PRIVACY POLICY
Effective date: 23 September 2026 · Last updated: 23 September 2026
Privacy at a glance
| Topic | In short |
|---|---|
| Who we are | Global Card is operated by Globalcard Services LLC, a Florida company headquartered in the United States. We are a financial technology company, not a bank. Your account is provided, and your card is issued, by our banking partner Zenus Bank International, Inc. |
| What we collect | Your identity details and ID document, a face scan to confirm it’s really you, your account and card activity, and device and security information. |
| Why | To open and run your account and card, keep them secure, prevent fraud and financial crime, and meet our legal obligations. |
| Face scans | Only with your explicit consent, only when you open your account, only to verify your identity and prevent fraud, and deleted on a set schedule. See section 6. |
| Selling your data | We do not sell your personal data and do not share it for targeted advertising. |
| Your rights | You can access, correct or delete your data, object to or restrict how we use it, take a copy with you, withdraw consent, and ask a person to review an automated decision. See section 13. |
| Staying safe | We will never ask for your password, one-time code or full card details. |
1. About this policy
This policy explains how we collect, use, share and protect personal data when you use the Global Card website, app, account, virtual card and related services (together, the Services).
It applies to you if you visit our website, apply for an account, are a customer, or were one in the past.
It does not cover services run by other companies that you choose to use with Global Card — for example Google Pay. Those companies have their own privacy policies.
2. Who is responsible for your data
Globalcard Services LLC, 7901 4th St N, Ste 300, St. Petersburg, FL 33702, United States, is the controller of your personal data for the processing described in this policy. “Controller” means the company that decides why and how your data is used. In this policy, “we”, “us” and “Global Card” mean Globalcard Services LLC.
Our banking partner. Zenus Bank International, Inc. provides your account and issues your card. It uses your data for its own purposes as a separate controller, under its own privacy policy: https://zenus.com/legal-documents/privacy-policy. Where both apply, you have the rights set out in each.
Privacy contact. legal@globalcard.ai
3. The personal data we collect
3.1 Information you give us
- Identity and contact details — full name, date of birth, nationality, country of residence, residential address, email address and phone number.
- Identity documents — your passport, national ID card or driver’s license, including the document number, issuing country, expiry date and the photo on it.
- Face scan — a selfie or short video used when you open your account, to check you are a real person who is present and that your face matches your ID. See section 6.
- Financial profile, where we need it for due diligence — your occupation, source of funds, expected use of the account and, in some cases, supporting documents.
- Tax information, where the law requires it — for example your tax residence, tax identification number, or a US tax form such as the W-8BEN.
- Communications — emails, chat messages and calls with our support team, including recordings of calls and chats.
- Preferences — your marketing choices, language and notification settings.
3.2 Information created when you use the Services
- Account and payment information — your account number and routing number, balances, and incoming and outgoing payments, including the name and account details of the other party.
- Card information — card status, limits and transactions (merchant, amount, date and place), and the token created when you add your card to Google Pay. Your full card number and security code are held by our card processing partner and shown to you only when you ask to see them. We do not store them on our systems.
- Device and technical information — IP address, device identifiers, operating system and browser, app version, approximate location derived from your IP address, and login times.
- Security and fraud information — sign-in events, failed attempts, device characteristics, risk scores and fraud alerts.
- Usage information — the pages and features you use, collected through cookies and similar technologies. See section 9.
3.3 Information we receive from others
- Our identity verification provider, Sumsub — the results of document, liveness and face-match checks.
- Screening sources — sanctions lists, lists of politically exposed persons, adverse-media sources and fraud-prevention databases.
- Our banking partner, Visa and our card processing partner — information about your account, card and transactions.
- Google Pay — token and device information when you add your card.
- People you pay or who pay you — names and account details contained in payment messages.
- People who refer you — if someone invites you to Global Card through our referral program, the fact of the referral.
3.4 Sensitive data
Face scan data is biometric data, which many laws treat as sensitive. We use it only as described in section 6.
We do not intentionally collect other sensitive information, such as health or religious beliefs. If a document you give us happens to show it, we use it only to verify your identity.
