Privacy Policy

This Privacy Policy explains how we collect, use, disclose, and safeguard personal information in connection with the website, application, and digital-asset custody services described on this site (collectively, the "Services"). It applies to visitors to our marketing pages and to registered account holders alike, though the categories of data we hold about each differ, as described below.

This Policy is incorporated by reference into, and should be read together with, our Terms of Service. Capitalized terms not defined in this Policy have the meaning given to them in the Terms of Service.

By using the Services, you acknowledge that you have read and understood this Policy. If you do not agree with how we describe our practices here, you should not use the Services.

[Operator to complete: the full legal name, registered address, and company registration number of the entity acting as data controller (or, under some frameworks, "business") for the personal information described in this Policy.] Until this section is completed, contact us using the details in Section 41 for the current, accurate identity of the operating entity.

Where we act as a data processor on behalf of another party (for example, in a future institutional or white-label arrangement), a separate data processing agreement will govern that specific relationship, and this Policy describes our practices as a controller with respect to our own account holders.

"Personal information" (used interchangeably with "personal data") means information that identifies, relates to, describes, or could reasonably be linked, directly or indirectly, with a particular individual.

"Processing" means any operation performed on personal information, including collection, storage, use, disclosure, and deletion.

"Controller" means the entity that determines the purposes and means of processing personal information; "processor" means an entity that processes personal information on a controller's behalf and under its instructions.

"Service provider" or "processor" (used in this Policy for any third party that processes data on our behalf, such as infrastructure hosting) is contractually restricted to using that data only to provide the contracted service, not for its own independent purposes.

"De-identified" or "aggregated" data means data that has been processed so that it can no longer reasonably be used to identify a particular individual; this Policy's obligations generally do not apply to data in that state.

This section is educational context, not a legal opinion about which of these laws applies to you specifically — that depends on where you live and is addressed section by section below. It's here so the more technical sections that follow make sense on first read.

The EU General Data Protection Regulation (GDPR) and its UK equivalent (UK GDPR) are comprehensive privacy frameworks that apply to organizations processing the personal data of individuals in the EU/UK, regardless of where the organization itself is based. They require a documented legal basis for every processing activity, grant a broad set of individual rights (Section 16), and empower an independent supervisory authority in each member state to investigate complaints and impose penalties.

The California Consumer Privacy Act (CCPA), as substantially expanded by the California Privacy Rights Act (CPRA), gives California residents rights to know, delete, correct, and limit the use of their personal information, and creates a dedicated enforcement agency (the California Privacy Protection Agency) alongside the state Attorney General.

A growing number of other U.S. states — including, as of this writing, Virginia, Colorado, Connecticut, Utah, and others — have enacted comprehensive privacy statutes broadly similar in structure to the CCPA, generally granting residents rights of access, correction, deletion, and opt-out of targeted advertising or profiling, enforced by the state Attorney General.

The Gramm-Leach-Bliley Act (GLBA) is a U.S. federal law specific to financial institutions, requiring a privacy notice describing what nonpublic personal information is collected and shared, and, where the institution shares information in ways the Act covers, a mechanism for consumers to opt out.

Financial Action Task Force (FATF) Recommendation 16, commonly called the "Travel Rule," is not itself a privacy law but a global anti-money-laundering standard requiring virtual-asset service providers to collect and, in qualifying transactions, transmit originator and beneficiary information — creating a specific, narrow category of information-sharing that exists for compliance reasons rather than a general data-sharing practice, described further in our Terms of Service.

Account information: when you register, we collect the email address and password you provide. Your password is never stored in plain text — it is hashed using argon2id, a memory-hard hashing algorithm, before it touches our database, meaning we ourselves cannot recover your original password.

Identity verification information: where identity verification is required (see our Terms of Service, Section 6), we may collect government-issued identification, proof-of-address documentation, date of birth, and, where applicable, source-of-funds or source-of-wealth information, either directly from you or from a third-party verification provider acting on our behalf.

