Privacy Policy.

This notice explains what Azura processes when you visit azura.cards, open an account, fund it with crypto, use virtual cards and contact support. “Personal data” means information that identifies you or can reasonably be linked to you, such as an email address, an IP address or a transaction record.

Azura is a brand of Azuria Labs LLC, a Wyoming limited liability company, 30 N Gould St, Ste N, Sheridan, WY 82801, United States. Azuria Labs LLC is the controller for the processing described here. Privacy questions go to the contact below.

The dashboard demo is a simulation that runs in your browser. Its balances, cards and transactions are examples and are not sent to us, apart from the ordinary technical request that loads the page.

Azura’s standard onboarding does not ask for passport scans, identity-card uploads or selfies, and we do not collect them. This is not a promise of anonymity. Running an account and a card needs an email address, security information and transaction records, and merchants, card networks and our providers keep their own records of your payments.

No-KYC messaging does not waive legal obligations. If a legally required check or a partner restriction ever applies to your account, we tell you before it affects an order.

• Account. Your email address, a password (stored only as a hash), your customer ID, your login-verification settings (emailed codes or an authenticator app; authenticator secrets and recovery codes are stored encrypted) and your dashboard preferences. We do not ask for your name; the account label is derived from your email address.
• Security events. For registrations, logins, verification codes, password or email changes, authenticator changes, deposits, card orders and card-detail reveals we record the time, the IP address, the country, and a hash of your browser’s user-agent string. City, region and network operator are looked up on our own server from a local GeoLite2 database; nothing about you is sent to a geolocation service. We use these records to spot account takeovers, to decide whether a remembered device may skip the login code, and to investigate disputes.
• Deposits. The coin, network and amount you choose, the deposit address and quote issued for you, the payment status and transaction identifiers reported by our payment processor, and the resulting credit to your Azura balance. The blockchain itself is public; the processor sees the wallet address you pay from.
• Cards and payments. Your card orders, top-ups, returns and closures; each card’s label, status, limits and balance; and the transactions the issuer reports for it: merchant name, amount, currency, status, decline reasons and refunds. Full card numbers and security codes are shown to you once on request and are not stored by Azura; we record only that a reveal happened.
• Balances and fees. A ledger of every movement on your Azura balance: deposits, card purchases, top-ups, returns, fees, referral credits and any card debt.
• Support. The requests you open in the dashboard, by email to hello@azura.cards or through our Telegram bot, with their messages, any screenshots or PDFs you attach, and our replies and internal notes. If you connect Telegram, we store your Telegram user and chat identifiers so we can match the chat to your account.
• Referrals. If you register through an invitation link, we record who invited you, so the inviter can earn credit. The inviter only ever sees totals, never your identity or your individual top-ups.
• Technical logs. Our web server keeps standard access logs (IP address, requested page, time, user-agent) for a short period to keep the service running and to block abuse. Cloudflare, which sits in front of our server, keeps its own security logs.

You can keep sensitive information out of support messages: never send full card numbers, passwords or authenticator codes. Messages containing a full card number are refused automatically.

Where the GDPR or UK GDPR applies, each purpose rests on one of these bases:

• Performing our contract with you (Article 6(1)(b)): opening and running your account, processing deposits, issuing and managing cards, booking fees and credits, answering support requests and sending the emails the service needs, such as verification codes and card notices.
• Our legitimate interests (Article 6(1)(f)): keeping the service secure and available, preventing fraud, card testing and abuse, enforcing the card rules, reconciling our books with our providers, and improving the website on the basis of aggregate visit counts. We balance these interests against your rights; you can object (see your rights below).
• Legal obligations (Article 6(1)(c)): keeping accounting records, answering lawful requests from authorities and complying with sanctions law.
• Consent (Article 6(1)(a)): only for optional things you switch on yourself, such as connecting a Telegram chat to your account. You can withdraw consent at any time; this does not affect processing that already happened.

We do not sell personal data, do not use it for advertising and do not build marketing profiles. We send no newsletters. Emails from Azura are about your account, your cards and your support requests.

Rules about storing or reading information on your device apply separately. The Cookie Policy lists every cookie and storage entry we use.

We share personal data only with the providers we need to run the service, and only what each of them needs:

• Card programme partner and card issuer. They issue the cards, hold the card funds and process payments. They receive an opaque customer reference for your account (never your email address or name), your card orders, top-ups and returns, and they report the transactions and card status back to us. Card numbers are generated by the issuer and shown to you through our dashboard.
• Crypto payment processor. Creates the deposit address and quote for each deposit, watches the blockchain for your payment and reports its status. It receives the deposit amount and a deposit reference, not your identity.
• Cloudflare (United States). Provides the network in front of our server: TLS, firewall, bot protection, the Turnstile human check on login and registration, and privacy-friendly visit counting (Cloudflare Web Analytics, which sets no cookies and builds no visitor profile). Cloudflare therefore sees all traffic to azura.cards, including IP addresses.
• Brevo (France). Sends our transactional emails: verification codes, login codes, password resets and card notices. Brevo receives your email address and the content of each email.
• Email inbox provider. Mail you send to hello@azura.cards is received in a mailbox hosted by our email provider.
• Telegram, only if you use our support bot. Telegram sees the chat; we receive your messages, attachments and Telegram identifiers through the Telegram Bot API.
• Hosting and backups. Our application and database run on a server we rent in a data centre in Frankfurt, Germany. Encrypted database backups are stored with Backblaze (B2) and Cloudflare (R2, Western Europe). The backups are encrypted on our server before upload; the storage providers only ever hold ciphertext and do not have the key.

