Privacy Policy

Effective Date: 13 December 2024. Last Updated: 24 September 2026

1. Introduction#

This Privacy Policy (Policy) applies to the Kasu lending platform, including the website at kasu.finance, the application at app.kasu.finance and any related sites and applications (together, the Platform), provided by Kasu, a company registered in the Cayman Islands with registration number 402812 (Kasu, we, us, our). It describes how we collect, use and disclose Personal Information about current and prospective users of the Platform and the services provided through it (you, your).

Personal Information means any information that relates to an identified or identifiable individual. It does not include information that has been anonymised so that it no longer identifies a specific person.

Kasu handles your Personal Information in accordance with the Data Protection Act (as revised) of the Cayman Islands, where Kasu is incorporated, and with any other data protection law that applies to you because of where you live, including the General Data Protection Regulation where you are in the European Economic Area or the United Kingdom (together, Data Protection Laws). This Policy applies in addition to, and does not limit, our obligations under those laws.

2. Your acknowledgment of this Policy#

By providing us with, or authorising us to collect, your Personal Information, you acknowledge that you have read and understood this Policy. Where Data Protection Laws require your consent for a particular use of your Personal Information, we will ask for it separately at the point it is needed.

If you do not want your Personal Information to be used or disclosed as described in this Policy, you should not use the Platform or the services offered through it (the Services).

3. Information we collect#

3.1 Types of Personal Information

(a) Technical and usage information. Information sent to us by your device when you use the Platform, such as device type, browser type and version, IP address, screen size, language and usage data. Some of this information is not personally identifiable on its own but may become so when combined with other data, and we treat it as Personal Information.

(b) Contact and identity details. Your name, email address, telephone number, date of birth, residential address and nationality.

(c) Financial and transaction information. The details of Lending Requests, Withdrawal Requests, transfers and other transactions you make through the Platform; the wallet addresses associated with your Digital Wallet or any wallet you connect; and, if you add funds by bank transfer or transfer funds to your bank, the bank account details you register.

(d) Verification information. Documents and data you provide for identity verification (Know Your Customer) or business verification (Know Your Business), which may include a copy of your government-issued identity document, a photograph or video of your face for comparison with that document, proof of address, occupation, and information about your source of funds and source of wealth. For businesses, it includes the identity information of directors and of individuals holding 25% or more of the business.

(e) Support communications. The content of your correspondence with us, including by email, Telegram or Discord.

3.2 Sensitive information

Sensitive Information is Personal Information that reveals a person's racial or ethnic origin, political or philosophical opinions, religious beliefs, criminal record, sexual orientation, or health, including biometric data. The facial image used in identity verification is biometric data. We do not collect Sensitive Information except where it is required for identity verification and financial crime screening, where the law requires or authorises it, or with your explicit consent.

4. How we collect your Personal Information#

(a) When you visit the Platform. Your device sends us technical information automatically (section 3.1(a)).

(b) When you sign in and verify your identity. When you create an account and complete identity or business verification, you provide the information in sections 3.1(b) and (d). Verification is carried out by our verification partner, Didit, which collects your documents and biometric data directly under its own privacy terms, shown to you when you begin, and provides us with the verification result and the identity information needed to operate your account.

(c) When you add funds by bank transfer or transfer funds to your bank. These services are provided by our payments partner, Wayex, on infrastructure provided by Bridge. Bridge is required to verify you separately, using Persona, and holds the documents you provide for that verification under its own privacy terms. We receive the outcome of that verification and the information needed to match transfers to your account, not the underlying documents.

(d) When you use the Services. We record the transactions you make through the Platform (section 3.1(c)). Transactions on the blockchain, including your wallet address and the amounts and timing of your loans, are recorded on a public ledger that anyone can read and that cannot be altered or deleted. Your name and other identity information are not recorded on the blockchain.

(e) To protect against fraud and misuse. We may collect information about how you use the Platform, and about your device, to detect fraud, security threats and misuse.

(f) When you contact us. Through email, Telegram, Discord or any other channel we make available.

5. Why we collect and process your Personal Information#

We collect, hold, use and disclose your Personal Information to:

(a) provide the Services, including operating your account and Digital Wallet, processing your Lending Requests and Withdrawal Requests, and generating and administering your Loan Agreements;

(b) verify your identity and screen against sanctions, politically exposed person and other financial crime lists, as required by anti-money-laundering and counter-terrorism-financing law;

(c) communicate with you about your account and transactions, including notifications you must receive to exercise rights under your Loan Agreement, such as the opportunity to opt in or out of lending to a named End Borrower;

(d) protect users and the Platform from fraud, security threats and illegal activity, and enforce our Terms of Use;

(e) improve the Platform and the Services, including developing features, fixing faults and analysing usage;

(f) send you service updates and, where you have opted in, marketing communications; and

(g) comply with applicable laws, regulations and lawful requests from authorities, and to establish, exercise or defend legal claims.

Where the General Data Protection Regulation applies, our legal bases for processing are: performance of our contract with you (purposes (a) and (c)); compliance with our legal obligations (purposes (b) and (g)); our legitimate interests in operating, securing and improving the Platform, where those interests are not overridden by your rights (purposes (d) and (e)); and your consent (marketing under purpose (f), and any Sensitive Information not required by law).

6. How we contact you#

We may contact you with service updates and, where you have opted in, information about our products and Services. You may opt out of marketing communications at any time. You cannot opt out of transactional communications, such as notifications about your Lending Requests, Withdrawal Requests, Loan Agreements, or your opportunity to opt in or out of lending to a named End Borrower, because these are necessary to operate your account and for you to exercise your rights.

7. Your rights#

Depending on where you live, you may have the right to access the Personal Information we hold about you, to have it corrected or updated, to have it deleted, to restrict or object to its processing, to receive it in a portable format, and to withdraw any consent you have given. Where a decision affecting you is made by automated means, such as automated screening in identity verification, you may have the right to ask for human review.

To exercise any of these rights, contact us at info@kasu.finance. We will respond within a reasonable period and no later than the time required by applicable law. We will take reasonable steps to verify your identity before acting on a request.

8. Circumstances in which we may not be able to accommodate your request#

(a) There may be circumstances in which we are unable to accommodate a request to access, correct, update or delete Personal Information, including where:

(i) applicable law permits us to refuse the request;

(ii) we are required to retain the information under applicable law, including anti-money-laundering and counter-terrorism-financing law, or for accounting or tax purposes;

(iii) we need the information to comply with a civil, criminal or regulatory inquiry, investigation, subpoena or summons;

(iv) we need to cooperate with law enforcement concerning conduct that we reasonably and in good faith believe may be unlawful;

(v) we need the information to establish, exercise or defend legal claims;

(vi) the information is subject to legal privilege or contains another party's proprietary information; or

(vii) complying with the request would compromise the privacy or other legitimate rights of others.

(b) If we cannot act on a request, we will tell you why and give you a contact point for further enquiries.

(c) Where applicable law permits, we may charge a reasonable fee for handling a request, in which case we will give you a written estimate before proceeding.

We may disclose your Personal Information to:

(a) our verification partner (Didit) for identity and business verification and financial crime screening;

(b) our payments partners (Wayex, Bridge and their verification provider, Persona) where you add funds by bank transfer or transfer funds to your bank, as described in section 4(c);

(d) Credit Originators, to the extent necessary to operate the Lending Strategies you lend to, for example to identify you as a lender under a Loan Agreement;

(e) other service providers carrying out functions on our behalf, such as email delivery, analytics and customer support tools, who are bound to keep your information confidential and to use it only for the purpose we specify;

(f) any person acting on your behalf, such as your solicitor, accountant, executor, administrator, trustee or guardian;

(g) courts, government, law enforcement and regulatory bodies, and other third parties, where required or authorised by applicable law; and

(h) any other third party with your consent.

We do not sell your Personal Information.

10. Location of your Personal Information#

Kasu is incorporated in the Cayman Islands, and our service providers operate in a number of countries. Your Personal Information may therefore be transferred to, stored and processed in countries other than the one you live in, including countries whose data protection laws differ from your own.

Where we transfer Personal Information out of the European Economic Area or the United Kingdom, we do so under safeguards recognised by the Data Protection Laws, such as standard contractual clauses or a finding that the destination provides adequate protection, and we require our service providers to protect your Personal Information in accordance with this Policy.

By submitting your Personal Information through the Platform you acknowledge, and where your local law requires it consent to, this transfer, storage and processing.

11. Cookies#

11.1 We use first-party and third-party cookies and similar technologies when you access the Platform. Cookies are small text files placed in your browser to store preferences and to collect information generated automatically as you use the Platform, including anonymous usage statistics.

11.2 We use these technologies to operate the Platform, remember your preferences and sign-in state, avoid re-entry of data, enhance security, and understand how the Platform is used.

11.3 Cookies set by third-party service providers for security, analytics and performance may share the information they collect with those providers, who are required to keep it confidential and to use it only as our service providers.

11.4 We use cookies and similar technologies where they are necessary to perform our contract with you, where they are in our legitimate interests and those interests are not overridden by your rights, and, where the law requires it, with your consent. You can control cookies through your browser settings, but disabling essential cookies may prevent the Platform from working.

12. Security#

We take reasonable steps to protect the Personal Information we hold, using physical, electronic and procedural measures designed to prevent interference, loss, misuse, unauthorised access, modification or disclosure.

No transmission over the internet, and no method of electronic storage, is completely secure. We cannot guarantee that unauthorised access or use will never occur. To the extent we have implemented the security measures required by applicable law, we are not liable for unauthorised access, hacking or other security intrusions, or for loss, theft, corruption or destruction of Personal Information resulting from them.

You are responsible for the security of your own devices, your email account and, if you connect your own wallet, its keys and recovery phrase.

13. Data retention#

We retain Personal Information for as long as it is needed for the purposes for which it was collected, and thereafter for as long as applicable law requires. Anti-money-laundering and counter-terrorism-financing laws require us to retain identity verification and transaction records for a minimum period after our relationship with you ends, generally at least five years. Personal Information that is no longer required will be deleted or anonymised, unless we have a valid reason to retain it under applicable law, such as to resolve a dispute or comply with a legal obligation.

14. Data breach notification#

If a breach of security affecting your Personal Information occurs, we will assess it and, where applicable law requires, notify the relevant supervisory authority and you without undue delay and within the timeframes that law sets, including within 72 hours of becoming aware of the breach where the General Data Protection Regulation applies.

15. Complaints and supervisory authorities#

If you have a question, concern or complaint about this Policy or our handling of your Personal Information, contact us first at info@kasu.finance and we will investigate and respond. If you are in the European Economic Area or the United Kingdom, you also have the right to complain to the data protection supervisory authority of the country in which you live. Users in other jurisdictions may have equivalent rights under their local law.

16. Children#

The Platform is not directed at, and may not be used by, anyone under 18 years of age. We do not knowingly collect Personal Information from children. If you believe a child has provided us with Personal Information, contact us and we will delete it.

17. Contact us#

Questions about this Policy, and requests to exercise your rights, should be sent to info@kasu.finance.

18. Updates to this Policy#

We may change this Policy from time to time. The current version, with its effective date, is published on the Platform, and we will draw material changes to your attention on the Platform or by email. Please check it periodically.

Last updated Sep 24, 2026