Privacy Policy

Effective Date: August 31, 2026 Last Updated: August 31, 2026 Operator: Songhai LLC (d/b/a SonghaiPay)

1. Introduction and Scope

This Privacy Policy explains how Songhai LLC, a Georgia limited liability company doing business as SonghaiPay ("SonghaiPay," "we," "us," or "our"), collects, uses, discloses, transfers, retains, and protects information about you when you visit https://songhaipay.com, use our mobile or web applications, or use any of our services. In this Policy, "you," "your," "Customer," and "Sender" refer to the individual using our services.

SonghaiPay is a technology and program-management platform for cross-border remittances, charitable giving, e-commerce fulfillment, and mobile top-ups. SonghaiPay is not a bank and does not itself hold customer funds. Regulated money transmission, payment processing, and payout settlement are performed by licensed partners described in Section 3. SonghaiPay does not claim to hold money transmitter licenses in its own name.

1.1 Services Covered by This Policy

This Policy applies to all of the following services (collectively, the "Services"):

1. Money transfers from the United States to 12 or more African countries, with payouts to mobile money wallets, bank accounts, and cash pickup locations. Named markets include Nigeria, Ghana, Kenya, and Senegal.
2. Donations and charitable giving to verified causes such as emergency relief, education, healthcare, and community development, whether added to a transfer or made on a standalone basis. Funds are pooled by cause and distributed by vetted local partner organizations, and campaign updates and impact reporting are published.
3. Shop & Send, the purchase of goods in the United States for local delivery to recipients in Africa.
4. Airtime and data top-ups, providing instant carrier recharge to supported African mobile numbers, funded from a SonghaiPay wallet balance or a linked payment method.
5. The SonghaiPay wallet, a stored-value balance used to fund top-ups and transfers. Wallet balances are held with licensed partners and not by Songhai LLC. They are not FDIC-insured deposits and earn no interest.

1.2 What This Policy Does Not Cover

This Policy does not cover the independent privacy practices of our licensed partners, payout partners, merchants, logistics providers, mobile carriers, charitable distribution partners, or any third-party website or application you reach from our Services. Where a partner acts as an independent controller of your information, that partner's own privacy policy governs its processing. Links to the principal partner policies appear throughout this document.

1.3 Related Documents

This Policy should be read together with our Terms of Service, Refund Policy, and KYC / AML Policy. Information about charitable programs is available on our Donations page. The current version of this Policy is always published at https://songhaipay.com/privacy-policy.

1.4 Age Restriction

The Services are available only to individuals who are at least 18 years old and who have full legal capacity to enter into a binding contract. We do not knowingly collect personal information from children under 13, and we do not offer the Services to anyone under 18. See Section 14.

2. Who We Are

Songhai LLC operates the SonghaiPay brand, platform, mobile and web applications, customer support function, compliance program, and partner integrations. For purposes of US state privacy laws, Songhai LLC is the "business" or "controller" with respect to the personal information described in this Policy, except where we act as a service provider or processor on behalf of a licensed partner in connection with that partner's own regulatory obligations.

Postal address for privacy correspondence:

Songhai LLC (d/b/a SonghaiPay) Attn: Privacy 650 Ponce De Leon Ave Ste. 300 #1380 Atlanta, GA 30308 United States

Email: privacy@songhaipay.com

3. Licensed Partners and Their Role in Processing Your Information

Because SonghaiPay is not a bank and does not perform regulated money transmission itself, the movement of your funds and much of the regulatory verification associated with it is performed by licensed partners. Those partners receive personal information about you directly from you or from us, and in most cases they process that information as independent controllers under their own legal and regulatory obligations, not merely as our processors. This distinction matters: a partner's collection, use, and retention of your information for its own legal compliance is governed by the partner's privacy policy and cannot be overridden by SonghaiPay.

3.1 United States Corridor — Stripe and Bridge

Payment processing for the US side of a transaction, including debit card payments, bank and ACH debits, and linked account funding, is provided by Stripe, Inc. and its affiliates.

• Stripe Payments Company is licensed for money transmission under NMLS ID #1280479 and is licensed or regulated as a money transmitter by state regulators including the New York State Department of Financial Services and the Georgia Department of Banking and Finance, as disclosed on the Stripe licensing disclosures page.
• Bridge Building Inc., a Stripe company, holds money transmitter and virtual-currency licenses in applicable US states under NMLS #2450917 and provides money transmission and stablecoin settlement services for SonghaiPay transfers, as disclosed in the Bridge US licenses and registrations page.

Your use of the funding leg of a transaction is also subject to the Stripe Services Agreement, the Stripe Consumer Terms, and the Stripe Privacy Policy. As reflected in those terms, Stripe may verify your identity, request additional information or documentation, collect and process identity documents and biometric identifiers derived from a government ID and a selfie, conduct anti-money-laundering, politically exposed person, and sanctions screening, apply export-control and high-risk-jurisdiction restrictions, and suspend or decline activity that it believes to be unlawful, fraudulent, or harmful, or that presents an unacceptable level of risk.

