Skip to content
MUZA Capital
Log inOpen account

Privacy notice

Effective date: 25 October 2026.

Who is responsible

MUZA Capital is operated by Morency & Co., a company incorporated in Hong Kong with its registered address at 728 King's Rd, Tsat Tsz Mui, Hong Kong Island, Hong Kong. Morency & Co. is the controller of your personal data. Our data protection and information officer is Wilkins Morency. You can contact him at support@muzacapital.com. Morency & Co. is established in Hong Kong. If you are in the European Union, European Economic Area or United Kingdom, you can contact our information officer directly at support@muzacapital.com about our use of your personal data and your data-protection rights. We have not appointed a representative in the European Union, European Economic Area or United Kingdom.

What we collect

  • Account: email address, display name, and your password (stored only as a hash).
  • Wallet: the public address of a wallet you link. We never receive your private keys or recovery phrase.
  • Activity: swap quotes and the transaction hashes of swaps you submit through the interface, bridge requests, P2P swap offers, Practice orders, and earlier simulated banking entries.
  • Screening: names and addresses you enter, for example as a P2P counterparty or beneficiary, may be checked against OFAC, UN and UK sanctions lists.
  • Technical: IP address, browser type, timestamps and error logs, used to run and secure the service.
  • Markets and Terminal: your watchlists, saved layouts, chart drawings and Terminal workspaces; the portfolio view we build from the public data of the wallets you link; and the trades you place through MUZA, so we can show what you paid.
  • Price alerts: the alert rules you set, when each alert fired, and how we delivered it (in the app, by email or by Telegram).
  • Acceptance record: when you first open Markets or Terminal, the version of the terms you accepted, the product and the time. We store it against a coded reference to your account, not your email address.
  • AI features: the questions you ask. See “How we use AI” below.
  • Telegram (optional): if you link Telegram, your Telegram chat id and username.
  • Support: what you write in the help box and, to help us find the problem, the page you were on, your browser type, your linked wallet address and recent error messages on the page.

Identity verification

We carry out identity verification ourselves, using Morency & Co.'s own verification service. It is optional until you need a higher limit or P2P trading.

  • What is sent: a photo of your identity document, a selfie, head-turn frames from your camera (level L2), a proof-of-address photo and your address (L2), the name you declare, and — for local-currency P2P — the holder name of the payment accounts you add (never account numbers).
  • Face comparison and liveness check: we compare your selfie and head-turn camera frames with the photograph on your identity document to confirm that you are a live person and that the document belongs to you. Where the GDPR or UK GDPR applies, this involves biometric data used to identify you uniquely. We process that biometric data with your explicit consent. You may withdraw your consent at any time, but we may then be unable to complete or maintain your identity verification or provide services that require it. Withdrawal does not affect processing that took place before withdrawal.
  • What MUZA keeps: your verification level and status, the reasons shown to you, and a random reference. MUZA does not store the photos; they pass through our server to Morency & Co. and are discarded.
  • How long Morency & Co. keeps it: photos only while a person needs to review your case, then deleted after at most 30 days; verified details are encrypted and kept for up to 5 years unless you ask for them to be erased, or less where the law requires.
  • Erasure: you can ask for your verification data to be erased from Account → Identity verification (under the data-protection law that applies to you). If the law requires records to be kept for a period, erasure happens when that period ends.

Why we use it

  • To provide the services and keep your account secure.
  • To meet legal duties, including sanctions screening and record keeping.
  • To answer support requests and send service notices.
  • To detect fraud, abuse and security incidents.

Our lawful bases

Where the GDPR or UK GDPR applies, we process account, service, support and subscription data because it is necessary to provide the services you request and perform our contract with you. We process security, fraud-prevention, sanctions-screening and service-integrity data to comply with applicable legal duties and for our legitimate interests in protecting users and the service. We keep tax, accounting and other records where applicable law requires this.

We use consent where applicable law requires it, including for optional features that ask for consent. You may withdraw consent at any time. Withdrawal does not affect processing that took place before withdrawal. Where we rely on legitimate interests, you may object to the processing. We will consider your objection under applicable law.

We do not sell personal data.

How we use AI

Some MUZA features use artificial intelligence: Vesper (the analyst in MUZA Terminal), market explanations in MUZA Markets, the swap description, the P2P assistant and chat translation, and our help box.

  • What we send: the text you type, and the market data needed to answer (prices, charts, headlines). For the P2P assistant and translation, the chat messages involved. For the help box, your message and the support details listed above. We never send your keys, passwords or identity documents.
  • Who processes it: Qwen Cloud (Alibaba Cloud), in Singapore, for customers outside the European Economic Area, the United Kingdom and Switzerland; Anthropic, in the United States, for customers in the European Economic Area, the United Kingdom and Switzerland, including in our help box.
  • What AI does not do: it makes no decisions about you, your account, your limits or your verification. It explains; it does not recommend buying or selling, and it never trades for you. Its answers can be wrong, so check them before you rely on them.
  • What we keep: for each AI request, the time, the feature, your account reference, the outcome, which provider answered and the size of the request. We do not keep the text of your question or the answer, with one exception: to check that Vesper does not give investment advice, we keep the question and answer when Vesper holds an answer back, and for a small random sample (about 2 in 100) of other answers. These are read only by our compliance review and deleted after 90 days.
  • Your choice: the AI features are optional. You can use Markets and Terminal without asking Vesper anything.

