Draft for legal review. This text has not been validated by a lawyer and must not be treated as final.
1. Controller
[Company name, tax ID (CNPJ) and address to be defined.] Data Protection Officer (DPO) contact: bluratech@gmail.com.
2. Data we process
- Swap data: currencies, networks, amounts, receiving address, memo or tag and refund address, when provided.
- Technical data: IP address and browser information (language, time zone and operating system), needed to create the swap with the Provider and to prevent fraud.
- We do not ask for your name, email, ID document or password to use the comparison tool.
3. What we use it for
- Fetching quotes and creating the swap you request (performance of a contract, art. 7, V, of the Brazilian General Data Protection Law, LGPD, Law 13.709/2018).
- Fraud prevention and compliance with legal and regulatory obligations (art. 7, II and IX, LGPD).
- Aggregated usage metrics to improve the service (legitimate interest).
4. Sharing
To create the swap, we send the transaction data, your IP address and browser information to the Provider you chose (for example, ChangeNOW or SimpleSwap), which then processes them under its own privacy policy. The Provider may be located outside Brazil, which constitutes an international data transfer. We also use hosting providers. We do not sell personal data.
5. Storage
In this version, SwapGun does not keep its own database of your swaps: the status is fetched from the Provider on each visit. Technical server logs may be retained for [period to be defined] for security and legal compliance.
6. Your rights
You may request confirmation of processing, access, correction, anonymization, deletion, portability and information about data sharing, and withdraw consent, by emailing the address above. You may also lodge a complaint with the ANPD (Brazilian National Data Protection Authority).
7. Cookies
We only use what is necessary for the site to work. If we adopt analytics or marketing cookies, we will ask for your consent.
8. Security
We use an encrypted connection (HTTPS) and keep integration keys on the server only. No system is completely immune to incidents.