1. Introduction and Scope
Velvet Labs Inc. (“Velvet,” “we,” “us,” or “our”) is a Canadian corporation incorporated under the Canada Business Corporations Act on June 3, 2026 (Federal Corporation Number 1798892-3; Ontario Corporation Number 1001633476). Our registered office is located at 7 Seed Court, Brampton, Ontario L6X 5E4, Canada.
We are committed to protecting the privacy and security of personal information entrusted to us. This Privacy Policy explains in detail how we collect, use, disclose, retain, safeguard, and otherwise process personal information when you visit our website at www.joinvelvet.io, use our mobile applications (if any), create an account, initiate money transfers or currency exchanges, contact our support team, or otherwise interact with our Services.
This Privacy Policy is designed to comply with the Personal Information Protection and Electronic Documents Act (PIPEDA), applicable provincial privacy legislation (including Quebec’s Act respecting the protection of personal information in the private sector / Law 25 where applicable), the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA) and its associated Regulations, the Canadian Anti-Spam Legislation (CASL), and other applicable Canadian and international laws and regulatory guidance.
By accessing or using the Services, creating an account, or providing personal information to us, you acknowledge that you have read and understood this Privacy Policy and consent to the collection, use, and disclosure of your personal information as described herein, subject to your rights under applicable law. If you do not agree with any part of this Policy, you should not use the Services.
This Privacy Policy applies to all users of the Services, including individual consumers and authorized representatives of business customers. It does not apply to third-party websites, applications, or services that may be linked from our platform, even if we co-brand or provide services in connection with those third parties.
2. Definitions
For the purposes of this Privacy Policy, the following terms have the meanings set out below:
“Personal Information” means any information about an identifiable individual, including information that can be used alone or in combination with other information to identify, contact, or locate a natural person. This includes, but is not limited to, name, address, date of birth, identification numbers, financial information, and biometric data.
“Sensitive Personal Information” means personal information that, by its nature or the context of its collection, requires a higher degree of protection, including government-issued identification documents, biometric data (if collected), financial account details, and information revealing racial or ethnic origin, political opinions, religious beliefs, or health information (though we do not intentionally collect the latter categories).
“Services” means the website www.joinvelvet.io, any associated mobile applications, application programming interfaces (APIs), and all money transfer, currency exchange, and related features, functionality, and capabilities offered by Velvet Labs Inc.
“Processing” means any operation or set of operations performed on personal information, including collection, recording, organization, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure by transmission, dissemination, alignment, combination, restriction, erasure, or destruction.
“Controller” / “Organization” refers to Velvet Labs Inc., which determines the purposes and means of processing personal information.
“Processor” / “Service Provider” means a third party that processes personal information on behalf of and under the instructions of Velvet.
“FINTRAC” means the Financial Transactions and Reports Analysis Centre of Canada, the Canadian financial intelligence unit and regulator for money services businesses.
3. Information We Collect
We collect personal information only to the extent reasonably necessary for the purposes identified in this Policy and as required by law. The categories of information we collect include the following:
3.1 Information You Provide Directly
Identification and Contact Information: Full legal name, previous names or aliases (if any), date of birth, place of birth, residential address, mailing address, email address, telephone number(s), nationality, citizenship status, residency status, and occupation or nature of business.
Government-Issued Identification: Copies or images of passports, driver’s licences, permanent resident cards, national identity cards, birth certificates, or other official documents required for identity verification under PCMLTFA and FINTRAC guidance. We may also collect information extracted from such documents.
Financial and Transaction Information: Bank account numbers, transit and institution numbers, payment card details (typically tokenized and processed by PCI-DSS compliant processors), source-of-funds and source-of-wealth declarations, purpose of transfer, relationship to recipient, transaction amounts, currencies, exchange rates applied, fees charged, and full transaction history.
Recipient Information: Name, address, contact details, bank account or wallet information of the intended recipient of a transfer, and any additional information required by the destination jurisdiction or payout partner.
Business Customer Information: For corporate or institutional clients: legal entity name, business registration numbers, registered and operating addresses, nature of business, ownership structure, beneficial ownership information (including names, dates of birth, addresses, and identification of beneficial owners holding 25% or more, or who exercise control), authorized signatories, and corporate documents (articles of incorporation, certificates of status, etc.).
Communications and Support Data: Content of emails, chat messages, phone call recordings (where disclosed and permitted), support tickets, feedback, survey responses, and any other information you choose to provide when contacting us.
Account Credentials: Username, password (stored in hashed form), security questions and answers, multi-factor authentication settings, and related authentication data.
3.2 Information Collected Automatically
Device and Technical Data: Internet Protocol (IP) address, device type and model, operating system and version, browser type and version, device identifiers (such as advertising ID or unique device ID), screen resolution, language settings, and time zone.
Usage and Log Data: Pages and features accessed, dates and times of access, referring and exit pages, clickstream data, session duration, search queries within the platform, error logs, and performance metrics.
Location Information: Approximate geographic location derived from IP address or, with your permission, more precise location data from device settings. Location data may be used for fraud prevention, compliance with geographic restrictions, and service optimization.
Cookies and Similar Technologies: As further described in Section 11, we and our service providers use cookies, web beacons, pixel tags, local storage, and similar technologies to enable core functionality, maintain security, analyze usage, and (where permitted) support marketing.
3.3 Information from Third Parties
We may receive personal information about you from third-party sources, including:
- Identity verification and electronic KYC providers that confirm the authenticity of identification documents and perform biometric or facial matching (where used);
- Sanctions, Politically Exposed Persons (PEP), and adverse media screening databases;
- Payment processors, banks, and financial institutions involved in funding or payout;
- Fraud prevention and risk scoring services;
- Credit reporting agencies (only where permitted and necessary);
- Publicly available sources, including government registries and court records; and
- Other users or third parties who provide information about you in connection with a transaction (for example, a sender providing recipient details).
3.4 Information We Do Not Intentionally Collect
We do not intentionally collect special categories of personal information such as racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, or data concerning health or sexual orientation, except where such information is incidentally contained in identification documents and is processed solely for verification and compliance purposes.
4. Purposes for Which We Use Personal Information
We use personal information for the following specific purposes:
4.1 Providing and Administering the Services
- Creating, verifying, and managing user accounts;
- Processing money transfer and currency exchange instructions;
- Communicating transaction status, confirmations, and service-related notices;
- Providing customer support and resolving disputes or inquiries;
- Maintaining accurate records of transactions and account activity.
4.2 Identity Verification, AML/CTF Compliance, and Fraud Prevention
- Conducting Know Your Customer (KYC) and Customer Due Diligence (CDD) checks as required by the PCMLTFA and FINTRAC guidance;
- Screening against sanctions lists, PEP lists, and other watchlists;
- Monitoring transactions for unusual or suspicious patterns and filing required reports (including Suspicious Transaction Reports and Large Cash Transaction Reports where applicable) with FINTRAC;
- Detecting, preventing, and investigating fraud, unauthorized access, money laundering, terrorist financing, and other illegal activities;
- Complying with court orders, regulatory requests, and other legal obligations.
4.3 Improving and Developing the Services
We analyze aggregated and, where appropriate, individual usage data to understand how the Services are used, identify technical issues, improve user experience, develop new features, and optimize performance and security.
4.4 Marketing and Promotional Communications
With your consent or as otherwise permitted under CASL, we may send you promotional emails, in-app messages, or other communications about our products, features, offers, and news. You may withdraw consent at any time as described in Section 12.
4.5 Business Operations and Corporate Transactions
We may use personal information for internal administration, accounting, auditing, risk management, enforcing our Terms of Service, protecting our legal rights, and, in the event of a merger, acquisition, financing, reorganization, or sale of assets, transferring relevant information to the successor entity under appropriate confidentiality protections.
5. Legal Bases for Processing
Under PIPEDA and related principles, we process personal information on the following bases:
Consent: Where required, we obtain your meaningful consent (express or implied, depending on the sensitivity of the information and the circumstances) for the collection, use, and disclosure of personal information. You may withdraw consent subject to legal or contractual restrictions and reasonable notice.
Performance of a Contract: Processing is necessary to provide the Services you have requested and to perform our obligations under the Terms of Service.
Legal Obligation: Processing is necessary to comply with obligations under the PCMLTFA, PIPEDA, tax laws, court orders, and other applicable legislation and regulatory requirements.
Legitimate Interests: Processing is necessary for our legitimate business interests (such as fraud prevention, service improvement, and network security), provided those interests are not overridden by your privacy rights and interests.
6. Disclosure and Sharing of Personal Information
We do not sell, rent, or trade personal information for marketing purposes. We may disclose personal information only in the following circumstances:
6.1 Service Providers and Processors
We engage carefully selected third-party service providers to perform functions on our behalf, including identity verification, payment processing, cloud hosting, analytics, customer support tooling, email delivery, and fraud screening. These providers are contractually required to process personal information only in accordance with our instructions, to implement appropriate security measures, and to refrain from using the information for their own purposes.
6.2 Financial and Payment Partners
To complete transfers and currency exchanges, we may share necessary transaction and recipient information with banks, payment networks, correspondent institutions, and payout partners in the destination jurisdiction.
6.3 Regulatory Authorities and Law Enforcement
We may disclose personal information to FINTRAC, the Office of the Privacy Commissioner of Canada, provincial privacy commissioners, law enforcement agencies, courts, and other governmental authorities when required or permitted by law, including in response to valid legal process, to report suspicious activity, or to protect the rights, property, or safety of Velvet, our users, or the public.
6.4 Corporate Transactions
In connection with a merger, acquisition, financing, corporate reorganization, or sale of all or a portion of our assets, personal information may be transferred to the successor or acquiring entity, subject to appropriate confidentiality and data protection commitments.
6.5 With Your Consent or at Your Direction
We may share information when you expressly consent or direct us to do so (for example, when you authorize a third-party application to access certain account data).
