Both documents in full, on one page. Written to be read. If anything here is unclear, ask us and we will answer plainly.
This policy explains what CurrencyDesk collects, why we collect it, and what we do with it. It covers our website, our software, and everything you do on the desk.
CurrencyDesk ("CurrencyDesk", "we", "us") provides software for money services businesses. In this policy, "you" means the business that holds an account with us and the people who use it on that business's behalf.
We are the controller of information about you and your staff. We are a processor, acting on your instructions, for information about your clients. Section four explains that difference and why it matters.
We collect the following, and we collect it because the service does not work without it:
We use the information above to run the desk, keep it working, and make it better. Specifically: to provide and maintain the service; to authenticate your team and secure your account; to generate your reports and records; to send service messages, billing notices and support replies; to detect, investigate and prevent fraud, abuse and security incidents; to meet our own legal obligations; and to develop, test and improve existing and future products and features.
We also use it to understand how the desk is used across our customer base, which features earn their place, where people get stuck, and what to build next. Where that analysis does not require identifying anyone, we carry it out on aggregated or de-identified data as described in section five.
We do not sell your information. We do not publish your rates, spreads, volumes or client list, and we do not disclose your identifiable business data to other customers, brokers or data buyers.
Information you record about your own clients belongs to your business, not to ours. You decide what to collect and why; you are responsible for having a lawful basis to collect it and for the notices and consents your regulator requires. We hold and process it on your behalf, following your instructions and the terms of this agreement.
We do not use your clients' identifiable personal information for our own marketing, and we do not contact your clients on our own behalf. Where we process it beyond providing the service, we do so only in de-identified form.
We create aggregated and de-identified data from activity on the desk, information from which you, your business and your clients cannot reasonably be identified. Examples include how long a task takes across all desks, how often a feature is used, and how currency demand moves across a region in aggregate.
We may use this data for any lawful business purpose, including improving and training our products, benchmarking, research, and producing industry insights, and we may continue to do so after your account ends. We will not attempt to re-identify it, and we will not publish it in any form that identifies you or your clients.
We share information only in these circumstances:
We use cookies to keep you signed in, remember your settings and keep the service secure. We do not run analytics cookies today.
We do not run third-party advertising trackers on the desk itself.
The desk is hosted on Render in its Oregon region in the United States, and the database is hosted by Neon [Neon region: to confirm]. We do not keep a separate copy in the country where the desk operates. This means information about you, your staff and your clients is stored and processed outside Canada. While it is in the United States it is subject to US law and may be accessed by courts, law enforcement and national security authorities there. [Data processing terms with Render and Neon: to confirm]. If you serve clients, you may need to tell them that their information is stored outside Canada.
The desk does not delete records on a schedule while your account is open. Keeping records for the period your regulator requires is your obligation. After your account ends you can export your records for at least thirty days, after which we may delete them, subject to retention we are legally required to maintain. Account and billing information is kept while your account is open and for as long afterwards as we need it to meet our own legal, tax and audit obligations. Aggregated and de-identified data may be kept indefinitely.
The public site is served over HTTPS. Access inside CurrencyDesk is limited to staff who need it to do their job. Changes made through our admin tools are logged. You control who on your team has an account and what they can see.
No system is perfectly secure. You are responsible for keeping credentials confidential, removing staff who leave, and telling us promptly if you believe an account has been compromised. If a breach affects your data and the law requires notice, we will notify you without undue delay.
Depending on where you are, you may have the right to access the personal information we hold about you, correct it, ask us to delete it, object to or restrict certain processing, and receive a copy in a portable format. You can download your ledger and client reports from the desk at any time without asking us.
Some information we cannot delete on request: records we are required to retain, and anything needed to resolve a dispute or enforce our agreement. If one of your clients makes a request about their information, direct them to you: you are the controller of that record, and we will support you in answering.
To make a request, write to privacy@currencydeskos.com.
We may update this policy as the service changes. If a change materially reduces your rights we will tell you by email or in the desk before it takes effect. The date at the top always shows the current version, and continuing to use the desk after a change means you accept it.
These terms govern your use of CurrencyDesk. By opening an account, or by using the desk, you agree to them on behalf of your business.
These terms, together with the Privacy Policy and any order or plan you sign up to, form the whole agreement between your business and CurrencyDesk. The person accepting them confirms they are authorised to bind the business. If we have signed a separate written agreement with you, that agreement governs where it conflicts with these terms.
CurrencyDesk is in early access in Canada. It is also actively being built: features may change, be added or be withdrawn, and availability targets are not guaranteed during this period. Jurisdictions listed as planned are indicative and not a commitment to a date.
Founding pricing is honoured for as long as your account remains continuously active on the plan you joined. If you cancel and return later, current pricing applies.
You are responsible for everything done under your account, including by your staff. Give each person their own login, set their permissions appropriately, and remove them when they leave. Keep the information on your account accurate. You must be a business, the desk is not for personal use, and the people using it must be at least eighteen.
