INSTITUTIONAL PRIVACY MANIFESTO
& DATA FIDUCIARY FRAMEWORK

1.1. Safi TopUp operates under the sovereign fiduciary umbrella of Safi International Capital LTD (London, UK • Company No. 17063286). We declare an uncompromising data fiduciary standard governed by the Data Protection Act 2018 (DPA 2018), the United Kingdom General Data Protection Regulation (UK GDPR), the European Union Regulation (EU) 2016/679 (EU GDPR), and the international security framework ISO/IEC 27001.

1.2. We do not monetize, sell, lease, or broker telecommunications subscriber metadata, financial records, or client traffic patterns to commercial advertisers or data brokers under any circumstances.

2.1. This Privacy Manifesto establishes the data governance baseline across the integrated enterprise ecosystem architected by Founder Shaheen Safi:

• Safi International Capital LTD: Group fiduciary management, statutory compliance records, and corporate holding governance.
• Safi TopUp: Wholesale telecommunications routing, MSISDN transit validation, eSIM SM-DP+ server communications, and carrier clearing.
• SafiPay: Multi-currency banking, KYC identity verification, PCI-DSS Level 1 card transactions, and SWIFT/SEPA clearing.
• ZEV App: End-to-end encrypted messaging, decentralized media streams, and tokenized creator incentives.
• Safi Academy: Educational telemetry, LMS credentials, and professional certification records.
• Safi Pro & Safi AI: E-commerce venture records and proprietary artificial intelligence algorithm data isolation.

3.1. Telecommunications Metadata Masking: When transmitting top-up payloads or eSIM remote provisioning requests across 700+ partner network operators, MSISDN phone numbers and IMSI identities are masked using one-way cryptographic hashing (SHA-256 with dynamic salt) within core database layers, decryptable only at the physical carrier border gateway for final packet routing.

3.2. In-Transit & At-Rest Encryption: All wholesale API communication demands TLS 1.3 encryption with ECDHE ephemeral key exchange. Databases and object storage are secured with AES-256 military-grade encryption with automated KMS key rotation.

4.1. Under UK Money Laundering Regulations 2017 and Proceeds of Crime Act 2002 (POCA), Safi TopUp retains immutable cryptographic transaction logs for wholesale settlement and balance transfers for a statutory duration of five (5) years following execution.

4.2. Transaction records include source IP address, API key identifier, timestamp, transaction value, destination carrier identifier, and upstream settlement code. These logs are isolated in write-once-read-many (WORM) storage to prevent modification.

5.1. Our backend infrastructure utilizes enterprise geodistributed data centers (including Supabase, AWS Europe, and London IX nodes) with SOC 2 Type II and ISO 27001 certifications.

5.2. Row-Level Security (RLS) is strictly enforced across all database tables. API consumers and wholesale partners are isolated through tenant cryptographically-enforced schemas, rendering cross-tenant data leakage mathematically impossible.

6.1. Operating across 150+ countries necessitates cross-border telecommunications transits. All international data transfers between the United Kingdom, European Economic Area, Middle East, and Asia are executed pursuant to UK International Data Transfer Agreements (IDTAs) and EU Standard Contractual Clauses (SCCs).

6.2. In corridors connecting emerging frontier markets (including Afghanistan, Pakistan, and Central Asia), technical routing is optimized through direct bilateral optical peering to eliminate unauthorized intercept or transit through third-party sovereign firewalls.

7.1. Subject to statutory anti-money laundering and carrier retention duties, every natural person whose personal data is processed by Safi TopUp retains the full spectrum of statutory rights guaranteed under Articles 15 through 22 of the UK GDPR and EU GDPR:

• Right of Access (Article 15): Right to obtain confirmation and cryptographic copies of personal data processed.
• Right to Rectification (Article 16): Right to require correction of inaccurate institutional data.
• Right to Erasure ("Right to be Forgotten", Article 17): Right to demand permanent cryptographic purging of personal data once legal retention periods expire.
• Right to Restriction of Processing (Article 18): Right to suspend processing during contested accuracy audits.
• Right to Data Portability (Article 20): Right to receive data in a structured, machine-readable JSON format.

8.1. Temporary operational routing caches (such as session tokens and transient carrier delivery acknowledgments) are automatically purged within seventy-two (72) hours of transaction finality.

8.2. Permanent data shredding utilizes the DoD 5220.22-M cryptographic sanitization standard, ensuring that deleted records cannot be recovered via forensic analysis.

9.1. Data principals have the statutory right to lodge complaints directly with the UK supervisory authority:

10.1. Third-Party Advertising Vendors: We participate in the Google AdSense advertising program operated by Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA). Third-party vendors, including Google, utilize cookies and web beacons to serve advertisements based on a user's prior visits to this website (safitopup.site) and other sites across the World Wide Web.

10.2. DoubleClick DART Cookie: Google's use of advertising cookies (including the DoubleClick DART cookie) enables Google and its partner advertising networks to serve personalized, contextual, and in-feed advertisements to users based on navigation history, geographic region, and demographic parameters.

10.3. User Opt-Out Mechanisms: Users and data principals retain the absolute right to opt out of personalized interest-based advertising at any time through the following accredited industry mechanisms:

• Google Ad Settings: Users may inspect, manage, or disable personalized advertising cookies directly via https://www.google.com/settings/ads.
• Digital Advertising Alliance (DAA): Users may opt out of third-party ad network tracking via the Network Advertising Initiative / DAA portal at https://www.aboutads.info/choices/.
• European Interactive Digital Advertising Alliance (EDAA): EEA/UK visitors can exercise preference opt-outs through https://www.youronlinechoices.eu/.

10.4. Publisher Transparency & Data Separation: Advertising cookies deployed by Google AdSense do not access or compromise Safi TopUp's internal telecommunications carrier databases, MSISDN customer records, or financial transaction logs. Advertising cookies operate strictly within the client browser sandbox in compliance with the UK Privacy and Electronic Communications Regulations (PECR) and UK GDPR Article 6(1)(a).