Privacy Policy

This policy explains what personal data Orris (“we”, the “Company”) collects through orris.cards and the dashboard, why and how we process it, who we share it with and what rights the Customer has.

Personal data means any information relating to an identified or identifiable individual. We process it only to provide the services, verify Customers, protect the Service, prevent fraud and comply with the law.

When you sign up and sign in:

• email address or Telegram ID;
• name, if provided;
• notification settings.

During verification, if required:

• phone number;
• identity document details and images;
• facial photos and liveness check data held by identity verification providers, where permitted by law;
• information and documents on the source of funds and purpose of transactions.

When you use the Service:

• Balance top-up, Card issue and Card funding history;
• Card transaction data: date, amount, currency, status, merchant;
• crypto wallet addresses and transaction IDs for crypto top-ups;
• support conversations and attachments.

Automatically:

• IP address, device type, browser and language;
• pages viewed, navigation and visit time;
• session identifiers.

Full Card numbers and CVCs are held by the Issuer and shown in the dashboard at the Customer's request.

We use cookies and browser local storage to keep you signed in, remember language and theme, protect the Service and understand how it is used.

• Strictly necessary — sign-in, security, fraud prevention.
• Functional — language, theme, interface preferences.
• Analytics — visit statistics, used only with consent or another lawful basis.

You can disable cookies in your browser, but some features may stop working.

We may receive data from Issuers and card networks, payment and crypto processing providers, identity verification, sanctions and anti-fraud providers, public registers, and public authorities where provided by law.

Only to the extent necessary for a specific purpose and under contractual and technical safeguards:

• Financial partners — Issuers, card program managers, card networks, acquirers, payment and crypto exchange providers — to issue Cards, process transactions, comply with the law and fight fraud.
• Verification providers — identity, AML, sanctions screening, anti-fraud.
• Technology vendors — hosting, email, messaging, support tools, analytics and security monitoring.
• Professional advisers — lawyers, auditors, insurers.
• Public authorities — where required by law or needed to protect the rights of the Company, Customers or third parties.

We do not sell personal data.

Some recipients are located in other countries, so data may be processed outside the country where it was collected, including where the level of protection differs. Where required by law, we apply appropriate safeguards.

We use encryption, access control, one-time code sign-in and monitoring. Only employees who need data for their work have access to it, and they are bound by confidentiality obligations.

Orris staff will never ask for your sign-in codes or Card details. If someone does so in our name, don't share them and contact us.

• Verification data and transaction history — at least 5 years after the relationship ends, or longer if required by law.
• Support conversations — a reasonable period after the ticket is closed, to handle recurring issues and disputes.
• Marketing consents — while the consent is active and a reasonable period after withdrawal.

After the retention period data is deleted or anonymized, unless the law requires longer retention or it is needed to defend a claim.

You have the right to:

• know what data we process and why;
• access your data;
• correct inaccurate data;
• request deletion, except data we must keep by law;
• restrict or object to processing where provided by law;
• receive your data in a machine-readable format;
• withdraw consent, including for marketing — via the link in emails or by writing to support.

Send requests to support@orris.cards from the email linked to your Account. We reply within 30 days and may ask you to confirm your identity. Sometimes the law does not allow us to fulfil a request — we will explain why.

We may update this policy. The new version applies from publication on the website; we may notify you of material changes by email or in the dashboard. Continued use of the Service means acceptance of the new version.