Cryptonera Privacy Policy

Last updated: 7 October 2026

This policy explains how personal information is handled through cryptonera.com, the merchant dashboard, Crypto Splitter, Crypto Billing, invoices, hosted checkout, payment links, APIs, webhooks, support and the Crypto Card waitlist. It applies to visitors, account holders, team members, Payers, Recipients and people who contact us. Public blockchain activity and a Merchant's own use of customer information are also explained below.

1 Who is responsible and how to contact us

Cryptonera is the name of the website and platform. “We”, “us”, “our” and “the Operators” mean the individual operator or operators responsible for the processing described in this policy. This wording does not represent that an incorporated company operates the platform.

Privacy contact: [email protected], with “Privacy” in the subject, or https://cryptonera.com/contact

For account administration, platform security, our communications and our own legal obligations, we determine the purposes and means of processing. Where we process customer details solely on a Merchant's documented instructions, the Merchant is the controller and we act as its processor under the applicable arrangement. Responsibility depends on the actual activity; a Merchant's instructions do not determine every use of transaction or security information.

If you paid a Merchant and your request concerns its order, fulfilment, marketing or customer records, contact that Merchant. You can contact us about processing for which we are responsible. Where we act only as a processor, we will assist the Merchant in handling your request as required.

2 Information we receive

Account and team information includes names, email addresses, account identifiers, Merchant or store details supplied during registration, roles and permissions, account status, authentication records and relevant login activity. Authentication data can include password hashes, passkey credential information, multifactor authentication settings and recovery information, depending on the methods enabled.

Configuration and integration information includes receiving and settlement addresses, recipient addresses and labels, split percentages and versions, fee settings and snapshots, invoice settings, API key identifiers and protected credential records, webhook endpoints, delivery records and audit trails of changes.

Payment information includes blockchain addresses, transaction hashes, asset and network identifiers, amounts, timestamps, block and confirmation information, invoice status, settlement and payout records, fees, held balances, refunds and release instructions. An address or transaction can be personal information when it can be connected to a person, even if a blockchain does not display a real name.

Merchant-supplied information can include order references, invoice descriptions, customer email addresses, line items, recipient labels and metadata. We receive it from the Merchant or its integration, and it may relate to a Payer who has no Cryptonera account. Merchants should provide only what is necessary and explain that disclosure to the people concerned.

Technical and security information includes IP addresses, browser and device characteristics, user-agent information, request timestamps, URLs or actions requested, error records, session identifiers and security events. Some information is recorded automatically when you use the website, checkout or API.

Communications include the name, email address, message and related technical information supplied through a contact form, support email or complaint. The Crypto Card waitlist records your email address and the time and IP address of signup and confirmation, together with the status needed to honour your choice.

We receive information directly from you, from authorised account users and Merchants, from your interaction with the Services, and from public blockchains and the infrastructure providers used to read them. If a particular legal or security check requires additional evidence, we will explain the requested information, purpose and relevant handling at that time. Do not send seed phrases, private keys, full payment-card credentials or unnecessary sensitive documents through ordinary support or invoice metadata.

3 Why we process information

Where the GDPR or a similar legal-basis requirement applies, the following purposes use the corresponding grounds only where their conditions are met.

Account operation and transactions: we use relevant account, configuration and transaction information to establish and perform a contract with you, or take steps you request before entering it. This includes instructions, calculations, invoices, status messages, releases, refunds and essential service communications. Contract necessity applies when you are the contracting individual. For a business's representatives or counterparties, our legitimate interests in providing and administering the requested business service may instead apply, or we process the information on the Merchant's instructions.

Security and reliability: we use technical information, audit records and relevant transaction information to protect accounts, identify abuse, investigate errors, reconcile records and maintain the Services. Our grounds are legitimate interests in protecting users and the platform, subject to a balancing assessment, and specific security duties where legally applicable. We limit processing to what is proportionate to those purposes.

Support and disputes: we use communications and relevant records to answer requests, verify authority, investigate complaints and establish or defend legal claims. The grounds are contract performance where applicable and legitimate interests in resolving issues and protecting legal rights.

Legal obligations: where an actual obligation applies to us, we use necessary information for required accounting, tax records, regulatory duties, court orders or other lawful requirements. We do not rely on an unspecified future obligation to justify collecting everything that might be useful.

Optional notifications: we use consent for the Crypto Card waitlist notification and for any other optional marketing for which consent is required. Withdrawing consent stops that optional use without affecting earlier lawful processing. Essential account, security and transaction messages do not depend on marketing consent.