3.2 Africa Corridor — Yellow Card

Payouts, local currency settlement, stablecoin on-ramp and off-ramp, and mobile-money and bank disbursement in Africa are provided by Yellow Card Inc. and its regional affiliates, including Yellow Card Financial South Africa. The applicable terms are published on the Yellow Card legal hub, including the Master Service Agreement and the Widget Terms.

Yellow Card holds operational licenses and regulatory registrations across African markets and maintains jurisdiction-specific privacy policies for the European Union, Nigeria, South Africa, and the United States, as well as a South Africa customer complaint policy, all linked from the Yellow Card legal hub. As reflected in those terms, Yellow Card requires that users be at least 18 years old, satisfy its own KYC and AML requirements, not be sanctioned by or resident in a country sanctioned by the United States, United Kingdom, or European Union, and hold receiving accounts — mobile money, bank, or blockchain wallet — in the customer's own name and under the customer's sole control. Verifying these conditions necessarily involves Yellow Card's independent processing of your and your recipient's personal information.

3.3 What This Means in Practice

When you fund a transfer, personal information you provide to us is shared with Stripe or Bridge so that the funding and settlement leg can be performed lawfully. When a payout is made in Africa, recipient information and transfer details are shared with Yellow Card and, through Yellow Card, with the local bank, mobile money operator, or cash-pickup agent that credits the funds. Each of those entities may be required by its own regulator to record, retain, and report information about the transaction. SonghaiPay cannot delete records that a licensed partner is legally required to keep.

4. Categories of Information We Collect

4.1 Information You Provide to Us

Account registration and profile. Full legal name, email address, mobile phone number, password or authentication credential, country of residence, preferred language and currency, and, where applicable, a profile photograph.

Identity verification information. Date of birth, residential address, nationality, Social Security number or individual taxpayer identification number or other government identifier, and images of government-issued identity documents such as a passport, driver's license, state identification card, or permanent resident card, together with a live selfie image used for liveness and match verification. Biometric processing is described separately in Section 6.

Financial and payment information. Debit card number, expiration date, and security code; bank account and routing numbers; linked-account credentials processed through a secure account-linking provider; billing address; wallet balance and transaction history; payment method metadata such as card brand, issuing country, and last four digits.

Transaction information. Send amount, receive amount, quoted exchange rate, fee, funding method, payout method, transfer purpose or reason for sending, source of funds where requested, relationship to the recipient, and the date and time of each instruction.

Donation information. The cause or campaign selected, donation amount, whether the donation was added to a transfer or made standalone, recurring donation preferences, and any dedication message or public display preference you choose.

Shop & Send information. Items purchased, order value, delivery address in the destination country, recipient delivery contact details, delivery instructions, and any customs or import information required to complete fulfillment.

Airtime and top-up information. The mobile number being recharged, the destination carrier, the bundle or denomination selected, and the funding source.

Customer support and communications. The content of your emails, in-app chat messages, support tickets, and phone calls with us, including call recordings and transcripts where we notify you that a call is recorded; your survey responses; and your reviews and feedback.

Compliance and dispute information. Documents and explanations you supply in response to an enhanced due diligence request, an error notice, a cancellation request, a chargeback, or a law enforcement or regulatory inquiry.

4.2 Information About Recipients and Beneficiaries

To deliver a transfer, a Shop & Send order, or a top-up, you provide information about another person. This typically includes the recipient's full name, mobile number, country and city, mobile money wallet identifier or bank account number and bank name, delivery address, blockchain wallet address where applicable, and, for cash pickup, identification details required by the payout agent.

If you provide information about a recipient, you confirm that you are authorized to do so and that you have informed the recipient that their information will be processed by SonghaiPay and its payout partners to complete the transaction. Recipients may contact privacy@songhaipay.com to exercise the rights described in Section 12. Where a payout is credited to a mobile money or bank account, the receiving institution processes the recipient's information under its own policies, and, as reflected in the Yellow Card Master Service Agreement, a payout that has been credited cannot be reversed, which limits what SonghaiPay can undo after the fact.

For charitable donations, we may collect limited information about beneficiaries from our distribution partners for impact reporting. That information is aggregated or de-identified before publication wherever possible, and we do not publish identifiable beneficiary information without documented consent obtained by the local partner.

4.3 Information We Collect Automatically

Device and application data. Device model, operating system and version, unique device and installation identifiers, mobile advertising identifier where you have not opted out, app version, language and locale, screen dimensions, time zone, battery and network state where relevant to diagnostics, and a device fingerprint used for fraud detection.

Log and usage data. IP address, access dates and times, pages and screens viewed, features used, buttons and links clicked, referring and exit pages, session duration, crash logs, latency and performance metrics, and error traces.

Approximate location data. Location inferred from IP address, and, where you grant permission, more precise device location used to locate cash-pickup agents or to assess transaction risk. You may withdraw location permission at any time in your device settings, though some features may then be unavailable.

Cookies and similar technologies. Cookies, local storage, software development kits, pixels, and web beacons, as described in Section 9.

