Draft for review. Highlighted items are still to be filled in.
Privacy Policy
Effective: [Effective date]
In short
We collect as little as we can. You don't need an account, and an email address is optional. To run your order we need your payout address and the blockchain transactions you send and receive, which are public anyway. If you give an email, we use it only for order updates and delete it 30 days after your order closes. We don't sell data and we don't use advertising or analytics cookies.
1.Who is responsible for your data
[Brand] OTC is run by [Operator name], who decides how the data described here is used. Contact us about privacy at .
2.What we collect
- Order details: the assets, amounts and rate you were quoted, your order number and its status history.
- Blockchain data: your payout address and the addresses and transaction hashes of payments to and from us. This data is public on the blockchain.
- Email (optional): only if you choose to give one for order updates.
- Technical data: IP address, browser type and request logs, used for security, rate limiting and bot protection.
- Screening results: risk scores and alerts about the wallet addresses involved in your order.
- Verification data (only if needed): for unusually large orders we may ask you to verify your identity. We will tell you before collecting anything.
- Messages: anything you send us, and notes our staff make on your order.
We never ask for wallet private keys or seed phrases. Never send them to anyone.
3.Your private order link
When you create an order you get a private link to it. The secret part of that link stays in your browser: it is not sent to our servers when you open the page, and we do not store it. Anyone who has the link can see the order, so keep it private.
Without the link, an order number or transaction hash only shows the order's status, not its addresses or details.
4.Why we use it
- To run your order: pricing, detecting your payment, paying out and, if you gave an email, order updates.
- To keep the service safe: fraud and abuse prevention, screening wallet addresses for links to theft, sanctions or other illicit activity, rate limiting, bot protection, and records of what our staff did.
- To meet legal obligations that apply to us, and to handle complaints and legal claims.
We don't use your data for advertising and we don't sell it. Orders flagged by automated checks are reviewed by a person; we don't make decisions about you by automated means alone.
6.How long we keep it
- Email: deleted automatically 30 days after your order is completed or expires.
- Order and transaction records: 5 years, so we can resolve disputes and meet our obligations.
- Security and request logs: up to 12 months, longer only if needed to investigate an incident.
Blockchain data is public and permanent. Nobody can delete what is recorded on a blockchain.
7.Your rights
Depending on where you live, you can ask to see, correct or delete your data, to restrict or object to how we use it, or to get a copy. Email with your order number; we may ask you to prove the order is yours, for example by opening your private order link.
You can also complain to your data protection authority.
9.Security
We encrypt data in transit, limit staff access by role with two-factor authentication, record every change staff make, and keep deposit-address private keys away from our application servers. No system is perfectly secure; if a breach affects you, we will tell you as the law requires.
10.Changes
We will update this policy when how we handle data changes. The date at the top shows the latest version.