Do not use the desk to break the law, to launder money or finance terrorism, to evade sanctions, to falsify records, or to conceal a transaction from a regulator. Do not resell or white-label the service, copy it, reverse engineer it, probe it for vulnerabilities without our written permission, or use it to build a competing product. Do not upload malicious code or place unreasonable load on our systems.
We may suspend an account immediately where we reasonably believe this section has been breached or where continuing would expose us or other customers to legal risk.
This section matters more than any other, so it is written plainly. CurrencyDesk is a tool that helps you meet your obligations. It is not a compliance officer, a law firm, or a filing agent, and nothing in the desk is legal or regulatory advice.
You remain solely responsible for your registration and licensing, for your compliance programme, for determining what must be reported, for the accuracy of what you record, and for submitting reports to your regulator on time. Thresholds, prompts and prepared reports are provided to assist you; you must review them before relying on or submitting anything. Rules change, and while we work to keep the rulebooks current we do not warrant that they are complete or up to date at any given moment.
Your data stays yours. You grant us a worldwide, non-exclusive, royalty-free licence to host, copy, transmit, display and process it for as long as needed to provide, secure, support and improve the service, and to create the aggregated and de-identified data described in the Privacy Policy. That licence ends when your data is deleted, except for de-identified data, which survives.
If you send us feedback, ideas or feature requests, we may use them freely and without obligation or payment to you.
Subscription fees are billed in advance, monthly or annually, and are non-refundable except where the law requires otherwise or we have agreed otherwise in writing. ID verification is coming and is not billed yet. Prices are quoted in the currency shown at checkout and exclude taxes, which are added where applicable.
You may cancel at any time, effective at the end of the current billing period. If payment fails we may suspend access after reasonable notice. We may change standard pricing with at least thirty days' notice, which takes effect at your next renewal; founding pricing is protected as described in section two.
Service providers we rely on: Render, for hosting in the United States; Neon, for the database; Resend, to send account and sign-in emails; Stripe, for billing; Twilio, to send sign up codes by text when that option is on, and to send a quote from a shop's public page by text or WhatsApp when texting is configured; and Google, to look up a business address during onboarding. Cloudflare, to deliver and protect the website. It sees visitors' IP addresses and requests. For our own sales outreach we use Tavily for research and ElevenLabs for phone calls, which may be recorded. Each provider may use the information only to provide its service to us. We do not warrant the accuracy, availability or fitness of any outside service the desk may use later, and we are not liable for its acts or omissions.
The software, its design, our name, logo and all related intellectual property belong to CurrencyDesk. You get a limited, non-transferable, revocable right to use the service while your account is in good standing. Nothing here transfers ownership of anything to you.
To the fullest extent permitted by law, the service is provided "as is" and "as available", without warranties of any kind, express or implied, including merchantability, fitness for a particular purpose, non-infringement, accuracy, or uninterrupted or error-free operation. Some jurisdictions do not allow certain exclusions; where that applies, this section applies to the extent permitted.
To the fullest extent permitted by law, CurrencyDesk is not liable for indirect, incidental, special, consequential or punitive damages, or for lost profits, lost revenue, lost business, lost data, or regulatory fines and penalties, however caused and on any theory of liability.
Our total aggregate liability arising out of or relating to this agreement will not exceed the amount you paid us in the twelve months immediately before the event giving rise to the claim. These limits apply even if a remedy fails of its essential purpose, and they do not exclude liability that cannot lawfully be excluded.
You will defend and indemnify CurrencyDesk against claims, losses and costs, including reasonable legal fees, arising from your use of the service, your data, your dealings with your clients, or your breach of this agreement or of any law or regulatory obligation that applies to your business.
You may close your account at any time. We may terminate or suspend for material breach, for non-payment, or where required by law, and we may discontinue the service on reasonable notice with a pro-rata refund of prepaid fees.
However the agreement ends, you can export your records in a standard format for at least thirty days afterwards. After that we may delete them, subject to retention we are legally required to maintain. Sections that by their nature should survive, including licence to de-identified data, intellectual property, warranties, liability, indemnity and disputes, survive termination.
We may amend these terms as the service and the law change. For material changes we will give notice by email or in the desk at least thirty days before they take effect. Continuing to use the service after that date means you accept the amended terms; if you do not accept them, cancel before they take effect and we will refund any unused prepaid fees.
This agreement is governed by the laws of the Province of Ontario and the federal laws of Canada that apply there, without regard to conflict of laws rules.
Before starting formal proceedings, both sides agree to raise the dispute in writing and try in good faith to resolve it for thirty days. Any dispute that cannot be resolved will be settled by final and binding arbitration seated in Toronto, Ontario, before a single arbitrator, conducted in English. Each party brings claims only in its individual capacity and not as a plaintiff or class member in any class or representative proceeding. Either party may still seek injunctive relief in court to protect intellectual property or confidential information, and either may pursue a claim in small claims court where it qualifies.
Questions about these terms go to legal@currencydeskos.com. Questions about your data go to privacy@currencydeskos.com. Anything else, use the contact page.
Your records are yours and you can take them with you. We never sell your data or show your numbers to another shop. The desk helps you meet your obligations, but meeting them is still your responsibility.