Fraud and security signals. Failed login attempts, password reset activity, velocity and pattern signals across accounts and devices, proxy or VPN indicators, and emulator or rooted-device indicators.

4.4 Information We Collect From Third Parties

• Identity verification vendors, who compare the information and documents you provide against authoritative and commercially available databases and return a match, mismatch, or risk score, together with document authenticity and liveness results.
• Credit bureaus and consumer reporting agencies, from which we or our partners may obtain identity-confirmation data, address history, and, where you apply for a credit-based product, a consumer report used to evaluate the application.
• Sanctions, watchlist, and politically exposed person screening databases, including OFAC Specially Designated Nationals and consolidated non-SDN lists, sectoral and country-program lists, other national and multilateral sanctions lists, adverse media sources, and PEP registers.
• Payment partners, including Stripe, Bridge, and card networks and issuing banks, who return authorization results, decline reasons, chargeback notices, account-status updates, and risk indicators, as described in the Stripe Privacy Policy.
• Payout partners, including Yellow Card and its regional affiliates, banks, mobile money operators, and cash-pickup agents, who return payout status, failure reasons, recipient account name-match results, and settlement confirmations.
• Mobile carriers, for airtime and data top-ups, who confirm that a number is valid and active, identify the carrier and country, and return recharge success or failure; and, for authentication, who may provide carrier-based number verification or SIM-change signals used to detect account takeover.
• Charitable distribution partners, who provide distribution confirmations, program reports, and impact metrics.
• Merchants and logistics providers in the Shop & Send program, who provide order, inventory, shipping, customs, and delivery-confirmation data.
• Analytics, attribution, and advertising platforms, which provide aggregated campaign performance and, where you have consented to such technologies, attribution data linking an install or signup to a campaign.
• Publicly available and social sources, including business registries, court and enforcement records, and information you make public on social media, used for verification, due diligence, and fraud investigation.

4.5 Sensitive Information

We collect a limited set of sensitive personal information: government identifiers, financial account information, precise geolocation where you permit it, account credentials, and biometric information derived from identity verification. We collect sensitive information only for the purposes described in this Policy and, for US state privacy law purposes, only for purposes permitted without a separate right to limit, such as verifying identity, preventing and detecting fraud, ensuring security, and complying with law.

5. How We Collect Information About You Across Our Services

Information reaches us in four principal ways: directly from you when you register, verify your identity, fund a transaction, or contact support; automatically from your device and browser as you use the Services; from third parties as described above; and from our licensed partners as a transaction progresses. Where a partner collects information directly from you inside an embedded flow — for example an identity verification widget or a payment element — that partner may collect the information first and share it with us, or may retain it without sharing the underlying documents with us at all.

6. Biometric Information Processing

6.1 What We Process

To satisfy customer identification program requirements and to prevent identity fraud, our identity verification flow asks you to photograph a government-issued identity document and to take a live selfie. The verification vendor and, for the US corridor, Stripe generate a biometric identifier in the form of a mathematical representation of facial geometry ("face template") from the selfie and from the photograph on your document, and compare the two templates to confirm that you are the person depicted on the document. The vendor also performs liveness detection to confirm that a live person, rather than a photograph, mask, or synthetic image, is present.

6.2 Purposes

Biometric information is processed exclusively to:

1. verify your identity for customer identification program purposes under the Bank Secrecy Act and implementing rules;
2. detect and prevent identity theft, synthetic identity fraud, account takeover, and impersonation;
3. satisfy the identity verification requirements of licensed partners, as reflected in the Stripe Services Agreement and the Yellow Card Master Service Agreement; and
4. respond to lawful requests where the underlying verification record is relevant.

We do not use biometric information for advertising, profiling unrelated to fraud and compliance, emotion or demographic inference, or general surveillance. We do not sell biometric information, and we do not license, lease, trade, or otherwise profit from it.

6.3 Disclosure

Biometric identifiers and the associated verification results are disclosed only to: the identity verification vendor performing the comparison; the licensed partner whose regulatory obligation the verification satisfies; our fraud and compliance personnel and their auditors and examiners; and, where legally compelled, courts, regulators, and law enforcement. We do not otherwise disclose biometric information without your consent unless disclosure is required by law, subpoena, or valid warrant.

6.4 Retention and Destruction

Face templates generated during verification are retained only as long as necessary to complete verification and to defend against fraud and dispute claims arising from it. Templates are destroyed no later than the earlier of (a) the date on which the initial purpose for their collection has been satisfied and any related fraud investigation or dispute has concluded, and (b) three years after your last interaction with SonghaiPay. Document images and the verification decision itself, which are records of a customer identification program, are retained for at least five years after account closure as required by the Bank Secrecy Act, and are then deleted or de-identified. Retention by a licensed partner is governed by that partner's schedule.