4. How we use your data, and our legal reasons
Many privacy laws require us to have a legal reason, or “legal basis”, for each use of your data. The table shows what we do and why.
| What we do | Examples | Legal basis |
|---|---|---|
| Open your account and verify who you are | Document checks, face match, liveness check | Contract; legal obligation; explicit consent for face scans |
| Provide and run your account and card | Process payments, create your virtual card, add it to Google Pay, show your transactions | Contract |
| Meet our legal and regulatory duties | Anti-money-laundering checks, sanctions screening, record-keeping, tax reporting, answering lawful requests from authorities | Legal obligation |
| Prevent fraud and keep the Services secure | Monitor transactions and sign-ins, detect unusual activity, block suspicious payments | Legal obligation; legitimate interests (protecting you, us and the financial system) |
| Help you and handle complaints | Answer questions, investigate disputes and chargebacks, monitor and record calls and chats for training and quality | Contract; legitimate interests |
| Tell you about your account | Transaction alerts, security messages, changes to our terms | Contract; legal obligation |
| Run our referral program | Record who referred you and apply any referral rewards | Contract; legitimate interests |
| Marketing | News and offers about Global Card | Consent where required, otherwise legitimate interests. You can opt out at any time |
| Improve the Services | Analytics, testing new features, fixing problems | Legitimate interests; consent for non-essential cookies where required |
| Legal claims and business changes | Defending legal claims; a merger or sale of our business | Legitimate interests; legal obligation |
We will not use your data for a new purpose that is incompatible with these without telling you first and, where the law requires, asking for your consent.
5. Automated decisions
We use automated systems to make, or help make, some decisions about you:
- Identity verification — whether your document is genuine, whether you are a real person present, and whether your face matches your ID.
- Screening — whether you match a sanctions or politically-exposed-person list.
- Fraud detection — which may decline a payment or temporarily restrict your account.
- Eligibility — whether we can open an account for you.
These decisions can affect you significantly. For example, we may not open your account, or a payment may be declined.
You can ask us to explain a decision, ask a person to review it, and challenge it. Email legal@globalcard.ai or go to Settings → Privacy in the app.
Sometimes, for example where we suspect fraud or financial crime, the law or the need to protect our controls may prevent us from explaining a decision in full.
6. Face scans and biometric data
What we collect. A selfie or short video when you open your account. Our identity verification provider creates a face template — a mathematical representation of your facial features — and uses it to check that you are a real person who is present and that your face matches the photo on your ID.
Why. To verify your identity when you open an account and to prevent fraud and impersonation. We never use face data for marketing, and we never sell it.
Your consent. Before the scan we ask for your explicit consent on a separate screen (see Annex A). Giving consent is your choice. Without it we cannot verify your identity, so we cannot open your account.
Who processes it. Our identity verification provider is Sumsub. Sumsub processes your data on our behalf. It also uses your data for its own purposes, as an independent controller, including:
- improving its services, which may involve artificial intelligence;
- producing fraud-risk signals that it uses across all its clients;
- comparing a new face scan with scans you provided before, to detect repeated or fraudulent attempts.
Sumsub’s privacy notice: https://sumsub.com/privacy-notice-service/
How long it is kept. Sumsub stores your face images and face template on our behalf. On our instructions, they are deleted once the purpose of the verification has been fulfilled and any retention period required by law has ended — and never later than 3 years after you provided them. If you ask us to delete them and no legal obligation requires us to keep them, deletion is completed within 30 days.
Where Sumsub keeps data for its own purposes, it deletes biometric data no later than 1 year after that purpose ends, under its own notice.
Images of your identity document, including the photo printed on it, are identity records. We keep those under section 11.
Withdrawing consent. You can withdraw your consent at any time in Settings → Privacy in the app or by emailing legal@globalcard.ai. This does not affect checks already completed. We may be unable to continue services that require your identity to be verified.
7. Who we share your data with
We share only what is needed for the purpose.
- Our banking partner, Zenus Bank International, Inc. — which provides your account and issues your card.
- Visa and our card processing partner — to issue your card and process card transactions.
- Identity verification and screening providers, including Sumsub.
- Fraud-prevention services and databases.
- The other party to a payment, and their bank — for example, your name, account details and the payment reference go to the person you pay.
- Google Pay — when you choose to add your card. Google’s own privacy policy applies.
- Service providers who help us run the Services — cloud hosting, customer support, email and push notifications, analytics and security. They are bound by contract and may use your data only on our instructions.
- Companies in our group — our affiliate Nexxo Venture HCMC Co., Ltd (Vietnam), which supports our operations, customer support and technology.
- Professional advisers — lawyers, auditors and insurers.
- Regulators, law enforcement, courts and tax authorities — where the law requires or allows it.
- A buyer or successor, if our business is merged or sold. Your data would remain protected under this policy.
- Anyone else, with your consent or at your direction.
A list of the service providers who process personal data for us is available on request from legal@globalcard.ai.
We do not sell your personal data, and we do not share it for cross-context behavioral (targeted) advertising.
8. International transfers
Global Card is headquartered in the United States. Our production systems are hosted on Amazon Web Services (AWS) in the United States. Our affiliate in Vietnam and some of our service providers may access or process personal data from other countries. Those countries may not protect personal data in the same way as the country where you live.
Where the law of the country you live in sets rules for sending personal data abroad, we protect those transfers with contractual commitments from the recipients, or another mechanism that law allows. You can ask us for details of the safeguards that apply by emailing legal@globalcard.ai.