Price alerts and messages

If you set a price alert, we check prices against your rule and send you a message when it is met: in the app, by email and, if you have linked it, by Telegram. You can limit the channels in your notification settings.

Terminal Pro subscriptions

If you subscribe to Terminal Pro, we keep your plan, each payment and refund (and, for OYO payments, the OYO price used), your renewal choice, and when you accepted the subscription terms. We use them to bill you, send receipts and renewal reminders, and keep our accounts. The same records are held in our group billing system, operated for us by Abraxas Technologies (Pty) Ltd in South Africa. Billing records are kept for as long as tax and accounting law requires, even after you close your account.

Cookies and storage in your browser

We use only the cookies and browser storage that MUZA needs to work, or that remember choices you make. We do not use advertising, analytics or cross-site tracking cookies, so we do not ask for cookie consent.

  • Sign-in and security: your session (up to 7 days), protection against forged requests, the second sign-in step (5 minutes), Sign in with Google (10 minutes), and a device cookie (180 days) that lets us recognise a browser you have used before and warn you about sign-ins from new devices.
  • Your wallet: the Leviathan wallet keeps your encrypted keys in your browser, and passkey data if you turn passkeys on. We never receive them.
  • Your choices: market favourites, your Terminal layout, whether you have seen the Terminal guide, your P2P filters, and your recent transfers on this device.
  • Help box: if you start a support conversation, a reference so you can continue it. The help box is provided by our group company Abraxas Technologies.

You can clear these at any time in your browser settings. If you do, you will be signed out, and a wallet you have not backed up will be lost.

Leviathan AI (optional)

If you switch on the Leviathan AI assistant in your wallet, we process additional data as described in the separate notice titled “How Leviathan AI uses your data”. In short: with your consent we read public data about your linked wallet and your questions; we send your questions and a minimal wallet summary to our AI provider, Qwen Cloud (Alibaba Cloud), in Singapore, where data-protection law may differ from yours; we never send your keys, passwords, email address or identity documents; we keep a tamper-evident activity log whose content is deleted after 5 years (or at once if you use “Delete my Leviathan data”); you can switch it off at any time. Leviathan AI is not offered in the European Economic Area or the United Kingdom.

Who we share it with

Our AI provider, Qwen Cloud (Alibaba Cloud), in Singapore, for Leviathan AI if you switch it on. No separate data processing agreement has been executed; the service is provided under Alibaba Cloud's standard Model Studio terms (see ‘How Leviathan AI uses your data’).

We share personal data only with these service providers, and only for the purposes above:

  • Contabo (Germany): hosting of our servers.
  • Abraxas Technologies (Pty) Ltd (South Africa), a company in our group: our billing system, mail server and help box.
  • Qwen Cloud (Alibaba Cloud, Singapore) and Anthropic (United States): AI features, as described in “How we use AI”.
  • Telegram: alerts and sign-in confirmations, only if you link Telegram.
  • Google: only if you choose Sign in with Google.
  • Transak: only if you choose to buy crypto with a card. You give your details to Transak directly, and we send it your wallet address and order.
  • Blockchain network providers and swap routing services: they receive wallet addresses and transaction details so we can show balances and prepare swaps. We send these requests from our servers, so they do not see your IP address.

Some of these providers are outside your country, including in the United States and Singapore. International transfers may be subject to legal safeguards required by the law that applies to you. Contact support@muzacapital.com if you want information about the safeguard used for a particular transfer.

Authorities, where the law requires. Public blockchains are public: swaps, bridge transfers and P2P swaps you sign on MUZA Chain or other networks are visible to anyone, and are linked to your wallet address.

How long we keep it

We keep personal data for as long as your account is open and afterwards only as long as the law requires us to keep records. Then we delete it.

Your rights

Depending on where you live, you can ask us for a copy of your data, to correct it, delete it or send it to you in a portable form, or to stop or limit some uses. You may also object to certain processing and withdraw consent where we rely on consent. These rights may be subject to legal exceptions. To make a request, email support@muzacapital.com from the email address on your account. We will respond within the time required by the law that applies to your request.

To delete your account and personal data, go to Account → Security → Delete my account, or email us. We complete deletion within 30 days. Records the law requires us to keep (trades, payments, identity checks and sanctions checks) are kept only for that period. Data on public blockchains cannot be deleted by anyone.

You may first send a privacy complaint to our data protection and information officer at support@muzacapital.com. You can also complain to the data-protection authority where you live, including your national supervisory authority in the European Union or European Economic Area, the Information Commissioner's Office in the United Kingdom, or the Office of the Privacy Commissioner for Personal Data in Hong Kong.

Related: Terms of use · Support