Privacy Policy

Last updated: 9 October 2026

This Privacy Policy explains how CrestBank ("CrestBank", "we", "us") collects, uses, stores and protects your personal information when you use our website and mobile app (the "Service"). By creating an account you confirm that you have read this policy.

Regulatory status. CrestBank has not provided verified licensing or regulatory details in this deployment. Do not treat this service as a licensed bank or assume that balances, transfers, or deposits are live unless independently confirmed.

1. Who is responsible for your data

CrestBank is the controller of the personal data described here. You can contact us about privacy at crestbanksupport@gmail.com.

2. Information we collect

  • Account and identity details: full name, email address, phone number, date of birth, country, state/province, city, residential address and postal code.
  • Login and security data: your password (stored only as a salted hash, never in readable form), failed-login counts, password-reset codes (stored only as one-way hashes), and for each session the IP address, browser/device description and time of activity.
  • Transaction data: wallet balances, transfers, swaps, funding, recipients you save (name, bank or wallet, account identifier), references, amounts, fees, status and receipts.
  • Card data: card requests and card settings. Full card numbers and security codes (CVV) are never stored by this application.
  • Support data: tickets, messages and any file you attach.
  • Preferences: language, theme, balance-hiding and notification settings.

3. How we use your information

  • To create and secure your account and verify it is really you (for example, emailing a one-time code when you reset your password).
  • To process, record and show your transactions, balances, cards and receipts.
  • To send service and security messages such as verification codes, password-change alerts and transfer notifications.
  • To prevent fraud, abuse and unauthorised access, including rate limiting and temporary account locks after repeated failed logins.
  • To answer support requests and to meet legal and regulatory obligations that apply to us.

We do not sell your personal information. We send marketing messages only if you turn that option on in Settings.

4. Who we share information with

  • Service providers that help us run the Service, such as our email delivery provider, hosting and database providers.
  • Banking, payment, card and crypto partners that execute transfers and issue cards, only to the extent needed to carry out the transaction you request. Provider credentials are kept on our servers and are never sent to your browser.
  • Authorities and professional advisers where the law requires it or to protect rights, safety and security.

5. Cookies

We use only essential cookies: a secure session cookie that keeps you logged in and a token that protects forms against cross-site request forgery. We do not use advertising or cross-site tracking cookies.

6. How we protect your information

Passwords are salted and hashed. Sessions are stored server-side, can be revoked, expire after inactivity and are cleared when you reset your password. Traffic should be served over HTTPS, forms are protected by CSRF tokens, inputs are validated, and every request is checked so you can only see your own data. No system is perfectly secure, so please use a strong, unique password and never share verification codes.

7. How long we keep information

We keep your information while your account is open and afterwards for as long as needed to meet legal, accounting and dispute-resolution obligations. Password-reset codes expire within 10 minutes. When information is no longer needed we delete or anonymise it.

8. Your rights

Depending on where you live, you may have the right to access, correct, delete or export your personal data, to object to or restrict certain processing, and to withdraw consent. You can update most details in Profile and Settings. To make any other request, contact us using the details above. You may also complain to your local data-protection authority.

9. International transfers

Your information may be processed in countries other than your own, for example where our providers operate. Where required, we use appropriate safeguards for such transfers.

10. Children

The Service is for people aged 18 or over. We do not knowingly collect information from anyone under 18.

11. Changes to this policy

We may update this policy from time to time. The date at the top shows when it last changed, and we will notify you of material changes in the app or by email.

Go back