Privacy Policy
How ON5 collects, uses, shares and protects personal information across the ON5.com card issuing platform, its dashboard and its API.
This policy explains what ON5 does with personal information when you use ON5.com, the dashboard at ON5.com/app, and the ON5 API. It covers the people who run a card programme with us and the cardholders whose cards we issue.
Who is responsible for your data
ON5 is a trading name. The platform is operated by KAANCH LIMITED (Business Registration No. 78360503), a company incorporated in Hong Kong with its registered office at Unit 1411, 14/F, Cosco Tower, 183 Queen's Road Central, Sheung Wan, Hong Kong, and that company is the data user — the controller — of the personal information described here. Reach us about anything in this policy at [email protected].
Because we are established in Hong Kong, this policy is anchored in the Personal Data (Privacy) Ordinance (Cap. 486) and its six data protection principles. Where you live somewhere with its own regime — the EU or UK GDPR, for instance — the rights that regime gives you apply as well, and we set them out below.
Where we issue cards through a card issuing partner, that partner processes some of the same information under its own responsibility. We say where that happens below.
What we collect
Information you give us
| Data | When we collect it | Why |
|---|---|---|
| Full name and email address | When you create an account | To identify the account and send it operational email |
| Phone number, date of birth, residential address, city, state or region, postcode and country | Before your first card is issued | Card networks and our issuing partners require a verified cardholder identity for every card |
| Identity documents and verification data | Where the programme, the jurisdiction or the amounts involved require it | To meet know-your-customer and anti-money-laundering obligations |
| Your brand: business name, logo, support email, support phone and website | When you set up your card programme | These are printed on the card art and shown to your cardholders in card emails |
| Anything you write to us | When you contact support | To answer you and to keep a record of the request |
Information we collect automatically
- Session records. For each sign-in we store the IP address, the browser user-agent string, when the session was created, when it was last used and when it expires. This is how you stay signed in and how an unrecognised session can be spotted and revoked.
- One-time-code records. When you request a sign-in code we store a hash of that code, the email it was sent to, the number of attempts made, the IP address it was requested from, and when it expires or is used. We never store the code itself.
- API request logs. For accounts using the API we record the method, path, response status, timing and outcome of each call. Only the 500 most recent calls per account are kept; older entries are deleted automatically.
- Audit records. Security-relevant actions are logged with who did them and when — including every occasion on which full card details were revealed.
- Server logs. Ordinary web-server logs, kept briefly for debugging, abuse investigation and capacity planning.
Information from the blockchain
When you fund an account we derive a deposit address for it and watch four public networks — Ethereum, BNB Smart Chain, Base and Kaanch Network — for transfers to that address. We record the transaction hash, the amount, the asset and the number of confirmations.
Information from our card issuing partner
- Card status, expiry date and the last four digits of the card number.
- Authorisations, settlements, declines, refunds and reversals.
- Step-up authentication events, including 3-D Secure codes that we deliver to the cardholder on the partner’s behalf.
We do not store full card numbers or security codes. When you reveal a card’s details, they are fetched from the issuing partner at that moment, returned to your browser, and not written to our database. Every reveal is recorded in the audit log.
Why we use it, and on what legal basis
| Purpose | Data used | Why we are allowed to |
|---|---|---|
| Creating and running your account | Identity, contact and session data | Performance of our contract with you |
| Issuing and managing cards | Cardholder identity, brand details, card and transaction data | Performance of our contract |
| Crediting deposits and keeping the ledger | Deposit addresses, transaction hashes, amounts | Performance of our contract |
| Identity verification, sanctions and anti-money-laundering checks | Identity documents, verification results, transaction patterns | Compliance with a legal obligation — the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615) and its equivalents |
| Fraud prevention and platform security | Session, IP, device, API-log and audit data | Our legitimate interest in a platform that is not abused |
| Support and service email | Contact details and your correspondence | Performance of our contract, and our legitimate interest in answering you |
| Product news and marketing email | Name and email address | Your consent, withdrawable at any time |
| Defending or bringing legal claims | Whatever the claim concerns | Our legitimate interest in defending ourselves, and legal obligation |
The middle column is a legal basis in GDPR terms; under the Hong Kong ordinance the same rows are the purposes we collected the data for, and we do not use it for a new purpose without your consent. Either way the substance is identical: this is the complete list of what we do with it.
We do not make decisions producing legal or similarly significant effects about you by automated means alone. Automated checks may flag an account, but a person reviews before an account is restricted or a card is terminated.
