Privacy Policy

Last Updated: October 27, 2026

This Privacy Policy explains how M3-SH ("we", "us"),

operator of the M3-SH card product, collects, uses, shares and protects

personal data. It applies to our website, applications and card services.

YOUR RESPONSIBILITY AND ZERO TOLERANCE FOR ILLEGAL ACTIVITY. You are solely and fully responsible for how you use your account, your cards and the service, and for complying with all laws that apply to you. M3-SH does not support, facilitate or tolerate money laundering, terrorist financing, sanctions evasion, violent crime, threats or extortion, human trafficking or sexual exploitation, any abuse or exploitation of children, illegal drugs or weapons, fraud or identity theft, hacking or stolen funds, darknet markets, illegal gambling, bribery, corruption, tax evasion or any other illegal activity. If we detect or reasonably suspect such activity, we may freeze or reverse transactions, block cards, close the account, preserve records and report to the competent authorities, and you are liable for the resulting losses.

Support on Telegram. When you contact us through our Telegram support bot, we process your Telegram user ID, username and display name, the messages and files you send, the date on which you accepted the Terms of Use and this Privacy Policy (by ticking both boxes) and, only if you choose to link it with a 6-digit code, the e-mail of your account. The support team sees your account status (registration, identity verification and cards), never card numbers or balances. Telegram also processes these messages under its own privacy policy. We do not sell personal data. In Telegram, /unlink removes the link to your account.

1. Our Role — Technology Provider, Not a Custodian

M3-SH is a technology company and program manager. We build and operate the

software layer of the card product. **We are not a bank, and we do not take custody

of, hold, control, or have access to customer funds or crypto assets.**

In any flow that involves assets, **custody, fund movement, settlement and card issuance

are performed by licensed partners** — the issuing partner, the sponsoring bank and the

payment networks. Crypto transactions occur directly on public blockchains, are visible

to anyone and, once confirmed, cannot be reversed by us. Our responsibility is limited to

the technology we provide and to the handling of personal data described in this Policy.

2. Information We Collect

• Account data: e-mail address, language and preferences, and the name and contact details you choose to give us.
• Minimum validation we perform ourselves: confirmation of your e-mail address by a one-time code, and the IP address and device used to log in. This is the baseline required by the policies of our licensed partners and it is how we recognise you for sensitive actions (card details, freezing, top-ups).
• Identity verification (KYC), when a partner requires it: we do not collect, receive or store identity documents, selfies or biometric data. Verification, when needed for a card or above certain limits, is carried out by the licensed card issuer or its specialised verification provider, under its own privacy policy. We receive only the result (verified or not) and its date. See Section 3.
• Business verification (KYB), for business customers: handled in the same way, by the licensed partner.
• Financial and transaction data: card transactions, top-ups, deposits, wallet addresses, amounts, timestamps and related records.
• Compliance data: the results of identity, business and sanctions/AML screening performed by our partners, and risk flags.
• Technical data: IP address, approximate location derived from IP, device and browser information, the cookies strictly necessary to operate the service and the measurement cookies described in our Cookie Policy.

3. Identity, Business and AML Verification

Card issuing partners are regulated companies. Know-Your-Customer (KYC), Know-Your-Business (KYB) and Anti-Money-Laundering (AML) checks, when required before a card is issued or above certain limits, are carried out by the licensed partner or its specialised verification provider, under its own regulated responsibility and its own privacy policy. The documents and any biometric data stay with that partner; they are never transmitted to or stored by M3-SH.

We receive the verification result and apply our own policy on top of it (for example, refusing restricted or sanctioned jurisdictions). The partner is identified to you before the verification step; it is not named here.

Our own validation of users is the minimum required by those policies: confirmation of the e-mail address by a one-time code, and checks of the IP address and device used. We may ask you to confirm the code again for sensitive actions.

4. How We Use Information

We use personal data to: create and manage accounts; verify identity and business

(KYC/KYB); issue, activate, freeze and manage cards; process top-ups, transactions and

withdrawals through our licensed partners; perform AML monitoring and sanctions screening;

prevent fraud and abuse; provide support; and comply with legal and regulatory obligations.

5. Legal Bases (GDPR / LGPD)

• Performance of a contract — to provide the card service you request.
• Legal obligation — KYC, KYB, AML, sanctions screening and record-keeping.
• Legitimate interest — fraud prevention and securing the service.
• Explicit consent — for the processing of biometric data, collected at the

verification step; you may decline, but without it we cannot verify your identity and

therefore cannot issue a card or allow withdrawals.

6. How We Share Information

We share personal data only as needed to run the service and to comply with law:

• the licensed card issuer, its verification provider, the sponsoring bank and the payment networks, who verify identity when required, issue the card and move and settle funds;
• payment and settlement partners, who hold and move funds (we do not);
• Microsoft, for the measurement of our own advertising (Microsoft Advertising tag) and for usage analytics of the public pages (Microsoft Clarity, which records clicks, scrolls and session replays with typed text masked; the client area is not recorded), as described in our Cookie Policy;
• competent authorities and regulators, when required by law or valid legal process.

We do not sell personal data. The advertising tag only measures the results of our own ads; we do not share data for third-party advertising.

7. International Transfers

Our partners and infrastructure may be located outside your country. Where personal data is

transferred internationally, we rely on appropriate safeguards (such as standard contractual

clauses) consistent with GDPR and LGPD.

8. Retention

We keep KYC, KYB, AML and transaction records for as long as the law requires —

typically at least five (5) years after the end of the customer relationship, as

mandated by anti-money-laundering rules — and delete or anonymize personal data when no

legal basis to keep it remains.

9. Security

We protect personal data with encryption in transit, access controls and the principle of

least privilege. Secrets and keys are kept out of application code. No system is perfectly

secure, and we cannot guarantee absolute security.

10. Your Rights

Subject to applicable law (GDPR, LGPD and others), you may request access to, correction of,

or deletion of your personal data; object to or restrict certain processing; and request

portability. Deletion does not override records we are legally required to retain for

AML purposes. To exercise a right, contact us using Section 13.

11. Biometric Data

We do not collect, receive or store biometric data. If a licensed partner requires a facial image or liveness check for identity verification, that processing happens entirely on the partner's side, under its policy and with the consent you give to it. The image is not transmitted to M3-SH and we never use biometric data for advertising or profiling.

12. Children

The service is for adults (18+). We do not knowingly collect data from minors.

13. Restricted and Sanctioned Jurisdictions

We screen against sanctions lists and do not provide the service to individuals or

entities in comprehensively sanctioned jurisdictions, or to anyone on an applicable

sanctions list. We may refuse, suspend or close an account on this basis.

14. Changes to This Policy

We may update this Policy. Material changes will be announced on this page with a new

"Last Updated" date.

15. Contact

For privacy requests or questions, contact: contact@m3sh.cards — M3-SH.