Privacy Policy.

This notice explains what Azura processes when you visit azura.cards, open an account, fund it with crypto, use virtual cards and contact support. “Personal data” means information that identifies you or can reasonably be linked to you, such as an email address or a transaction record.

Azura is a brand of Azuria Labs LLC, a Wyoming limited liability company, 30 N Gould St, Ste N, Sheridan, WY 82801, United States. Azuria Labs LLC is the controller for the processing described here. Privacy questions go to the contact below.

Azura’s standard onboarding does not ask for passport scans, identity-card uploads or selfies, and we do not collect them. This is not a promise of anonymity. Running an account and a card needs an email address, security information and transaction records, and merchants, card networks and our providers keep their own records of your payments.

No-KYC messaging does not waive legal obligations. If a legally required check or a restriction by the card issuer ever applies to your account, we tell you before it affects an order.

• Account. Your email address, your password (stored only in protected form), your security settings and your dashboard preferences. We do not ask for your name.
• Security and technical data. Information about the connection and device you use when you visit the website, sign in or make important changes to your account. We use it to keep the service running, to protect your account against misuse and to investigate disputes.
• Deposits. The coin, network and amount of each deposit, its status and the resulting credit to your Azura balance.
• Cards and payments. Your cards, top-ups, returns and closures, and the payments made with each card, such as merchant, amount, currency and status.
• Balances and fees. A record of every movement on your Azura balance, including fees, referral credits and any card debt.
• Support. The messages and attachments you send us in the dashboard, by email or through our Telegram bot, and our replies. If you connect Telegram, the chat is linked to your account.
• Referrals. If you register through an invitation link, we record who invited you, so the inviter can earn credit. The inviter only ever sees totals, never your identity or your individual top-ups.

Keep sensitive information out of support messages: never send full card numbers, passwords or authentication codes.

Where the GDPR or UK GDPR applies, each purpose rests on one of these bases:

• Performing our contract with you (Article 6(1)(b)): opening and running your account, processing deposits, issuing and managing cards, booking fees and credits, answering support requests and sending the emails the service needs, such as verification codes and card notices.
• Our legitimate interests (Article 6(1)(f)): keeping the service secure and available, preventing fraud, card testing and abuse, enforcing the card rules, reconciling our books with our providers, and improving the website on the basis of aggregate visit counts. We balance these interests against your rights; you can object (see your rights below).
• Legal obligations (Article 6(1)(c)): keeping accounting records, answering lawful requests from authorities and complying with sanctions and anti-money-laundering law.
• Consent (Article 6(1)(a)): only for optional things you switch on yourself, such as connecting a Telegram chat to your account. You can withdraw consent at any time; this does not affect processing that already happened.

We do not sell personal data, do not use it for advertising and do not build marketing profiles. We send no newsletters. Emails from Azura are about your account, your cards and your support requests.

Rules about storing or reading information on your device apply separately. The Cookie Policy lists every cookie and storage entry we use.

We share personal data only with the providers we need to run the service, and only what each of them needs:

• Card issuer. Issues the cards, holds the card funds and processes card payments. It receives what it needs to run your cards, but not your email address or name.
• Crypto payment processor. Handles your deposits, reports their status and screens incoming transfers under anti-money-laundering and sanctions rules. It receives the deposit details, not your identity.
• Cloudflare. Protects and delivers our website, including the Turnstile human check on login and registration and cookie-free visit counting. It therefore sees the traffic to azura.cards.
• Email providers. Deliver the emails we send you and receive the emails you send to us.
• Telegram, only if you use our support bot.
• Hosting and storage providers. Run our servers and keep our encrypted backups.

Each provider processes data under its own data-processing terms. We may also share information with our professional advisers under a duty of confidentiality, with a buyer or successor if the business is sold or merged, under obligations equivalent to this notice, and disclose it where a valid legal obligation requires it, or where lawfully necessary to establish, exercise or defend legal claims, including to prevent fraud against us or our providers.

