Privacy Policy
Version and effective date: [Pending — insert once confirmed]. Governing language and translation versioning are specified in the Terms of Service.
What we collect and why
We collect the information onboarding, compliance, and service delivery genuinely require: identity and contact details, identification documents, tax residency self-certification, source of funds and wealth information, and records of how you use the platform. We practice data minimization — we do not collect what we do not need.
Legal basis for processing
Processing is grounded in the performance of our services, compliance with legal obligations (including AML/KYC requirements), legitimate interests such as security and fraud prevention, and consent where required. The governing legal framework is confirmed per jurisdiction.
Your rights
Subject to the framework that applies to you — GDPR for UK/EU clients, CCPA/CPRA for California residents, equivalent local law elsewhere — you may have rights of access, rectification, erasure, and portability. AML/KYC record-retention obligations (commonly five years or longer after a relationship ends, per applicable regulation) can limit the right to erasure; where that applies we will explain it plainly rather than silently decline.
Sub-processors
The disclosed list of sub-processors — cloud hosting, KYC vendor, screening vendor, and others — is published here once each provider is real and contracted. Information pending regulatory confirmation.
International data transfers
Where data crosses borders, transfer safeguards are applied per the applicable framework. Data-residency options are configurable per partner and jurisdiction rather than fixed to one region.
Breach notification
Breach-notification timelines follow the regulator-mandated window in each operating jurisdiction once confirmed (72 hours under GDPR is a commonly referenced benchmark; the actual obligation is verified with counsel).