Legal Document
Terms of Use
Acceptance of Terms
These Terms of Use (the "Terms") govern your access to and use of the Passport.Me service, including the website available at passport.me and any associated mobile interfaces, APIs, CLI tools, and MCP endpoints (collectively, the "Service"), operated by Passport.Me (a service of Magic Crystal Limited, a company incorporated in Hong Kong) ("we", "us", or "Company").
By accessing or using the Service in any way — including visiting the website, connecting an account, installing the CLI, or authorizing an AI application — you agree to be bound by these Terms and our Privacy Policy, which is incorporated by reference. If you do not agree to these Terms, you must immediately stop using the Service.
These Terms constitute a legally binding agreement between you and Passport.Me. If you are using the Service on behalf of an organisation, you represent that you have authority to bind that organisation to these Terms, and all references to "you" include that organisation.
Eligibility
To use the Service, you must:
- Be at least 18 years of age;
- Have full legal capacity to enter into a binding contract under the laws of your jurisdiction;
- Not be a person barred from receiving services under applicable laws, including sanctions or export control restrictions; and
- Not be located in a jurisdiction where use of the Service is prohibited by applicable law.
The Service is not directed at or intended for use by minors under the age of 18. By accessing the Service, you represent and warrant that you satisfy all of the above eligibility requirements. We reserve the right to request proof of age and to suspend or terminate any account we reasonably believe is held by a person who does not meet these requirements.
Account Registration
Passport.Me does not maintain a traditional username-and-password account system. Your identity on the Service is established through one or more of the following authentication mechanisms:
Google OAuth Authentication
You may sign in and connect your Google account by completing a standard OAuth 2.0 consent flow. By doing so, you give the Service the permissions you approve during that flow, including read access for Gmail, Google Calendar, and Google Drive as applicable. You represent that you are the authorised holder of the Google account you connect and that you have authority over its sharing.
Crypto Wallet Connection
You may link one or more Ethereum-compatible wallet addresses by signing a cryptographic challenge (Sign-In With Ethereum / SIWE) or by connecting via WalletConnect. You represent that you control the private keys associated with any wallet address you connect. Wallet connections do not give the Service custody of, or access to, your private keys or funds.
Accuracy and Security
You agree to provide accurate information in connection with registration and to keep your connections current and valid. You are solely responsible for maintaining the security of your connected accounts, wallets, and any devices used to access the Service. You must notify us immediately at privacy@passport.me if you suspect any unauthorised access to your Passport.Me account or connected credentials.
We are not liable for any loss or damage arising from your failure to keep your credentials secure or from any unauthorised access that results from your own actions or negligence.
Service Description
Passport.Me is a personal data gateway. Its core purpose is to allow you to connect your personal data sources — including Google account data (Gmail, Calendar, Drive, People), on-chain wallet data, developer-platform data (GitHub), and wearable health data (Oura Ring) — and to selectively share live data from those sources with authorised AI assistants and tools via the Model Context Protocol ("MCP"). Additional sources may be added to the Service from time to time and will be governed by these Terms and our Privacy Policy unless separately disclosed.
What the Service Does
- Stores encrypted credentials. When you connect a Google account, we store your OAuth refresh token in encrypted form using industry-standard key derivation and encryption.
- Proxies Google API data. On your instruction and within the scopes you have authorised, we fetch data from Google APIs (Gmail, Calendar, Drive, and Google People) and relay it to your authorised AI tools.
- Reads on-chain data. We query publicly available blockchain data, including token balances, NFT holdings, and DeFi positions, for wallet addresses you have connected, using third-party data providers.
- Collects demographic signals. With your consent, we collect and store structured demographic data such as your birthday, gender, locale, and approximate geolocation derived from your IP address, sourced from the Google People API and Cloudflare edge metadata.
- Issues OAuth tokens. We act as an OAuth 2.0 authorisation server to issue scoped bearer tokens to connected AI applications that you have explicitly authorised.
- Delivers context via MCP. Your authorised AI tools receive structured data through MCP transport layers, enabling them to act on live information from your connected sources.
- Sends transactional emails. We may send you email notifications related to your account activity, connection status, and material updates to the Service.
What the Service Does Not Do
- The Service does not take custody of, transfer, or control any cryptocurrency or digital assets.
