Data Privacy
Policy

1. About this Policy

Pasiv Financial Limited is registered in the DIFC and subject to the DIFC Data Protection Law 2020. This Policy explains how we collect, use, share and protect personal information through our website, mobile application, Agent services and any web application, API or Model Context Protocol (MCP) connection provided or expressly authorised by Pasiv, as available. Mentioning a feature does not mean it is available at launch.

Personal information is information that identifies you directly or indirectly, including linked account, financial, device and AI records. We are committed to its confidentiality, integrity and security. Read this Policy with our Client Agreement. Privacy consent, contractual acceptance and approval of individual financial transactions are separate. Contact us through the app or at support@pasiv.ae.

2. Information we collect

• Information you provide: name, contact details, date of birth, residency, identity documents, photograph, registration and login details, settings, bank account and IBAN, employment and source of wealth; messages, emails and attachments, support discussions, survey answers, promotions and service interests; and deposit, withdrawal, beneficiary, investment and holdings information.
• Device and usage information: device identifiers, operating system, network and browser details, login activity, IP address, advertising ID, service usage and links followed. We use GPS/IP location for fraud protection, subject to applicable permissions. With your permission, contacts are accessed solely to show which contacts use Pasiv. You can reset or limit advertising identifiers through device settings.
• External sources: KYC, anti-money-laundering and fraud-prevention providers for identity checks and application risk assessment; authentication information from supported social sign-in; and public profile details and messages when you contact us through social media.
• AI interactions: prompts, submitted or authorised files, voice recordings and transcripts, generated responses, proposed instructions, relevant portfolio/account activity, preferences, permitted connected-tool information and operational metadata. This can include remembered information and inferred preferences described in section 5.

Information collected depends on the services, permissions and connections you use. Refusing information or consent needed for a feature may make it unavailable.

3. Why we use information

We rely on an applicable lawful basis for each purpose:

• Contract: assess your application, provide agreed services and process transactions; communicate account and service changes; provide support, resolve enquiries and complaints, and exercise contractual rights.
• Legal obligations: verify identity, perform required due diligence and immigration/fraud checks, validate tax residency, prevent fraud, money laundering and tax evasion, retain required records and meet financial-services, tax, regulatory and law-enforcement requirements.
• Legitimate interests: protect people, property and services; maintain security and reliability; investigate misuse; improve products and safety controls; personalise features using account and transaction information; analyse usage and advertising responses, seek feedback and provide relevant marketing. These interests must not override your privacy rights. Where appropriate, we share fraud-prevention information and account-holder details with financial institutions to confirm payment recipients or trace disputed or fraudulent payments.
• Consent: optional marketing, community/profile sharing, relevant disclosures to applications or partners, and AI processing as explained below. Partners may provide information about their services where you agree. Public-interest or vital-interest grounds apply only where the relevant legal conditions are met.

We obtain explicit informed consent before using personal financial data for AI features. Optional Adaptive AI additionally requires express activation and agreement to Pasiv-managed provider/model selection. Each live trade, deposit and withdrawal still requires separate biometric or OTP approval.

You may withdraw consent through available settings or support. Withdrawal does not affect earlier lawful processing or processing justified by another lawful basis, including legal obligations. We explain material changes to AI data use and the effect of your choices.

4. Cookies, personalisation and marketing

We use cookies, pixels and similar technologies to recognise browsers/devices and sign-ins, remember preferences, personalise content and services, improve security, prevent fraud, perform diagnostics and measure usage and performance. They may record language, country and pages viewed. Necessary cookies support basic service functions; personalisation cookies remember choices; analytical cookies help us improve services. Convenience features do not bypass transaction approval.

Consent is obtained where required for optional cookies. You may withdraw consent or block/delete cookies through available controls or browser settings; some features may then be unavailable. Account settings allow you to manage available personalisation and advertising preferences.

We may promote relevant products through the app or other channels based on service use and information we hold. We do not share identifying information with social media companies other than your mobile advertising ID. Identifiable data is not shared for third parties’ own direct marketing without permission. You can opt out of marketing through email or available settings and withdraw optional community/profile-sharing consent.

5. AI and Agent services

Approved AI providers may include OpenAI, Anthropic and other supported providers. Available options may include Pasiv’s included service with limited reasoning, your own provider API key or supported subscription sign-in, and optional Adaptive AI when introduced. Adaptive AI is not included at initial Agent launch. Supported integrations and provider terms apply.

We use relevant information to generate responses, provide account/tool context, prepare instructions for your review, and support service operation, security, safety monitoring, compliance and investigation. AI context may include authorised account or connected-service information beyond your typed message; it does not grant unrestricted access to your files, accounts or services.

Memory and background features: the agent may retain relevant goals, preferences and conversation summaries, including preferences inferred from interactions, to personalise later responses. Enabled background features may check relevant account or portfolio information and send updates while you are not chatting. These activities remain within the authorised service scope and do not authorise financial transactions. You may ask support to correct or delete remembered personal information, subject to applicable retention requirements. Optional preferences, including Sharia-related preferences, may reveal sensitive information; we process them only for the requested feature with applicable consent and safeguards.

Voice: when you use voice input, recordings may be sent to a transcription provider and the resulting text processed as an AI input. Voice and transcript records are subject to the retention and provider arrangements in section 9.

Where Pasiv controls AI requests, we minimise disclosed data and mask or remove direct identifiers where appropriate and feasible. We do not intentionally include government-issued identifiers for AI response generation. Prompts and authorised documents may still identify you; different connections may use different processing routes. Avoid unnecessary sensitive information. Never include credentials in ordinary prompts, monitoring records or shared support messages.

