Zashi-Flexa Integration is Here: Spend ZEC at Thousands of Retailers!

[peacemonger]

To say that we are thrilled about this new release would be an understatement. It. Is. Happening. The Zashi-Flexa integration is here! This powerful update allows Zashi users to seamlessly spend their ZEC at thousands of retail locations that accept Flexa as a payment option.

What Is Flexa and Why Is This Important?

Flexa’s groundbreaking payments network enables secure, fraud-proof cryptocurrency transactions at thousands of merchants in the US, Canada, and El Salvador, with new locations and merchants in the works. Like Zashi, Flexa is deeply committed to user privacy. While Flexa is required to ask for some identifying information in order to bridge the gap between cryptocurrencies and traditional systems, it never collects or stores more than is absolutely required by law, never shares it with third parties, and deletes it as soon as legally allowed. This shared commitment to user privacy makes Flexa the perfect partner for Zashi, aligning with our own principles where we strive to know close to nothing about Zashi users and their wallet activity and protect them from any metadata leakage at every turn.

This integration marks a significant milestone for Zcash, bridging the gap between digital currency and real-world usability. It empowers ZEC holders to not only store and spend their shielded ZEC but also spend it easily in their daily lives. With this integration, Zashi users can now use their ZEC to pay for everyday purchases, from coffee and groceries to clothes and kitchen appliances—all while minimizing the risks to their privacy and security associated with traditional forms of payment.

How It Works:

Follow these steps to make your first purchase with Flexa:

1. Make sure there’s ZEC in your Zashi wallet. In the U.S., if you’re new to Zcash and prefer not to register with a crypto exchange, you can use Zashi’s Coinbase integration to purchase ZEC directly within Zashi using your debit card. All you need is a U.S. debit card, a U.S. phone number, and just a few minutes.
2. Inside Zashi, click the hamburger icon to navigate to Settings, and then choose Integrations.
3. Open Flexa and go through a quick registration process.
4. Choose the merchant you want to pay.
5. Generate a payment code in the app and scan it at checkout. (Note: sometimes the QR code must be scanned by the cashier as a gift card.)
6. Your shielded ZEC will be instantly sent and processed through Flexa’s payment network.
7. The merchant receives your payment in their chosen currency. All they know is that the payment is complete—they won’t know anything about you, not even the currency you used.

It’s that easy! Fast, smooth, private transactions using the most reliable privacy coin out there. Magic.

Why We’re Excited:

Zashi’s mission is to make Zcash as usable as possible while maintaining the privacy and security that Zcash is famous for. With this Flexa integration, we’re unlocking an entirely new use case for ZEC, turning it into a true form of digital cash that can be spent wherever Flexa is accepted. “For the first time in history, instant payments with shielded ZEC are available at thousands of retail locations,” said ECC’s CEO @joshs. “This is an epic, long-awaited milestone for Zcash. Zashi empowers users to make private, secure payments effortlessly through Flexa, bringing us closer to a world where true financial privacy is standard.”

Get Started Today:

Make sure your Zashi wallet is updated to the latest version to start paying with Flexa. The app is available on App Store and Google Play.

Try it out at one of the many Flexa locations and let us know what you think. We genuinely can’t wait to see how you use this new feature in your daily lives! In the absence of user analytics to protect your data, we rely on your feedback in improving Zashi and shaping the future Zcash. And if you love it, help us show it off. So, share your experiences and don’t forget to tag us!

Here’s to making Zcash more accessible and usable for everyone, everywhere! Here’s to Zashi-Flexa!

Happy transacting.

[emersonian]

Congratulations on the release.

Can Flexa host an AMA thread to help build trust here? I expect people to want some clarifications.

Off of the top of my head:

“The merchant receives your payment in their chosen currency”

Is shielded ZEC a possible payout currency, or do they focus on fiat settlement?

“At Flexa, we believe in preserving your privacy to the greatest extent possible, which is why we encrypt all of your personal information as it is transmitted to our servers, and only retain that information for the minimum duration as required by the law.”

Exactly for how long does Flexa consider “the minimum duration as required by the law” to be? Are they only referring to USA laws? Does the retention period differ for USA citizens verses global users? Flexa logs IP addresses, right? Do they allow users to sign up and use their service while on Tor or on a VPN, or do they block or flag these users in some way?

Does the encryption of personal information go beyond standard TLS? How many times has Flexa deleted someone’s personal information due to this retention period expiring, and what technologies are they using to ensure that this actually happens?

I presume that Flexa files SARs (suspicious activity reports) as a registered money services business. Do they report SARs in their public transparency report? Will they publish their policy of what designates “suspicious activity” on their platform?

Interesting references:

Why does Flexa need my personal information? | Flexa Support

Transparency report - Flexa — New tools for commerce

[trev]

Hey @emersonian, I’m Trevor, one of the cofounders of Flexa. I’d love to try and answer some of these (very thoughtful, thank you) questions.

As far as hosting an AMA goes, we definitely have plans along these lines and I would like to defer to the ECC team to announce those when ready.

Other clarifications below…

“The merchant receives your payment in their chosen currency”

Is shielded ZEC a possible payout currency, or do they focus on fiat settlement?