Transaction and ledger data: records of your deposits, withdrawal requests, and balances across the available, pending, and locked states, together with associated metadata such as the destination address you specify for a withdrawal and the timestamp of each event. This data is the operative record of your custodial relationship with us and is retained as described in Section 12.

Session and device information: when you sign in, we create a session record containing a randomly-generated session identifier and the user-agent string your browser sends (which describes your browser and operating system in general terms, such as "Chrome on macOS"). We do not log your IP address as part of this session record; the architecture of this deployment means our application layer only ever observes the IP address of an upstream proxy, not your browser's real IP address, so no attempt is made to store or display an IP-derived location for your sessions.

Communications: if you contact our support channels, we retain the content of that communication and any information you volunteer within it in order to respond to you and to maintain a record of the interaction.

Support context: when you send a message in authenticated support chat, we associate it with your account, current session reference, and browser user-agent. Where our web proxy is configured to verify edge data, we also record the public IP address and country reported by our hosting provider for that message; IP-based country can be inaccurate, and this is not GPS location. Earlier versions of the chat offered optional location and device-context sharing; previously shared entries may remain in account activity. We do not silently create a persistent hardware or browser fingerprint for support.

Technical and log data: our infrastructure automatically generates operational logs (for example, which API endpoint was called and its response status) for security monitoring and debugging. These logs are not used to build an advertising or tracking profile of you.

Directly from you: information you provide when you register, complete identity verification, initiate a deposit or withdrawal, or contact support.

Automatically: session and technical data generated as a byproduct of your use of the Services, as described in Section 5.

From third parties: where applicable, from an identity-verification provider engaged to confirm your identity, from blockchain networks themselves (which are public and from which we observe your deposit transactions), and, where legally required, from sanctions and PEP screening providers.

Where data-protection law requires us to identify a legal basis for processing (for example, under the EU/UK GDPR), we rely on one or more of the following, depending on the specific processing activity: performance of a contract with you (to open and operate your account and provide the Services you request); compliance with a legal obligation (for example, AML/KYC record-keeping and sanctions screening); our legitimate interests, balanced against your rights (for example, securing our systems against fraud and abuse); and, where none of the above applies, your consent (for example, for optional marketing communications, which you can withdraw at any time).

To provide the Services: creating and maintaining your account, generating deposit addresses, recording ledger entries, and processing withdrawal requests.

To secure your account: authenticating sign-ins, detecting and responding to suspicious activity, and enabling the session-management features described in Section 5 (letting you see and revoke individual sign-in sessions).

To meet legal and compliance obligations: identity verification, sanctions and PEP screening, transaction monitoring, and record-keeping required by applicable AML/CTF law, as described further in our Terms of Service.

To communicate with you: sending service-related notices (security alerts, changes to these policies, transaction confirmations) and, where you have not opted out, optional product updates.

To maintain and improve the Services: diagnosing technical issues, understanding aggregate (non-identifying) usage patterns, and prioritizing engineering work.

We do not sell personal information to third parties, and we do not use your account or transaction data to serve you targeted third-party advertising — there is no advertising technology integrated into the Services.

We use exactly one cookie for a purpose beyond your immediate page request: a session cookie (named `session` for client accounts, or `admin_session` for administrative accounts) that authenticates you after you sign in. This cookie is httpOnly (not readable by JavaScript running on the page, which reduces its exposure to cross-site-scripting attacks), scoped to our own domain, and expires automatically after a period of inactivity.

We do not use analytics cookies, advertising cookies, or third-party tracking pixels. There is no cookie-consent-management platform on this site because there is nothing beyond the single essential cookie described above to manage consent for; the cookie notice you may see when you first visit exists to tell you this plainly, not to collect a granular consent record for categories of tracking that don't exist here.

Your browser's local storage may be used by the Services for genuinely local, non-tracking purposes, such as remembering a UI preference (for example, whether you've dismissed the cookie notice) on your own device. This data is not transmitted to us and is not a tracking mechanism.