- The Service does not provide investment, financial, legal, medical, or professional advice of any kind.
- The Service does not store the full content of your emails, calendar events, or documents persistently; we fetch and relay data at the time of each authorised request unless you have configured caching.
- The Service does not sell your personal data to third parties for advertising purposes.
- The Service does not access your Google account data except within the scopes you explicitly approved and for the purposes described in these Terms and our Privacy Policy.
User Responsibilities
You agree that your use of the Service is subject to the following obligations:
Lawful Use
You will use the Service only for lawful purposes and in accordance with these Terms. You will not use the Service in any way that violates applicable local, national, or international law or regulation, including data protection laws applicable in your jurisdiction.
Credential Security
You are responsible for all activity that occurs through your connected accounts and through any OAuth tokens or MCP endpoints issued in your name. You must not share your Passport.Me session, API credentials, or issued tokens with any third party, except as part of an explicit authorisation flow you initiate through the Service.
Accurate Information
You will not provide false, misleading, or inaccurate information to the Service or impersonate any person or entity.
Third-Party Terms
Your use of Google services through Passport.Me remains subject to Google's own Terms of Service and Privacy Policy. Your use of any AI application you connect remains subject to that application's own terms. You are responsible for ensuring your use of the Service does not cause a breach of any third-party terms that bind you.
Appropriate Use of Data Access
You will not use Passport.Me so AI tools can access data that you are not legally authorised to share — for example, data belonging to other individuals that happens to be present in your Google account — unless you have a valid legal basis for that sharing under applicable law.
Data Sources and Third-Party Services
Passport.Me integrates with the following categories of external services to deliver the Service. By using the Service, you acknowledge and accept the role of these third parties:
Google (OAuth and API Access)
Passport.Me uses Google's OAuth 2.0 framework to authenticate you and to obtain authorisation to access your Google account data within the scopes you approve. All access to Google data is subject to your own Google account permissions and Google's policies. Passport.Me's use of information received from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for any purpose other than providing and improving the features you have requested.
GitHub (OAuth and API Access)
Passport.Me uses GitHub's OAuth 2.0 framework to authenticate optional connections to your GitHub account. When you authorise this connection, the Service may read profile metadata, repositories you own or collaborate on, organisations, starred repositories, and issues to the extent permitted by the scopes you approve. Your use of GitHub data through Passport.Me remains subject to GitHub's Terms of Service and GitHub Privacy Statement. You represent that you have authority to share any repository or organisation data you connect.
Oura (OAuth and Health Data Access)
Passport.Me uses Oura's OAuth 2.0 framework to authenticate optional connections to your Oura Ring account. When you authorise this connection, the Service may read your personal information, daily sleep, daily readiness, daily activity, workouts, heart rate, and SpO₂ data to the extent permitted by the scopes you approve. Your use of Oura data through Passport.Me remains subject to Ōura Health Oy's Terms of Service and Privacy Policy.
No medical advice. Oura data made available through Passport.Me — including biometric, sleep, activity, and cardiovascular metrics — is provided for general informational and personal-insight purposes only. It is not medical advice, a clinical assessment, a diagnostic tool, or a substitute for consultation with a qualified healthcare professional. Any AI Application that processes Oura data through your MCP endpoint is likewise not a medical service. You should not rely on Oura data, or on any AI output derived from it, to make medical, fitness, or treatment decisions. If you have any health concern, consult a licensed healthcare provider.
Moralis (Wallet and Blockchain Data)
On-chain data queries — including token balances, NFT ownership, and DeFi position data — are fulfilled in part through Moralis and other third-party blockchain data providers. Blockchain data is inherently public; queries are made against your wallet's public address. We do not control the availability, accuracy, or completeness of data returned by these providers.
Resend (Email Delivery)
Transactional emails sent by the Service, such as connection notifications and account alerts, are delivered via Resend. Your email address is shared with Resend solely for the purpose of delivering messages you have requested or that are necessary for account operation.
Cloudflare (Infrastructure)
The Service is built on Cloudflare Workers and Cloudflare D1. Cloudflare processes data as part of routine infrastructure operation, including routing, caching, and security filtering. Cloudflare may collect certain network-layer data such as IP addresses as a standard part of internet traffic management.
WalletConnect
WalletConnect is used to facilitate wallet connections from mobile wallets and browser extensions. Connection flows initiated via WalletConnect are subject to WalletConnect's own protocols and privacy practices.
