1. Who we are
Cobalt is owned and operated by Amanors Holding Limited, registered in the Dubai International Financial Centre (DIFC), under registration number 11976. In this policy, “Cobalt”, “we”, “us” and “our” refer to Amanors Holding Limited.
We are responsible for the personal information we process to operate the Cobalt website, your Cobalt login and onboarding. A banking partner or another provider may be independently responsible for information it processes to provide its own regulated services. Its privacy notice will apply to that processing.
For privacy questions or to exercise your rights, contact privacy@cobalt.ci.
2. The current test service
Cobalt currently provides a test account and onboarding experience. Creating a login or completing a test identity check does not open a bank account or activate a financial service. Shufti sandbox checks simulate verification; they do not establish a verified identity.
Use sample information in test verification. Do not upload real identity documents or selfies. Your actual login email, account identifier and security information are still personal information and are covered by this policy.
3. Information we collect
Launch waitlist: when you join, we store your email address, selected website region, source page and the time and version of your consent in a separate Cloudflare database restricted to the European Union. With your consent, we use these details to email you about Cobalt’s launch and your bonus. Joining does not create a bank account. To opt out or request deletion, contact privacy@cobalt.ci.
- Account and security information: your email address, account identifier, passkey credentials and sign-in records. Auth0 provides authentication. The fingerprint or face data used by your device to unlock a passkey stays on your device and is not supplied to Cobalt.
- Onboarding information: the country of residence you select, your acceptance of our terms, an identifier for your Shufti verification and its verification status.
- Identity information: when live verification is available, Shufti may collect information such as your name, date of birth, address, government-issued ID, document images and a selfie. Depending on the check and applicable law, Shufti may process biometric information. Shufti explains the applicable checks and any consent required in its verification flow. This is separate from the biometrics used to unlock your passkey.
- Service and technical information: messages you send us, device and browser information, IP addresses and security or operational records needed to run and protect the service.
- Banking information: if a regulated service becomes available to you and you apply for it, the relevant partner may collect account, transaction, source-of-funds and other information required for that service. We will provide the applicable service and privacy notices before that stage.
4. Why we use information
We use information to create and protect your account, manage onboarding, verify identity, prevent fraud, provide support and meet applicable legal obligations. Depending on the purpose and the law that applies, we rely on taking steps at your request or performing a contract, legal obligations, legitimate interests such as service security and fraud prevention, or your consent where required.
Where a check requires consent, the relevant notice will explain the choice and its consequences. Withdrawing consent does not affect earlier lawful processing. Some legally required checks may be necessary before a service can be provided. We do not treat acceptance of our terms as blanket consent to every use of personal information.
5. Where information is stored
Our data-residency policy is not to store personal data in the United Arab Emirates. Our ownership and registration in the DIFC do not mean that your personal information is stored in the UAE.
For live banking and KYC, our policy is to store information within the regulatory region required for your location and the service involved, including with appropriately configured third-party processors such as Shufti and our banking partners. The applicable requirements depend on your residence, the relevant regulated provider and the type of information. We must establish the required regional arrangements before making the live service available.
Current test setup: login is provided through an Auth0 tenant in the United States. Cobalt’s test onboarding records are stored in a Cloudflare database restricted to the European Union. Shufti’s test service is separate from those records. Currencycloud sandbox account setup uses generated sample customer details. Cobalt stores the associated account references and test account details in its EU database; workflow references and internal ledger records are processed on its test server in London, United Kingdom. Currencycloud receives the sample details and selected country, not your Shufti identity documents, through this test integration. This test setup is not a representation that live banking or KYC residency requirements have already been implemented for every country.
Service providers may process information in other countries where permitted by applicable law. Where a transfer requires safeguards, these may include an adequacy decision, approved contractual safeguards or another lawful mechanism. A regional storage requirement and an international processing or access arrangement are distinct; we assess both for the service concerned.
6. Who receives information
We share information only as needed for the purposes described here, including with:
- Our processors and service providers, including Shufti for current identity verification (Persona is planned as a future provider), Auth0 for authentication and Cloudflare for website delivery and test onboarding infrastructure. Shufti receives verification submissions directly through its flow. Read Shufti’s Privacy Policy.
- Banking and financial-service partners, where you apply for or use a service they provide and the information is necessary to assess, open or operate it, or meet their legal obligations.
- Regulators, courts, law-enforcement authorities and other authorised bodies, when disclosure is required by law or made in response to a valid, lawful request. We assess the authority and scope of requests before disclosure.
- Professional advisers and authorised personnel, where needed for compliance, dispute handling, security or service operations and subject to appropriate confidentiality obligations.
We do not sell your personal information.
7. Retention and protection
We retain information for as long as it is reasonably needed for the stated purpose, to meet applicable record-keeping requirements, resolve disputes or protect the service. The period depends on the information and the applicable law; regulated banking and KYC records may need to be kept after an account closes.
We use access controls and technical safeguards designed to protect information. Our onboarding record contains verification references and status, rather than copies of identity documents or selfies. Those submissions are handled by Shufti. No system can be guaranteed completely secure.
8. Your choices and rights
Depending on the law that applies, you may have rights to access, correct or erase information, restrict or object to processing, obtain a portable copy, withdraw consent and seek review of certain automated decisions. These rights may be limited by legal record-keeping or other requirements.
Contact privacy@cobalt.ci. We may need to confirm your identity before responding; please do not email identity documents unless we arrange a suitable secure method. We will handle requests within the applicable legal timeframe. You may also complain to your local data-protection authority or the DIFC Commissioner of Data Protection.
9. Website storage and changes
We use browser storage and similar technologies where needed for authentication, security and your website preferences. Optional tracking, if introduced, will be explained and consent requested where required. Our current sign-in tokens are held in browser memory.
We may update this policy as Cobalt develops. The effective date above identifies the current version. We will provide additional notice of material changes where required.