Who we share it with
| Recipient | What they receive | Why |
|---|---|---|
| Our card issuing partner and, through them, Visa and Mastercard | Card, cardholder and transaction data needed to issue and authorise cards | Cards cannot be issued or authorised without it |
| Identity verification providers | Identity documents and the data needed to check them | Know-your-customer and anti-money-laundering obligations |
| Our email provider | Recipient address and message contents | Delivering one-time codes, card notifications and account email |
| Cloud hosting and database providers | Whatever the platform stores, as processors | Running the service |
| Blockchain node providers | Deposit addresses and queries about them | Detecting and confirming your deposits |
| Professional advisers, auditors and insurers | What the engagement requires | Our legitimate interest in properly run affairs |
| Regulators, law enforcement and courts | What the law requires us to produce | Compliance with a legal obligation |
| A buyer, in a merger or acquisition | Account and transaction records, under confidentiality | Our legitimate interest in the transaction |
We do not sell personal information, and we do not share it for cross-context behavioural advertising.
Where your data goes
We are established in Hong Kong, so your information is processed there and by providers elsewhere. Where it leaves a jurisdiction with data-transfer restrictions, we rely on the transfer mechanisms available under that law — such as standard contractual clauses or an adequacy decision — and require the recipient to protect the data to the same standard.
How long we keep it
| Record | Retention |
|---|---|
| Account, cardholder and identity records | For the life of the account, then for the period the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615) requires — five years after the relationship ends |
| Card and transaction records | Same as above; they are the evidence behind a settled payment |
| Session records | Until the session expires or is revoked, plus a short window for security investigation |
| One-time-code records | Until the code expires or is used, plus a short window for abuse detection |
| API request logs | The 500 most recent calls per account; older entries are deleted automatically |
| Audit records | For as long as the account exists, and afterwards where they evidence a regulated action |
| Marketing preferences | Until you withdraw consent, plus a record that you did so |
When a record is no longer needed for any of the purposes above, it is deleted or irreversibly anonymised. Blockchain transactions remain on their networks regardless; we cannot remove them.
How we protect it
- Sensitive personal fields — phone number, date of birth and address — are encrypted at rest with AES-256-GCM.
- Session tokens are stored only as hashes; the session cookie is HTTP-only, restricted to our own site, and marked Secure in production.
- Full card numbers and security codes are never written to our database.
- API keys are scoped to the permissions you grant them, can be restricted to an IP allowlist, and every money-moving endpoint requires an idempotency key.
- Traffic is served over HTTPS with HSTS, a content security policy and cross-origin restrictions.
- Access to production data is limited to the people who need it, and privileged actions are recorded in the audit log.
No system is perfectly secure. If you believe an account has been compromised, or you have found a vulnerability, write to [email protected].
Your rights
The Personal Data (Privacy) Ordinance (Cap. 486) gives everyone two rights we honour without qualification: to access the personal data we hold about you, and to have it corrected if it is wrong. We ask for a fee only where the ordinance allows one, and in practice we do not charge.
Beyond that, residents of the EU, the UK and other places with a comparable regime have the fuller set below as of right. We extend the same set to everyone, wherever you live, where we reasonably can.
- Access — a copy of the personal information we hold about you.
- Correction — to have inaccurate information fixed.
- Erasure — to have information deleted where we no longer have grounds to keep it.
- Restriction — to have processing paused while a dispute is resolved.
- Portability — to receive the data you gave us in a machine-readable form.
- Objection — to processing based on legitimate interests, including profiling for fraud prevention.
- Withdrawal of consent — at any time, for anything we do on the basis of consent, without affecting what was done before.
- Complaint — to the Privacy Commissioner for Personal Data, Hong Kong, or to the data protection authority where you live or work.
Write to [email protected] to exercise any of these. We will answer within one month, and will tell you if we need longer. We may ask you to confirm who you are first — we are not going to hand an account’s records to whoever asks for them.
Cookies
We use one strictly necessary cookie to keep you signed in, and no advertising or cross-site tracking cookies at all. The Cookie Policy sets out the detail.
Children
ON5.com is not for anyone under 18. We do not knowingly collect information about children, and an account found to belong to one will be closed and its data deleted except where law requires otherwise.
Changes to this policy
When this policy changes we update the date at the top of the page. If a change materially affects how we handle your information, we will tell account holders by email before it takes effect.
Contact
- Privacy questions and rights requests: [email protected]
- Security reports: [email protected]
- Everything else: [email protected]
- Post: KAANCH LIMITED, Unit 1411, 14/F, Cosco Tower, 183 Queen's Road Central, Sheung Wan, Hong Kong
- Regulator: the Privacy Commissioner for Personal Data, Hong Kong