9. Cookies and similar technologies
We use cookies and similar technologies on our website and app. We do not use advertising cookies or advertising pixels.
| Type | What it does | Your choice |
|---|---|---|
| Strictly necessary | Sign-in, security, fraud prevention, remembering your cookie choices | Always on — the Services don’t work without them |
| Functional | Remembering preferences such as language | Can be turned off |
| Analytics | Understanding how the Services are used so we can improve them | Off until you agree, where the law requires consent |
Where the law requires it, we honor the Global Privacy Control signal from your browser.
Our marketing emails may contain a pixel that tells us whether they were opened. You can block it by turning off automatic image loading in your email app.
The full list of cookies is in our Cookie Notice at globalcard.ai/legal/cookies.
10. Marketing
We send marketing only where the law allows — with your consent where that is required. You can opt out at any time using the unsubscribe link in any marketing email, in the app settings, or by contacting us.
Service messages — security alerts, transaction notices and legal notices — are not marketing. They continue while you have an account.
11. How long we keep your data
| Data | How long | Why |
|---|---|---|
| Account, transaction and card records | 5 years after your account closes, or longer where a law in a country we serve requires it | Anti-money-laundering, tax and consumer-protection laws require it |
| Identity documents, verification and screening results — including for applications we did not approve | 5 years after your account closes or after the application decision, or longer where the law requires it | Anti-money-laundering record-keeping |
| Face images and face templates | Deleted once verification is complete and any legally required period has ended; never later than 3 years after you provided them | Identity verification only (section 6) |
| Support communications — emails, chats and call recordings | Kept with your account records (first row) | Handling complaints and disputes, training and quality |
| Security and access logs | Kept with your account records (first row), or deleted earlier once no longer needed | Security and fraud investigations |
| Marketing preferences | Until you opt out, plus a record that you opted out | So we keep respecting your choice |
| Cookie data | As set out in our Cookie Notice | — |
We may keep data longer if the law or a regulator requires it, or if we need it for a legal claim. When we no longer need data, we delete it securely or anonymize it.
12. How we protect your data
We use technical and organisational measures designed to protect your data, including:
- encryption in transit and at rest;
- access limited to people who need it, protected by multi-factor authentication;
- security monitoring;
- security reviews of our service providers;
- staff training.
Full card numbers stay with our card processing partner and are not stored on our systems.
No system is completely secure, so we cannot guarantee absolute security.
We will never ask for your password, one-time code or full card details by email, phone or message. If anyone does, don’t reply — report it to support@globalcard.ai or through chat in the app.
If a data breach is likely to put you at risk, we will tell you and the relevant authorities as the law requires.
13. Your rights
Depending on where you live, you have some or all of these rights:
| Right | What it means |
|---|---|
| Access | Get a copy of the personal data we hold about you |
| Correction | Have inaccurate or incomplete data corrected |
| Deletion | Have your data deleted — except data we must keep by law (see section 11) |
| Restriction | Ask us to limit how we use your data while a concern is resolved |
| Objection | Object to uses based on our legitimate interests. You can always object to direct marketing |
| Portability | Receive your data in a common electronic format, or have it sent to another company |
| Withdraw consent | Including for face scans and marketing. This does not affect anything done before |
| Human review | Ask a person to review an automated decision (see section 5) |
| Complain | Complain to a data protection authority (see section 14) |
How to use your rights. Email legal@globalcard.ai or go to Settings → Privacy in the app. We will ask you to confirm your identity first, to protect your account. We will never ask for your password.
Someone can act on your behalf if they have your written permission and we can verify both of you.
Timing and cost. We reply within 30 days — or sooner if your local law requires. We may extend this where the law allows, and we will tell you if we do. Requests are free unless they are clearly unfounded or excessive.
If we say no. We will tell you why and how to appeal or complain. Some rights are limited by law. For example, we cannot delete records we must keep for anti-money-laundering purposes, and we may be unable to share information that would reveal an investigation.
We will not treat you less favorably for using your rights.
14. Information for specific regions
14.1 United States
- Financial privacy notices. Annex B is our notice under US federal financial privacy law. It explains how we share consumer financial information and the choices you have. Zenus Bank International, Inc. provides its own privacy policy for the account it holds: https://zenus.com/legal-documents/privacy-policy.
- State privacy laws. Residents of some states, including California, may have rights to know, delete and correct their data, to opt out of its sale or sharing and of targeted advertising, to limit the use of sensitive data, and to appeal our decisions. Much of the data we hold is covered by federal financial privacy law and may be exempt from these state laws. Where a state law applies, we honor it. To appeal a decision, reply to our response with “Appeal”.
- Biometric privacy laws. Some states, including Illinois, Texas and Washington, have specific rules on biometric data. Section 6 and Annex A describe our written notice, consent, retention schedule and our commitment never to sell or profit from biometric data.