Yes, merchants who accept payments via Flexa can elect to be paid in either fiat or digital assets, including shielded ZEC. We don’t currently support direct payments (i.e., customer-to-merchant) because we batch payments for settlement, but shielding is supported on both sides.

“At Flexa, we believe in preserving your privacy to the greatest extent possible, which is why we encrypt all of your personal information as it is transmitted to our servers, and only retain that information for the minimum duration as required by the law.”

Exactly for how long does Flexa consider “the minimum duration as required by the law” to be? Are they only referring to USA laws? Does the retention period differ for USA citizens verses global users? Flexa logs IP addresses, right? Do they allow users to sign up and use their service while on Tor or on a VPN, or do they block or flag these users in some way?

The required duration varies based on jurisdiction. In the US, we are required to retain certain information you provide to us for at least five (5) years, while other jurisdictions require us to retain certain records for longer or shorter periods.

In the US, 31 CFR section 1010.430—which I would encourage searching for, since I can’t post links—describes the duration and information that any US bank or money services business (including any exchange that sells ZEC in the US) must record and retain about you when you use their platforms to transmit money.

Given the broad scope of the law here, our general approach at Flexa has been to drastically limit the information we collect to the extent that our team thinks is viable, and then attempt to be as transparent about that as possible. For example, we do not log IP addresses, and we do not block Tor or VPNs. (We do use Cloudflare, who enable us to estimate a customer’s jurisdiction based on the administrative area–level regions that we ask them to append to incoming API requests.)

I think it’s worth noting that the payments industry in the US is incredibly well regulated—as compared with, say, the crypto industry—and that any payment provider transmitting ZEC for payments at any reasonable scale without collecting some degree of personal information is operating illegally. Flexa is explicitly not working to enable end-to-end anonymous payments at large retailers (which would be, in my opinion, putting those retailers in a very precarious position); we have, however, set out to build the most privacy-preserving payment system that can operate and scale within the bounds of the applicable laws of any country.

And we think digital assets are absolutely essential to that end. The rise of credit in the modern world has been incredibly erosive to personal privacy, and our end game here is really to build a system that can completely supplant credit and debit cards. As it turns out, digital assets are very effective at proving someone has good funds for a purchase, so we don’t need to collect a bunch of useless personal information (like billing addresses, for example). But of course, using Flexa to make payments is totally optional for users of the Zashi app and any other app that integrates our SDK.

Does the encryption of personal information go beyond standard TLS? How many times has Flexa deleted someone’s personal information due to this retention period expiring, and what technologies are they using to ensure that this actually happens?

Yes, all of the customer information we collect is encrypted in transit over TLS 1.2+ (preferring TLS 1.3) and at rest using AES-256. This data is maintained in databases separate from other transactional information, which are only accessible to members of our team on a need-to-know basis. We have deleted customer information upon recordkeeping requirements expiring 100% of the times those durations have elapsed, and we use custom alerting to ensure that this happens consistently.

I presume that Flexa files SARs (suspicious activity reports) as a registered money services business. Do they report SARs in their public transparency report? Will they publish their policy of what designates “suspicious activity” on their platform?

We do file SARs, but no, we do not report any data about the individual SARs we report (because that would be illegal). As far as publishing a stance on “suspicious activity,” I think that’s a really interesting idea and would love to explore what our Legal and Compliance teams think we can reasonably do here.

---

Anyway, I hope this provides some better context for understanding our perspective on payments and privacy. Thanks again for the thoughtful prompts!

[emersonian]

Thank you for signing on to answer the questions so quickly and thoughtfully, your response in itself is a great sign.

Your team rocks for allowing shielded pay-outs! Also for allowing Tor and VPN users to use your service. So many compliance programs make no sense and indicate a deep lack of technical understanding.

I’m excited to try out Flexa and will continue to share feedback once I have a better feel for it. Welcome to the community!

[peacemonger]

What. A. Day.

[joshs]

A peak behind the curtain in the ECC/Flexa slack channel.

[trev]

Absolutely! We’re longtime fans of Zcash and definitely want to make sure we do right by the team and community.

So many compliance programs make no sense and indicate a deep lack of technical understanding.

Could not agree more. We always try to dig deep into the regulations to understand why certain compliance practices exist, and often times these onerous policies are just in place due to convenience or because the data is already there. We don’t think that’s right. It often feels like tearing down to the studs and pouring a new foundation, but, hey, no one said it would be easy…

Excited to hear your feedback about Flexa. Thanks again for the questions!

[hanh]

Do you guys have a public API for wallet devs? I remember there was a series of grants for integration (Nighthawk was one of them), but then it didn’t materialize.
Also, a year ago I signed up for the dev preview but also didn’t hear back from your team.
Could you clarify what the situation is nowadays?
Thanks

[Shawn]

Zashi

[jelly5649]

I am quite a bit cautious about payment systems that require disclosing my legal name, but this looks at least worth paying attention to.

Is it correct that Flexa-ZEC is available in El Salvador? Has anyone tried it over there? Can you actually pay for most daily expenses?