6.5 Consent

Before biometric processing begins, we present a written notice describing what will be collected, why, how long it will be kept, and who will receive it, and we obtain your affirmative written consent through the verification interface. You may decline. If you decline, we cannot complete identity verification, and you will not be able to use the Services, because the underlying obligation is regulatory rather than optional. You may withdraw consent for future biometric processing by writing to privacy@songhaipay.com; withdrawal does not affect the lawfulness of processing already completed, and does not remove records we are legally required to retain.

7. How We Use Your Information

7.1 Service Delivery and Account Administration

To create and maintain your account and wallet; to authenticate you; to display quotes with the exchange rate and fee disclosed and locked at checkout; to initiate, route, track, and complete transfers, donations, Shop & Send orders, and top-ups; to hold and reconcile stored-value balances with licensed partners; to generate receipts and disclosures; to process cancellations, refunds, and error claims under our Refund Policy; and to provide customer support.

We use transaction information to operate our business model transparently: SonghaiPay earns revenue from transfer fees and from a foreign exchange margin built into the quoted rate. The rate shown at checkout is the rate applied to the recipient amount.

7.2 Compliance and Regulatory Obligations

To comply with the Bank Secrecy Act and the USA PATRIOT Act, 31 CFR Chapter X, and FinCEN rules for money services businesses, including customer identification, suspicious activity monitoring and reporting, currency transaction reporting, funds transfer recordkeeping and the Travel Rule at the US$3,000 threshold, and the five-year records retention requirement. Where a suspicious activity report is filed, we are prohibited by law from disclosing its existence or contents to you, and we will neither confirm nor deny a filing.

To screen you, your recipients, and counterparties against sanctions programs administered by the US Department of the Treasury's Office of Foreign Assets Control, including the Specially Designated Nationals list, consolidated non-SDN lists, sectoral programs, and comprehensive country programs, and to block, reject, and report transactions as required. To apply export-control and high-risk-jurisdiction restrictions consistent with partner requirements.

To meet consumer protection obligations under Regulation E, Subpart B, the Remittance Transfer Rule at 12 CFR 1005.30 through 1005.36 (Consumer Financial Protection Bureau), which requires prepayment disclosures and receipts showing the transfer amount, fees, taxes, exchange rate, total, amount to be received, and date of availability; supports your right to cancel for a full refund within 30 minutes of payment, and longer where funds are scheduled for a future date, provided the funds have not yet been picked up or deposited; and supports your right to report an error within 180 days of the promised date of availability, with investigation and report within 90 days and, where an error occurred, a refund or resend at your election. Processing your identity, contact, and transaction information is necessary to deliver these disclosures and to investigate error notices.

To comply with tax information reporting, subpoenas, court orders, regulatory examinations, and the recordkeeping obligations of our licensed partners; and to support state money transmitter oversight exercised through those partners, whose licensing disclosures are published at https://stripe.com/legal/spc/licenses and https://www.bridge.xyz/legal/licenses/us-licenses-and-registrations.

Where our processing of financial information is subject to the Gramm-Leach-Bliley Act and Regulation P, we handle that information consistently with those requirements and with any privacy notice we provide under them.

7.3 Security and Fraud Prevention

To authenticate logins and step up authentication when risk is elevated; to detect and investigate fraud, scams, romance and impersonation fraud, mule accounts, account takeover, unauthorized transactions, and prohibited use; to maintain device and network security; to enforce transaction limits and velocity controls; to investigate and respond to chargebacks and disputes; and to enforce our Terms of Service, including suspending or closing accounts where we or a partner suspect fraud, money laundering, or terrorism financing, or where directed by a regulator or court.

7.4 Business Operations and Improvement

To measure and improve product performance, reliability, and conversion; to debug and test; to conduct internal research and analytics; to forecast liquidity and corridor demand; to manage vendor relationships; to prepare aggregate and de-identified reporting for partners, funders, and regulators; and to protect our legal interests, including establishing, exercising, and defending legal claims.

7.5 Communications

To send transactional and service messages, including verification codes, receipts, payout confirmations, failure notices, disclosure updates, security alerts, and legally required notices. These are not marketing messages and cannot be turned off while your account is active, though you may change the channel where options exist.

To send marketing and promotional communications about new corridors, features, promotional rates, referral programs, and charitable campaigns, where permitted by law and, where required, with your consent. You may unsubscribe at any time using the link in any marketing email, by replying STOP to a marketing SMS, by adjusting in-app notification settings, or by writing to support@songhaipay.com. Message and data rates may apply to SMS.

7.6 Donations and Impact Reporting

To route donations to the selected cause; to pool funds by cause and instruct vetted local distribution partners; to publish campaign updates and impact reporting; to issue donation acknowledgments; and to conduct diligence on distribution partners. Donor names are published only where you opt in to public recognition.

7.7 Credit Products, If Applicable

If we or a partner offer a credit-based product such as a deferred-payment transfer, we will use application information, income and affordability information you provide, and consumer report information obtained from a consumer reporting agency to evaluate eligibility, set terms, service the account, and report performance where applicable. Any such product will be accompanied by the additional disclosures required by the Equal Credit Opportunity Act, the Fair Credit Reporting Act, and applicable state law, and we will tell you at the time of application which entity is the creditor. SonghaiPay does not provide tax or legal advice.

