Privacy Policy

1. What we collect

Account data (name, email, organization), verification documents (KYB), transaction records, payment metadata (handled by our processors), and technical data such as IP and user agent for security and audit logging.

Page-view measurement data, collected by a first-party counter that runs on this deployment's own servers with no third party involved: the page path, any utm_source / utm_medium / utm_campaign on the link you followed, the host name only of the referring site, the display language, a UTC timestamp, and a visitor hash computed with SHA-256 from a random daily salt, your IP address and your user-agent. Your IP address is never stored and never logged — it is used to compute that hash and then discarded. The salt is deleted after two days — a day's salt is kept for that day and the two that follow — and because it changes daily there is no identifier that spans days: the counter measures daily unique visitors and cannot recognise a returning visitor or build a profile. Section 6 says why this is not a consent question.

Sign-up source data: how the browser session in which you registered FIRST reached this deployment — any utm_source / utm_medium / utm_campaign on the link you followed, the host name only of the site that linked here (never our own pages), and the path of the first page you opened. Held with your session from that first page until you register, copied to your account at that moment, and discarded with the session if you never do. No IP address, no cookie of its own, no page after the first.

2. How we use it

• To operate the marketplace and process trades
• To verify identity and prevent fraud
• To send transactional emails (receipts, milestone updates, disputes)
• To comply with legal and tax obligations
• To improve the Service through aggregated, anonymized usage data
• To measure our audience — how many people visit, which pages they read, in which language, and which campaigns or referring sites brought them. This is a different purpose from the security and audit logging in Section 1, so it is stated separately rather than folded into it, and it rests on our legitimate interest under GDPR Art. 6(1)(f), not on consent. You may object under Art. 21; note that because no identifier links a page view to you, there are no past page views we can find in response (GDPR Art. 11), and the reliable way to avoid being counted is a browser that does not run the script that sends the count.
• To know which channel brought a registration — the sign-up source data above, read in aggregate by the operator to judge their own pages, links and postings. Legitimate interest under Art. 6(1)(f); you may object under Art. 21, and the five fields are then deleted from your account.

3. Sharing

We share data only with the parties needed to deliver the Service — payment processors, KYB providers, email and SMS partners, and (when relevant) the counterparty of a specific trade. We never sell personal data.

Where your account is affiliated with another account on this deployment — one selling what the other delivers, or paying it a commission — that other account is an independent controller, not a processor acting for us: it decides for itself what it does with what it receives. What reaches it is the affiliation and its agreed rate, the amounts and dates of the completed trades that rate applies to, and the requisites printed on the settlement documents the two accounts exchange (legal name, taxpayer number, VAT number where held, registered address). Those documents carry no bank details of either party, and no buyer identity reaches an account merely because it delivers.

4. Retention

Trade and ledger records are retained for the period required by tax and accounting law in your jurisdiction. Other data is removed within 90 days of account closure unless retention is legally required.

Page-view measurement rows are deleted automatically after a retention period this deployment configures, 365 days by default — a longer period than the security and diagnostic logs, which is why it is stated separately. Two things limit what those rows contain: the IP address is never written at all, and the daily salt is deleted after two days, after which the surviving row cannot be linked back to an IP address.

5. Your rights

You can access, export, correct, or delete your personal data at any time from your account settings, or by writing to the contact address published on this site. EU/UK residents have additional rights under GDPR — including the right to lodge a complaint with your local supervisory authority.

6. Cookies and cookieless measurement

We use strictly-necessary cookies for authentication and security. We do not use advertising or third-party tracking cookies. See our Cookie Policy for detail.

The page-view counter described in Section 1 is not a cookie question. The consent requirement for cookies comes from Art. 5(3) of the ePrivacy Directive (2002/58/EC) and the national laws implementing it, and it attaches to storing information in, or gaining access to information already stored in, a user's terminal equipment. The counter does neither — it writes nothing to your device and reads nothing from it — so there is no storage or access for a consent control to govern. Its processing of your IP address and user-agent is governed by the GDPR instead, on the legitimate-interest basis in Section 2. Consequently, where a deployment offers an "analytics" category in a consent banner, that category governs cookie-based analytics; switching it off does not switch off this counter.

7. Security

We use industry-standard encryption in transit and at rest, role-based access controls, and audit logging. No system is perfectly secure — if you suspect a breach of your account, contact support immediately.

8. Changes

We will notify you of material changes by email and via the platform. Continued use of the Service after changes take effect constitutes acceptance.

This is a placeholder Privacy Policy for an early-stage product. Replace it before commercial launch with counsel-reviewed text aligned to your jurisdiction — see docs/runbooks/legal-pages.md. The page-view measurement disclosure in Sections 1, 2, 4 and 6 describes software that actually ships with the Engine, so if you replace this file, carry that disclosure into whatever replaces it.