You choose submitted content and optional services/connections. Use available settings or support to disconnect a provider or tool, stop optional AI processing or withdraw applicable consent. This does not itself close your brokerage account or delete records lawfully retained.

Your own provider account is also governed by its privacy settings and terms. Pasiv remains responsible for its own processing and services. Provider retention and secondary-use arrangements vary. Safety review does not permit unrestricted model training on identifiable content: any separate Pasiv training or fine-tuning use requires an approved purpose, lawful basis, appropriate notice and consent where required.

6. Credentials, security and human oversight

We use appropriate technical and organisational safeguards, including secure transmission, encryption where applicable, restricted access and purpose limitations, to protect against loss, misuse, unauthorised access, disclosure, alteration or destruction. Payment transmissions use TLS or equivalent secure transport. We take reasonable steps to keep information accurate, complete and suitable for its purpose.

Customer API keys are processed and stored within systems supporting the Agent service. Access is restricted to authorised systems and personnel where necessary for provisioning, account recovery, maintenance, security or support, subject to confidentiality and purpose limitations. Supported provider sign-in uses appropriate authentication safeguards. Pasiv-provided credentials are managed separately. Never send secrets through email or ordinary support messages; revoking credentials or disconnecting a provider may affect service availability.

Pasiv monitors relevant Agent conversations, outputs and technical events for inappropriate guidance, misuse and security or service issues. Authorised staff typically review conversations during business hours; automated monitoring does not imply continuous human review. Staff may provide human support, pause the agent or restrict/end VPS access under the Client Agreement.

Authorised staff may access your VPS as necessary for maintenance, security, support or compliance, including regulatory and AML/CTF checks. Credential access remains subject to the restrictions above. Approved providers may process necessary support and monitoring records under access and data-protection safeguards.

7. Sharing information and other websites

We share only information needed for the relevant service or authorised purpose, applying encryption, masking or other measures to reduce identification where possible. We never sell personal data.

Recipients may include affiliates; brokerage, banking and remittance partners; KYC and fraud-prevention providers; IT, cloud, AI and connected-service providers; business intelligence, analytics and marketing providers; email, communications and customer-support providers; and recipients you authorise.

Before sharing personal data with affiliates or trusted service providers, Pasiv conducts due diligence on their security and data-protection controls and requires appropriate contractual safeguards. We seek permission where required for sharing with other applications or partners. External websites are outside our control; review their privacy practices.

We may disclose information to regulators, tax authorities, law enforcement, courts, dispute-resolution bodies, financial institutions or other parties where legally required or otherwise lawfully necessary to prevent financial crime, trace funds, resolve disputes or meet legal obligations. Information may also be shared in a corporate restructuring, merger, acquisition or takeover.

8. International processing and VPS hosting

Cloud, AI, connected-service and support providers may process data outside the DIFC, including in the United States, European Union and other jurisdictions used by approved providers. We assess transfers and apply an appropriate lawful basis and safeguards, such as recognised adequacy arrangements or contractual protections. Accepting this Policy does not replace those safeguards. Request recipient and transfer information at support@pasiv.ae.

Pasiv’s core platform and customer data remain on its existing AWS infrastructure. Dedicated customer VPSs use reputable cloud providers and may operate in the EU or other approved locations; not every VPS or AI provider is hosted by AWS.

Under the Client Agreement, Pasiv may change hosting with data-protection safeguards, migration of personal files and preservation of the same user experience. Routine maintenance preserves files; a notified factory reset may delete them. Maintain your own backups. The Agreement governs machine management and access termination; material privacy changes are notified as described below.

9. Retention, access termination and deletion

• Core records: account, onboarding, transaction and compliance records are retained during your account relationship and generally for six years after closure. Longer retention may apply for legal requirements, fraud/AML matters, legal claims or holds.
• AI and operational records: conversations, outputs, remembered information, voice/transcription, monitoring, security and support records are retained only for relevant operational, legal, compliance and security purposes and applicable periods, including investigations or legal holds. Provider-held records follow the relevant provider arrangements and terms. The core six-year period does not automatically apply to all AI records or VPS files.
• VPS files: cancelling renewal does not itself close the account or request deletion; access may continue through the paid period or applicable payment grace period. When Agent/VPS access ends under the Agreement, files are deleted immediately, including following an eligible Agent refund or expiry of an unresolved payment grace period. Pasiv provides the applicable advance download notice. Resubscribing provides a fresh VPS; deleted files are not restored.

Deleting VPS files does not automatically erase separately retained account, AI, compliance, security or monitoring records. We assess personal-data deletion requests under applicable rights, retention duties and lawful exceptions, respond within applicable timeframes and notify you of the outcome.

10. Your rights and complaints

Subject to applicable legal conditions and exceptions, you may access or obtain a copy of your personal data; correct inaccurate or outdated information; request deletion, restriction or portability where applicable; object to processing or marketing; withdraw consent; and request human review of a relevant automated decision. These rights extend to personal information processed through AI features and remembered information.

Use the app, website or support@pasiv.ae for requests or complaints. We will investigate concerns and explain applicable limits, including legal retention requirements. You may also raise concerns with the DIFC Commissioner of Data Protection.

11. Changes to this Policy

Updates will be posted here. We will notify you by email of significant changes, including material changes to relevant privacy arrangements, and obtain further consent where required.