Privacy Policy

1. Who we are

onetwocard is a service that lets you issue a virtual payment card and manage it through a Telegram bot. Below we call it “the Service”, and ourselves “we”.

We are not a bank or a credit institution. Cards are issued by a licensed issuing bank we work with as a partner. The money on the card sits in its payment system, not in our accounts. This matters for the sections that follow: part of your data has to be passed to the issuer, otherwise a card cannot be issued at all.

2. What data we collect

2.1. What you tell us yourself

To issue a card, the issuing bank requires a cardholder record. We ask you only for what it requires and nothing beyond that:

• first and last name;
• date of birth;
• country of residence, city, address and postal code;
• email address;
• phone number.

We do not ask for documents. No passport, no proof of income, no proof of address. We do not ask you to send a photo or a scan and we run no video identification. The record is accepted as you state it.

We reserve the right to request supporting documents in individual cases — for example, if card activity looks like an attempt to cash out, or if the issuing bank or the payment network asks for such confirmation. If you decline, we may suspend the card and return the remaining balance.

2.2. What we receive from Telegram

The Service runs inside Telegram, so on your first message to the bot we receive your numeric Telegram ID, your username (if you have one), your display name and interface language. The bot has no access to your correspondence, contacts, Telegram phone number or any other chats.

2.3. Transaction data

• the crypto wallet addresses you top up from, and transfer hashes;
• amounts of deposits, transfers to the card and withdrawals;
• card transactions: amount, currency, merchant name and category, date, outcome;
• decline reasons, where a transaction did not go through.

We do not store the full card number or the CVV. They stay with the issuing bank and are delivered to you directly over a secure channel at the moment you ask. We keep only the last four digits and the expiry date, which is enough to show the card in the interface.

2.4. Technical data

Using the site and the bot automatically records your IP address, device and browser type, timestamps and the actions taken in the interface. These records exist to diagnose failures and to spot intrusion attempts.

3. Why we use it

We do not use your data to show third-party advertising and we do not build advertising profiles from it. We do not sell or rent personal data under any circumstances.

4. Who we share it with

Only those without whom the Service does not work:

• The issuing bank and the card infrastructure provider. They receive the cardholder record and transaction data. Without this a card cannot be issued or serviced.
• Blockchain analytics services. They receive only the wallet address and the amount — without your name or any other record data. See section 5.
• Telegram. Bot messages travel through Telegram’s infrastructure and are subject to its own privacy policy.
• Our hosting provider. Our servers are rented from a third party that technically has access to the hardware, but not to the content in the clear.
• Government authorities. Only on a lawful and substantiated request from a competent body. We check such requests against the law and do not hand over data in response to informal approaches.

We do not share data with ad networks, data brokers or analytics platforms that track users across sites.

5. Screening of crypto deposits

Every deposit goes through an automatic check of the sender address using blockchain analytics services. This is standard practice and a requirement for working with payment networks: it shows whether the address is linked to sanctions lists, darknet marketplaces, mixers or stolen funds.

The check runs against public blockchain data. Only the address and the amount are sent to such a service — your name, phone and home address are not disclosed.

If the check returns a high risk, we may decline to credit the transfer and ask you about the origin of the funds. Blocked funds are returned to the sending address where this is technically possible and not contrary to law.

6. How long we keep it

• Cardholder record and transaction data — for the term of the agreement and five years after it ends. That period comes from financial record-keeping requirements, not from our preference: it lets us answer a lawful request and resolve a disputed transaction.
• Support correspondence — one year from closing the request.
• Technical logs — 90 days.
• Deposit screening results — five years, together with transaction data.

Once the period ends, data is deleted or anonymised so that it can no longer be linked back to you.

7. Where the data is stored

The Service’s servers are located in the European Union. Data passed to the issuing bank and the card infrastructure provider is processed in the jurisdictions where those organisations operate; it may sit outside your country, including where data protection requirements differ from local ones. By using the Service you consent to that transfer — without it a card cannot be issued.

8. How we protect it

• connections to the site and the bot are protected with TLS;
• cardholder data is stored encrypted, with restricted and logged access;
• the full card number and CVV are not stored by us at all;
• card details are shown in the bot on an explicit request and hide automatically after 30 seconds;
• 3-D Secure confirmations arrive in Telegram rather than in an SMS that a SIM swap can intercept.

Absolute protection does not exist, and promising it would be dishonest. If a breach affecting your data occurs, we will report it in the bot and by email within 72 hours of becoming aware of it, and describe what actually happened.

9. Your rights

At any time you may:

• request a copy of the data we hold about you;
• correct inaccurate data;
• ask for deletion of your data and closure of your account;
• opt out of non-essential notifications;
• object to processing based on our legitimate interest.

Write to the bot or the address in section 13. We respond within 30 days.

The right to erasure is not absolute. Transaction data must be kept for five years regardless of your request — that is a financial record-keeping requirement. In that case we delete everything not covered by it and explain exactly what remains and why.

10. Cookies and local storage

This site sets no advertising or analytics cookies. We use no counters, pixels or third-party trackers.

The only thing the site saves in your browser is your chosen interface language. It lives in local storage, never leaves your device and is cleared along with the site data.

Page fonts are loaded from Google Fonts, so opening the site makes your browser contact Google’s servers and they see your IP address. We pass them no other data.

11. Age of users

The Service is intended for people over 18. We do not knowingly collect children’s data. If an account turns out to belong to a minor, we will close it, delete the data and return the remaining balance.

12. Changes to this policy

We may change this document — for instance when we add new top-up methods or change partners. The current version always lives at onetwocard.ru/privacy-en.html, with the version date at the top of the page.

We will announce material changes — such as new categories of data or new recipients — in the bot at least 14 days before they take effect.

13. How to reach us

For anything about your data, write to @onetwocard_bot or to privacy@onetwocard.ru.

We answer in Russian and English, usually within one business day; formal data requests within 30 days.