Privacy
Policy.

Last Updated: July 1st, 2026

1. Introduction

HandlePay (“HandlePay”, “we”, “our”, “us”) is committed to protecting your privacy and securing your personal information.

HandlePay is a self-custodial financial technology product that enables users to access digital asset services, tokenized assets, and related financial services. HandlePay is a product operated by BlockApex Labs (Private) Limited, a company incorporated in Pakistan with its registered office at 191 Q, Block 2, PECHS, Karachi 75400, Pakistan. BlockApex Labs (Private) Limited is the data controller responsible for your personal information under this Privacy Policy.

HandlePay is a non-custodial financial software provider. We do not custody user funds, issue money, or provide banking services. Regulated financial services are delivered by licensed third-party partners.

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the HandlePay application, website, and services (“Services”). By accessing or using the Services, you agree to the collection and use of information in accordance with this Privacy Policy.

2. Eligibility

The Services are intended only for individuals who are 18 years of age or older. We do not knowingly provide the Services to, or collect personal information from, anyone under 18. If we learn that we have collected information from a person under 18, we will delete it. See Section 13 for more detail.

3. Information We Collect

3.1 Waitlist and The Handle Movement

If you join our waitlist or sign up for “The Handle Movement,” we collect:

  • Email address
  • Referral code or referral information, where you choose to provide it

We collect this information solely to:

  • Add you to the waitlist and manage your place in it, including your position on The Handle Movement leaderboard
  • Notify you when early access or the Services become available
  • Send you updates and announcements related to The Handle Movement

Joining the waitlist does not require a HandlePay account, and we do not collect any financial, identity, or KYC information at this stage. You may unsubscribe or request removal at any time using the unsubscribe link in our emails or through the contact details in Section 15.

3.2 Account Information

When you create a HandlePay account, we collect:

  • Your reserved username
  • A passkey credential associated with your account (see Section 5 for how passkeys and biometrics are handled)

We do not collect a seed phrase, private key, or biometric data as part of account creation.

3.3 Identity Verification (KYC/AML)

We do not collect identity documents at signup. Identity verification is required only when you choose to use a specific feature offered through a licensed partner, such as a first-party off-ramp to a local bank account, an on-ramp, or a card.

When verification is required, it is performed by our external KYC/AML provider. You submit your documents (which may include government-issued identification, proof of address, and a liveness or selfie check) directly to them. We receive only the verification result (a pass or fail outcome) and do not store the underlying identity documents in our systems.

Where you request a service from a partner that requires identity verification, and with your authorization, we may facilitate the sharing of your verification data through partner interfaces to that partner so the partner can provide the service you requested. See Section 6.

3.4 Transactional Information

To provide our Services, we may collect:

  • Transaction IDs and timestamps
  • Transaction amounts and asset types
  • Payment method details (for example, bank rails, cards, on-ramps and off-ramps)
  • Wallet addresses, where applicable

3.5 Usage and Technical Data

We may automatically collect:

  • Device type, operating system, and app version
  • IP address and log data, including access times and interaction data
  • A device identifier used solely for fraud and abuse prevention (see Section 10)
  • Security-related information used for fraud prevention

4. How We Use Your Information

We use your information to:

  • Add you to and manage the waitlist and The Handle Movement (Section 3.1)
  • Create, maintain, and secure your HandlePay account
  • Enable transactions and financial services
  • Facilitate identity verification through our partners where you request a feature that requires it
  • Send service updates, alerts, and security notifications
  • Provide customer support
  • Send relevant product updates and promotional material, where permitted
  • Comply with applicable laws and prevent fraud, money laundering, and abuse
  • Enforce our Terms of Service and protect users and the integrity of the platform

5. Authentication, Passkeys, and Biometrics

HandlePay uses passkeys for authentication. Your passkey is created and stored on your own device.

Any biometric data used to unlock your passkey, such as Face ID, Touch ID, or a fingerprint, is processed entirely by your device and its operating system. Biometric data is never transmitted to, accessed by, or stored by HandlePay.

Your passkey may be backed up and synced through your own device provider's service, such as iCloud Keychain or Google Password Manager. This backup is controlled by you and governed by your device provider's terms and privacy policy. HandlePay does not control or access these backups.

Because of this design, HandlePay never has custody of your credentials and cannot sign transactions or move assets on your behalf.

