Privacy Policy

The data controller is Sciurus, reachable at privacy@sciurus.io.

• Contract performance (Art. 6.1.b GDPR): to provide the multi-chain swap service.
• Legal obligations (Art. 6.1.c GDPR): AML/KYC compliance where applicable.
• Legitimate interests (Art. 6.1.f GDPR): fraud prevention and platform security.
• Consent (Art. 6.1.a GDPR): marketing communications (only with explicit consent).

• Access (Art. 15): receive a copy of the data we hold about you.
• Rectification (Art. 16): correct inaccurate or incomplete data.
• Erasure (Art. 17): "right to be forgotten".
• Restriction (Art. 18): restrict processing in certain circumstances.
• Portability (Art. 20): receive your data in a machine-readable format.
• Objection (Art. 21): object to legitimate-interest-based processing.
• Withdrawal of consent: withdraw consent at any time.

Contact privacy@sciurus.io. You may also lodge a complaint with your national data protection authority.

• Account data: until deletion + 30 days.
• Transaction data: 10 years (AML obligations).
• Security logs: 12 months.
• Marketing data: until consent is withdrawn.

Your data is processed primarily within the EEA. Transfers to third countries use Standard Contractual Clauses approved by the European Commission (Arts. 44–49 GDPR).

We may update this Privacy Policy. For material changes, we will notify you by email or via a platform notice at least 30 days before the changes take effect.