Privacy Policy
Last updated: 5 October 2026
FlagIQ ("FlagIQ", "we", "us") provides a real-time financial crime screening platform — sanctions screening, transaction monitoring, crypto Know-Your-Transaction (KYT) and on-chain tracing — to business clients such as payment platforms and fintechs. This policy explains what personal information we handle, in which role, and what rights you have.
The two hats we wear — read this first:
- As a controller — for our website visitors, demo requests, and the user accounts of people who sign in to FlagIQ. We decide how this data is used, and this policy governs it directly.
- As a processor — for the transaction data our clients submit for screening (which may include personal information about our clients' customers). Here our client is the controller: we process that data only to deliver the screening service under our agreement with the client. If your data reached FlagIQ because you transacted with one of our clients, that client's privacy policy governs — and requests about your data should go to them first.
1. Information we collect
a) As a controller
- Account data — name, email address, role and organization when a client user is invited to or signs in to the platform.
- Demo & contact data — name, work email, company, transaction volume and message when you submit our demo form or email us. Demo submissions are stored with the request's IP address and browser user-agent for abuse prevention.
- Correspondence — emails sent to our @flagiq.io addresses.
- Website data — we do not run analytics, advertising or tracking cookies on this site (see our Cookie Policy). Standard server logs (IP, request path) are kept by our hosting provider for security and operations.
b) As a processor, on our clients' instructions
- Transaction data submitted by clients via our API: party names, contact details, dates of birth, addresses, account and wallet identifiers, beneficial-ownership information, amounts, currencies, countries, device/IP context and related metadata, in whatever depth the client chooses to send.
- Screening outputs — risk scores, rule signals, matches against sanctions and illicit-address lists, case records, investigator notes, uploaded case documents and requests for information.
2. How we use information
- To deliver the service — screening transactions against sanctions lists (OFAC, UN, UK OFSI), politically-exposed-person data where configured, known illicit cryptocurrency addresses, mixing services and behavioral rules; opening and managing alerts and cases; producing audit trails.
- On-chain lookups — when a transaction involves cryptocurrency, wallet addresses and transaction hashes may be queried against public blockchain data via third-party block explorers and public RPC endpoints to verify the transaction and trace counterparties. Blockchain data is public by nature; we send only the address/hash required for the lookup.
- To operate and secure the platform — authentication, role-based access, tenant isolation, abuse prevention, append-only audit logging of privileged actions.
- To communicate — responding to demo requests and support, and sending service notifications. We do not sell personal information, and we do not use client-submitted transaction data for marketing, advertising, or training of any kind.
3. Legal bases
Where GDPR or similar laws (including South Africa's POPIA) apply: we process controller data on the basis of legitimate interest (operating and securing a B2B service, responding to enquiries) and contract (providing the platform to client users). Transaction data is processed on our clients' documented instructions; our clients typically rely on legal obligation — their own anti-money-laundering and counter-terrorist-financing duties — as their basis. Because AML screening is a legal-compliance activity, certain data-subject rights (such as erasure or objection) may be limited by law where records must be retained or screening must be performed.
4. Who we share data with
| Recipient | Purpose | Location |
|---|---|---|
| Google Cloud / Firebase | Hosting, database, authentication, file storage, serverless compute — our core infrastructure | United States (us-central1 / nam5) |
| Resend | Transactional email (demo confirmations, notifications, inbound mail routing) | United States |
| Public blockchain data providers (block explorers, public RPC endpoints) | On-chain verification and tracing lookups (wallet addresses / transaction hashes only) | Various |
| Authorities | Where required by law, regulation or valid legal process | As applicable |
Sanctions and attribution data flows into FlagIQ from official and open sources (OFAC, UN, UK OFSI, open ransomware and attribution registries); we do not send your personal information to those sources. A current subprocessor list and a Data Processing Addendum are available to clients on request at hello@flagiq.io.
5. Retention
- Transaction and case data is retained for the duration of the client relationship and thereafter per the client's instructions. Clients in regulated industries typically require retention of screening records for five years or more under AML law; deletion requests for this data are routed through the controlling client.
- Account data is kept while the account is active and removed within a reasonable period after closure, except where law requires longer.
- Demo and correspondence data is kept as long as needed to handle the enquiry and for reasonable business records.
- Audit logs are append-only by design and retained for the life of the client relationship — that immutability is a feature of the compliance service.
6. Security
FlagIQ is built as a compliance system of record: encryption in transit (TLS) and at rest (Google Cloud default encryption), HMAC-signed ingestion with replay protection and rotating per-client secrets, database-rule-level tenant isolation, role-based access control, server-side-only secrets, and attributed, append-only audit logging of privileged actions. No system is perfectly secure; if we become aware of a breach affecting personal information we will notify affected clients and, where required, regulators and data subjects without undue delay.
7. International transfers
Our infrastructure is located in the United States. Where data originates from jurisdictions with transfer restrictions (such as the EEA, UK or South Africa), transfers rely on appropriate safeguards — including our infrastructure providers' standard contractual clauses and, for Google, applicable adequacy frameworks. Details are available on request.
8. Your rights
Depending on your jurisdiction you may have rights to access, correct, delete, restrict or port your personal information, and to object to certain processing. If FlagIQ is the controller (website, demo, account data), contact us at hello@flagiq.io and we will respond within the legally required period. If your data was submitted by one of our clients for screening, please contact that organization — we will support them in fulfilling your request to the extent their AML obligations allow. You may also lodge a complaint with your data protection authority.
9. Children
FlagIQ is a business-to-business service and is not directed at children. We do not knowingly collect personal information from anyone under 18 as a controller.
10. Changes & contact
We will post any changes to this policy on this page and update the date above; material changes affecting clients will be notified directly. Questions, requests or complaints: hello@flagiq.io.