1. Data we collect
Account data: name, email address, hashed password, country, optional social handle, interface language.
Transaction data: conversion amounts, target currency, payout method, payout details, crypto addresses, transaction hashes and order status.
Technical data: IP address, device type, browser, operating system, session timestamps and the pages you visited while signed in.
2. Why we process it
To execute your conversions, to meet AML and sanctions obligations, to prevent fraud and account takeover, to provide support, and to improve the product. We do not sell personal data and we do not use it for behavioural advertising.
3. How it is protected
Passwords are hashed with bcrypt. Payout details are encrypted at rest with AES-256-GCM using a key held outside the database. Session tokens are random 256-bit values stored only as SHA-256 hashes.
Treasury keys are maintained as public extended keys. The application cannot sign transactions, and no seed phrase is ever stored by the service.
4. Retention
Transaction and identity records are retained for five years after the end of the business relationship, as required by financial record-keeping rules. Session and device metadata is retained for 24 months. Marketing preferences are kept until you withdraw consent.
5. Sharing
We share the minimum necessary data with payout providers (PayPal, Payoneer, Wise, banking partners), blockchain analytics providers, and competent authorities where legally required. All processors are bound by data-processing agreements.
6. Your rights
You may request access, correction, deletion, restriction, portability, or object to processing by writing to privacy@crypto2fiat.cash. We respond within 30 days. You may also lodge a complaint with your local supervisory authority.
7. International transfers
Where data leaves the UK or EEA we rely on the UK International Data Transfer Addendum or Standard Contractual Clauses together with supplementary technical measures such as encryption at rest and in transit.
8. Cookies
We use a single strictly necessary cookie to keep you signed in. We do not deploy advertising or cross-site tracking cookies. Language preference is stored in the URL path.