Connected AI Applications
A central feature of Passport.Me is the ability to authorise AI assistants and tools (such as Claude, ChatGPT, Gemini, and Cursor) to receive live data from your connected sources through the MCP protocol ("AI Applications").
Your Authorisation
Each time you connect an AI Application, you are explicitly authorising that application to request and receive data from your Passport.Me account within the scopes you have approved. This authorisation is recorded and may be disconnected at any time through your account settings. Disconnecting an authorisation will invalidate the associated OAuth tokens and prevent further data sharing with that application.
Scope of Our Responsibility
Passport.Me acts as an authorised data relay. We are responsible for the secure storage of your credentials, the accurate relay of data within authorised scopes, and the integrity of the MCP transport mechanism. We are not responsible for:
- The behaviour, outputs, accuracy, or reliability of any AI Application you connect;
- How any AI Application uses, stores, or processes the data it receives from the Service;
- Any decisions made, actions taken, or content generated by an AI Application based on data it receives through Passport.Me;
- Any loss or harm resulting from an AI Application acting on data relayed by Passport.Me.
AI Application Terms
Your use of any AI Application is governed by that application's own terms of service, privacy policy, and acceptable use policy. You should review those terms before connecting any application to Passport.Me. We make no warranties or representations about any AI Application.
Wallet and Blockchain
Public Nature of Blockchain Data
Information associated with cryptocurrency wallet addresses — including transaction history, token balances, and NFT holdings — is inherently public and recorded on distributed ledgers accessible to anyone. By connecting a wallet address to Passport.Me, you acknowledge that the underlying on-chain data is already publicly available and that our queries against that address do not expose any data that was otherwise private.
No Custody
Passport.Me never takes custody of, or has any access to, your private keys, seed phrases, or cryptographic signing credentials. We cannot initiate transactions, move funds, or act on your behalf on any blockchain. Connecting a wallet to Passport.Me involves only reading your wallet's public address and verifying ownership through a signed message; it does not give us any control over your assets.
Not Financial Advice
Nothing on the Service, in data relayed through MCP, or in any AI Application output derived from your wallet data constitutes financial advice, investment advice, tax advice, or a recommendation to buy, sell, or hold any digital asset. You should consult a qualified financial adviser before making any investment decisions. Cryptocurrency and digital asset markets are volatile and highly speculative; values can fall to zero.
Market Data Accuracy
On-chain data and token valuations displayed through the Service are sourced from third-party providers and may be delayed, incomplete, or inaccurate. We make no warranty as to the accuracy or timeliness of any blockchain or market data.
Beta and Invite System
Passport.Me is currently in beta. Access to the Service is granted by invitation and is subject to availability. The following terms apply during the beta period:
Beta Access
Beta access may be obtained by receiving an invite code from an existing user or by meeting eligibility criteria for early access programs we operate, including holding qualifying amounts of the Measurable Data Token (MDT). We reserve the right to modify eligibility criteria, expand or contract access, or transition out of beta at any time.
Usage Metering and Credits
During beta, use of certain features is subject to usage metering. We may allocate usage credits to your account that are consumed as you use the Service. Credits have no monetary value, are not transferable, and may be modified, reset, or removed by us at any time. When your credits are exhausted, access to credit-gated features may be suspended until credits are refreshed or additional credits are granted.
No Guarantees During Beta
The Service is provided during beta on an as-is, as-available basis with no uptime guarantees. We may modify, deprecate, or discontinue features, change usage limits, or take the Service offline without prior notice. Beta users accept that they are using a pre-production service that may contain bugs, errors, or incomplete functionality.
Invite Codes
If you receive an invite code, it is for your personal use only. You may share invite codes with third parties in the manner permitted by the Service interface, but you may not sell, auction, or trade invite codes for money or other consideration. We reserve the right to invalidate invite codes at any time.
Intellectual Property
Our Intellectual Property
All intellectual property rights in the Service — including the software, source code, database schemas, API specifications, user interface designs, trademarks, wordmarks, logos, and documentation — are owned by or licensed to Passport.Me. Nothing in these Terms transfers any ownership of our intellectual property to you. You are granted a limited, non-exclusive, non-transferable, disconnectable licence to use the Service solely for the purposes described in these Terms and solely during the period your access remains active.