If our practices change to include analytics or advertising technology in the future, we will update this Policy and the cookie notice before doing so, and we will not backdate that change to cover data already collected under this version of the Policy.

Service providers: we share information with third-party providers who perform functions on our behalf, such as hosting our infrastructure, sending transactional email, and (where applicable) verifying your identity. These providers are contractually restricted to using your information only to provide the contracted service.

Legal and regulatory disclosure: we may disclose information where required by law, in response to a valid legal process (such as a subpoena or court order), to a regulator with jurisdiction over us, or where we believe in good faith that disclosure is necessary to prevent fraud, protect the safety of any person, or protect our rights.

Corporate transactions: if we are involved in a merger, acquisition, financing, or sale of assets, personal information may be transferred as part of that transaction. We will require any successor to honor the commitments in this Policy with respect to previously-collected information, or will provide notice of any material change.

With your direction: where you explicitly direct us to share information with a third party (for example, a Travel-Rule-compliant beneficiary institution for a qualifying withdrawal, as described in our Terms of Service).

We do not share your personal information with third parties for their own independent marketing purposes.

Depending on where our infrastructure and service providers are located, your information may be processed in a country other than the one in which you reside, which may have data-protection laws different from those of your home jurisdiction. Where required by applicable law, we use appropriate safeguards for such transfers — for example, standard contractual clauses approved by the relevant authority — and [Operator to complete: identify the specific jurisdictions in which personal data is processed and the specific transfer mechanism relied upon, once infrastructure and vendor selection is finalized].

We retain personal information for as long as necessary to provide the Services to you, plus any additional period required by applicable law, whichever is longer. In practice, this generally means: account and transaction records are retained for the life of your account and for a period after closure required by AML/CTF record-keeping obligations, which in many jurisdictions extends several years beyond account closure; identity-verification records are retained on the same schedule as the compliance obligation that required their collection; and support communications are retained for a reasonable period to maintain continuity of service and to resolve any follow-up questions.

When information is no longer needed and no legal retention obligation applies, we delete it or render it non-identifying, using processes appropriate to the storage medium involved.

Passwords are hashed with argon2id, not stored or logged in plain text at any point in our systems. We cannot see or recover your original password; a forgotten password can only be reset, not retrieved.

Sensitive material at rest — including the cryptographic key material underlying per-client deposit-address derivation — is protected with AES-256-GCM authenticated envelope encryption, with the encryption key managed separately from the encrypted data.

Sessions are individually tracked in a database, not just as an unrevocable signed token — this is what lets you see every device currently signed in to your account from the security centre and revoke any one of them individually, including revoking every session but your current one in a single action if you ever suspect compromise.

All traffic between your browser and our servers is encrypted in transit using TLS. Administrative access to production systems is limited to personnel who need it to perform their role, and sensitive actions (such as releasing a withdrawal) require a second person's review before they take effect.

No security measure is perfect, and we cannot guarantee absolute security. If we become aware of a breach affecting your personal information, we will notify you and the relevant authorities as required by applicable law — see Section 28.

This section gives a more concrete picture of Section 12's general retention principle, broken down by the categories of information described in Section 5. Specific periods can vary based on the applicable law in your jurisdiction and on an active legal process (such as a litigation hold), which can extend any of the periods below.

Account credentials (hashed password, email address): retained for the life of your account, and for a limited administrative period after closure to handle any post-closure dispute or regulatory inquiry, after which they are deleted.

Identity-verification records: retained for the period required by applicable AML/CTF record-keeping law, which in many jurisdictions is measured in years from the date your account is closed, not from the date the record was created — meaning the retention clock does not start until your relationship with us ends.

Transaction and ledger records: retained on the same schedule as identity-verification records, since the two are used together to demonstrate compliance with our AML/CTF obligations, and because the ledger is the operative record of your custodial relationship with us.

Session records: active session metadata is retained for as long as the session remains valid, plus a limited period afterward for security-investigation purposes, then deleted or aggregated into non-identifying security metrics.