14.2 Other countries
Many countries give similar rights. Wherever you live, you can use the rights in section 13 as far as your local law allows, and complain to your local data protection authority.
15. Children
You must be at least 18, or the age of majority where you live, to use Global Card. We do not knowingly collect personal data from anyone younger. If we learn that we have, we will close the application and delete the data, unless the law requires us to keep it.
16. Changes to this policy
We may update this policy from time to time. If we make significant or material changes, we will let you know by email or in the app.
The date at the top shows when the policy was last updated. Previous versions are available on request.
17. Contact us
Globalcard Services LLC7901 4th St N, Ste 300, St. Petersburg, FL 33702, United States
- Privacy and policy questions and requests: legal@globalcard.ai
- Customer support: support@globalcard.ai or chat in the app
- Website: globalcard.ai
Annex A — Face scan notice and consent
Shown on its own screen immediately before the face scan. Not bundled with the terms of service.
Before we scan your face
To confirm it’s really you, we’ll take a short video selfie. Our identity verification provider, Sumsub, will:
- check that you’re a real person who is present, and
- create a face template — a mathematical map of your facial features — and compare it with the photo on your ID.
Why: to verify your identity when you open your account and to prevent fraud. We don’t use it for anything else, and we never sell it.
How long: your face scan and template are deleted once verification is complete and any legally required period has ended, and never later than 3 years after you provide them.
Sumsub’s own use: Sumsub also uses this data for its own purposes — preventing fraud across its clients and improving its services, which may involve AI — and keeps it under its own privacy notice: https://sumsub.com/privacy-notice-service/
Your choice: consent is optional, but without it we can’t verify your identity or open your account. You can withdraw consent later in Settings → Privacy or by emailing legal@globalcard.ai.
I have read this notice. I consent to Global Card and Sumsub collecting, storing and using my face scan and face template as described here and in the Privacy Policy.
Annex B — US Consumer Financial Privacy Notice
FACTS — WHAT DOES GLOBAL CARD DO WITH YOUR PERSONAL INFORMATION?
| Question | Answer |
|---|---|
| Why? | Financial companies choose how they share your personal information. Federal law gives consumers the right to limit some but not all sharing. Federal law also requires us to tell you how we collect, share, and protect your personal information. Please read this notice carefully to understand what we do. |
| What? | The types of personal information we collect and share depend on the product or service you have with us. This information can include: account balances and account transactions; payment history and wire transfer instructions; and employment information. When you are no longer our customer, we continue to share your information as described in this notice. |
| How? | All financial companies need to share customers’ personal information to run their everyday business. In the section below, we list the reasons financial companies can share their customers’ personal information; the reasons Global Card chooses to share; and whether you can limit this sharing. |
| Reasons we can share your personal information | Does Global Card share? | Can you limit this sharing? |
|---|---|---|
| For our everyday business purposes — such as to process your transactions, maintain your account(s), respond to court orders and legal investigations, or report to credit bureaus | Yes | No |
| For our marketing purposes — to offer our products and services to you | Yes | No |
| For joint marketing with other financial companies | No | We don’t share |
| For our affiliates’ everyday business purposes — information about your transactions and experiences | Yes | No |
| For our affiliates’ everyday business purposes — information about your creditworthiness | No | We don’t share |
| For our affiliates to market to you | No | We don’t share |
| For nonaffiliates to market to you | No | We don’t share |
Questions? Email legal@globalcard.ai or go to globalcard.ai.
| Who we are | Answer |
|---|---|
| Who is providing this notice? | Globalcard Services LLC |
| What we do | Answer |
|---|---|
| How does Global Card protect my personal information? | To protect your personal information from unauthorized access and use, we use security measures that comply with federal law. These measures include computer safeguards and secured files and buildings. |
| How does Global Card collect my personal information? | We collect your personal information, for example, when you open an account, use your card, make or receive a payment, or give us your contact information. We also collect your personal information from others, such as identity verification providers, our banking partner, and card networks. |
| Why can’t I limit all sharing? | Federal law gives you the right to limit only: sharing for affiliates’ everyday business purposes — information about your creditworthiness; affiliates from using your information to market to you; and sharing for nonaffiliates to market to you. State laws and individual companies may give you additional rights to limit sharing. |
| Term | Meaning |
|---|---|
| Affiliates | Companies related by common ownership or control. They can be financial and nonfinancial companies. Our affiliates include Nexxo Venture HCMC Co., Ltd. |
| Nonaffiliates | Companies not related by common ownership or control. They can be financial and nonfinancial companies. Global Card does not share with nonaffiliates so they can market to you. |
| Joint marketing | A formal agreement between nonaffiliated financial companies that together market financial products or services to you. Global Card doesn’t jointly market. |