Privacy Policy

We collect information you provide directly to us, including: Account Information: When you create an account, we collect your name, email address, company name, and password. Business Information: For merchant accounts, we may collect business details required for compliance purposes. Usage Data: We automatically collect information about your use of our services, including API calls, timestamps, transaction volumes, and performance metrics. Communications: When you contact us, we collect information in your messages, including support requests and feedback. Important: Kobaru does not collect or store wallet private keys, seed phrases, or custody any cryptocurrency. We only process transaction metadata necessary to facilitate payments.

We use the information we collect to: • Provide, maintain, and improve our payment gateway services • Process and facilitate payment transactions • Send technical notices, updates, and security alerts • Respond to your comments, questions, and support requests • Monitor and analyze trends, usage, and transaction patterns • Detect, investigate, and prevent fraudulent transactions and abuse • Comply with legal and regulatory obligations • Generate anonymized analytics and reporting

What We Process: When you use our API to process payments, we handle transaction metadata including wallet addresses, transaction amounts, timestamps, and transaction hashes. What We Don't Store: We never have access to private keys, seed phrases, or the ability to move funds on your behalf. All transactions are executed on-chain by the parties involved. Blockchain Data: Transaction data recorded on the Solana blockchain is publicly visible. Kobaru does not control blockchain data and cannot delete on-chain records. Retention: Transaction metadata is retained as required for compliance, fraud prevention, and dispute resolution purposes.

We do not sell your personal information. We may share information in the following circumstances: Service Providers: With vendors who perform services on our behalf, such as infrastructure hosting and analytics. Legal Requirements: When required by law, subpoena, or legal process, including requests from regulatory authorities. Compliance: With financial regulators or law enforcement as required for anti-money laundering (AML) and sanctions compliance. Business Transfers: In connection with a merger, acquisition, or sale of assets. Protection: To protect the rights, property, and safety of Kobaru, our users, or others. With Consent: With your explicit consent or at your direction.

We implement industry-standard security measures to protect your information: • Encryption in transit (TLS 1.3) and at rest (AES-256) • Regular security audits and penetration testing • Access controls and authentication requirements • Monitoring and logging of system access • Incident response procedures • API key rotation and secure credential management While we strive to protect your information, no method of transmission over the Internet is 100% secure. We cannot guarantee absolute security.

We retain your information for as long as your account is active or as needed to provide services. Retention periods vary by data type: • Account Data: Retained until account deletion, plus 30 days • Transaction Metadata: Retained for 7 years for compliance and audit purposes • API Logs: Retained for 90 days by default • Support Communications: Retained for 3 years You may request deletion of your data at any time, subject to legal retention requirements. Note that blockchain transaction data cannot be deleted as it exists on a public ledger.

Depending on your location, you may have the following rights: Access: Request a copy of the personal information we hold about you. Correction: Request correction of inaccurate personal information. Deletion: Request deletion of your personal information (subject to legal retention requirements). Portability: Request a portable copy of your data. Objection: Object to certain processing of your information. Restriction: Request restriction of processing in certain circumstances. To exercise these rights, contact us at [email protected].

We are based in the United States and process information on servers located in the US and other countries. If you are located outside the US, your information will be transferred to and processed in the US. We use appropriate safeguards for international transfers, including: • Standard Contractual Clauses approved by the European Commission • Data Processing Agreements with service providers • Certification under applicable privacy frameworks

We use cookies and similar technologies to: • Keep you logged in and remember your preferences • Analyze usage patterns and improve our services • Provide personalized content and features Essential Cookies: Required for basic functionality. Analytics Cookies: Help us understand how you use our services. Preference Cookies: Remember your settings and choices. You can control cookies through your browser settings. Disabling certain cookies may affect functionality.

Our services are not directed to children under 18. Payment processing services require users to be of legal age to enter into contracts in their jurisdiction. If you believe we have collected information from a minor, please contact us immediately at [email protected], and we will take steps to delete such information.

We may update this Privacy Policy from time to time. We will notify you of material changes by: • Posting the updated policy on our website • Sending an email to your registered address • Displaying a prominent notice in our dashboard Your continued use of our services after changes become effective constitutes acceptance of the revised policy.

If you have questions about this Privacy Policy or our data practices, please contact us: Privacy Inquiries: [email protected] Data Protection Officer: [email protected] For EU residents, you also have the right to lodge a complaint with your local data protection authority.