7. International Data Transfers
Your personal information may be transferred to, stored in, or processed in countries outside Canada, including the United States and other jurisdictions where our service providers or payment partners operate. Privacy laws in those jurisdictions may differ from Canadian law and, in some cases, may not provide the same level of protection. Where we transfer personal information outside Canada, we implement appropriate contractual, technical, and organizational safeguards designed to protect the information in accordance with this Privacy Policy and applicable Canadian requirements. By using the Services, you acknowledge that your information may be transferred internationally as described.
8. Data Security Measures
We implement a comprehensive information security program that includes administrative, technical, and physical safeguards appropriate to the sensitivity of the personal information we process. These measures include, but are not limited to:
- Encryption of data in transit (TLS) and, where feasible, at rest;
- Access controls based on the principle of least privilege and role-based access;
- Multi-factor authentication options for user accounts and privileged internal access;
- Regular security assessments, vulnerability scanning, and penetration testing;
- Employee training on data protection and security awareness;
- Incident response and breach notification procedures aligned with applicable legal requirements;
- Secure development practices and change management controls.
Despite these measures, no method of transmission over the Internet or method of electronic storage is completely secure. We cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials and for any activity that occurs under your account.
9. Data Retention
We retain personal information only for as long as necessary to fulfill the purposes for which it was collected, to meet our legal and regulatory obligations (including record-keeping requirements under the PCMLTFA, which generally require retention of certain records for a minimum of five years from the date of the transaction or the end of the business relationship), to resolve disputes, to enforce our agreements, and for other legitimate business purposes.
When personal information is no longer required, we will securely destroy, erase, or anonymize it in accordance with our data retention schedule and applicable law. Anonymized or aggregated data that cannot reasonably be used to identify an individual may be retained indefinitely for analytical and statistical purposes.
10. Your Rights Under PIPEDA and Applicable Law
Subject to limited exceptions under applicable law, you have the following rights with respect to your personal information:
Right of Access: You may request access to the personal information we hold about you and information about how it has been used and disclosed.
Right of Correction: You may request that we correct inaccurate or incomplete personal information.
Right to Withdraw Consent: Where we rely on consent, you may withdraw that consent at any time, subject to legal or contractual restrictions and reasonable notice. Withdrawal of consent may affect our ability to provide certain Services.
Right to Challenge Compliance: You may challenge our compliance with this Privacy Policy and applicable privacy legislation.
Additional Rights in Certain Jurisdictions: Residents of Quebec and certain other provinces may have additional rights under provincial legislation (including rights relating to de-indexing, data portability, and automated decision-making, where applicable).
To exercise any of these rights, please contact our Privacy Officer using the contact details in Section 16. We will respond to your request within the timelines required by law (generally 30 days under PIPEDA, subject to extensions in certain circumstances). We may need to verify your identity before processing your request and may charge a reasonable fee for access requests in limited circumstances permitted by law.
12. Marketing Communications and CASL Compliance
We comply with the Canadian Anti-Spam Legislation (CASL). Commercial electronic messages will only be sent where we have obtained the necessary consent (express or, where permitted, implied) or where an exemption applies. Every commercial electronic message will include a clear and prominent unsubscribe mechanism that is free and easy to use. You may opt out of marketing communications at any time by following the unsubscribe instructions in the message or by contacting us. Opting out of marketing will not affect service-related transactional or administrative messages.
13. Children’s Privacy
The Services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children under 18. If you are a parent or guardian and believe that your child has provided us with personal information, please contact us immediately. If we become aware that we have collected personal information from a child under 18 without verified parental consent, we will take steps to delete that information as quickly as practicable.
14. Third-Party Links and Services
The Services may contain links to third-party websites, applications, or services that are not owned or controlled by Velvet. We are not responsible for the privacy practices or content of those third parties. We encourage you to review the privacy policies of any third-party sites you visit.
15. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make material changes, we will notify you by posting the updated Policy on our website, updating the “Last Updated” date, and, where appropriate, providing additional notice (such as email or in-app notification). We encourage you to review this Policy periodically. Your continued use of the Services after the effective date of any changes constitutes your acceptance of the revised Policy, to the extent permitted by law.
16. Contact Information and Privacy Officer
If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices, or if you wish to exercise your rights, please contact our Privacy Officer:
Privacy OfficerVelvet Labs Inc.7 Seed CourtBrampton, Ontario L6X 5E4CanadaEmail: contact@joinvelvet.ioWe will acknowledge and respond to inquiries in a timely manner and in accordance with applicable legal timelines.
17. Complaints and Regulatory Oversight
If you are not satisfied with our response to a privacy concern, you may file a complaint with the Office of the Privacy Commissioner of Canada:
Office of the Privacy Commissioner of Canada30 Victoria StreetGatineau, Quebec K1A 1H3Toll-free: 1-800-282-1376Website: www.priv.gc.caResidents of certain provinces may also contact their provincial privacy commissioner.