Each provider processes data under its own data-processing terms. We may also disclose information where a valid legal obligation requires it, or where lawfully necessary to establish, exercise or defend legal claims, including to prevent fraud against us or our providers.

Our server and database are in Germany. Cloudflare and Backblaze are United States companies that operate global infrastructure; Brevo is based in France. Our card programme partner, the card issuer and the payment processor may process data outside the EEA and the United Kingdom.

Where personal data leaves the EEA or the UK, we rely on the provider’s data-processing agreement with the EU standard contractual clauses (and, where the provider is certified, the EU-US Data Privacy Framework). You can ask the privacy contact for information about the safeguards that apply to a particular provider.

When a retention period ends, the data is deleted or anonymised. Legal holds or an open dispute can require us to keep specific records longer.

All traffic to azura.cards is encrypted with TLS, including between Cloudflare and our server. Passwords are stored as hashes. Authenticator secrets and recovery codes are stored encrypted. Full card numbers and security codes are never stored by Azura; they are fetched from the issuer when you reveal them and shown to you once. Every customer login is protected by a second factor: a code by email, or your authenticator app. Changes to your password, email or authenticator require the second factor again.

Our server is firewalled so that only Cloudflare can reach it, access to the database is restricted to the application, and backups are encrypted before they leave the server. We do not claim an independent security certification or PCI DSS attestation for Azura itself; card data is handled by the issuer and its certified processors.

No system can guarantee absolute security. If a breach affects your data and the law requires it, we will inform you and the competent authority. You can reduce your own exposure by using a unique password, keeping your authenticator and recovery codes safe, and never sending card details or codes in a message.

Depending on the law that applies to you, you have the right to:

• Obtain confirmation of processing, access to your personal data and a copy of it.
• Correct inaccurate information and complete incomplete information. You can change your email address and security settings yourself in the dashboard.
• Request deletion or restriction of processing, subject to the retention duties above. You can close your account yourself in the dashboard; see the Terms for what happens to a remaining balance.
• Receive the data you provided in a portable format.
• Object to processing based on legitimate interests on grounds relating to your situation.
• Withdraw consent for a consent-based purpose, for example by disconnecting Telegram in your settings.
• Not be subject to a decision based solely on automated processing that has legal or similarly significant effects, without human review (see the next section).

To exercise a right, write to the privacy contact from the email address of your account. We answer within one month; where a request is complex we may extend this by up to two months and tell you why. We may ask you to confirm the request from your account or with your second factor; we will not ask for identity documents.

You may complain to a data-protection authority. In the EEA this can be the authority where you live, work or believe an infringement occurred; the EDPB’s directory lists them. In the UK it is the Information Commissioner’s Office. You do not have to contact Azura first.

Some card rules are applied automatically by the card engine of our card partner, and we show you the result: a card is locked after two consecutive payment declines for insufficient funds and unlocks again when a top-up covers the declined charge; repeated attempts at restricted merchant categories lock the card; a card used behind many advertiser accounts is locked; a card with unpaid debt is frozen and eventually retired; an expired or inactive card is retired and its balance returned to your Azura balance. The thresholds are stated in the Terms and in the card rules in your dashboard.

These rules look only at the card’s own payments and balance; they do not profile you as a person and they never close your account by themselves. Where a lock needs a review, a member of our team does it. You can always ask support to review an automated lock, explain your position and have the decision checked by a person.

Azura is for adults aged 18 or over. We do not knowingly open accounts for children. If you believe a child has provided us with personal data, tell the privacy contact and we will delete it.

Following a link to a merchant, an advertising platform or another external website brings you under that service’s own practices. A logo or link on Azura does not mean that visiting our page has sent that company your data.

The date above records the latest revision. We update this notice when our processing changes, for example when we add a provider or a feature. If a change materially affects you, we tell you in the dashboard or by email before it takes effect.

Privacy contact: hello@azura.cards

Controller: Azuria Labs LLC, 30 N Gould St, Ste N, Sheridan, WY 82801, United States, registered with the Wyoming Secretary of State under Filing ID 2026-002098781. We have not appointed a data-protection officer or an EU/UK representative; if that changes, this notice will say so.