Support communications: retained for a reasonable period after the interaction is resolved, to maintain continuity if you follow up, then deleted or archived in a form that limits ongoing access.

Marketing preferences (such as an opt-out record): retained indefinitely, specifically so that your opt-out choice itself is not lost and inadvertently reversed.

Infrastructure and hosting providers: the companies whose servers and networks run the Services, who process personal information only as necessary to host and operate the platform, under contractual confidentiality and security obligations.

Identity-verification providers: where identity verification applies to your account, a specialist third party that receives the documents and information necessary to perform that verification and returns a result to us; we do not share more information with such a provider than is necessary for that specific check.

Professional advisors: our lawyers, auditors, and accountants may access personal information as necessary to provide advice or to complete a professional engagement, under professional confidentiality obligations.

Law enforcement and regulators: as described in Section 10, where required by valid legal process or by a regulator with jurisdiction over us.

We maintain an internal record of the categories of service providers we use and periodically review that list to remove providers that are no longer engaged.

Depending on your jurisdiction, you may have some or all of the following rights with respect to your personal information: the right to know what personal information we hold about you and how it is used; the right to request a copy of your personal information in a portable format; the right to request correction of inaccurate personal information; the right to request deletion of your personal information, subject to our legal retention obligations described in Section 11; the right to object to, or request that we restrict, certain processing; and the right to withdraw consent, where processing is based on consent, without affecting the lawfulness of processing before withdrawal.

To exercise any of these rights, contact us using the details in Section 41. We will verify your identity before acting on a request (to prevent someone else from exercising rights over your data), and we will respond within the time period required by applicable law. We will not charge a fee for a reasonable request, though we may charge a reasonable fee, or decline, for a request that is manifestly unfounded, excessive, or repetitive, to the extent applicable law permits.

Some rights are not absolute. For example, a deletion request cannot override our legal obligation to retain AML/CTF records for the period required by law; in that case, we will explain the specific legal basis for retaining the specific information you asked us to delete.

If you are located in the European Economic Area or the United Kingdom, the EU General Data Protection Regulation or the UK GDPR (as applicable) gives you the rights described in Section 16, plus the right to lodge a complaint with your local data-protection supervisory authority if you believe our processing of your personal information violates applicable law — though we would appreciate the opportunity to address your concern directly first, using the contact details in Section 26.

[Operator to complete: if required because the Company is established outside the EU/UK but offers services to individuals there, identify the Company's appointed EU representative under Article 27 GDPR and/or UK representative, and their contact details.]

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act, gives you the right to know what personal information we have collected about you and for what purpose, the right to delete personal information we hold about you (subject to certain exceptions, including our legal retention obligations), the right to correct inaccurate personal information, the right to opt out of the sale or sharing of personal information (we do not sell or share personal information as those terms are defined by the CCPA), and the right to limit the use of sensitive personal information to purposes necessary to provide the Services.

We will not discriminate against you for exercising any of these rights. You may designate an authorized agent to make a request on your behalf, subject to our ability to verify that authorization.

In the twelve months preceding the "last updated" date of this Policy, the categories of personal information we have collected are those described in Section 5, collected for the business purposes described in Section 8, and disclosed to the categories of recipients described in Section 10 — we have not sold or shared (as those terms are defined by the CCPA) any personal information.

A number of other U.S. states have enacted comprehensive privacy laws broadly similar in structure to the CCPA (for example, Virginia's Consumer Data Protection Act, Colorado's Privacy Act, Connecticut's Data Privacy Act, and Utah's Consumer Privacy Act, among others as they take effect). If you are a resident of a state with such a law in effect, you have the rights that law grants you, which generally track the rights described in Section 13, and you may exercise them using the contact details in Section 26.

We use automated and semi-automated processes to support fraud detection, sanctions and PEP screening, and transaction-risk assessment (for example, flagging a withdrawal for closer human review based on its size or pattern relative to your account history). These processes inform, but do not by themselves finally determine, decisions that significantly affect you — a flagged withdrawal is reviewed by a person before it is completed or cancelled, consistent with our Terms of Service.