Your Data
You retain all ownership rights in your personal data — including your Google account content, your wallet data, and your demographic information. By connecting your data sources, you give us a limited, non-exclusive, worldwide licence covering processing, storage, transmission, and relay of your data as necessary for operating the Service and as described in our Privacy Policy. This licence terminates when you delete your account and all associated data has been purged in accordance with our data retention schedule.
Feedback
If you submit feedback, suggestions, or ideas about the Service, you give us a perpetual, irrevocable, royalty-free licence covering use and incorporation of that feedback without any obligation to compensate you or attribute the feedback to you.
Prohibited Uses
You agree not to engage in any of the following prohibited activities:
- Unauthorised scraping or harvesting. You may not use automated means to scrape, crawl, or harvest data from the Service or through its APIs in any manner not expressly permitted by these Terms.
- Reverse engineering. You may not decompile, disassemble, reverse engineer, or attempt to derive source code from the Service, except to the extent expressly permitted by applicable law.
- Circumventing controls. You may not attempt to bypass, disable, or defeat any security, access control, rate limiting, metering, or authentication mechanism of the Service.
- Misrepresentation. You may not impersonate any person or entity, falsely claim affiliation with any person or entity, or misrepresent the source or authorisation of a connection.
- Harmful or illegal content. You may not use the Service to generate, relay, or facilitate the transmission of content that is illegal, defamatory, harassing, fraudulent, or in violation of any applicable law.
- Interference. You may not upload or transmit malware, viruses, or other malicious code, or take any action that could overload, impair, or degrade the infrastructure or performance of the Service.
- Commercial resale without authorisation. You may not resell, sublicense, or commercially exploit access to the Service or any data received through it without our prior written authorisation.
- Sanctions evasion. You may not use the Service to evade economic sanctions or to transact with sanctioned persons, entities, or jurisdictions.
- Data aggregation for training. You may not use data received through the Service to train machine learning models or build competing products without our prior written consent.
Violation of these prohibitions may result in immediate termination of your access and, where appropriate, referral to law enforcement authorities.
Disclaimers
As-Is Provision
THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE" WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. TO THE FULLEST EXTENT PERMITTED BY APPLICABLE LAW, WE DISCLAIM ALL WARRANTIES, INCLUDING IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, TITLE, AND ANY WARRANTIES ARISING FROM COURSE OF DEALING OR USAGE OF TRADE.
No Guarantee of Availability
We do not warrant that the Service will be uninterrupted, timely, error-free, or free of viruses or other harmful components. We make no warranty that defects will be corrected or that the Service will meet your requirements.
Third-Party Services
We disclaim all warranties with respect to any third-party service, including Google APIs, blockchain data providers, AI Applications, and email delivery services. We are not responsible for the accuracy, completeness, or availability of data obtained from third-party services.
No Professional Advice
Nothing in or accessible through the Service constitutes financial advice, investment advice, legal advice, medical advice, or any other form of professional advice. You should seek qualified independent professional advice before making any decision based on information you receive through or in connection with the Service.
Data Accuracy
We do not warrant the accuracy, completeness, or timeliness of any data relayed through the Service, including on-chain data, Google account data, or demographic data. Data returned through MCP endpoints reflects the state of the underlying source at the time of the query and may be subject to delay, error, or omission.
Limitation of Liability
Exclusion of Consequential Damages
TO THE FULLEST EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT WILL MAGIC CRYSTAL LIMITED, ITS DIRECTORS, EMPLOYEES, CONTRACTORS, PARTNERS, OR LICENSORS BE LIABLE TO YOU FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES, INCLUDING LOSS OF PROFITS, LOSS OF DATA, LOSS OF GOODWILL, BUSINESS INTERRUPTION, LOSS OF DIGITAL ASSETS, OR COST OF SUBSTITUTE SERVICES, ARISING OUT OF OR IN CONNECTION WITH YOUR USE OF OR INABILITY TO USE THE SERVICE OR ANY CONTENT OBTAINED THROUGH THE SERVICE, REGARDLESS OF THE THEORY OF LIABILITY AND WHETHER OR NOT WE HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
Liability Cap
TO THE FULLEST EXTENT PERMITTED BY APPLICABLE LAW, OUR TOTAL AGGREGATE LIABILITY TO YOU FOR ALL CLAIMS ARISING OUT OF OR IN CONNECTION WITH THESE TERMS OR THE SERVICE, WHETHER IN CONTRACT, TORT, STATUTE, OR OTHERWISE, WILL NOT EXCEED THE GREATER OF: (A) THE TOTAL FEES PAID BY YOU TO US IN THE TWELVE (12) MONTHS PRECEDING THE EVENT GIVING RISE TO LIABILITY, OR (B) ONE HUNDRED HONG KONG DOLLARS (HKD 100).
Essential Basis
The limitations and exclusions in this section reflect a fair allocation of risk between you and us and form an essential basis of the bargain between us. These limitations apply even if any limited remedy fails of its essential purpose.
Jurisdiction Carve-outs
Some jurisdictions do not allow the exclusion of certain warranties or limitation of liability for certain types of damages. In those jurisdictions, our liability is limited to the maximum extent permitted by law. Nothing in these Terms excludes liability for death or personal injury caused by our negligence, fraud, fraudulent misrepresentation, or any other liability that cannot be excluded or limited under applicable law.
Indemnification
You agree to indemnify, defend, and hold harmless Passport.Me and its officers, directors, employees, contractors, agents, and successors from and against any and all claims, liabilities, damages, losses, costs, and expenses (including reasonable legal fees) arising out of or in connection with:
- Your use of the Service in violation of these Terms;
- Your violation of any applicable law or regulation;
- Your infringement of any third-party intellectual property, privacy, or proprietary right;
- Any data or content you transmit through or in connection with the Service;
- Your misrepresentation of any information provided in connection with the Service; or
- Any third-party claim arising from your use of an AI Application that received data through Passport.Me.
We reserve the right to assume the exclusive defence and control of any matter subject to indemnification by you, in which case you agree to cooperate with us in asserting any available defences at your expense.
Termination
Termination by Us
We may suspend or terminate your access to the Service, with or without notice, if we reasonably believe you have violated these Terms, applicable law, or if suspension or termination is necessary to protect the integrity of the Service or other users. In the event of termination for cause, any outstanding obligations you owe us will survive termination.
We may also discontinue the Service or any feature thereof at any time, with reasonable notice where practicable, including by posting notice on the Service website.
Termination by You
You may stop using the Service at any time. To permanently delete your account and associated data, use the account deletion functionality available in your account settings or contact us at privacy@passport.me. Deletion requests are processed subject to the terms described in Section 16 below.
Effect of Termination
Upon termination: your right to access the Service immediately ceases; any OAuth tokens issued to AI Applications in your name are invalidated; and we will process deletion of your data in accordance with our data retention policy. Sections that by their nature should survive termination — including disclaimers, limitations of liability, indemnification, arbitration, and governing law — will continue to apply after termination.
Data Deletion
We are committed to honouring your right to delete your personal data. Details of how we collect, retain, and delete personal data are set out in our Privacy Policy.
When you request account deletion:
- Your Passport.Me session and authentication records will be invalidated immediately;
- Encrypted Google OAuth tokens will be deleted from our database;
- Connected AI Application authorisations and associated OAuth tokens will be disconnected;
- Your demographic data, connection records, and usage history will be queued for deletion and purged within 30 days, subject to any legal retention obligations; and
- Residual data in encrypted backups will be purged on the next backup rotation cycle.
Certain records may be retained beyond your deletion request where we are required to do so by applicable law, regulation, or court order, or where retention is necessary to resolve an outstanding dispute or enforce our legal rights.
Deleting your Passport.Me account does not delete your Google account, your crypto wallets, or data held by AI Applications you have connected. You must manage those independently.
Governing Law
These Terms and any dispute, claim, or controversy arising out of or in connection with them — including any question regarding their existence, validity, or termination — are governed by and construed in accordance with the laws of the Hong Kong Special Administrative Region, without regard to its conflict of law principles.
This choice of governing law does not override any mandatory consumer protections or statutory rights that apply to you under the laws of your jurisdiction and that cannot be contractually disapplied. Where mandatory local laws provide greater protections, those protections continue to apply.
Dispute Resolution and Arbitration
Informal Resolution First
We want to resolve disputes quickly and fairly. Before initiating any formal proceeding, you agree to contact us at privacy@passport.me to describe the nature of your dispute and the relief you seek. We will attempt to resolve the dispute informally within 30 days. If we cannot reach a resolution in that period, either party may proceed to arbitration as described below.
