Privacy Policy

This Privacy Policy explains how Collext ("we", "us") collects, uses, shares and protects personal information when you use our website, mobile apps and related services (the "Services"). Collext is responsible for the personal information described here.

It applies to everyone who uses the Services, whether or not they have an account. It should be read together with our Terms of Service. If you do not agree with how we handle personal information, please do not use the Services.

Information you give us

• Account details: your username, email address and password. We never store your password itself, only a one-way cryptographic hash of it.
• Payment details: your Telebirr phone number; the bank or mobile-money accounts you add, with the bank, account holder name and account number; and any USDT withdrawal addresses you save.
• Security settings: if you turn on two-factor authentication, the secret key that links our Services to your authenticator app. It is stored encrypted.
• Payment proofs: the transaction IDs, receipt links and confirmation messages you submit for orders.
• Identity documents: if we ask you to verify your identity, the documents and images you provide.
• Communications: messages you send to our support team and evidence you provide in a dispute.

Information created when you use the Services

• Trading activity: your ads, your orders and their amounts, prices, payment methods and outcomes, disputes, and your reputation figures such as completed trades, completion rate and average release time.
• Wallet activity: your balances and every ledger entry, deposit request, deposit, withdrawal, and the blockchain addresses and transaction hashes involved.
• Verification results: when we check a payment receipt, the details the payment provider returns for it, such as the transaction reference, amount, date and time, status, and the names and account numbers (often partly masked) of the payer and payee.
• Security and technical data: the IP address and device or browser description (user agent) used to sign in or make requests, sign-in times, sign-in codes we have sent (stored only in hashed form), active sessions, and logs of requests to our servers.

Information from others

• Payment providers' receipt systems, when we verify a payment, as described above.
• Public blockchains, which record the addresses, amounts and timing of every transaction. We read this public data, through our own systems and data providers, to detect and confirm deposits and withdrawals.
• Other users, for example when a counterparty gives us information about you in a dispute.
• Authorities, where they lawfully provide information to us.

We use personal information to:

• provide the Services: create and run your account, show your ads, open and settle orders, hold escrow, credit deposits, process withdrawals, and verify payments;
• keep accounts secure: confirm your email, send sign-in codes and reset links, check authenticator codes, recognise unusual activity, and protect against unauthorised access;
• prevent fraud and crime: detect reused or fake receipts, third-party payments, suspicious patterns, and activity that breaks our policies, and meet our anti-money-laundering obligations;
• resolve disputes: review orders and evidence when a buyer and seller disagree;
• communicate with you: send messages about your account, orders, security and changes to our terms, and reply when you contact us;
• run and improve the Services: monitor performance and reliability, fix problems, and understand how features are used, using our own aggregated records; and
• meet legal obligations: keep records, respond to lawful requests from courts and authorities, and enforce our terms.

We do not sell your personal information. We do not use it for advertising, and we do not use third-party advertising or analytics trackers in the Services.

We use personal information only where we have a lawful reason, namely where:

• it is necessary to provide the Services you have asked for under our Terms of Service;
• we must do so to comply with the law;
• it is in our legitimate interests, or those of other users, to do so, for example to keep the Services secure and prevent fraud, and those interests are not outweighed by your rights; or
• you have given your consent, which you can withdraw at any time.

P2P trading means your counterparties see some information about you:

• Everyone using the marketplace can see your username, your ads, and your reputation figures (completed trades, completion rate and average release time), and whether your account is verified.
• A buyer on your order sees the details of the account they must pay into: the bank or wallet, the account holder name and the account number or Telebirr number.
• A seller on your order sees the payment you made and the proof you submitted, so they can check it.

Your email address, your password, and your full list of saved accounts are never shown to other users. Please share only what an order needs, and do not post personal information in places other users can see.

We share personal information only as described here:

• Service providers who run parts of the Services for us under contract and may use the information only to provide their service: cloud hosting and content-delivery providers that run our servers and website; our email provider, which delivers sign-in codes and account emails; the receipt-verification service we use to read payment providers' receipts; and blockchain data providers, which receive the public addresses and transaction hashes we ask about.
• Payment providers, when we look up a receipt you submitted, which involves sending them the transaction reference.
• Authorities, such as courts, regulators, tax authorities, financial intelligence units and law enforcement, where we are legally required to, or where we believe in good faith it is necessary to prevent fraud or other crime, or to protect the safety of any person.
• Professional advisers, such as lawyers and auditors, under a duty of confidentiality.
• A successor organisation, if our business or part of it is reorganised, merged or sold. We will tell you before your information becomes subject to a different privacy policy.

Blockchain transactions are public. When you deposit or withdraw, the addresses and amounts are recorded permanently on the public blockchain, which anyone can read. Neither we nor anyone else can remove them.

Some of our service providers process information in countries other than Ethiopia, including the United States and countries in Europe. When information is transferred abroad, we take steps to make sure it continues to be protected in line with this policy, for example by using providers that commit contractually to appropriate safeguards.

We keep personal information only as long as we need it for the purposes in this policy:

• Account and payment details: while your account is open, and afterwards for as long as needed to meet our legal and record-keeping obligations.
• Trades, ledger entries, deposits, withdrawals, payment proofs and verification results: for as long as the law requires us to keep financial and anti-money-laundering records, and in any case long enough to handle disputes, reversals and investigations. We keep these records even after your account is closed because they are needed to show that balances are correct.
• Sign-in codes and password reset links: they expire within minutes, can be used only once, and are stored only in hashed form, so the original code or link cannot be read back from our records.
• Sessions and security logs: for as long as needed to protect your account and investigate incidents.

When we no longer need information, we delete it or make it anonymous.

We use technical and organisational measures designed to protect personal information, including:

• encryption of data in transit using TLS;
• one-way hashing of passwords with a modern, deliberately slow algorithm, and hashing of sign-in codes and reset tokens;
• encryption of two-factor authentication secrets;
• email verification codes on sign-in, and optional authenticator-app codes for withdrawals and profile changes;
• an append-only ledger that records every balance movement; and
• restricting staff access to what each role needs, and logging staff actions.

No system is completely secure. If we become aware of a breach that affects your personal information, we will act to contain it and tell you and the relevant authorities where the law requires. You can help by keeping your password private and turning on two-factor authentication.

We use only what the Services need to work:

• A session cookie that keeps you signed in. It is essential, is marked secure and HTTP-only, and expires when you sign out or after the session ends.
• Browser storage to remember things on your device, such as a draft ad you have not finished, so you do not lose it when you move between pages.

We do not use advertising cookies or third-party tracking. If you block cookies in your browser, you will not be able to sign in.

Subject to the law that applies to you, you can ask us to:

• give you a copy of the personal information we hold about you;
• correct information that is inaccurate or incomplete. You can update most of it yourself in Settings;
• delete your information, where we are not required to keep it;
• restrict or object to certain uses of your information; or
• close your account.

To make a request, email [email protected] from the address on your account. We may need to confirm your identity before acting. We will respond within a reasonable time and within any period the law sets. Some requests may be refused where the law allows, for example where we must keep records to meet anti-money-laundering obligations. If you are unhappy with our response, you may complain to the data protection authority in your country.

The Services are only for people aged 18 or over. We do not knowingly collect information from anyone younger. If you believe a child has given us personal information, please contact us and we will delete it.

We may update this policy from time to time. The "Last updated" date at the top shows when it last changed. If we make a material change, we will tell you by email or by a notice in the Services before it takes effect.

For any question about this policy or your personal information, write to [email protected].