Both documents in full, on one page. Written to be read — if anything here is unclear, ask us and we will answer plainly.
This policy explains what CurrencyDesk collects, why we collect it, and what we do with it. It covers our website, our software, and everything you do on the desk.
CurrencyDesk ("CurrencyDesk", "we", "us") provides software for money services businesses. In this policy, "you" means the business that holds an account with us and the people who use it on that business's behalf.
We are the controller of information about you and your staff. We are a processor — acting on your instructions — for information about your clients. Section four explains that difference and why it matters.
We collect the following, and we collect it because the service does not work without it:
We use the information above to run the desk, keep it working, and make it better. Specifically: to provide and maintain the service; to authenticate your team and secure your account; to generate your reports and records; to send service messages, billing notices and support replies; to detect, investigate and prevent fraud, abuse and security incidents; to meet our own legal obligations; and to develop, test and improve existing and future products and features.
We also use it to understand how the desk is used across our customer base — which features earn their place, where people get stuck, and what to build next. Where that analysis does not require identifying anyone, we carry it out on aggregated or de-identified data as described in section five.
We do not sell your information. We do not publish your rates, spreads, volumes or client list, and we do not disclose your identifiable business data to other customers, brokers or data buyers.
Information you record about your own clients belongs to your business, not to ours. You decide what to collect and why; you are responsible for having a lawful basis to collect it and for the notices and consents your regulator requires. We hold and process it on your behalf, following your instructions and the terms of this agreement.
We do not use your clients' identifiable personal information for our own marketing, and we do not contact your clients on our own behalf. Where we process it beyond providing the service, we do so only in de-identified form.
We create aggregated and de-identified data from activity on the desk — information from which you, your business and your clients cannot reasonably be identified. Examples include how long a task takes across all desks, how often a feature is used, and how currency demand moves across a region in aggregate.
We may use this data for any lawful business purpose, including improving and training our products, benchmarking, research, and producing industry insights, and we may continue to do so after your account ends. We will not attempt to re-identify it, and we will not publish it in any form that identifies you or your clients.
We share information only in these circumstances:
We use cookies and similar technologies to keep you signed in, remember your settings, keep the service secure, and understand how our website and software are used. Some are strictly necessary and cannot be turned off without breaking the desk; others support analytics and can be declined where your law requires us to ask.
We do not run third-party advertising trackers on the desk itself.
We hold your data in the region you operate in wherever we can. Some of our service providers operate in other countries, so information may be transferred to, stored in or accessed from outside your jurisdiction — including Canada and the United States. Where that happens we use appropriate safeguards, and the information remains subject to this policy.
Records created on the desk are retained for the statutory retention period that applies to your business, because that is what the service is for. Account and billing information is kept while your account is open and for as long afterwards as we need it to meet our own legal, tax and audit obligations. Aggregated and de-identified data may be kept indefinitely.
Data is encrypted in transit and at rest. Access inside CurrencyDesk is limited to staff who need it to do their job and is logged. You control who on your team has an account and what they can see.
No system is perfectly secure. You are responsible for keeping credentials confidential, removing staff who leave, and telling us promptly if you believe an account has been compromised. If a breach affects your data and the law requires notice, we will notify you without undue delay.
Depending on where you are, you may have the right to access the personal information we hold about you, correct it, ask us to delete it, object to or restrict certain processing, and receive a copy in a portable format. You can export your records from the desk at any time without asking us.
Some information we cannot delete on request — records we are required to retain, and anything needed to resolve a dispute or enforce our agreement. If one of your clients makes a request about their information, direct them to you: you are the controller of that record, and we will support you in answering.
To make a request, write to privacy@currencydeskos.com.
We may update this policy as the service changes. If a change materially reduces your rights we will tell you by email or in the desk before it takes effect. The date at the top always shows the current version, and continuing to use the desk after a change means you accept it.
These terms govern your use of CurrencyDesk. By opening an account, or by using the desk, you agree to them on behalf of your business.
These terms, together with the Privacy Policy and any order or plan you sign up to, form the whole agreement between your business and CurrencyDesk. The person accepting them confirms they are authorised to bind the business. If we have signed a separate written agreement with you, that agreement governs where it conflicts with these terms.
CurrencyDesk is in early access. The service is live and handling real work, and it is also actively being built: features may change, be added or be withdrawn, and availability targets are not guaranteed during this period. Jurisdictions listed as planned are indicative and not a commitment to a date.
Founding pricing is honoured for as long as your account remains continuously active on the plan you joined. If you cancel and return later, current pricing applies.
You are responsible for everything done under your account, including by your staff. Give each person their own login, set their permissions appropriately, and remove them when they leave. Keep the information on your account accurate. You must be a business — the desk is not for personal use — and the people using it must be at least eighteen.