We do not sell or rent personal information or use it for targeted advertising. We do not treat acceptance of the Terms, browsing the website or making a payment as consent to unrelated marketing. A materially different use requires an appropriate legal basis and updated information before that use begins, including fresh consent where required.

4 Required and optional information

Information needed to create an account, authenticate access, execute an instruction or comply with an applicable legal duty must be supplied for that activity to proceed. Without it, we may be unable to create the account, provide the affected feature, release funds or resolve the request. We explain additional verification requirements when they arise.

Waitlist signup and optional marketing choices are voluntary. Do not include unnecessary personal information in free-text descriptions, labels, URLs or API metadata. A Merchant should not make an unrelated optional disclosure a condition of payment without a lawful basis.

5 Blockchain records and payment links

Public blockchains can reveal addresses, amounts, transaction histories, timestamps and any information placed in a transaction message. Network participants, explorers, indexers and other persons worldwide may independently copy and analyse that information. Transactions and linked addresses can allow activity to be associated with an individual.

We cannot alter or delete the underlying records on networks we do not control. This does not remove our responsibilities for information we collect or keep outside the blockchain, including considering a lawful deletion request. Do not place names, email addresses, identity documents or other unnecessary personal information in public blockchain messages.

A hosted payment or status URL can reveal payment or invoice information to someone who possesses it. Share these links only with intended recipients. The Merchant receives information needed to reconcile its payment, including through configured webhooks. Recipients can see their own blockchain payments and other publicly visible transaction information.

6 Cookies and Cloudflare Turnstile

We use session and security technologies needed for functions such as signing in, maintaining a requested session, submitting forms and preventing forged requests. Browser settings can restrict cookies, but blocking essential storage may stop those functions from working. The current website does not use advertising trackers or behavioural marketing analytics. Any introduction of optional tracking will be explained and, where required, enabled only after consent, with a way to withdraw it.

The contact and Crypto Card waitlist forms use Cloudflare Turnstile to distinguish people from automated traffic. Cloudflare can receive the IP address, browser or user-agent information, technical connection signals and the website context needed for the check. Cloudflare describes its processing for website protection and for improving its bot-detection service, including the different roles it takes for those purposes, in its Turnstile Privacy Addendum: https://www.cloudflare.com/turnstile-privacy-policy/.

We use these checks to protect the forms against abuse. Any device storage or access must be assessed under the applicable rules; a security label alone does not make every technology exempt from consent. If a check prevents you from using a form, you can contact [email protected] instead.

7 Who receives information

We disclose information only as necessary for an identified purpose and subject to applicable safeguards. Authorised Operators and support personnel access relevant information to operate the Services, investigate issues and respond to requests.

Infrastructure providers supply hosting, databases, backups, delivery or security services. Signing providers receive the addresses and transaction instructions required for execution. Blockchain indexers and node providers receive relevant address or transaction queries. Email providers process recipient addresses and message contents for service or requested waitlist communications. If a price source is enabled, it supplies asset quotations; it does not need a customer's name merely to quote an asset pair.

Cloudflare provides the Turnstile checks described above. Merchants, their authorised team members and their chosen integration or webhook providers receive information needed for the configured payment workflow. You should also read the Merchant's notice for its separate use of that information.

Professional advisers and competent authorities may receive necessary information where there is a lawful basis, such as a legal claim, binding request or duty. In a proposed or completed lawful transfer of the service, information may be disclosed under appropriate confidentiality and purpose restrictions, with notice of a controller change where required.

Some recipients act on our instructions and others determine their own processing purposes. Our use of a provider does not remove our own legal responsibilities. Public network participants process blockchain records independently, as explained in section 5.

8 International processing

Your information may be accessed or processed in the Operators' location and in the countries used by the providers described above. Public blockchain records are also accessible worldwide. Countries can have different data-protection laws.

For restricted international transfers, we use the applicable mechanism identified above and any assessments or supplementary measures that the law requires. You may request information about the safeguards applying to your data, and a copy where applicable, using our privacy contact, subject to necessary protection of confidential information.

9 How long information is kept

We keep personal information only for as long as necessary for its purpose or a justified legal requirement. The applicable period depends on the category, account status, pending transaction, legal duty, dispute and technical deletion cycle. We do not treat the indefinite existence of a blockchain as a reason to keep all account information indefinitely.