Binding Arbitration
Except as set out in the Small Claims exception below, any dispute, controversy, or claim arising out of or in connection with these Terms or the Service, or the breach, termination, or invalidity thereof, shall be referred to and finally resolved by arbitration administered by the Hong Kong International Arbitration Centre ("HKIAC") in accordance with the HKIAC Administered Arbitration Rules in force at the time the dispute is submitted. The number of arbitrators shall be one. The seat of arbitration shall be Hong Kong. The language of arbitration shall be English. The arbitrator's award shall be final and binding on the parties and may be enforced in any court of competent jurisdiction.
No Class Actions
ALL DISPUTES MUST BE BROUGHT IN YOUR INDIVIDUAL CAPACITY AND NOT AS A PLAINTIFF OR CLASS MEMBER IN ANY PURPORTED CLASS, COLLECTIVE, REPRESENTATIVE, OR CONSOLIDATED ACTION OR PROCEEDING. The arbitrator may not consolidate more than one person's claims and may not otherwise preside over any form of a representative or class proceeding. You waive any right to have any dispute heard as a class or representative action. If this class action waiver is found unenforceable in a particular jurisdiction, that dispute shall be resolved by a court of competent jurisdiction in Hong Kong, and the remainder of the arbitration agreement shall remain in full force and effect.
Small Claims Exception
Either party may bring an individual claim in a small claims court of competent jurisdiction, provided the claim qualifies for and remains in small claims court. This exception applies only to claims that remain in small claims court and does not permit class action proceedings.
Injunctive Relief
Notwithstanding the foregoing, either party may seek emergency injunctive or other equitable relief in a court of competent jurisdiction in Hong Kong to prevent actual or threatened infringement, misappropriation, or violation of a party's intellectual property rights or confidentiality obligations, or to address a threat to the security or integrity of the Service. Such an application does not waive the right to arbitrate the underlying dispute.
General Provisions
Severability
If any provision of these Terms is found to be invalid, illegal, or unenforceable under applicable law, that provision will be modified to the minimum extent necessary to make it enforceable, or if modification is not possible, will be severed. The remaining provisions of these Terms will continue in full force and effect.
Waiver
Our failure to enforce any right or provision of these Terms will not constitute a waiver of that right or provision. A waiver of any specific breach does not constitute a waiver of any subsequent breach of the same or any other provision.
Entire Agreement
These Terms, together with our Privacy Policy and any other policies or notices we publish on the Service, constitute the entire agreement between you and us with respect to your use of the Service and supersede all prior and contemporaneous agreements, representations, and understandings, whether written or oral, relating to the same subject matter.
Assignment
You may not assign or transfer any of your rights or obligations under these Terms without our prior written consent. We may assign our rights and obligations under these Terms, in whole or in part, to any affiliate, successor entity, or acquirer in connection with a merger, acquisition, or sale of all or substantially all of our assets, without your consent. Any purported assignment in violation of this section is void.
Force Majeure
Neither party will be liable for any failure or delay in performance caused by circumstances beyond that party's reasonable control, including acts of God, natural disasters, war, terrorism, civil unrest, government action, internet disruption, or failure of third-party services.
No Partnership or Agency
Nothing in these Terms creates or implies any partnership, joint venture, agency, franchise, or employment relationship between you and us.
Language
These Terms are written in English. If they are translated into another language, the English version shall prevail in the event of any conflict or inconsistency.
Changes to These Terms
We may update these Terms from time to time to reflect changes in law, changes in the Service, or for other legitimate business reasons. When we make material changes, we will:
- Update the Effective Date at the top of this page;
- Post the revised Terms on this page; and
- Where practicable, provide notice through the Service interface or by email to the address associated with your account.
Your continued use of the Service after any revised Terms become effective constitutes your acceptance of those revised Terms. If you do not agree to any revised Terms, you must stop using the Service before the effective date of the revision.
For changes that we consider material, we will endeavour to provide at least 14 days' advance notice before the changes take effect. For changes required to comply with applicable law or to address security issues, we may need to implement changes immediately without advance notice.
