Verification Information
To comply with financial regulations and anti-money laundering obligations, we may collect:
- Government-issued identity documents
- Proof of address
- Facial images or selfie photographs
- Liveness detection data
- Risk and fraud screening results
- Sanctions screening information
D. Device and Technical Information
- Device type
- Operating system
- IP address
- Mobile network information
- App version
- Device identifiers
- Log and diagnostic information
- Hardware key attestation
E. Location Information
We may collect approximate or precise location information where necessary for:
- fraud prevention,
- transaction verification,
- regulatory compliance,
- security monitoring.
Additionally, we use Bluetooth to connect to other phones and to Exto hardware devices. Enabling Bluetooth on your device enables precise location tracking as a side effect, but we do not use it for this purpose.
2. How We Use Your Information
We use personal information to:
- provide and maintain the Services;
- verify your identity;
- comply with KYC, AML, sanctions, and financial compliance obligations;
- process payments and transactions;
- prevent fraud, abuse, and unauthorized activity;
- provide customer support;
- improve app functionality and security;
- comply with legal and regulatory obligations;
- communicate important service notices;
- enforce our Terms of Service.
We do not sell personal information to third parties.
3. Legal Basis for Processing
Depending on your jurisdiction, we process information based on one or more of the following lawful grounds:
- your consent;
- performance of a contract;
- compliance with legal obligations;
- protection against fraud and financial crime;
- legitimate business interests.
4. Sharing of Information
We may share information with:
A. Financial and Payment Partners
Including:
- banks,
- payment processors,
- mobile money operators,
- card networks,
- compliance providers.
B. Identity Verification and Compliance Providers
For KYC, AML, fraud detection, sanctions screening, and identity verification.
C. Other Registered App Users
When you connect to another user's phone to send or receive a payment over Bluetooth they may optionally review the name and facial image registered with your account to determine if you are the registered owner of the account.
If you wish to receive payments from far away users who cannot connect directly face to face, you may choose to share your wallet address app link with them by e-mail, text, or other methods. Registered users who receive your address app link may review your registered name and facial image to be sure they are sending payment to the intended recipient. Additionally, they may share this link with other App users beyond your control. However, only registered App users may open the link. If you do not share your wallet address app link with anyone, then only users you connect with face to face can review this information. There are no interfaces where users may browse or search for names or images.
D. Service Providers
Such as:
- cloud hosting providers,
- analytics providers,
- customer support vendors,
- cybersecurity providers.
E. Government Authorities and Regulators
Where required by law, regulation, court order, or lawful request.
F. Corporate Transactions
In connection with a merger, acquisition, restructuring, or sale of assets.
We require third parties handling personal information to implement appropriate security and confidentiality protections.
5. Identity Verification and Biometric Processing
To comply with applicable financial regulations, anti-money laundering obligations, fraud prevention requirements, and Know Your Customer (“KYC”) obligations, we use third-party identity verification providers.
Currently, identity verification services are provided by Shufti Pro (“Shufti”).
When you initiate identity verification through the App, certain personal information may be collected and processed by Shufti on our behalf, including:
- government-issued identification documents,
- facial images or selfie photographs,
- liveness detection data,
- personal identification information,
- device and technical information associated with the verification process.
This information is used solely for:
- identity verification,
- fraud prevention,
- sanctions and watchlist screening,
- anti-money laundering compliance,
- regulatory compliance,
- account security.
Shufti may process biometric information and identity verification data in accordance with its own privacy policy and terms.
Before initiating identity verification, you may be presented with additional disclosures or consent requests by Shufti.
You acknowledge that identity verification services may be subject to:
- Shufti’s Terms of Service, and
- Shufti’s Privacy Policy.
For additional information regarding Shufti’s privacy practices, please review:
- https://shuftipro.com/privacy-policy/
- https://shuftipro.com/terms-and-conditions/
We require our identity verification providers to implement reasonable security safeguards and process personal information in accordance with applicable data protection laws.
Device Biometric Authentication
The App may allow you to use biometric authentication features provided by your device operating system, including:
- fingerprint recognition,
- facial recognition,
- passkeys,
- other platform authentication technologies.
These authentication methods are provided and managed by your device manufacturer and operating system provider.
We do not receive or store your fingerprint, facial template, or other device biometric authentication data.
The App receives only a confirmation from the device indicating that authentication was successful.
You may disable biometric authentication at any time through your device settings.
Sensitive Information
We process sensitive personal information, including identity verification information, solely for regulatory compliance, fraud prevention, security, and financial services functionality, and not for advertising purposes.
6. International Transfers
Your information may be processed or stored outside Botswana.
Where international transfers occur, we take reasonable measures to ensure appropriate safeguards are in place consistent with applicable data protection laws.
7. Data Retention
We retain personal information only as long as necessary for:
- providing the Services,
- regulatory compliance,
- dispute resolution,
- fraud prevention,
- record keeping obligations.
Financial and KYC records may be retained for periods required by applicable financial regulations.
8. Security
We implement technical, administrative, and organizational safeguards designed to protect personal information, including:
- encryption in transit,
- encryption at rest where appropriate,
- access controls,
- audit logging,
- authentication protections,
- security monitoring.
However, no system can be guaranteed to be completely secure.
9. Your Rights
Depending on applicable law, you may have the right to:
- access your personal information;
- request correction of inaccurate information;
- request deletion of information;
- object to certain processing activities;
- withdraw consent;
- request restriction of processing;
- lodge a complaint with a data protection authority.
Certain information may be retained where required by financial or legal obligations.
10. Children's Privacy
The Services are not intended for individuals under the age of 18 unless expressly authorized by applicable law and parental or guardian consent requirements are satisfied.
11. Google Play and Mobile Permissions
The App may request permissions including:
- Bluetooth access for transacting with other phones and Exto hardware devices
- camera access for identity verification and QR code scanning
- storage/photo access for QR code sharing via e-mail, text, etc.
- location access for fraud prevention,
- notification access for transaction alerts.
Permissions are requested only where necessary for app functionality or legal compliance.
12. Analytics and Automated Decision-Making
We may use analytics and automated systems to:
- detect fraud,
- assess risk,
- improve service performance,
- identify suspicious activity.
These systems may involve profiling related to transaction risk and compliance obligations.
13. Changes to This Privacy Policy
We may update this Privacy Policy periodically.
Material changes will be communicated through the App or other appropriate channels.
Continued use of the Services after updates constitutes acceptance of the revised Privacy Policy.
14. Contact Information
If you have questions about this Privacy Policy or our privacy practices, contact:
ExtoLabs, LLC
2376 Old Topanga Canyon Rd
Topanga, CA 90290
United States
support@extolab.com
+1 401-203-5024