Account and configuration records are kept while needed for an active account and for completing closure, pending instructions or necessary follow-up. Transaction, ledger and audit records may need to be kept longer for applicable accounting duties, reconciliation and the period in which relevant claims may be brought or defended. Only information needed for those continuing purposes is retained.

Technical and security logs are retained for the period proportionate to diagnosing incidents, preventing abuse and investigating relevant security events. Support records are kept while a request remains open and for necessary follow-up or related claims. A specific investigation or legal hold can justify retaining relevant records longer, with access restricted to that purpose.

API idempotency records are retained for 48 hours under the current API operation. This does not delete the associated transaction or any audit record with a separate justified retention purpose.

Unconfirmed Crypto Card waitlist entries are deleted after seven days. Confirmed entries are kept until the requested availability notification is sent, you unsubscribe, or the waitlist is discontinued. The notification entry is then removed when no longer needed for delivery handling, with only the limited record necessary to demonstrate consent or honour an unsubscribe retained for that purpose.

After the relevant period, information is deleted or irreversibly anonymised unless another lawful retention ground applies. Backup copies expire through the normal backup cycle and are restricted from ordinary use. You may ask which retention criteria apply to a particular record. Public blockchain records remain subject to section 5.

10 Security

We use technical and organisational measures appropriate to the data and risks, including access restrictions, protected authentication records, encrypted transmission where required, and controls around sensitive account or transaction changes. Access is limited to people and providers with a legitimate operational need. The strength and scope of controls must be appropriate to the actual service provided.

No system or transmission is completely secure. Report suspected account compromise or a privacy incident promptly. We will investigate and notify affected individuals or regulators when the applicable legal thresholds and deadlines require it. This statement does not waive any security duty or limit statutory remedies. Keep your own devices, credentials and endpoints secure and do not send secrets through support.

11 Your privacy rights

Depending on the law that applies and the processing involved, you may request access to your information, correction, erasure, restriction, a portable copy, or an objection to processing based on legitimate interests. You may withdraw consent at any time for processing that relies on it. You may object to direct marketing, if any, without giving a reason. Rights can be subject to legal conditions and exceptions.

Send requests to [email protected] or through the contact page. We may ask only for information reasonably necessary to verify your identity and authority, and must not request a seed phrase or private key. A request is normally free; any permitted fee or refusal must have a lawful basis and explanation.

Where the EU GDPR applies, we respond without undue delay and normally within one month. A permitted extension for complexity or the number of requests will be explained within the initial period. Other applicable statutory deadlines remain unaffected. Account closure does not necessarily require immediate deletion of records that must lawfully be retained, and an erasure request cannot remove records from an independently operated public blockchain.

You may complain to the competent data-protection authority, including, where applicable, the authority in your habitual residence, place of work or the place of an alleged infringement. You do not need our permission or to complete our support process first. A directory of EU authorities is available at https://www.edpb.europa.eu/about-edpb/about-edpb/members_en.

12 Automated processing

The platform automatically evaluates transaction amounts, confirmations, expiry times, recipient settings and resource availability to assign payment states and prepare payouts. Turnstile evaluates technical signals to identify automated traffic. These processes can delay or prevent a transaction or form submission, and can produce errors.

Contact support to request review of a disputed payment state, automated restriction or suspected error. Human review cannot reverse a completed blockchain transaction. If processing constitutes a decision based solely on automation with legal or similarly significant effects under applicable law, the required disclosures, lawful basis and safeguards must apply, including any right to human intervention, express your view and contest the decision. This policy is not consent to such a decision.

13 Crypto Card waitlist and children

The proposed Crypto Card product is not currently available. The waitlist is used to confirm your email address and send one availability notification. Every waitlist email provides a way to leave the list. Joining it does not authorise broader marketing, identity checks or the collection of card or financial credentials for a future programme. A future card service will require additional notices before collecting additional information.

The account and payment Services are intended for adults aged 18 or over. We do not knowingly invite children to register. Contact us if you believe a child has supplied information so we can assess deletion or other appropriate steps, subject to any legal need to retain a record.

14 Changes and contact

We update this policy when our practices or legal requirements change and show the revised date above. Material changes will be brought to your attention in an appropriate way. Where a new purpose needs consent, we will request it before beginning that use. An updated policy does not retrospectively authorise unlawful processing.

Questions, privacy requests and concerns can be sent to [email protected] or https://cryptonera.com/contact. Include only the information necessary for us to identify and respond to your request.