Privacy Policy

Last updated: 10 October 2026

In short: we collect only what we need to run your family’s accounts and to verify identity as the law requires. We don’t sell your data or use it for advertising. You can see, correct or delete your data at any time – just write to [email protected].

1. Who we are

Fampy, including the website fampy.app, belongs to Yamsoft Ltd, a technology company in the United Kingdom (“Yamsoft”, “we”, “us”). Yamsoft builds and runs the Fampy platform and offers on it products of other companies, such as payment cards.

Yamsoft is not a bank or a financial institution and does not hold or manage customers’ money. Cards and payment services are provided by licensed third-party providers, which depend on where you live.

Yamsoft is the controller of the personal data described in this policy. This policy covers the Fampy parent app, the Fampy Kids app (together, the “Apps”) and the website fampy.app. Contact: [email protected].

2. Data we collect

Parents (account holders)

Account data: name, email address, phone number, preferred language, and your password or sign-in through Google or Apple.
Identity verification (KYC): the details on your identity document, a photo of the document, a selfie and a short liveness video, and the result of the check.
Financial data: top-ups, transfers to your children, card transactions and the payment method used. Card details are handled by the card provider.
Family data: the children you link to your account and their relationship to you.

Children (Kids app users)

Name, phone number or email if provided, the link to their parent, card transactions and balance, and requests sent to the parent.
Children can only use Fampy after a parent links them to the parent’s account. The parent is responsible for the child’s use of the Apps.

Everyone

Device data: device model, operating system, app version, push notification token, and app integrity checks.
Support data: messages you send us, and feedback or ratings you give in the Apps.

Website visitors

Messages sent through the contact form (name, email, message). The form is protected by Cloudflare Turnstile, which checks that the visitor is a person. With your consent, we use Google Analytics cookies to understand how visitors use the website (pages visited, approximate location, device and browser). They are set only after you click Accept in the cookie banner, and you can change your choice at any time with “Cookie settings” at the bottom of every page. We don’t use advertising cookies.
If you apply to our partner program: your name, email, phone, country, company, website or profile, the description you send and your IP address, used to review your application and, if approved, to run the partnership and pay your commission.

3. Phone permissions

Camera and microphone: only during identity verification (document photo, selfie, liveness video) and to scan a QR code when linking a child.
Photos: only if you choose a profile picture.
Face ID / fingerprint: to unlock the app. Your phone checks it; we never receive your biometric data.
Notifications: to tell you about payments, transfers and requests.

4. Why we use your data, and the legal basis

Opening and running your account, ordering cards, top-ups and transfers – contract.
Identity verification, anti-money-laundering and fraud checks – legal obligation.
Biometric checks during identity verification – your explicit consent and legal obligation.
Children’s accounts – consent of the parent and contract with the parent.
Customer support, service messages and notifications – contract.
Keeping the Apps secure and preventing abuse – legitimate interest.
Improving the Apps based on feedback – legitimate interest.

We don’t sell your data and don’t use it for advertising.

5. Who we share data with

Each receives only what it needs:

Licensed card issuers and payment providers that provide the cards and payment services in your region.
Didit, for identity verification.
Google (Firebase sign-in, push notifications, app integrity checks, Google Sign-In) and Apple (Sign in with Apple, push notifications).
Our email delivery provider, for account and security emails.
Google Analytics, for website visit statistics, only if you accept analytics cookies.
Oracle Cloud Infrastructure, where our servers are hosted.
Authorities, when the law requires it.

6. International transfers

Some of these providers may process data outside the United Kingdom or the European Economic Area. When they do, we rely on adequacy decisions or approved standard contractual clauses.

7. How long we keep data

Account data: while your account is open.
Identity verification and transaction records: 5 years after the account is closed, as required by anti-money-laundering law.
Support messages: up to 2 years.

After that, the data is deleted or anonymised.

8. Your rights

You can ask to access, correct, delete or move your data, object to or restrict its use, and withdraw your consent at any time. Write to [email protected]. Some data must be kept by law even if you ask us to delete it (see section 7).

You can delete your account in the parent app (Profile → Delete account) or by emailing us.

If you are unhappy with how we handle your data, you can complain to the UK Information Commissioner’s Office (ico.org.uk) or to the data-protection authority in your country.

9. Security

We use encryption in transit, secure storage on the phone, access controls and app integrity checks. No system is perfectly secure, so please keep your phone and app PIN private.

10. Changes to this policy

If we change this policy, we will update this page and the date above. For important changes, we will also tell you in the Apps.

11. Contact

[email protected] – Yamsoft Ltd, United Kingdom.