Do not use the desk to break the law, to launder money or finance terrorism, to evade sanctions, to falsify records, or to conceal a transaction from a regulator. Do not resell or white-label the service, copy it, reverse engineer it, probe it for vulnerabilities without our written permission, or use it to build a competing product. Do not upload malicious code or place unreasonable load on our systems.
We may suspend an account immediately where we reasonably believe this section has been breached or where continuing would expose us or other customers to legal risk.
This section matters more than any other, so it is written plainly. CurrencyDesk is a tool that helps you meet your obligations. It is not a compliance officer, a law firm, or a filing agent, and nothing in the desk is legal or regulatory advice.
You remain solely responsible for your registration and licensing, for your compliance programme, for determining what must be reported, for the accuracy of what you record, and for submitting reports to your regulator on time. Thresholds, prompts and prepared reports are provided to assist you; you must review them before relying on or submitting anything. Rules change, and while we work to keep the rulebooks current we do not warrant that they are complete or up to date at any given moment.
Your data stays yours. You grant us a worldwide, non-exclusive, royalty-free licence to host, copy, transmit, display and process it for as long as needed to provide, secure, support and improve the service, and to create the aggregated and de-identified data described in the Privacy Policy. That licence ends when your data is deleted, except for de-identified data, which survives.
If you send us feedback, ideas or feature requests, we may use them freely and without obligation or payment to you.
Subscription fees are billed in advance, monthly or annually, and are non-refundable except where the law requires otherwise or we have agreed otherwise in writing. Client verification is billed per file as it is used. Prices are quoted in the currency shown at checkout and exclude taxes, which are added where applicable.
You may cancel at any time, effective at the end of the current billing period. If payment fails we may suspend access after reasonable notice. We may change standard pricing with at least thirty days' notice, which takes effect at your next renewal; founding pricing is protected as described in section two.
The desk connects to services we do not control, including identity verification providers, payment processors and rate sources. Their results are theirs: we pass them through in good faith but do not warrant their accuracy, availability or fitness, and we are not liable for their acts or omissions. Your use of those services may also be subject to their own terms.
The software, its design, our name, logo and all related intellectual property belong to CurrencyDesk. You get a limited, non-transferable, revocable right to use the service while your account is in good standing. Nothing here transfers ownership of anything to you.
To the fullest extent permitted by law, the service is provided "as is" and "as available", without warranties of any kind, express or implied, including merchantability, fitness for a particular purpose, non-infringement, accuracy, or uninterrupted or error-free operation. Some jurisdictions do not allow certain exclusions; where that applies, this section applies to the extent permitted.
To the fullest extent permitted by law, CurrencyDesk is not liable for indirect, incidental, special, consequential or punitive damages, or for lost profits, lost revenue, lost business, lost data, or regulatory fines and penalties, however caused and on any theory of liability.
Our total aggregate liability arising out of or relating to this agreement will not exceed the amount you paid us in the twelve months immediately before the event giving rise to the claim. These limits apply even if a remedy fails of its essential purpose, and they do not exclude liability that cannot lawfully be excluded.
You will defend and indemnify CurrencyDesk against claims, losses and costs, including reasonable legal fees, arising from your use of the service, your data, your dealings with your clients, or your breach of this agreement or of any law or regulatory obligation that applies to your business.
You may close your account at any time. We may terminate or suspend for material breach, for non-payment, or where required by law, and we may discontinue the service on reasonable notice with a pro-rata refund of prepaid fees.
However the agreement ends, you can export your records in a standard format for at least thirty days afterwards. After that we may delete them, subject to retention we are legally required to maintain. Sections that by their nature should survive — including licence to de-identified data, intellectual property, warranties, liability, indemnity and disputes — survive termination.
We may amend these terms as the service and the law change. For material changes we will give notice by email or in the desk at least thirty days before they take effect. Continuing to use the service after that date means you accept the amended terms; if you do not accept them, cancel before they take effect and we will refund any unused prepaid fees.
This agreement is governed by the laws of the Province of Ontario and the federal laws of Canada that apply there, without regard to conflict of laws rules.
Before starting formal proceedings, both sides agree to raise the dispute in writing and try in good faith to resolve it for thirty days. Any dispute that cannot be resolved will be settled by final and binding arbitration seated in Toronto, Ontario, before a single arbitrator, conducted in English. Each party brings claims only in its individual capacity and not as a plaintiff or class member in any class or representative proceeding. Either party may still seek injunctive relief in court to protect intellectual property or confidential information, and either may pursue a claim in small claims court where it qualifies.
Questions about these terms go to legal@currencydeskos.com. Questions about your data go to privacy@currencydeskos.com. Anything else, use the contact page.
Your records are yours and you can take them with you. We never sell your data or show your numbers to another shop. The desk helps you meet your obligations, but meeting them is still your responsibility.