Privacy Policy
Version 1.0 · Effective Date: 21 September 2026
This policy explains what happens to personal data when SpendLayer Direct is used. It covers the consent screen we host, where a merchant’s customer approves a Mandate, and this web site. It is written for the people whose data we handle: merchants, and the customers who approve a Mandate.
SpendLayer Direct is provided by Circinus Finance Ltd., a non-resident domestic company incorporated in the Republic of the Marshall Islands on 7 August 2025 with corporation number 133239, whose registered office is at Trust Company Complex, Ajeltake Road, Ajeltake Island, Majuro, Republic of the Marshall Islands MH 96960, trading as SpendLayer (“SpendLayer”, “we”, “our”, “us”).
1. Who is responsible for what
1.1 We are the controller for the consent screen we host and for the operation of the SpendLayer technology. We decide what that screen shows, what it collects and how it works.
1.2 The merchant is the controller for its own relationship with its customer — the account, the order, the goods or services, and any marketing. We are not responsible for what a merchant does with its customer’s data, and this policy does not describe it. The merchant’s own privacy policy covers that.
1.3 Where we hold data solely on a merchant’s instructions, such as an order reference the merchant passes to us so that a payment can be matched to its records, we act as that merchant’s processor and handle it under our agreement with them.
1.4 Where a distributor is appointed for your region under section 2.5 of the Merchant Terms, that distributor takes our role in this policy for the Services it provides, on terms materially equivalent to these.
2. What we collect
2.1 When a customer approves a Mandate. The wallet address giving the Mandate, the merchant’s wallet address, the terms of the Mandate you are approving (the amount or cap, the frequency and the period), the identifier of the merchant and of the order, and the date and time of approval.
2.2 Technical data. IP address, approximate location derived from it, browser and device type, language, and the pages and actions on the consent screen and on this web site. We use this to make the screen work, to keep it secure, and to detect misuse.
2.3 Merchant data. For merchants, the business and contact details, onboarding and verification records, and correspondence we hold in order to provide the Services under the Merchant Terms.
2.4 What we do not collect. We do not ask for and do not receive card numbers or bank account details. We do not hold your private key or your password, and we cannot move, freeze or recover the assets in any wallet.
3. Why we use it
3.1 To show you the Mandate and record your approval of it — because it is necessary to do what you asked us to do.
3.2 To operate, secure and improve the technology, to prevent fraud and abuse, and to keep records of what happened — because we have a legitimate interest in running a service that works and is not abused, and we have balanced that against your interests.
3.3 To provide the Services to merchants and to administer that relationship — because it is necessary to perform our contract with them.
3.4 To comply with a legal obligation, or to establish, exercise or defend a legal claim.
3.5 We do not sell personal data, and we do not use it to profile you or to make automated decisions that produce legal effects for you.
4. The blockchain record
4.1 A Mandate and the transfers made under it are recorded on a public blockchain network. That record is public and permanent. It shows wallet addresses, amounts and times. It does not show your name.
4.2 We cannot change, delete or hide anything once it is on a blockchain, and neither can anyone else. If your wallet address can be connected to you, the record can be read by anyone. Please consider this before you approve a Mandate.
4.3 This is a limit on what we are able to do for you under section 8, not a refusal.
5. Who we share it with
5.1 The merchant you are paying, so that it can identify and fulfil your order.
5.2 Our service providers — hosting, infrastructure, logging, analytics and security — who act on our instructions and are bound to protect the data.
5.3 Companies in our group and appointed distributors, where they provide or service part of the Services.
5.4 Authorities, courts and advisers, where we are required by law to disclose or where it is necessary to bring or defend a claim.
5.5 A buyer, if the business or the relevant part of it is reorganised, merged or sold.
6. Where data is handled
6.1 We and our providers handle data in more than one country, including outside the United Kingdom and the European Economic Area. The Marshall Islands, where we are incorporated, is not the subject of a UK or EU adequacy decision.
6.2 Where personal data protected by UK or EU law leaves those areas, we rely on the UK International Data Transfer Addendum or the European Commission’s standard contractual clauses, together with the additional measures those require. You can ask us for a copy of the safeguards we use.
6.3 Data you put on a blockchain network is distributed across that network worldwide by its design, and no transfer mechanism can control where it goes. Section 4 explains this.
7. How long we keep it
7.1 We keep the record of a Mandate and of the transactions under it for as long as we need it to run the service and to answer a question or a claim about it, and then for as long as the law requires.
7.2 We keep technical and security logs for a short period, usually measured in months, unless we need a particular log for an investigation.
7.3 We keep merchant records for the life of the relationship and for the period afterwards that the law and our own limitation periods require.
7.4 The blockchain record is permanent and is outside these periods.
8. Your rights
8.1 Depending on where you are, you may ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, or to receive it in a portable form. Where we rely on consent, you can withdraw it at any time, which does not affect what we did before.
8.2 Write to info@spendlayer.com. We will answer within one month. We may ask you to prove that the request is yours — for a wallet address, that usually means signing a message with it.
8.3 There are two limits we want you to know about before you ask. We cannot change or remove anything recorded on a blockchain. And if a merchant, not we, holds the data you are asking about, we will tell you and point you to that merchant.
8.4 If you are in the United Kingdom or the European Economic Area you may complain to your data protection authority. In the UK that is the Information Commissioner’s Office.
9. Cookies and similar technologies
9.1 The consent screen uses only what it needs to work and to stay secure — keeping your session, remembering where you are in the flow, and preventing abuse. These do not require your consent.
9.2 Where we use anything beyond that on this web site, we ask you first and you can decline without losing access to anything.
10. Security
10.1 We use encryption in transit, access controls, least-privilege access, logging and regular review. No service can promise that nothing will ever go wrong, but we will tell you and the relevant authority where the law requires it.
11. Children
11.1 The Services are not directed to children and are not offered to anyone under 18.
12. Changes to this policy
12.1 We may change this policy. We will publish the changed version here with a new version number and Effective Date. The version published at the time you use the Services is the one that applies.
13. Contact
Circinus Finance Ltd. trading as SpendLayer, corporation number 133239. Registered office: Trust Company Complex, Ajeltake Road, Ajeltake Island, Majuro, Republic of the Marshall Islands MH 96960. Enquiries, including about this policy and about your rights: info@spendlayer.com.
