HuzraPurpose and scope
This policy explains the safeguards Huzra applies to personal data across the mini app, the Telegram bot, the website and our internal processes. It complements the Privacy Policy, which describes what we collect and why.
The data controller is CashAlo Finance Inc., 221 W 10th St, 4th Floor, Wilmington, DE 19801, United States. Send data protection requests through the bot chat or the contacts on our Contact page.
Principles
We handle personal data according to these principles:
- Purpose limitation. Data is collected for running the service, verifying identity, preventing fraud and meeting legal duties, and not reused for unrelated purposes.
- Data minimisation. We ask only for what a step needs. Identity verification needs your name, date of birth, address, ID number and its issuing country; withdrawals abroad need the recipient details a bank requires.
- Accuracy. You can correct details by contacting support.
- Storage limitation. Data is kept only as long as needed for the purposes above or as required by law.
- Integrity and confidentiality. Data is protected against unauthorised access, loss and alteration.
We apply the data protection standards required by the law where each user is located, including Indonesia's Personal Data Protection Law (Law No. 27 of 2022) for users in Indonesia.
Categories of data
| Category | Examples | Why |
|---|---|---|
| Telegram account data | User ID, username and username changes, language, Premium status | Identify you, talk to you in your language, and spot account misuse |
| Identity data | Full legal name, date of birth, residential address and country, passport or government ID number and issuing country | Identity verification before the first order |
| Transaction data | Orders, amounts, currencies, pickup method, status, timestamps | Run and record transactions |
| Balance and withdrawal data | Balance history, recipient bank and address details | Pay out your balance to your own account |
| Communications | Messages you send to support in the bot chat | Answer questions and resolve issues |
| Technical data | IP address and the approximate country and network it belongs to, browser type, server logs | Security, abuse and fraud prevention |
| Device hints from the mini app | Telegram app type (Android, iPhone, desktop), phone time zone, screen size, app language | Fraud prevention: spotting one device behind several accounts, or a location that does not match |
| Payment-source data | The wallet address a USDT or USDC payment came from | Matching payments to orders, fraud and sanctions checks |
| How you found us | The link you used to open the bot (for example a link from one of our Instagram accounts) | Showing the bot in your language and measuring which channels work |
| Feedback | Whether you collected your cash, a 1 to 5 rating, comments you choose to send | Improving the service and fixing problems |
Security measures
- Encryption. ID numbers, dates of birth and addresses are encrypted before they are stored. All traffic to our website and mini app uses HTTPS.
- Signed sessions. The mini app accepts a request only if Telegram's signature on your session is valid.
- Access control. Only designated administrators can see identity and transaction data, and only for the tasks they perform. Administrative actions are logged.
- Network protection. Our servers run a firewall and automatically block repeated abusive requests.
- Bot protection. Requests are rate-limited, and identity verification includes an automated check that runs in your browser plus a Cloudflare Turnstile security check. Turnstile is provided by Cloudflare, which processes technical data such as your IP address and browser signals only to tell people from bots.
- Fraud and compliance checks. When you verify your identity, place an order, report a payment or request a withdrawal, we record the IP address, its approximate country and network, and the device hints listed above. A team member sees these signals next to the order. They help us spot stolen accounts, one person using several accounts, VPN use that hides a location, payments from wallets frozen by the stablecoin issuer, and orders split to stay under review limits. The signals do not make decisions on their own: a person reviews every order. Country and network data come from an IP database we keep on our own server; no outside service receives your IP address for this.
- Watch list. Accounts, passports (stored only as a one-way fingerprint), IP addresses and wallets linked to suspected fraud can be marked for extra review. A marked customer can still place orders; a team member reviews each one before cash is released.
- Backups. Databases are backed up daily and older backups are deleted on a rolling schedule.
Sharing
We do not sell personal data. We share it only:
- with banks and payment providers, to the extent needed to complete a transaction or withdrawal you request;
- with authorities, when the law requires it or to respond to a valid legal request;
- with service providers that host or operate our infrastructure, under confidentiality obligations.
The service providers that process personal data for us are our infrastructure hosting provider, Telegram (messaging and the mini app) and Cloudflare (the security check during identity verification and website delivery). Telegram and Cloudflare may process data in other countries under their own safeguards. To check whether a sending wallet has been frozen by the stablecoin issuer we query the public TRON blockchain; this sends the wallet address, not your name or other details.
Retention
| Category | Kept for |
|---|---|
| Identity, transaction, balance and withdrawal records | 5 years after the end of our relationship with you, or longer where the law requires |
| Support messages | Kept with the related order records |
| Server logs | 120 days |
| IP address and device hints recorded with orders, verifications and withdrawals | Kept with the related records (see the first row) |
| IP address and device hints recorded when you open the mini app | 90 days |
| Website statistics | Kept only as daily totals (pages, countries, referring sites). No cookies and no visitor IDs are stored. |
Your rights
Subject to applicable law, you can ask to access, correct or delete your data, to withdraw consent where processing relies on consent, and to receive a copy of your data. Some data cannot be deleted while we are legally required to keep it, for example transaction records. Send requests through the bot chat or the contacts on our Contact page. We will verify your identity before acting on a request.
Data breaches
If a breach is likely to affect your rights, we will notify you and the relevant authority within the time the law requires, describe what happened and explain what we are doing about it.