HuiLink Pay · Privacy Policy
Version: v2.0 (Official Release)
Drafted: 2026-07-08 · Published: 2026-09-12
Effective: 2026-09-12
Last updated: 2026-09-12
Applies to: HuiLink Pay mobile and web applications
⚠️ This is a technical compliance template, not legal advice. Must be reviewed by qualified legal counsel and localized to target jurisdictions before publication.
📚 Version Index
| Version | Date | File | Change |
|---|---|---|---|
| **v2.0** | **2026-09-12** | **This document (official)** | **Entity & governing-law finalized (Ecoin Digital Asset Exchange LTD · Colorado) · Official release** |
| **v1.0** | **2026-07-08** | v1.0 | **Initial · GDPR / CCPA / PIPL / AML compliance baseline** |
1. Who We Are
Ecoin Digital Asset Exchange LTD ("we", "us", "HuiLink Pay") · Registered in the State of Colorado, United States · Registration No. Colorado Entity ID 20251543897 · Contact privacy@huilinkpay.com
We operate the HuiLink Pay mobile and web applications, providing peer-to-peer / over-the-counter cross-border foreign exchange matching, merchant verification, order chat, wallet history, and dispute arbitration.
2. Information We Collect
We collect only what is necessary, in five categories:
2.1 Provided by you
- **Account**: email, phone, display name, language, country/region
- **KYC**: legal name, ID type/number/country, ID photos (front/back/handheld), selfie
- **Merchant credentials** (when applying): business name, business type, operating regions, credentials
- **Payment methods**: bank card, Alipay, WeChat, Wise, etc. — account holder name, last 4 digits, holder identity
- **Transactions**: orders, chat messages, payment proofs, appeal evidence
- **Customer support**: your inquiries, attachments, conversation history
2.2 Collected automatically
- **Device**: model, OS, app version, language, timezone, screen size
- **Network**: IP address, approximate location (city level), carrier
- **Application logs**: login time, page views, clicks, crash reports
- **Push identifiers**: APNs Device Token, FCM Registration Token (for notifications)
2.3 From third parties
- Exchange rate data sources (European Central Bank, Frankfurter, etc.)
- KYC service providers (when third-party verification is enabled)
- Payment service providers (when card deposits are enabled)
2.4 Sensitive information
- **ID / passport numbers**: used solely for KYC verification · encrypted at rest · not disclosed externally
- **Facial biometric** (selfie): used only for human identity review · not stored in any facial recognition database
2.5 Children
This application is intended for users aged 18 and above. We do not knowingly collect information from minors. Any such data is deleted upon discovery.
3. How We Use Your Information
| Purpose | Data | Legal basis |
|---|---|---|
| Provide account services | Account, KYC | Contract performance |
| Match P2P transactions | Account, payment, transaction | Contract performance |
| Anti-fraud / AML screening | All data | Legal obligation, legitimate interest |
| Customer support | Contact, transaction | Contract performance |
| Push notifications | Push tokens, account | Your consent (revocable) |
| Product analytics & improvement | Device, logs (de-identified) | Legitimate interest |
| Regulatory compliance | All (as required by law) | Legal obligation |
| Service change notifications | Contact | Contract performance |
We will not:
- Sell your personal information to third parties
- Use it for targeted advertising (unless you separately consent)
- Use it for automated decision-making with legal effects (e.g. credit scoring)
4. Who We Share With
We share only in the following cases, and require recipients to meet equivalent protection obligations:
- **Counterparties**: in P2P orders, you and the other party see each other's display name, UID, chat, and payment proofs
- **Platform merchants/users**: information you choose to publish (e.g. merchant name, success rate)
- **KYC providers**: only necessary ID materials for verification
- **Payment providers**: necessary account information for settlement
- **Cloud providers**: AWS / Alibaba Cloud / Tencent Cloud (data hosting, DPA signed)
- **Push providers**: APNs (Apple), FCM (Google) · only push tokens and message content
- **Email providers**: SMTP (notification emails only)
- **Law enforcement**: as legally required (logged)
- **Corporate transactions**: mergers/reorganizations may involve transfer (advance notice given)
5. Cross-Border Data Transfers
Our servers are located in Singapore (Tencent Cloud data centers). To serve global users, your data may be transferred and stored across jurisdictions. Safeguards include:
- **Standard Contractual Clauses (SCC)** for GDPR transfers
- Transport encryption (TLS 1.3)
- At-rest encryption (AES-256)
- Data minimization principle
6. Your Rights
Regardless of whether you are covered by GDPR / CCPA / PIPL:
| Right | Description | How to exercise |
|---|---|---|
| Access | View data we hold about you | App "Me → Privacy Center → Export" |
| Rectification | Correct inaccurate data | App "Me → Profile / KYC" |
| Erasure (right to be forgotten) | Request deletion | Email privacy@huilinkpay.com |
| Restriction | Restrict certain processing | Email privacy@huilinkpay.com |
| Portability | Structured data export | App "Me → Export" |
| Withdraw consent | Withdraw notification opt-ins | App "Me → Settings → Notifications" |
| Object | Object to legitimate-interest processing | Email privacy@huilinkpay.com |
| Complain | File with regulator | Your local data protection authority |
Response time: within 30 days (GDPR standard), extendable to 90 days for complex cases with notice.
Note: Some data (e.g. AML records) is subject to statutory retention and cannot be immediately deleted.
7. Retention Periods
| Data category | Retention |
|---|---|
| Account information | Duration of account · deleted within 30 days of closure |
| KYC materials | **≥ 5 years** post-transaction (AML law) |
| Transaction records | **≥ 5 years** (AML law) |
| Chat & proofs | 2 years post-transaction · for dispute traceability |
| Application logs | 90 days · then aggregated/de-identified |
| Support conversations | 3 years |
| Push tokens | Until account closure or notifications disabled |
8. Security
- Transport: HTTPS + TLS 1.3
- Storage: encryption at rest (disk-level DB encryption · KYC materials stored as base64 in MEDIUMTEXT columns)
- Access control: least privilege · staff require 2FA + audit logs
- Passwords: bcrypt one-way hash
- Sessions: JWT + token_version for forced logout
- Regular security audits and penetration testing
- Incident response: notify regulators and affected users within 72 hours of breach discovery (GDPR)
9. Cookies and Tracking (Web)
We use only functional cookies (login session, language preference) · no third-party tracking/advertising cookies. iOS versions comply with App Tracking Transparency (ATT) and perform no cross-app tracking.
10. Changes to This Policy
We may update this policy. Material changes will be communicated via:
- In-app modal · mandatory read on next launch
- Push / email (if applicable)
- Official site · at least 30 days advance notice
Continued use constitutes acceptance. You may close your account instead.
11. Contact Us
- **Data Protection Officer**: GUOKANG YANG · privacy@huilinkpay.com
- **General privacy inquiries**: privacy@huilinkpay.com
- **Customer support**: support@huilinkpay.com
- **Mailing address**: 5142 N Academy Blvd Unit #4322, Colorado Springs, CO 80918, United States
12. Governing Law
This policy is interpreted and applied under the laws of the laws of the State of Colorado, United States.
_v2.0 · Official Release_