8. Legal Bases for Processing

Where a data protection law requires us to identify a legal basis, we rely on the following.

Where we rely on consent, you may withdraw it at any time, and withdrawal does not affect processing already carried out or processing that rests on another basis. Where we rely on legitimate interests, you may object as described in Section 12.

9. How and With Whom We Share Information

We do not sell your personal information for money, and we do not share it for cross-context behavioral advertising as those terms are defined under California law. We disclose personal information in the following categories of circumstances.

9.1 Licensed Money Transmission and Payment Partners

Stripe, Inc., Stripe Payments Company (NMLS ID #1280479), and Bridge Building Inc. (NMLS #2450917) receive identity, contact, payment, device, and transaction information to process funding, perform money transmission and stablecoin settlement, verify identity, screen for sanctions and AML risk, and meet their own regulatory obligations. See the Stripe Privacy Policy, the Stripe Services Agreement, the Stripe Consumer Terms, and the Stripe licensing disclosures.

9.2 Payout Partners

Yellow Card Inc. and its regional affiliates, including Yellow Card Financial South Africa, receive sender and recipient information, payout instructions, and compliance data to execute local currency settlement, stablecoin on-ramp and off-ramp, and mobile money or bank disbursement, and to perform their own KYC and AML obligations. See the Yellow Card legal hub, which links Yellow Card's jurisdiction-specific privacy policies for the EU, Nigeria, South Africa, and the United States. Downstream banks, mobile money operators, and cash-pickup agents receive the recipient information necessary to credit or release funds.

9.3 Charitable Distribution Partners

Vetted local partner organizations receive campaign-level funding information, distribution instructions, and, where necessary for program delivery, limited donor or beneficiary contact details. They report distribution confirmations and impact metrics back to us.

9.4 Shop & Send Merchants and Logistics Providers

US merchants, freight forwarders, customs brokers, and last-mile delivery providers receive order details, recipient name and delivery address, recipient phone number, and any information required by customs authorities in the destination country.

9.5 Mobile Carriers and Aggregators

African mobile network operators and their aggregators receive the mobile number and recharge instruction to complete airtime and data top-ups and to confirm success or failure. Carriers and messaging providers also receive your number to deliver SMS verification codes and, where used, to provide number-verification or SIM-change signals for authentication.

9.6 Service Providers and Processors

Cloud hosting and storage providers; identity verification and document authentication vendors; sanctions, PEP, and adverse media screening vendors; fraud and device-intelligence vendors; account-linking providers; customer support and ticketing platforms; communications and messaging providers; analytics and crash-reporting providers; accounting, audit, and tax advisers; and outside counsel. Service providers are bound by contract to process personal information only on our instructions, to apply appropriate safeguards, and not to use it for their own purposes.

9.7 Regulators, Law Enforcement, and Legal Process

We disclose information to FinCEN, OFAC, the Consumer Financial Protection Bureau, state financial regulators acting through our licensed partners, tax authorities, courts, law enforcement, and foreign financial intelligence units and regulators where required by law, subpoena, warrant, court order, or regulatory demand, or where necessary to report suspected fraud or financial crime, protect our rights, or protect the safety of any person. Reports of suspicious activity are confidential by law.

9.8 Corporate Transactions

If SonghaiPay is involved in a merger, acquisition, financing, reorganization, sale of assets, or insolvency proceeding, personal information may be disclosed to counterparties and their advisers under confidentiality obligations, and may be transferred as part of the transaction. Any acquirer will remain bound by this Policy with respect to information transferred, unless and until you are notified of a change and, where required, consent to it.

9.9 With Your Direction

We share information when you ask us to, for example when you authorize a linked account, choose to be recognized publicly as a donor, or refer a friend.

9.10 Aggregate and De-identified Information

We may create and share aggregate or de-identified information, such as corridor volumes or campaign impact totals, that cannot reasonably be used to identify you. We do not attempt to re-identify such information.

10. International Data Transfers

SonghaiPay is based in the United States, and our Services are inherently cross-border. Personal information about you and your recipients is transferred to and processed in the United States, in African countries where payouts are delivered — including Nigeria, Ghana, Kenya, Senegal, and South Africa — and in the European Union, the United Kingdom, and other regions where our partners and service providers operate infrastructure or support functions.

Laws in these jurisdictions differ, and some do not provide the same level of protection as the law of your home jurisdiction. Where we transfer personal information across borders, we rely on one or more of the following safeguards:

• Necessity for performance of a contract with you, including the transfer or payout you have instructed, which cannot be completed without sending recipient information to the destination country.
• Standard contractual clauses or equivalent approved transfer mechanisms in our contracts with processors and partners, including the European Commission standard contractual clauses and the UK International Data Transfer Addendum where relevant to Yellow Card's EU-facing operations, as referenced on the Yellow Card legal hub.
• Adequacy decisions where the destination has been recognized as providing adequate protection.
• Statutory transfer conditions under local law, including the transfer provisions of the Nigeria Data Protection Act, Chapter 9 of South Africa's Protection of Personal Information Act, the Ghana Data Protection Act, and the Kenya Data Protection Act.
• Your explicit consent, where no other basis applies and consent is a lawful option.
• Legal obligation, where a transfer is required to satisfy sanctions screening, Travel Rule recordkeeping, or a lawful regulatory or judicial demand.