Jurisdiction-Specific Rights
The following provisions supplement these Terms for users in specific jurisdictions. In the event of a conflict between these supplemental provisions and the body of these Terms, the supplemental provisions prevail for users in the relevant jurisdiction, but only to the extent required by applicable mandatory law.
If you are located in the EU or EEA, your use of the Service and the processing of your personal data is subject to the General Data Protection Regulation (GDPR). Nothing in these Terms limits or overrides any rights you have under the GDPR, including:
- The right of access to your personal data (Article 15);
- The right to rectification of inaccurate data (Article 16);
- The right to erasure ("right to be forgotten") (Article 17);
- The right to restriction of processing (Article 18);
- The right to data portability (Article 20);
- The right to object to processing (Article 21);
- Rights related to automated individual decision-making (Article 22).
To exercise any of these rights, contact us at privacy@passport.me. You also have the right to lodge a complaint with the supervisory authority in your Member State.
The arbitration clause in Section 18 does not affect your right to bring a claim before a competent supervisory authority or a court in your Member State for non-waivable consumer claims under EU law.
If you are located in the United Kingdom, your personal data is processed in accordance with the UK GDPR and the Data Protection Act 2018. You have the same data subject rights as described above for EU users, enforceable under UK law. You may lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.
Nothing in these Terms affects your non-waivable statutory consumer rights under English law. The jurisdiction clause and arbitration clause apply to the extent permitted by applicable UK law, subject to any mandatory protections you have as a consumer.
If you are located in Brazil, the processing of your personal data is subject to the Lei Geral de Proteção de Dados (LGPD). You have rights under the LGPD, including the right to confirmation of processing, access, correction, anonymisation, portability, deletion, and information about sharing. You may exercise these rights by contacting us at privacy@passport.me.
You may also file a complaint with the Autoridade Nacional de Proteção de Dados (ANPD). Nothing in these Terms waives any non-waivable rights you have under the LGPD or Brazilian consumer protection law.
If you are a California resident, you may have additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), including:
- The right to know what personal information we collect, use, share, or sell;
- The right to delete your personal information, subject to certain exceptions;
- The right to opt out of the sale or sharing of your personal information (we do not sell personal information);
- The right to correct inaccurate personal information; and
- The right to non-discrimination for exercising your privacy rights.
To exercise these rights, contact us at privacy@passport.me. We will respond within 45 days of a verifiable consumer request. The class action waiver in Section 18 does not apply to CCPA-specific claims to the extent California law prohibits such a waiver.
If you are located in Singapore, your personal data is processed in accordance with the Personal Data Protection Act 2012 (PDPA). You have the right to access and correct your personal data held by us, and to withdraw consent to the collection, use, or disclosure of your personal data (subject to legal and contractual restrictions). To exercise these rights, contact us at privacy@passport.me.
You may also file a complaint with the Personal Data Protection Commission of Singapore (PDPC).
If you are located in Hong Kong, your personal data is processed in accordance with the Personal Data (Privacy) Ordinance (PDPO, Cap. 486). You have the right to:
- Request access to your personal data (Sections 18–19) — we will respond within 40 calendar days;
- Request correction of inaccurate personal data (Sections 22–24);
- Opt out of direct marketing at any time without charge (Section 35C) — we will cease using your data for marketing within 10 business days.
To exercise these rights, contact us at privacy@passport.me. You may also file a complaint with the Office of the Privacy Commissioner for Personal Data (PCPD) at pcpd.org.hk.
If you are located in Australia, you have rights under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Nothing in these Terms excludes, restricts, or modifies any right or remedy you have under the Australian Consumer Law or any other non-excludable provision of Australian law, including any guarantee implied by the Competition and Consumer Act 2010 (Cth). Our liability for a breach of any such non-excludable guarantee is limited, to the maximum extent permitted by law, to the resupply of the services or the cost of having the services supplied again. You may contact the Office of the Australian Information Commissioner (OAIC) to make a privacy complaint.
Contact
If you have any questions, concerns, or requests regarding these Terms, please contact us:
Passport.Me (Magic Crystal Limited)
28 Wellington St
Central, Hong Kong
Email: privacy@passport.me
We aim to respond to all inquiries within five business days. For data subject rights requests, we are required by applicable law to respond within the applicable statutory period (typically 30 days for GDPR requests, 40 days for PDPO requests, and 45 days for CCPA requests).