Data Sharing & Processors

We do not sell personal data. We share data only with processors and recipients listed below, strictly to provide the service, comply with legal obligations or protect our legitimate interests. Each processor is bound by a Data Processing Agreement (DPA) where applicable.

Payment providers (crypto and fiat), gift-card providers, KYC providers, email delivery providers, hosting and infrastructure providers, monitoring and error-tracking providers, and (where required) law-enforcement authorities. Specific provider names and contractual terms will be finalised in the public release of this page.

When you pay for an order we share the minimum data required to process the payment (order id, amount, currency, your email or pseudo-identifier required by the provider). Final provider names (NOWPayments, Heleket, Paypalich, ЮKassa or others as enabled) will be listed here at launch. Provider links to their privacy and DPA documents will be provided.

If your transaction triggers KYC L2 verification, we transfer identity information (selfie, document scan, document metadata) to the verification provider you choose during the flow. Final provider name (e.g. Sumsub) and the DPA URL will be listed here at launch.

Transactional emails (sign-in OTP, password reset, order delivery, withdrawal verification) are sent via Resend. We share your email address and message content with Resend solely for delivery. Resend acts as our processor under a signed DPA.

The application runs on a virtual private server operated by our hosting provider. Provider name and data-centre location will be listed here at launch. The provider has access to encrypted-at-rest data via standard hosting privileges; access logs are retained per their policy.

We use Sentry Cloud for error tracking and Better Stack for log aggregation. Error reports may include limited request data (trace id, route, sanitised error context) but exclude full message bodies, payment data and KYC documents. Both processors are bound by DPAs.

Some processors may be located outside your country of residence. Where transfers cross GDPR borders we rely on Standard Contractual Clauses (SCCs) or equivalent safeguards. Specific transfer mechanisms per processor will be listed here at launch.

You may request a full list of recipients with whom your specific personal data has been shared. Requests can be submitted via the channels listed in the GDPR page; we will respond within one month.

If you are a California resident, you have additional rights under the California Consumer Privacy Act: the right to know what categories of personal information we collect, share or sell (we do not sell), the right to deletion, and the right to opt out of certain transfers. Exercise these rights via the contact channels below.