LCash Privacy Policy

Effective Date: April 23, 2026

This Privacy Policy explains how Place Stars, Inc., a Nevada corporation doing business as LCash (“LCash,” “we,” “us,” or “our”), collects, uses, shares, stores, and protects your personal information when you access or use the LCash website, mobile application, wallet, card features, and related services (the “Services”).

LCash serves users residing in supported countries in Africa, starting with the Federal Republic of Nigeria and the Republic of Kenya. For those users, this Privacy Policy is provided in accordance with the Nigeria Data Protection Act, 2023 (NDPA) and the Kenya Data Protection Act, 2019 (Kenya DPA), among other applicable laws.

By using the Services, you acknowledge that you have read this Privacy Policy.

1. Data Controller and Contact

For the purposes of the NDPA and the Kenya DPA, the data controller of your personal information is:

2. Data Protection Officer

LCash has designated a contact point for all data-protection matters. You can reach our Data Protection Officer (DPO) or equivalent privacy contact at:

Please use this address for requests to exercise your rights, privacy questions, or data-protection complaints before escalating to a regulator.

3. Scope

This Privacy Policy applies to personal information we collect through:

• the LCash mobile app;
• the LCash website;
• customer support interactions;
• identity verification and onboarding;
• wallet funding and card activity;
• fraud, security, and compliance monitoring.

This Privacy Policy does not apply to third-party websites, app stores, payment pages, or external services that have their own privacy policies.

4. Information We Collect

We may collect the following categories of personal information:

A. Identity and Contact Information

• full name;
• date of birth;
• email address;
• phone number;
• residential address;
• country of residence;
• username or account identifier.

B. Verification Information

• government-issued ID details, including Nigerian National Identification Number (NIN), Bank Verification Number (BVN), Kenyan National ID, or equivalent documents;
• ID document images;
• selfies or facial images used for identity verification;
• tax or regulatory information where required;
• sanctions, politically-exposed-person, watchlist, or fraud-screening results.

C. Account and Wallet Information

• account status;
• wallet balance information;
• funding history;
• transaction history;
• card activity;
• card status, including freeze/unfreeze events and card controls;
• dispute, refund, and reversal information.

D. Payment Information

• payment card tokens or masked card details;
• funding-source metadata;
• payment confirmations and failures;
• billing and fee records.

We do not store full payment card numbers or security codes unless specifically required and lawfully permitted. Sensitive payment credentials are typically handled by specialized payment and issuing partners.

E. Device and Technical Information

• device identifiers;
• operating system and app version;
• IP address;
• browser type;
• language settings;
• time zone;
• mobile carrier information;
• log data and error reports;
• app interaction and usage analytics.

F. Location Information

We may infer approximate location from your IP address, SIM, country code, device signals, or transaction patterns. Where necessary and permitted, we may collect more precise location data for fraud prevention and security.

G. Communications and Support Information

• messages sent to support;
• complaint and dispute information;
• survey responses;
• call, chat, or email records;
• attachments you provide.

H. Risk and Security Information

• login attempts;
• authentication results;
• device trust signals;
• fraud flags;
• blocked activity;
• watchlist or compliance review results.

5. How We Collect Information

We collect information:

• directly from you when you sign up, verify your identity, fund your wallet, request a card, or contact us;
• automatically when you use the Services;
• from payment processors, card issuers, KYC vendors, fraud vendors, analytics providers, and communication service providers;
• from public databases, sanctions lists, legal registries, and similar lawful sources where needed for compliance and risk review.

6. Why We Use Your Information

We use personal information to:

• create and manage your account;
• provide the wallet and card services;
• process funding transactions and card activity;
• verify your identity;
• prevent fraud, abuse, chargebacks, and unauthorized use;
• comply with laws, regulations, sanctions rules, and partner obligations, including the NDPA, Kenya DPA, AML regulations of the Central Bank of Nigeria, the Central Bank of Kenya, and U.S. sanctions administered by OFAC;
• communicate with you about your account, transactions, security, and support needs;
• improve the performance, usability, and safety of the Services;
• troubleshoot errors, outages, and account issues;
• enforce our Terms and other policies;
• defend legal claims and protect our rights.

7. Legal Bases for Processing

We process personal data on one or more of the following bases under the NDPA, the Kenya DPA, and other applicable laws:

• Contract: processing necessary to provide the Services you have requested and to perform our obligations under the Terms of Use;
• Legal obligation: processing required to comply with laws and regulations applicable to LCash or its partners, including AML, counter-terrorism-financing, sanctions, tax, and recordkeeping laws;
• Legitimate interests: processing necessary for fraud prevention, security, product improvement, analytics, and the safe and lawful operation of the Services, where our interests are not overridden by your rights;
• Consent: where consent is required by law (for example, certain marketing communications or optional features), and only for as long as you do not withdraw it.

8. How We Share Information

We may share personal information with:

A. Service Providers

Companies that help us operate the Services, including:

• cloud hosting providers;
• payment processors;
• issuing and card fulfillment partners;
• KYC and identity verification vendors;
• fraud, sanctions, and compliance screening vendors;
• customer support software providers;
• analytics, communications, and security vendors.

B. Financial and Compliance Partners

We share relevant data with the regulated financial-service providers that operate the wallet, card-issuing, and payment-processing layers of the Services — principally Kora (Korapay Services Ltd.) and Paystack — as well as with other payment, issuing, banking, compliance, and fraud-prevention partners. LCash acts as an authorized agent of these providers, and the providers are independent controllers or processors of personal data they receive from us, under their own privacy notices and program rules. These partners use such data to:

• verify your identity;
• perform sanctions and politically exposed person screening;
• assess fraud and transaction risk;
• process funding events or card transactions;
• meet legal and regulatory obligations.

