Settley Send — Privacy Policy

1. Who this policy covers

Settley Send is operated by Settley LLC, a Delaware limited liability company ("Settley," "we," "us"). This policy explains what we collect through the Settley Send Telegram bot and the settleysend.com payment pages, why we collect it, and what happens to it.

This policy doesn't cover Telegram itself. Your conversation with our bot runs inside Telegram's app, so Telegram's own privacy policy also applies to that layer — we only see what the bot is given access to, not your full Telegram account.

2. What we collect

From a sender

Telegram identity: your numeric chat ID and display name, used to keep the conversation and find your transfers.
What you type to the bot: the amount, destination country, and recipient name you give in natural language.
The wallet address you pay from — recorded so we know who to refund if a payment doesn't match a claim.
Transaction data: chain, token, amount, and transaction hash for any payment you send.

From a receiver

Whatever you provide when claiming: your chosen payout method (bank, wallet, airtime, or card) and the account/address details that method needs.
For bank payouts, the account name and number our payout partner needs to send the money, and the institution it resolves to.
Where a transfer's size or destination requires it: identity information such as name, date of birth, or address (see our KYC/AML Policy).

Collected automatically

Support and error logs generated while the bot or payment page processes your request.
Basic technical data from the payment page (browser type, IP address) needed to serve the page and detect abuse.

3. Onchain data is not private

Important: Settley Send settles transfers using public blockchains (Celo, Base, Arbitrum). Once a payment is sent, the sending wallet address, the receiving address, the token, and the amount are permanently visible to anyone on that chain's public explorer. We cannot delete, edit, or hide a transaction once it's confirmed onchain — no one can. Don't treat a wallet address as private once you've used it to pay.

4. How we use what we collect

To run the transfer — match your payment to your claim, generate the receiver's claim code, and execute the payout you or the receiver chose.
To keep money safe — detect and resolve underpayments, overpayments, expired links, and deposits that don't match any open claim (see our refund mechanics in the Trust & Safety page).
To meet legal and partner obligations — screening against sanctions/PEP lists, reporting where required by law, and satisfying the requirements of payout partners like our bank-payout provider.
For support — looking up a claim code or transaction hash you give us when something needs investigating.
We do not sell your data, and we do not use it for third-party advertising.

5. Who we share data with

Who	What they get	Why
Bank-payout partner (e.g. Switch)	Receiver's bank/account details, payout amount	To actually deliver a bank payout
Blockchain RPC providers	Wallet addresses, transaction data — already public onchain	To read and submit transactions
Compliance/screening tools	Names, wallet addresses, transaction details	Sanctions and fraud screening
Regulators / law enforcement	Whatever is lawfully requested	Where we're legally compelled

We don't hand your data to anyone outside this list for marketing, resale, or unrelated purposes.

6. How long we keep it

Government ID document images: stored for up to 30 days after the identity review decision, then automatically deleted from our private storage. After deletion we retain only a cryptographic hash of the document text and metadata about the review outcome.
Identity verification records (name, date of birth, country, hashed ID number, and review outcome): retained for 5 years after the verification is completed, as required by anti-money laundering regulations applicable to us.
Transaction records (claims, payouts, refunds, transfer amounts): retained for 7 years, as required by applicable AML/CFT record-keeping regulations.
Expired payment links that were never funded are removed from active use quickly; we don't keep indefinite records of conversations that never produced a real transfer.
Onchain data is not something we can control the retention of — it is permanent by the nature of the blockchain it is recorded on.

7. Security

We apply standard safeguards — encrypted connections, access controls on internal tools, and isolating funds in dedicated settlement wallets — to reduce the risk of unauthorized access. No system is perfectly secure, and we can't guarantee against every possible compromise; we disclose what we can control and remain transparent about incidents that affect you.

8. Your choices and rights

You can ask what data we hold about you and request a correction by contacting support.
You can request deletion of data we're not legally required to keep — but we can't delete onchain transaction history, and we may need to retain records tied to an active or completed transfer for compliance and audit purposes.
You can delete your optional Settley profile and linked contact identities at any time using the /forgetme command in the bot. This also erases any uploaded identity verification documents and the associated compliance profile.
If you're in a jurisdiction with specific data-protection rights (e.g. GDPR, UK GDPR, or similar regimes), those rights apply to the extent the law requires, and we'll honor lawful requests through support.

Nigeria — NDPC

We process the personal data of Nigerian residents in accordance with the Nigeria Data Protection Act 2023 (NDPA) and the Nigeria Data Protection Regulation 2019 (NDPR), as overseen by the Nigeria Data Protection Commission (NDPC).

Lawful basis: Identity verification (KYC) data is processed on the basis of a legal obligation — specifically, compliance with the Central Bank of Nigeria's Anti-Money Laundering and Combating the Financing of Terrorism (AML/CFT) Regulations, which require customer due diligence for transactions above prescribed thresholds.
Consent: Where we rely on your consent — for example, before collecting your identity details for KYC — you will be shown a clear notice and given the opportunity to agree before data collection begins. You may withdraw consent at any time using /forgetme, subject to any legal-retention obligations described above.
Retention periods: Document images: up to 30 days. Identity verification records: 5 years. Transaction records: 7 years. These periods reflect CBN AML/CFT record-keeping requirements.
Your rights under the NDPA: You have the right to access, correct, and (where legally permitted) request erasure of your personal data. To exercise these rights, contact us at [email protected].
Complaints: If you believe your data protection rights have not been respected, you may lodge a complaint with the Nigeria Data Protection Commission at ndpc.gov.ng.

9. Age restriction

Settley Send isn't directed at children and isn't intended for use by anyone under 18 (or the age of majority in their jurisdiction). We don't knowingly collect data from minors.

10. Changes to this policy

We may update this policy as the product or our legal obligations change. Material changes will be reflected here with an updated date at the top of the page.

11. Contact

Email: [email protected]
Telegram: @settleysendbot

This page is product disclosure copy, not legal advice. Final production text — including any jurisdiction-specific data-protection language — should be reviewed by qualified counsel before this is relied on as a binding privacy policy.