SohoPay Privacy Policy

Every individual borrower registering for a SohoPay account is required to provide a mobile phone number, legal name and date of birth. We use a one-time password (OTP) to verify control of the provided phone number. We also collect an optional email address, chosen @handle, SohoPay account and borrower identifiers, account status, and account settings. A verified phone number establishes control of that number, not proof of legal identity. Legal name and date of birth are minimum identity information and do not, by themselves, mean regulatory KYC has been completed. Supported account registration may precede optional bank or external wallet linking, but service and Purchasing Power eligibility remain subject to applicable requirements.

Additional identity verification may be required by applicable law, risk, product eligibility, transaction activity or requested Purchasing Power. When required, we may collect residential address, government identification details, identity documents, additional personal information, verification evidence and screening outcomes, directly or through verification providers. Account creation does not automatically establish eligibility for Purchasing Power or restricted services. Business verification is separately addressed below.

SohoPay operates its own identity management and OAuth-based authorization infrastructure. We manage account identities, sign-in sessions, issued authorization credentials and access permissions. External providers may assist with OTP delivery, identity checks and fraud verification, but are not SohoPay's primary account identity provider. We process OTP delivery and attempt records, session and token identifiers, authorization metadata, IP addresses, device and browser information, sign-in timestamps and suspicious activity indicators. Where supported, sign-in may use passkeys; we process public authentication credentials and relevant metadata, while biometric checks to unlock a passkey normally occur locally on the user's device. SohoPay does not receive the device biometric template in that process.

For businesses, we may collect registered and trading names, registration numbers, addresses, tax or regulatory identifiers, ownership and control details, account permissions, authorized representative information and relevant evidence of beneficial ownership. Applicable KYB and compliance checks may require identification data about owners, officers and controlling persons.

We distinguish between (a) a user-controlled external wallet, which the user connects and proves control of by signing a message, and (b) a SohoPay-provisioned account address used to execute authorized transactions. We do not require the private key for a user-controlled external wallet. For a SohoPay-provisioned account address, SohoPay operates the relevant signing keys through its controlled signing infrastructure, subject to authorization and security controls. For AI agents, signing credentials may be operated by the agent owner or, where supported, provisioned and operated by SohoPay under the relevant integration model. We process public wallet addresses, network identifiers, verification signatures, transaction hashes, on-chain history and wallet risk indicators. The applicable product agreements describe control and operational responsibility for supported signing arrangements.

We process agent identifiers and names, associated accounts, public credentials and relevant provisioned key records, delegation permissions, approved spending limits, merchant and transaction restrictions, validity periods, revocation events, payment requests, authorization outcomes, transaction status and audit logs. Agents may initiate requests only within the permissions and controls applicable to their integration and account.

When SohoPay is accessed through an MCP client, API or third-party AI platform, we process the requests received by our Services, including authentication information, integration identifiers, requested operations and parameters, transaction outcomes, errors and diagnostic data. External AI platforms may process conversations, prompts or tool calls independently under their own privacy policies. This policy governs SohoPay's own processing.

SohoPay operates its own Credit Profile Engine. It receives, derives and analyzes permitted information from multiple sources to build borrower credit profiles, calculate internal risk scores and classifications, evaluate eligibility, determine or adjust Purchasing Power and monitor credit exposure. Sources may include minimum identity and verification information; account age and status; connected wallet activity and public on-chain transactions; SohoPay payments, A2A transfers and repayment history; outstanding balances and utilization; authorized bank information and financial reports; and fraud, sanctions and compliance results. External providers furnish authorized data or verification results but do not independently determine SohoPay's internal credit profile or Purchasing Power outcome. Assessments may be automated and may change as relevant data changes. Regulatory limitations on data sources and automated decisions continue to apply.

Accounts may be addressed by @handle for agent-to-agent payments. We process handle assignment and change history, temporary reservation of prior handles, payer and payee account and agent identifiers, amounts, timestamps, status, received-value balances and withdrawal destinations. Transaction counterparties may see an @handle, the agent involved and information needed to confirm and complete the payment. We do not display a user's phone number, email address or private wallet balance to other users through the A2A recipient display.

We process merchant names, business and contact details, payment destination addresses, applicable fees, transaction values and status, capture receipts, settlement, reconciliation, refund and dispute records.

We process payment obligations, repayment amounts and due dates, repayment method and source account or wallet, transaction confirmations, missed or late payments, balances and related communications. Repayment sources may be screened and monitored for sanctions and fraud risks where required or permitted.

Where available and authorized by you, bank-linking providers, including Plaid where used, may supply institution name, account type, masked identifiers, account holder information, balances, permitted transaction history, financial account status and eligible reports such as asset or cash-flow reports. The exact information depends on provider products, institution availability and granted permissions. Bank credentials are entered through the provider's supported authentication flow, not directly into SohoPay. Authorized financial information may be analyzed by SohoPay's Credit Profile Engine for eligibility, affordability and risk. Disconnecting a bank may stop future collection but does not necessarily require deletion of previously collected information retained lawfully for credit administration, compliance or disputes.

We may process screening results for persons, businesses, linked wallets and repayment sources, plus fraud indicators, duplicate-account signals, transaction monitoring findings, compliance reviews and investigation records.

We automatically collect IP addresses, approximate location derived from IP, device and browser characteristics, operating system, access times, API routes, request and response metadata, security events, performance metrics and error logs. We do not seek precise GPS location through the described Services.

We retain support requests, operational messages, emails, feedback, verification notices and other service communications.

Email privacy@sohopay.xyz with the subject "Privacy Request." Where available, requests may also be submitted through account settings. We may verify account control and other information reasonably required to protect against unauthorized requests. We will acknowledge and respond within deadlines prescribed by applicable law and explain lawful extensions or exemptions.

If you disagree with an eligible privacy request decision, email privacy@sohopay.xyz with the subject "Privacy Appeal." We will review and respond within the time required by applicable state law and explain any further avenue available to you.

Categories of personal information that may be collected include identifiers (name, phone, @handle, account and wallet addresses), customer records (DOB, verification and permitted financial information), age-related information, commercial and transaction records, internet and device activity, business representative details, inferences such as internal risk scores, and sensitive information such as authentication or financial account data. Sources and uses are described in Sections 3 through 5; recipient categories are described in Section 9; retention criteria are in Section 11. We do not sell or share these categories for cross-context behavioral advertising. Actual categories depend on the services used.