Policy on processing personal data

Processing is carried out by Команда Morena, «we» below. The «Morena» service belongs to us. Questions about your data: @morena_support.

At sign-up: your email address, your Telegram handle if you gave one, and your password — which is not stored as such but as an irreversible fingerprint (scrypt) from which the password cannot be recovered.

At identity verification: the country that issued the document, surname, given name, middle name, date of birth, document number (and series, where one exists), by whom and when it was issued, plus a photo of the document page and a photo of you holding it.

At exchange: amounts, the pair, the rate, the details you gave for receiving funds, your device's network address and information about your browser.

Email and password so you can sign in and see your exchanges. The ID document so we send money to the person who exchanged it, and so a disputed transfer is settled with a person rather than with a wallet address. Details and amounts to carry out the exchange and to prove it in a dispute. The network address to tell you apart from someone trying to get into your account.

Document photos are kept neither in the database nor in the public part of the site. They are encrypted with AES-256-GCM and stored as separate files with random names; the encryption key is kept outside the database. There is no direct link to a photo: only a signed-in staff member can open it, and a request without a session answers «not found». Caching of those files is forbidden along the whole path.

Only the staff handling verification and orders. Every action of theirs is written to an internal log stating who did what.

Nobody, of our own accord. We do not sell data, do not pass it to advertising networks and do not publish it. Disclosure is possible only on a lawful demand from a state authority.

Separately: the contents of your documents do NOT go into staff notifications — the message carries only the order number, and the data itself is viewed in the protected part of the site.

Exchange data and its records — for as long as our duty to keep them lasts, and no less than five years from the exchange: that is how long a dispute over a transfer can run. Document photos — while you use the service, and no more than three years after your last exchange.

Write to us from the address your account is registered to. We delete the document photos and anonymise your data within thirty days. Records of the exchanges themselves remain, without your personal data: they are needed for accounting and for settling disputes.

You have the right to receive a copy of your data, to demand its correction and to withdraw your consent to processing. Withdrawing consent means we can no longer carry out exchanges for you.

Our servers are located in Германия. If you are in another country, your data is processed there — this is a cross-border transfer, and by using the service you consent to it.

By signing up you agree to this policy in the version that was on this page at that moment. We record the date of your consent and the version.

If the policy changes, a new version date appears here. We notify you by email about changes that affect your rights.