You may request further information about the safeguards applicable to a specific transfer by writing to privacy@songhaipay.com.

11. Cookies and Similar Technologies

We and our providers use cookies, local storage, SDKs, pixels, and similar technologies on our website and in our applications. Strictly necessary technologies operate at all times because the Services cannot function without them. Other categories operate only where you have consented through our cookie banner or preference center, or where consent is not required by applicable law.

Providers on our website today.

• Meta Platforms (Meta Pixel), in the Attribution and marketing category. It helps us see which of our ads bring people to SonghaiPay. It loads only after you choose “Accept” in our cookie notice, never on account pages (sign-in, sign-up, identity verification, your dashboard and your transfers), and never when your browser sends a Global Privacy Control signal.
• Intercom, which runs our website chat (answered by Intercom’s Fin assistant and our support team), in the Functional category. It sets cookies needed to run the chat and keep your conversation. It receives what you type in the chat and, if you are signed in, your name, email address, phone number and a SonghaiPay account identifier, so your conversation is linked to your account.

You can change your choice at any time with “Your privacy choices” at the bottom of every page of our website.

You can manage cookies through our in-product cookie preference center, through your browser settings, and, on mobile, by resetting or limiting your advertising identifier in your device settings. Blocking strictly necessary cookies will prevent the Services from working. Because we do not share personal information for cross-context behavioral advertising, we do not use cookies to build cross-site advertising profiles about you.

12. Data Retention

We retain personal information only as long as necessary for the purposes described in this Policy, and then for the additional period required by law. Financial crime and consumer protection law sets the floor, and the Bank Secrecy Act five-year minimum governs most transaction and identification records. Where we no longer need information but cannot yet delete it, we restrict access and archive it.

Licensed partners retain their own copies of records under their own schedules. A deletion request to SonghaiPay does not remove records lawfully retained by Stripe, Bridge, Yellow Card, a bank, a carrier, or a regulator.

13. Data Security

We maintain an information security program with administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, use, alteration, disclosure, and loss. Measures include:

• encryption of personal information in transit using current TLS and at rest using strong industry-standard algorithms;
• tokenization of card and bank account data, with card data captured and stored by our PCI DSS validated payment partners rather than by SonghaiPay wherever possible;
• role-based access control, least-privilege provisioning, mandatory multi-factor authentication for staff, and periodic access reviews;
• network segmentation, firewalling, centralized logging, and continuous monitoring with alerting for anomalous access;
• secure software development practices, code review, dependency scanning, penetration testing, and vulnerability management with defined remediation timelines;
• background screening of personnel with access to sensitive data, mandatory security and privacy training, and confidentiality obligations;
• vendor security diligence, contractual security requirements, and periodic reassessment;
• documented incident response, business continuity, and disaster recovery plans that are tested periodically; and
• secure deletion and media sanitization at end of life.

No system is perfectly secure. You are responsible for keeping your credentials confidential, using a unique password, enabling available authentication features, and notifying us immediately at security@songhaipay.com if you suspect unauthorized access. Credential sharing is prohibited under our Terms of Service and under partner terms including the Yellow Card Master Service Agreement.

If a breach of security affecting your personal information occurs, we will notify you and the appropriate regulators as and when required by applicable federal, state, and foreign law.

14. Your Privacy Rights

14.1 Rights Available to All Users

Regardless of where you live, you may ask us to:

• Access the personal information we hold about you and receive information about how we process it;
• Correct inaccurate or incomplete information, subject to re-verification where the information is part of a regulatory record;
• Delete personal information that we are not required to retain;
• Receive a portable copy of information you provided to us in a structured, commonly used, machine-readable format;
• Opt out of marketing communications;
• Withdraw consent for biometric processing, non-essential cookies, or precise geolocation;
• Object to or restrict processing based on legitimate interests;
• Not be subject to a decision based solely on automated processing that produces legal or similarly significant effects, without human review; and
• Complain to us or to a supervisory authority.

Automated tools are used in sanctions screening, fraud scoring, and identity verification. Where an automated result leads to a decline, hold, or account closure, you may request human review by writing to compliance@songhaipay.com, except where telling you the reason would violate the prohibition on disclosing a suspicious activity report or would compromise an investigation.

14.2 California Residents — CCPA and CPRA

If you are a California resident, you have the rights to know, access, delete, correct, and receive a portable copy of your personal information; to opt out of sale and of sharing for cross-context behavioral advertising; to limit the use and disclosure of sensitive personal information; and to be free from discrimination or retaliation for exercising these rights.

