Privacy Policy

1. Overview

This Privacy Policy explains how Mustard ("we", "us", or "our") collects, uses, shares, and protects personal information when you use our app, money transfer services, and website at mustardmsb.com (together, the "Service"). As a financial services provider, we are also subject to the Gramm-Leach-Bliley Act (GLBA); where our GLBA privacy notice applies, it governs the information it covers.

2. Our website and waitlist

When you join our waitlist, we collect your email address and use it to tell you about our launch. On our website we also collect basic technical information, such as your browser type, pages visited, and IP address, to keep the site secure and understand how it is used. You can leave the waitlist at any time by replying to any of our emails or contacting us.

3. Information you give us

To provide the Service we collect: identity information for verification (your name, date of birth, residential address, and government identifiers such as a Social Security Number, and for Nigerian identity a BVN or NIN and a selfie); contact information (email and phone number); recipient and payment details you enter; and messages you send us.

4. Information about transactions and devices

When you use the app, we collect transaction information (amounts, currencies, recipients, times, and status) and device and usage information (device identifiers, operating system, app version, IP address, approximate location derived from IP, and session activity). We use device and network signals to help prevent fraud.

5. Information from others

We receive information from identity-verification, fraud, and sanctions-screening providers, from your linked bank and our banking and payout partners, and from other sources we use to verify identity, assess risk, and comply with the law.

6. Information about recipients

To send a transfer, you give us information about your recipient, such as their name and account details. We use it to deliver the transfer, screen it against sanctions and watchlists, and comply with the law. If you give us another person's information, you confirm you are allowed to share it with us for these purposes.

7. How we use information

We use information to: provide, operate, and support the Service; verify your identity; screen against sanctions and watchlists and monitor for fraud and suspicious activity; process, convert, and settle transfers; calculate fees; meet legal and regulatory obligations (including the Bank Secrecy Act, sanctions, tax, and state licensing rules); communicate with you; and improve and secure the Service. Where the law requires it, we do not make legally significant decisions about you by solely automated means without a right to human review.

8. How we share information

We share information with: identity-verification and sanctions-screening providers; our partner bank and the payment and payout providers needed to move your money; service providers such as cloud hosting, communications, and analytics, under contract and only for the purposes we set; professional advisors and auditors; and government authorities, regulators, and law enforcement where the law requires or to detect or prevent fraud or harm. We may also share information as part of a merger, acquisition, or similar transaction, subject to this Policy.

9. We do not sell your information

We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

10. Sensitive identifiers

Sensitive identifiers such as a Social Security Number, BVN, or NIN, and bank access tokens, are encrypted at rest and decrypted only at the moment they are needed. Access is limited to what each role requires. Where a licensed partner needs a BVN to open a local collection account, we pass it to that partner to complete verification and do not keep it in plain text. Bank access tokens are never sent to your device.

11. Cookies, SDKs, and analytics

Our website and app use cookies, device identifiers, software development kits, and analytics tools to operate the Service, remember your preferences, prevent fraud, and understand usage. Some are necessary for the Service to work. Where required, we honor opt-out signals such as Global Privacy Control. You can also limit some collection through your browser or device settings.

12. International transfers of data

Because we move money between the United States and other countries, starting with Nigeria, some information (such as the recipient details needed to deliver a transfer) is processed across borders. We use appropriate safeguards for these transfers as the law requires.

13. How long we keep information

We keep personal and transaction records while your account is open and afterward as the law requires. As a Money Services Business, we must generally keep transaction and identity records for at least five years under the Bank Secrecy Act. We keep other information only as long as needed for the purposes in this Policy. Waitlist email addresses are deleted on request or when the waitlist closes.

14. Security

We use administrative, technical, and physical safeguards designed to protect your information, including encryption of sensitive data, access controls, and monitoring. No system is perfectly secure, so please protect your device, password, and PIN, and tell us promptly at support@mustardmsb.com about any unauthorized use.

15. Your choices and rights

You can view and update your profile in the app and ask us to delete your account and data, subject to records the law requires us to keep; our Data Deletion page explains how. Depending on where you live, you may have rights to access, correct, delete, or obtain a copy of your personal information, to limit certain uses of it, and to appeal our decision. To use these rights, contact support@mustardmsb.com. We will verify your request and will not treat you differently for using your rights.

16. State privacy rights

If you live in California or another state with a comprehensive privacy law, you have specific rights over your personal information, including the right to know the categories we collect and disclose and to request access, correction, or deletion. We do not sell or share personal information for cross-context behavioral advertising. Some financial information covered by the GLBA may be exempt from certain state-law rights.

17. GLBA financial privacy

As a financial institution under the GLBA, we provide a separate financial privacy notice describing how we collect, share, and protect nonpublic personal financial information, and any right you have to limit certain sharing. Where that notice applies, it governs that information.

18. Children

The Service is not directed to, and may not be used by, anyone under 18, and we do not knowingly collect information from children. If you believe a child has given us information, contact support@mustardmsb.com.

19. Changes and contact

We may update this Policy and will update the date above when we do. If a change is material, we will tell you. For privacy questions or requests, contact support@mustardmsb.com.