Where applicable law gives you a right to obtain human review of, or to contest, a decision based solely on automated processing, contact us using the details in Section 26.

Response timelines vary by the law that applies to your request, and the figures below are the general statutory outer limits, not a promise that every request will take that long — we aim to respond well within them where the request is straightforward. Under the EU/UK GDPR, controllers generally must respond within one month, extendable by a further two months for complex requests, with notice of the extension given within the first month. Under the CCPA/CPRA, businesses generally must respond within forty-five days, extendable once by a further forty-five days with notice. Other U.S. state laws generally set similar forty-five-day windows. Where no specific statutory deadline applies, we aim to respond within thirty days.

Before introducing a new feature that involves a materially new way of processing personal information, we consider the privacy risk it introduces and how to mitigate it — a lightweight version of what data-protection law calls a Data Protection Impact Assessment for higher-risk processing. This is why, for example, the session-tracking feature described in Section 4 was deliberately scoped to exclude IP-derived location data rather than including a half-accurate version of it.

If you access the Services while traveling or otherwise outside your usual country of residence, the privacy rights available to you are generally determined by your habitual residence and citizenship, not by your physical location at the moment you use the Services, though this can vary by jurisdiction. If you are unsure which rights apply to you, contact us using the details in Section 26 and we will do our best to point you to the right section of this Policy.

Where we send optional marketing communications (as opposed to the service-related communications described in Section 8, which are necessary to operate your account), you may opt out at any time using the unsubscribe link included in those communications, or by contacting us using the details in Section 26. Opting out of marketing communications does not opt you out of service-related communications.

The Services may link to third-party websites or resources. This Policy does not apply to those third parties, and we are not responsible for their privacy practices. We encourage you to review the privacy policy of any third-party site you visit.

The Services are not directed to, and are not intended for use by, anyone under the age of eighteen (18), consistent with the eligibility requirement in our Terms of Service. We do not knowingly collect personal information from a child. If we become aware that we have inadvertently collected personal information from someone under the applicable age of consent, we will take reasonable steps to delete it.

You can review your current sign-in email at any time from your account page, and you can review and individually revoke active sign-in sessions from the security centre — this is a real, functioning control, not a placeholder, and it directly reflects the session data described in Section 4. Changing your password automatically revokes every other active session, keeping only the session you used to make the change.

To close your account, contact support using the details in Section 41; account closure is subject to the completion of any pending transactions and compliance review described in our Terms of Service, and to the retention obligations described in Section 11.

If a breach of security leads to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal information we hold, we will assess the risk to affected individuals and, where required by applicable law, notify affected individuals and the relevant supervisory authority within the timeframe that law requires. Notification will describe, to the extent known at the time, the nature of the breach, the categories and approximate number of individuals and records affected, the likely consequences, and the measures taken or proposed to address it.

[Operator to complete: if required under applicable law (for example, where mandated for certain controllers under GDPR Article 37), the name and contact details of the Company's appointed Data Protection Officer.] Until this is completed, use the general contact details in Section 26 for any privacy-related question or request.

Some browsers offer a "Do Not Track" signal. Because we do not operate cross-site tracking or behavioral-advertising technology on the Services in the first place, as described in Section 9, there is no tracking for such a signal to meaningfully disable, and we do not currently respond differently to the presence or absence of that signal.

Depending on your jurisdiction's definition, certain information we process in connection with identity verification (for example, a government-ID document, which may reveal information such as national origin) may be classified as sensitive personal information. We process this category of information only to the extent necessary to meet our identity-verification and compliance obligations described in Section 7, and we apply the same security measures described in Section 12 to it, without using it for any unrelated purpose such as marketing or profiling.