Our servers are located in the European Union. Some of our providers, including the card issuer and the payment processor, may process data outside the EEA and the United Kingdom.

Where personal data leaves the EEA or the UK, we rely on the provider’s data-processing agreement with the EU standard contractual clauses (and, where the provider is certified, the EU-US Data Privacy Framework). You can ask the privacy contact for information about the safeguards that apply.

• Account data while your account is open. After closure we keep only what we need to prevent misuse, for example that a closed account does not simply reopen.
• Deposits, cards, payments and your balance record for as long as accounting, tax and anti-fraud obligations require, also after closure. These are financial records and cannot be deleted on request.
• Security and technical data for a limited period, at most 12 months, after which it is deleted or anonymised.
• Support requests for the life of the account and, after closure, as long as a dispute or refund may still need them.
• Backups for a limited period, after which they are deleted. Data you deleted can remain in a backup until that backup expires.

Legal holds or an open dispute can require us to keep specific records longer.

Connections to azura.cards are encrypted. Passwords and security secrets are stored in protected form, customer logins are protected by a second factor, and changes to your password, email or authenticator require it again. Access to our systems and data is restricted, and our backups are encrypted.

No system can guarantee absolute security. If a breach affects your data and the law requires it, we will inform you and the competent authority. You can reduce your own exposure by using a unique password, keeping your authenticator and recovery codes safe, and never sending card details or codes in a message.

Depending on the law that applies to you, you have the right to:

• Obtain confirmation of processing, access to your personal data and a copy of it.
• Correct inaccurate information and complete incomplete information. You can change your email address and security settings yourself in the dashboard.
• Request deletion or restriction of processing, subject to the retention duties above. You can close your account yourself in the dashboard; see the Terms for what happens to a remaining balance.
• Receive the data you provided in a portable format.
• Object to processing based on legitimate interests on grounds relating to your situation.
• Withdraw consent for a consent-based purpose, for example by disconnecting Telegram in your settings.
• Not be subject to a decision based solely on automated processing that has legal or similarly significant effects, without human review (see the next section).

To exercise a right, write to the privacy contact from the email address of your account. We answer within one month; where a request is complex we may extend this by up to two months and tell you why. We may ask you to confirm the request from your account or with your second factor; we will not ask for identity documents.

You may complain to a data-protection authority. In the EEA this can be the authority where you live, work or believe an infringement occurred; the EDPB’s directory lists them. In the UK it is the Information Commissioner’s Office. You do not have to contact Azura first.

Some card rules are applied automatically, and we show you the result: a card can be locked after repeated declines for insufficient funds, after attempts at restricted merchant categories or when it is used behind several advertiser accounts; a card with unpaid debt is frozen and eventually closed; an expired or inactive card is retired and its balance returned to your Azura balance. The rules are part of the card rules in your dashboard.

These rules look only at the card’s own payments and balance; they do not profile you as a person and they never close your account by themselves. Where a lock needs a review, a member of our team does it. You can always ask support to review an automated lock, explain your position and have the decision checked by a person.

Azura is for adults aged 18 or over. We do not knowingly open accounts for children. If you believe a child has provided us with personal data, tell the privacy contact and we will delete it.

Following a link to a merchant, an advertising platform or another external website brings you under that service’s own practices. A logo or link on Azura does not mean that visiting our page has sent that company your data.

The date above records the latest revision. We update this notice when our processing changes, for example when we add a provider or a feature. If a change materially affects you, we tell you in the dashboard or by email before it takes effect.

Privacy contact: hello@azura.cards

Controller: Azuria Labs LLC, 30 N Gould St, Ste N, Sheridan, WY 82801, United States, registered with the Wyoming Secretary of State under Filing ID 2026-002098781. We have not appointed a data-protection officer or an EU/UK representative; if that changes, this notice will say so.