Privacy Policy

Avocado Financial Technologies Ltd. — operating as Guap. Governing law: Data Protection Act (Ch.22:02), Trinidad and Tobago.

1. Who We Are

The data controller for your personal information is:

Avocado Financial Technologies Ltd. (operating as Guap)

22 Midway Road, North Valsayn, Valsayn, Trinidad and Tobago

TTSEC VASP Regulatory Sandbox — Certificate TTSEC-VASP-CoA-KG-26/04/07|003

Compliance Officer: Alexandra Lutchman

Contact: hello@alexandra.to · WhatsApp: +1 (868) 349-0993

This Privacy Policy explains what personal information Guap collects when you use our services, how we use and protect it, who we share it with, and what rights you have over your data.

It applies to the Guap mobile application (iOS and Android), the Guap Teller (ATM) network in Trinidad and Tobago, and our WhatsApp support channel and customer communications.

2. What Data We Collect

When you create an account:

• Mobile phone number
• Email address

When you complete Tier 0 verification (required to transact at a Guap Teller):

• Full name
• Date of birth
• Phone number (one-time passcode confirmation via SMS)

When you complete Tier 1 verification:

• Government-issued ID (front and back image) — accepted: Trinidad national ID card, passport, driver’s licence
• Selfie photograph (captured during a liveness check)
• Liveness check result
• Sanctions and PEP (politically exposed person) screening result

When you transact:

• Transaction amount (in TTD and/or virtual asset denomination)
• Transaction timestamp
• Spark wallet address and Lightning address
• Teller location used — M6 Plaza (Chaguanas), Gulf View (San Fernando), Piarco, or Movie Towne (Port of Spain)
• Transaction type (cash-in or cash-out)

When you use the Guap App:

• Product usage events (e.g. screens visited, features used) — collected in anonymised form via PostHog
• Application errors and crash reports — collected via Sentry

When you contact support:

• WhatsApp messages and message history
• Phone number
• Details of your issue or complaint

3. How We Use Your Data

We use your personal data to:

• Verify your identity and comply with know-your-customer (KYC) obligations under the VA/VASP Act 2025 and the Proceeds of Crime Act (Ch.11:27)
• Process your transactions at Guap Tellers and via the Guap App
• Screen against sanctions lists and politically exposed person (PEP) databases
• Monitor transactions for suspicious activity and file reports as required by law
• Send one-time passcodes via SMS
• Respond to your support requests and complaints
• Improve the Guap App and Teller experience through anonymised analytics
• Comply with our obligations under TTSEC Certificate TTSEC-VASP-CoA-KG-26/04/07|003

We do not use your personal data for advertising. We do not sell your data to third parties.

4. Who We Share Your Data With

We use the following service providers, each of whom processes only the data necessary for their function:

• Didit — KYC verification, sanctions/PEP screening (receives identity documents, selfie, name, date of birth)
• Twilio — one-time passcode delivery via SMS (receives mobile phone number)
• Supabase — primary data storage (receives customer records, transaction records, KYC status)
• Sentry — crash and error monitoring (receives application error diagnostics)
• PostHog — product analytics (receives anonymised product usage events)
• Orchestra / Flashnet — transaction routing and settlement (receives wallet addresses, transaction amounts)
• Lamassu — ATM terminal software (receives ATM transaction records)

All service providers are contractually required to process your data only for the stated purpose and to maintain appropriate security standards.

We may also share your data with:

• The Trinidad and Tobago Securities and Exchange Commission (TTSEC), pursuant to our sandbox obligations
• The Financial Intelligence Unit of Trinidad and Tobago (FIUTT), as required under the Proceeds of Crime Act (Ch.11:27)
• The Trinidad and Tobago Police Service or other competent authority, pursuant to a lawful request

5. How Long We Keep Your Data

Under the VA/VASP Act 2025 and the Proceeds of Crime Act, we are required to retain KYC records, transaction records, and AML monitoring records for seven (7) years from the date of your last transaction with Guap.

Data that is no longer required and is not subject to any legal retention obligation is securely deleted. Where a deletion request cannot be fulfilled due to statutory retention obligations, we will record the reason and communicate it to you.

6. How We Protect Your Data

• All data transmitted between your device and our servers is encrypted using TLS 1.2 or higher
• Data at rest is encrypted at the infrastructure level using AES-256 or equivalent
• Access to customer data is restricted to staff with a documented business need, enforced by role-based access controls and multi-factor authentication
• Your wallet keys and seed phrase are never stored by Guap. The Guap App is a self-custody wallet — you and only you hold the keys to your funds
• Administrative and compliance actions on customer data are recorded in an append-only audit log

7. Your Rights

Under the Data Protection Act (Ch.22:02), you have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete personal data
• Request deletion of your personal data (subject to our legal retention obligations under AML/CFT law)
• Withdraw consent where processing is based on consent
• Object to processing for purposes other than those required by law

To exercise any of these rights, contact us at hello@alexandra.to or via WhatsApp at +1 (868) 349-0993. We will respond within 30 days.

If you are not satisfied with our response, you may raise a complaint with the Information Commissioner of Trinidad and Tobago.

8. Analytics

The Guap App uses PostHog to collect anonymised, aggregate data about how customers use the app (e.g. which screens are visited most often). This data is not linked to your identity and is used only to improve the Guap App experience. If you wish to opt out, contact us at hello@alexandra.to.

9. Children

The Guap App is not intended for use by persons under 18 years of age. We do not knowingly collect personal data from anyone under 18. If you believe a minor has created an account, please contact us immediately at hello@alexandra.to.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will post the updated policy here and update the “Last updated” date above. For material changes, we will notify you via the Guap App or WhatsApp.

11. Contact Us

For privacy-related questions or to exercise your data rights:

Email: hello@alexandra.to

WhatsApp: +1 (868) 349-0993

Post: Avocado Financial Technologies Ltd., 22 Midway Road, North Valsayn, Valsayn, Trinidad and Tobago

This policy is issued under the Data Protection Act of Trinidad and Tobago (Ch.22:02) and the Virtual Assets and Virtual Asset Service Providers Act, 2025 (Act No. 12 of 2025).