To the extent applicable law treats us as a "financial institution" for purposes of the U.S. Gramm-Leach-Bliley Act and its implementing regulations, this section serves as our GLBA-required privacy notice. We collect nonpublic personal information about you from the sources described in Section 5. We do not disclose nonpublic personal information about you to nonaffiliated third parties for their own independent marketing use. We disclose it only in the categories described in Section 9 — principally to service providers who perform functions on our behalf, and where required by law. You do not need to take any action to limit our sharing, because we do not share in the ways GLBA gives you the right to limit in the first place.

We aim to collect only the personal information reasonably necessary for the purposes described in Section 8, and to use it only for those purposes or a purpose compatible with them. Where a feature can be built without collecting a new category of personal information, we prefer that approach — for example, our session-tracking feature (Section 4) deliberately does not log or display an IP-derived location for your sessions, because the underlying architecture does not give us a trustworthy browser IP address to base one on, and a half-accurate location would mislead you more than an honestly absent one.

Internally, access to personal information is limited to personnel and systems that need it to perform a specific function — for example, our compliance function's access to identity-verification documents is separate from the access an engineer troubleshooting an unrelated technical issue would have. Administrative accounts used to operate the platform are entirely separate, at the authentication level, from client accounts; an administrative session cookie is cryptographically distinct from, and cannot be used to authenticate as, a client session, and vice versa.

We maintain backups of the systems that store personal information as part of our operational resilience practices, so that a hardware failure or similar incident does not result in irrecoverable loss of your account data. Backup copies are subject to the same security principles described in Section 12 and are retained only as long as necessary for business-continuity purposes, subject to the retention schedule in Section 11.

Before engaging a third-party service provider that will process personal information on our behalf, we assess its security and privacy practices and put in place a contract that restricts its use of that information to the services it is engaged to provide. We periodically review our list of active service providers and remove access for any that are no longer in use.

1. Contact us using the details in Section 41, describing which right you'd like to exercise (access, correction, deletion, portability, objection, or opt-out) and the account or email address the request relates to.

2. We verify that the request is genuinely coming from you (or your authorized agent) before acting on it, typically by confirming details only the account holder would know or, where appropriate, by requiring the request to come from the email address on file.

3. We locate the relevant data and determine whether any exception applies (for example, a legal retention obligation that limits a deletion request, as described in Section 12).

4. We respond within the time period required by applicable law for your jurisdiction, explaining what we did and, where a request is declined in whole or in part, why.

If you are not satisfied with our response, Section 17 and Section 18 describe your right, where applicable, to escalate to a supervisory authority.

We will never ask you for your password, or for a one-time passcode, over email, phone, or chat. We will never ask you to move funds to a "safe" address as part of a support interaction. If you receive a message claiming to be from us that asks for either of these things, it is not from us — please report it using the contact details in Section 41 and do not act on it.

Always access the Services by typing the address directly into your browser or using a bookmark you created yourself, rather than clicking a link in an unsolicited message. Enabling step-up authentication and reviewing your active sessions periodically (Section 27) are two of the most effective things you can do to catch unauthorized access early.

Much of this Policy's ability to protect you depends on us being able to reach you — for a security alert, a request to update expired identity-verification documents, or a notice of a change to this Policy. Please keep the email address on your account current, and update your identity-verification information promptly if it changes, as also required under our Terms of Service.

This Policy is written in English. Any translated version is provided for convenience only, and the English-language version controls in the event of any conflict or ambiguity between versions.

For any question about this Policy, or to exercise a privacy right described above, contact us using the details published on our Contact page. Please describe your request as specifically as you can, including your account email, so we can locate and act on it efficiently.

We may update this Policy from time to time to reflect changes in our practices or in applicable law. When we make a material change, we will provide reasonable advance notice — such as an email to the address on your account or a prominent notice within the product — before the change takes effect, except where an immediate change is required to comply with law or address an urgent security issue. The "Last updated" note at the top of this page reflects the date of the most recent revision.

Your continued use of the Services after a revised Policy takes effect constitutes your acknowledgement of the revised Policy. If you do not agree with a revision, you may close your account as described in Section 27.