Notice of no sale and no sharing. In the 12 months preceding the Effective Date, SonghaiPay has not sold personal information and has not shared personal information for cross-context behavioral advertising. Because we do not sell or share, we do not respond to opt-out preference signals as a sale or sharing opt-out, though we honor them as cookie consent choices where they apply. We do not have actual knowledge of selling or sharing the personal information of consumers under 16 years of age.

Limiting sensitive personal information. We use sensitive personal information only for purposes that California law permits without a right to limit — verifying and maintaining the quality of the personal information we hold, performing services you request, preventing and detecting security incidents and fraudulent or illegal conduct, ensuring physical safety, and complying with law. We do not use or disclose sensitive personal information to infer characteristics about you.

The following table summarizes the categories we handle.

California residents may also designate an authorized agent to submit a request, provided the agent supplies written proof of authorization and we can verify your identity directly.

Note that information we process solely under the Gramm-Leach-Bliley Act, and personal information collected for Bank Secrecy Act compliance, may be exempt from certain state privacy rights. Where an exemption applies, we will explain it in our response.

14.3 Other US State Privacy Rights

If you are a resident of Colorado, Connecticut, Utah, Virginia, or another state with a comprehensive consumer privacy law — including Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky, or Rhode Island as those laws take effect — you generally have the rights to confirm whether we process your personal data, to access it, to correct inaccuracies, to delete it, to obtain a portable copy, and to opt out of targeted advertising, the sale of personal data, and profiling in furtherance of decisions producing legal or similarly significant effects. Utah provides a narrower set of rights and does not include a correction right or an appeal right.

We do not engage in targeted advertising, sale of personal data, or profiling that produces legal or similarly significant effects without human involvement, so there is generally nothing to opt out of. Where a state law requires consent for processing sensitive data, we obtain it, including for biometric processing. Colorado, Connecticut, Virginia, and most other states provide a right to appeal a denied request; see Section 15.3.

Nevada residents may submit a request that we not sell covered information; we do not sell covered information.

14.4 Rights Under African and European Laws

Nigeria — Nigeria Data Protection Act. If you or your recipient is in Nigeria, you have rights of access, rectification, erasure, restriction, portability, and objection, the right to withdraw consent, and the right to lodge a complaint with the Nigeria Data Protection Commission. Yellow Card maintains a Nigeria-specific privacy policy available from the Yellow Card legal hub.

South Africa — Protection of Personal Information Act. You have the right to be notified of collection and of any compromise of your information, to request access to and correction or deletion of your personal information, to object to processing on reasonable grounds, and to complain to the Information Regulator. Yellow Card Financial South Africa maintains a South Africa privacy policy and a South Africa customer complaint policy, both linked from the Yellow Card legal hub.

Ghana — Data Protection Act. You have rights of access, correction, erasure or blocking of inaccurate data, objection to processing likely to cause unwarranted damage or distress, and prevention of direct marketing, and you may complain to the Data Protection Commission.

Kenya — Data Protection Act. You have rights to be informed of use, to access, to object to processing, to correction of false or misleading data, and to deletion, and you may complain to the Office of the Data Protection Commissioner.

European Union and United Kingdom — GDPR, where applicable. Where the GDPR or UK GDPR applies — including to processing by Yellow Card under its EU privacy policy — you have rights of access, rectification, erasure, restriction, portability, objection, and withdrawal of consent, the right not to be subject to solely automated decision-making with legal or similarly significant effects, and the right to lodge a complaint with your supervisory authority. International transfers rely on the safeguards described in Section 10.

Other jurisdictions' laws may grant similar rights. We will honor rights that apply to you under applicable law, subject to the exemptions and retention obligations described in this Policy.

15. How to Exercise Your Rights

15.1 Submitting a Request

Submit a privacy request by:

• emailing privacy@songhaipay.com with the subject line "Privacy Request";
• using the privacy request form or the account settings tools in the SonghaiPay app or website; or
• writing to Songhai LLC, Attn: Privacy, 650 Ponce De Leon Ave Ste. 300 #1380, Atlanta, GA 30308, United States.

Please tell us which right you are exercising, the jurisdiction whose law you are relying on, and enough detail for us to locate your records.

15.2 Verification

To protect your information, we must verify your identity before acting on a request. Verification generally requires that you confirm control of the email address or phone number on your account and confirm two or three data points that match our records, such as recent transaction details. For sensitive requests, including deletion or a request for identity documents, we may require additional verification, including re-verification through our identity verification flow. If we cannot verify you, we will tell you and will not act on the request. Requests from authorized agents require written authorization plus direct verification of the consumer.

15.3 Timing and Appeals

We acknowledge requests promptly and respond within 45 days where US state law applies, with one 45-day extension where reasonably necessary and with notice to you, and within one month where the GDPR applies, extendable by two further months for complex requests. There is no charge for a reasonable request; we may charge a reasonable fee or decline where a request is manifestly unfounded, excessive, or repetitive.

If we deny your request in whole or in part, our response will explain why. Where applicable law provides an appeal right, you may appeal within 45 days by emailing privacy@songhaipay.com with the subject line "Privacy Appeal" and referencing your original request. We will decide the appeal within 45 days and, if we again deny the request, will provide information about how to contact the relevant attorney general or supervisory authority.

15.4 Limits on Deletion

We will decline a deletion request to the extent the information is needed to complete a transaction you requested, to comply with the Bank Secrecy Act, OFAC, Regulation E, tax, or other legal obligations, to detect or prevent fraud or security incidents, to defend legal claims, or where a licensed partner independently retains the record. In those cases we delete what we can and restrict the remainder.

15.5 No Retaliation

We will not deny you goods or services, charge you a different price, provide a different level of quality, or suggest that we will do any of those things because you exercised a privacy right. Denying service for a lawful compliance reason — for example, an inability to verify your identity — is not retaliation.

16. Children's Privacy

The Services are intended solely for adults. You must be at least 18 years old and have full legal capacity to use the Services, a requirement that mirrors both the Stripe Consumer Terms and the Yellow Card Master Service Agreement. We do not knowingly collect personal information from anyone under 18, and we do not knowingly collect personal information from children under 13 as defined by the Children's Online Privacy Protection Act. If we learn that we have collected information from a child under 13, or that an account holder is under 18, we will close the account, delete the information to the extent not subject to a legal retention obligation, and return any remaining balance in accordance with our Refund Policy and applicable law. Parents or guardians who believe a child has provided information to us should contact privacy@songhaipay.com.

17. Do Not Track and Global Privacy Control

Web browsers offer a "Do Not Track" setting, but no common industry standard for interpreting it has been adopted. SonghaiPay therefore does not currently respond to Do Not Track signals. We do recognize the Global Privacy Control and similar opt-out preference signals as an expression of your cookie and advertising preferences, and we apply them to non-essential cookie categories. Because we do not sell personal information or share it for cross-context behavioral advertising, there is no sale or sharing for such a signal to stop.

18. Third-Party Links, Widgets, and Embedded Flows

The Services contain links to and embedded components from third parties, including payment elements, identity verification flows, and partner widgets such as those governed by the Yellow Card Widget Terms. When you interact with an embedded component or follow a link, the third party may collect information directly from you under its own privacy policy, which we do not control. We encourage you to review the privacy policy of any third party before providing information, including the Stripe Privacy Policy and the jurisdiction-specific policies on the Yellow Card legal hub. We are not responsible for the content, security, or privacy practices of third-party sites and services.

19. Governing Law and Dispute Resolution

This Policy and any dispute arising out of it or out of our processing of your personal information are governed by the laws of the State of Georgia and applicable US federal law, without regard to conflict-of-laws principles. Venue for any permitted court proceeding is Fulton County, Georgia.

As set out more fully in our Terms of Service, disputes are resolved by binding individual arbitration administered by the American Arbitration Association under its Consumer Arbitration Rules. You may opt out of arbitration by written notice to support@songhaipay.com within 30 days of the date you first accept the Terms. Claims that qualify may instead be brought in small-claims court, and class actions and class-wide arbitration are waived. Nothing in this Policy or in the Terms limits any right that cannot be waived under Regulation E, under state money transmitter law, or under any applicable data protection law, including your right to complain to a regulator or supervisory authority.

You may also contact the Consumer Financial Protection Bureau about a remittance transfer at consumerfinance.gov/complaint or (855) 411-2372. State-level complaint routing for the licensed money transmitter is described on the Stripe licensing disclosures page and the Bridge US licenses page.

20. Changes to This Policy

We may update this Policy to reflect changes in our Services, our partners, our technology, or applicable law. When we make a change, we will revise the "Last Updated" date above and publish the updated Policy at https://songhaipay.com/privacy-policy. If a change is material — for example, a new category of processing, a new category of recipient, or a change in the legal basis or retention period for a significant category of information — we will provide additional notice by email, in-app message, or a prominent notice on our website before the change takes effect, and will obtain your consent where the law requires it. Your continued use of the Services after the effective date of an updated Policy constitutes acceptance of the update, except where consent is required. We encourage you to review this Policy periodically. Prior versions are available on request from privacy@songhaipay.com.

21. How to Contact Us

Songhai LLC (d/b/a SonghaiPay) 650 Ponce De Leon Ave Ste. 300 #1380 Atlanta, GA 30308 United States

Website: https://songhaipay.com — Privacy Policy · Terms of Service · Refund Policy · KYC / AML Policy · Donations

SonghaiPay is a technology and program-management platform. SonghaiPay is not a bank, does not hold customer funds, and does not itself hold money transmitter licenses. Regulated money transmission and payment processing are provided by licensed partners, including Stripe Payments Company (NMLS ID #1280479) and Bridge Building Inc. (NMLS #2450917) in the United States and Yellow Card Inc. and its regional affiliates in Africa. SonghaiPay does not provide tax or legal advice.

This document is provided for informational purposes and should be reviewed by qualified legal counsel licensed in your jurisdiction before publication.