6. How We Share Your Information

6.1 Service Providers and Partners

We share only the information necessary to deliver a service you request, with trusted third parties, including:

  • Payment processors and banking partners
  • Identity verification (KYC/AML) providers
  • Card issuing partners
  • On-ramp and off-ramp service providers

Where you request a partner service that requires identity verification, and with your authorization, we may facilitate the sharing of your verification data with that partner. These partners are contractually obligated to handle your data in accordance with applicable data protection standards.

6.2 Legal and Regulatory Disclosures

We may disclose your information:

  • To comply with legal obligations, court orders, or regulatory requirements
  • To law enforcement or regulatory authorities where required
  • To protect the rights, safety, and integrity of HandlePay, our users, or the public

6.3 No Sale of Personal Data

We do not sell your personal information, and we do not share it with third-party organizations for their own marketing purposes. We share information only as described in this Privacy Policy.

7. International Data Transfers

We operate from Pakistan, and our database is hosted on infrastructure located in Singapore. Some of our partners may process your information in other jurisdictions. This means your information may be transferred to, stored in, or processed in countries outside your country of residence, where data protection laws may differ.

Where such transfers occur, we take reasonable steps to ensure your information receives an appropriate level of protection consistent with this Privacy Policy and applicable law.

8. Data Security

We implement administrative, technical, and organizational safeguards to protect your information, including:

  • Encryption of sensitive data
  • Secure access controls
  • Continuous monitoring for suspicious activity

We take reasonable steps to protect your data. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

If a data breach occurs that affects your personal information, we will notify affected users and the relevant authorities where required by applicable law.

9. Data Retention

We retain your information only for as long as necessary to:

  • Provide our Services
  • Comply with legal, regulatory, and financial record-keeping obligations
  • Resolve disputes and enforce our agreements

We retain waitlist emails until you unsubscribe, until you create a HandlePay account, or until the waitlist is no longer active, whichever comes first.

10. Cookies, Tracking, and Device Identifiers

Our website uses only strictly necessary and functional cookies required to operate. We do not use advertising cookies, third-party analytics, or cross-site tracking on our website.

Within our mobile application, we access a device identifier for the sole purpose of detecting and preventing fraud and abuse, including the creation of multiple accounts by the same device to exploit referral rewards. We do not use this identifier for advertising, ad measurement, or cross-app tracking, and we do not share it with advertising networks or data brokers.

Where our iOS application accesses the device advertising identifier (IDFA), we request your permission through Apple's App Tracking Transparency prompt, and you can review or change this permission at any time in your device settings. On Android, you can reset or limit the advertising identifier through your device privacy settings. If our use of any device identifier changes in the future, we will update this Privacy Policy and, where required, request your consent.

11. Your Rights

Depending on your jurisdiction, you may have the right to:

  • Access or update your personal information
  • Request deletion of your data, subject to legal and regulatory requirements
  • Object to or restrict certain processing activities
  • Withdraw consent at any time, where processing is based on consent
  • Request a copy of your data in a portable format
  • Lodge a complaint with a relevant data protection or supervisory authority

To exercise any of these rights, contact us using the details in Section 15. We will respond within the timeframe required by applicable law.

12. Legal Basis for Processing

Pakistan does not currently have a comprehensive enacted data protection law. We process your personal information in accordance with applicable Pakistani law, including the Prevention of Electronic Crimes Act 2016 and applicable sector-specific rules, and we voluntarily align our practices with recognized international data protection principles.

Where those principles apply, we rely on the following bases to process your information:

  • Consent, for example when you join the waitlist or opt in to marketing communications
  • Performance of a contract, to provide the Services you request
  • Legal obligation, for compliance with KYC, AML, and financial regulatory requirements
  • Legitimate interests, such as securing the platform and preventing fraud, balanced against your rights

Residents of the European Economic Area, the United Kingdom, and California may have additional rights under their local laws, as described in Section 11.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Updates will be posted within the app or on our website, and the “Last Updated” date will be revised accordingly. Continued use of the Services after an update constitutes acceptance of the revised policy.

14. Contact Us

For questions, concerns, or requests regarding this Privacy Policy:

BlockApex Labs (Private) Limited
191 Q, Block 2, PECHS, Karachi 75400, Pakistan
Email: contact@handlepay.io

15. Consent

By using HandlePay, you acknowledge that you have read and understood this Privacy Policy and agree to its terms.

Frequently Asked Questions

Contact Us