C. Authorities and Legal Recipients

We may disclose information when required or permitted by law, including in response to:

• subpoenas;
• court orders;
• lawful regulatory requests, including from the Nigeria Data Protection Commission (NDPC), the Central Bank of Nigeria, the Nigerian Financial Intelligence Unit, the Office of the Data Protection Commissioner of Kenya (ODPC), the Central Bank of Kenya, or the Financial Reporting Centre of Kenya;
• law enforcement requests;
• anti-fraud or sanctions investigations.

D. Corporate Transactions

If LCash is involved in a merger, acquisition, financing, asset sale, or restructuring, personal data may be disclosed as part of that transaction subject to appropriate safeguards.

We do not sell your personal data for money.

9. International Transfers

LCash is incorporated in the United States, and we process and store information in the United States and other countries where our service providers or partners operate. If you use the Services from Nigeria, Kenya, or another country, your personal information will be transferred outside of your country of residence.

Where required by law, we use reasonable safeguards for cross-border transfers, including:

• contractual protections with our service providers;
• technical and organizational security measures;
• transfer mechanisms recognized under the NDPA and the Kenya DPA, including transfers necessary for the performance of your contract with us, transfers based on your explicit consent where required, and transfers to countries or organizations offering an adequate level of protection.

10. Data Retention

We keep personal information for as long as reasonably necessary to:

• provide the Services;
• maintain your account;
• complete transactions;
• comply with legal, regulatory, tax, accounting, anti-fraud, and recordkeeping requirements (which, for financial-services records, typically require retention for several years after the end of the customer relationship under CBN, CBK, FinCEN, and similar rules);
• resolve disputes and enforce agreements.

Retention periods may differ depending on the type of information and applicable law. We may retain certain data after account closure where necessary for compliance, security, or legal reasons.

11. Data Security

We use administrative, technical, and physical safeguards designed to protect personal information, including access controls, monitoring, encryption where appropriate, secure infrastructure, and fraud detection systems.

However, no system is completely secure. You are also responsible for protecting your device, passwords, one-time codes, and account access methods.

12. Your Rights under the Nigeria Data Protection Act (NDPA)

If you are a data subject in Nigeria, the NDPA gives you rights in respect of your personal information, including the right to:

• be informed about the processing of your personal data;
• access the personal data we hold about you;
• request correction of inaccurate or incomplete personal data;
• request deletion or erasure of your personal data where there is no legal basis for continued processing;
• restrict or object to certain processing;
• request a copy of your personal data in a structured, commonly-used, machine-readable form (data portability);
• withdraw consent at any time where processing is based on consent, without affecting the lawfulness of prior processing;
• not be subject to a decision based solely on automated processing that produces legal or similarly significant effects, except as permitted by law;
• lodge a complaint with the Nigeria Data Protection Commission (NDPC).

These rights are subject to exceptions set out in the NDPA, including where we must retain data to meet legal obligations, fight fraud, or defend legal claims.

To exercise your rights, contact us at privacy@lcash.com. If you are not satisfied with our response, you may contact the regulator directly:

13. Your Rights under the Kenya Data Protection Act

If you are a data subject in Kenya, the Kenya DPA gives you rights in respect of your personal information, including the right to:

• be informed of the use of your personal data;
• access your personal data in our custody;
• object to the processing of your personal data or parts of it;
• request correction of false or misleading data;
• request deletion of false or misleading data;
• request a copy of your personal data in a portable format where technically feasible;
• withdraw consent at any time where processing is based on consent, without affecting the lawfulness of prior processing;
• not be subject to a decision based solely on automated processing that has legal or similarly significant effects, except as permitted by law;
• lodge a complaint with the Office of the Data Protection Commissioner (ODPC).

These rights are subject to exceptions set out in the Kenya DPA, including where we must retain data to meet legal obligations, fight fraud, or defend legal claims.

To exercise your rights, contact us at privacy@lcash.com. If you are not satisfied with our response, you may contact the regulator directly:

14. Marketing Communications

We may send service-related communications that are necessary to operate your account and the Services.

Where allowed by law, we may also send product updates, promotions, or announcements. You may opt out of non-essential marketing communications at any time, but you will still receive important transactional or legal notices.

15. Cookies and Similar Technologies

Our website and app may use cookies, SDKs, pixels, local storage, and similar tools to:

• remember preferences;
• improve site performance;
• understand usage patterns;
• help detect abuse and security issues.

Where required by applicable law, including the Kenya DPA, we will ask for your consent before setting non-essential cookies or similar trackers. You may control cookies through your browser or device settings, though some features may not function properly if certain technologies are disabled.

16. Children’s Privacy

LCash is not intended for children. We do not knowingly permit anyone under 18, or under the applicable age of majority, to use the Services.

If we learn that we collected personal information from a person who was not eligible to use the Services, we may delete the information and close the account, subject to legal retention requirements.

17. Third-Party Links and Services

The Services may contain links to third-party sites, tools, or services. We are not responsible for the privacy practices of those third parties. You should review their privacy notices separately.

18. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we may notify you through the app, website, email, or another reasonable method.

The updated version becomes effective on the date shown at the top.

19. Contact Us

If you have questions, requests, or complaints about this Privacy Policy or our data practices, contact: