> For the complete documentation index, see [llms.txt](https://docs.mysorbet.xyz/sorbet/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.mysorbet.xyz/sorbet/legal/privacy-policy.md). # Privacy Policy What personal data Sorbet collects, why, who we share it with, how long we keep it, and your rights. **Last updated: 26 October 2026** This Privacy Policy explains how **Sorbet Holdings Limited** ("Sorbet", "we", "us", "our") collects, uses, shares and protects personal data when you use our websites, apps and APIs, including mysorbet.io, mysorbet.xyz and app.mysorbet.io (the "Services"), or when you contact us. Sorbet is incorporated in the Abu Dhabi Global Market (ADGM). This policy is written to meet the **ADGM Data Protection Regulations 2021** and, where they apply to you, other privacy laws such as the EU and UK GDPR and US state privacy laws. If you don't agree with this policy, please don't use the Services. ## Summary * **What we collect:** account details, identity and business verification data (KYC/KYB), payment and transaction data, wallet addresses, support conversations, and device and usage data. * **Why:** to run your account, meet anti-money-laundering and sanctions obligations, prevent fraud, support you and improve the product. * **Who we share it with:** our regulated payment partners, our verification provider, and service providers who help us run Sorbet. We don't sell your personal data. * **How long:** verification and transaction records for at least five years after your account closes; most other data until you delete your account. * **Your rights:** access, correction, deletion, objection, restriction, portability, and a human review of automated decisions. Email . ## 1. Who is responsible for your data Sorbet Holdings Limited is the **controller** of the personal data we process to run, secure and improve the Services. Our regulated payment partners and verification provider (see [Who We Are & Our Partners](/sorbet/legal/who-are-we.md)) may process your data as **independent controllers** under their own privacy policies and legal obligations. In some cases we collect data on their behalf so they can open and operate your account. **Contact for privacy matters:** , or Sorbet Holdings Limited, Al Maryah Street, DD-15-134-004 – 007, Level 15, WeWork Hub71, Abu Dhabi, United Arab Emirates. ## 2. The personal data we collect ### Information you give us * **Account and profile:** name, email address, phone number, nationality, country of residence, date of birth, username, profile details, and sign-in details. * **Business details (for business accounts):** company name, registration and tax numbers, addresses, industry, expected volumes, and details of directors, beneficial owners, authorised signers and team members. * **Verification (KYC/KYB):** government ID, tax identification number, a live selfie and liveness check, proof of address, source of funds and source of wealth information, business formation and ownership documents, proof of business activity, and answers to onboarding questions. * **Payments and invoices:** payment instructions, recipient and beneficiary names and bank or wallet details, invoice and client details, amounts, currencies and payment references. * **Support:** emails, chat messages, attachments and call recordings where enabled. ### Information about other people If you give us data about someone else, such as a recipient, an invoice client, a team member, a director or a beneficial owner, you confirm that you're allowed to share it and that you've told them it will be processed as described in this policy. ### Information we receive from others * **Verification and screening providers:** verification outcomes, risk signals, and sanctions, politically exposed person (PEP) and adverse media results. * **Payment partners:** account status, eligibility decisions, payment status and settlement confirmations. * **Public sources:** corporate registries and public blockchains. * **Sign-in providers:** basic profile details if you sign in with Google, Apple or a similar account. ### Information collected automatically * Device and browser type, operating system, language, IP address and approximate location derived from it. * Pages and screens viewed, actions taken, timestamps and error logs. * Cookies and similar technologies (see section 12). ### On-chain data Wallet addresses and stablecoin transactions are recorded on public blockchains and can be seen by anyone. Sorbet doesn't control public blockchains and can't change or delete on-chain data. ### If you don't provide data Anti-money-laundering laws and our partners require verification before an account can be opened. If you don't provide the information we ask for, we can't open your account, and we may have to restrict or close an existing one. ## 3. Why we use your data, and our legal basis | Purpose | Legal basis | | ---------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------- | | Creating and running your account, processing payment instructions, invoices and payouts | Contract | | Identity and business verification (KYC/KYB), including enhanced due diligence | Legal obligation; legitimate interests (meeting our partners' compliance requirements) | | Sanctions, PEP and adverse media screening | Legal obligation; legitimate interests | | Transaction monitoring, fraud prevention and investigating suspicious activity | Legal obligation; legitimate interests | | Passing your data to the payment partner that provides your account | Contract; legal obligation | | Customer support, including AI-assisted support | Contract; legitimate interests | | Security, debugging and keeping the Services available | Legitimate interests | | Product analytics and improving the Services | Legitimate interests (and consent where the law requires it) | | Service messages and security alerts | Contract | | Marketing emails and promotions | Consent, or legitimate interests where the law allows. You can opt out at any time | | Referral and affiliate programmes | Contract | | Record-keeping, audits, responding to authorities and legal claims | Legal obligation; legitimate interests | Where we rely on legitimate interests, we have weighed those interests against your rights. Ask us if you'd like more detail. We process government ID and biometric data (your selfie and liveness check) only for verification and fraud prevention. ## 4. Automated decisions and monitoring We and our partners use automated systems to: * check identity documents and match your selfie to your ID * screen names against sanctions, PEP and adverse media lists * score risk to decide what level of checks applies to you * monitor transactions, apply limits and pause activity that looks unusual or suspicious These systems can lead to an account being declined, limited or paused. Business applications always get a manual review. If an automated decision significantly affects you, you can ask for a person to review it, explain your point of view, and challenge it by emailing . ## 5. When we can't tell you more Anti-money-laundering and counter-terrorist financing laws sometimes prohibit us, and our partners, from telling you that a report has been made to an authority, or from explaining why an account was restricted or closed. This is known as "tipping off". In those cases your rights to access information or to an explanation may be limited, as the law allows. ## 6. Who we share your data with * **Regulated payment partners:** Bridge and Walapay, to open and operate your account and execute payments. * **Verification provider:** AiPrise, which runs identity and business checks on behalf of our partners. * **Wallet infrastructure:** Privy, which provides sign-in and your self-custodial embedded wallet. * **Service providers acting on our instructions:** cloud hosting, product analytics (PostHog), customer support and messaging (Intercom, including its AI assistant), email delivery, and security monitoring. They may only use your data to provide services to us. * **Professional advisers:** lawyers, auditors and insurers. * **Authorities:** regulators, law enforcement, courts and tax authorities, when the law requires it or to protect rights and safety. * **Business transfers:** a buyer, investor or successor if Sorbet is involved in a merger, acquisition, financing or sale of assets, subject to confidentiality. **We don't sell your personal data**, and we don't share it for cross-context behavioural advertising. ## 7. AI in customer support Some support conversations are first answered by an AI assistant provided by Intercom. It uses your messages and our help content to reply. You can ask for a person at any time. We don't use AI support conversations to make verification or account decisions. ## 8. International transfers Our partners and service providers are based in several countries, mainly the **United States**, the EU and the UK. Your data will be transferred outside the country you live in, and outside the ADGM. Where the destination doesn't have adequate data protection laws, we use appropriate safeguards such as standard contractual clauses and data processing agreements, together with encryption in transit and at rest. You can ask us for a copy of the relevant safeguards. ## 9. How long we keep your data | Data | How long | | ---------------------------------------------------------------------------------- | ---------------------------------------------------------------------------- | | Verification records (KYC/KYB documents, verification outcomes, screening results) | At least **5 years** after your account closes | | Transaction records, payment instructions and sent or paid invoices | At least **5 years** after the transaction | | Support conversations linked to a compliance matter, complaint or dispute | At least **5 years** after the matter is closed | | Account, profile and contact details, saved recipients, draft invoices | Until you delete your account, then deleted or anonymised within **30 days** | | Other support conversations | Up to **2 years** after the conversation | | Product analytics identifiers | Deleted or de-identified when you delete your account | We keep data longer if a law, a regulator, a court or one of our partners requires it, or while an investigation or legal claim is open. For what happens when you close your account, see [Delete Your Account](/sorbet/legal/delete-your-account.md). ## 10. Security We use access controls, encryption, logging and monitoring to protect your data, and staff access to verification data is restricted. No system is completely secure, so we can't guarantee absolute security. If a personal data breach is likely to put your rights at risk, we'll notify the ADGM Commissioner of Data Protection and, where required, you, without undue delay. ## 11. Your rights Depending on where you live, you can ask us to: * give you a copy of your personal data * correct inaccurate or incomplete data * delete your data * restrict or object to certain processing, including direct marketing * give you your data in a portable format * have a person review an automated decision * withdraw consent where we rely on it To make a request, email or use our [data subject access request form](https://app.termly.io/dsar/a35100c8-4407-4103-8c12-d6cbd1a1f84d). * We'll respond **within one month**. If your request is complex we may extend this by up to two further months, and we'll tell you why. US state laws may allow up to 45 days. * Making a request is **free**. We may charge a reasonable fee, or decline, if a request is clearly unfounded or excessive. * We may need to **verify your identity** first. * Some rights are limited by law. For example, we can't delete verification or transaction records we're legally required to keep, and the tipping-off rules in section 5 may apply. We'll tell you when a limit applies. ### Complaints If you're unhappy with how we've handled your data, contact us first at . See [Complaints](/sorbet/legal/complaints.md) for how we handle it. You also have the right to complain to the **ADGM Office of Data Protection** (Commissioner of Data Protection), or to the data protection authority where you live. ## 12. Cookies We use cookies and similar technologies to keep you signed in and secure, remember your preferences, and understand how the Services are used. Where the law requires it, we ask for your consent before setting non-essential cookies and let you change your choice later. You can also block cookies in your browser, though some features may stop working. Our Services don't respond to Do Not Track signals. ## 13. Sign in with Google or Apple If you sign in with a third-party account, we receive basic details such as your name and email address, and use them only to sign you in. The provider's own privacy policy applies to what they do with your data. ## 14. Children Sorbet is only for people aged **18 or over**. We don't knowingly collect data from anyone under 18. If you think a child has given us their data, email and we'll delete it. ## 15. Additional information for US residents Residents of some US states have the rights listed in section 11, plus the right not to be discriminated against for using them. We don't sell personal data or share it for targeted advertising. Email to make a request. An authorised agent may make a request for you, with proof of authorisation. ## 16. Changes to this policy We'll update this policy as our services and partners change. If a change is material, we'll tell you by email or in the app before it takes effect. The date at the top shows the latest version. ## 17. Contact Sorbet Holdings Limited\ Al Maryah Street, DD-15-134-004 – 007, Level 15, WeWork Hub71\ Abu Dhabi, United Arab Emirates * Privacy and compliance: * Account and product support: