Privacy Policy

1. Institutional Privacy Commitment

SnowBridge operates as an advanced platform for digital asset management and automated financial technology solutions. We are committed to upholding absolute confidentiality, data minimization, and institutional security across all operations and settlement rails.

This Privacy Policy outlines how personal, transactional, and technical data is processed in accordance with international security standards, the European General Data Protection Regulation (GDPR), the Brazilian General Data Protection Law (LGPD — Law 13.709/2018), and applicable data protection regulations.

2. Scope of Data Collection

We collect data strictly necessary to deliver high-performance digital services and satisfy international Anti-Money Laundering (AML/CFT) standards:

• Account & Identity Data: Full name, primary email address, mobile phone number, encrypted credentials, and cryptographic user identifiers.
• Digital Asset & Transaction Identifiers: Public wallet addresses (e.g., USDT, USDC, BTC), network transaction hashes, on-chain execution receipts, and settlement logs.
• Social Authentication Metadata: When authenticated via verified identity providers (Facebook, Google, Apple), we collect unique federated user IDs, verified email addresses, and security tokens to maintain secure account continuity.
• Access & Device Data: IP address, date and time of each access, browser, operating system, device model and type, language, time zone, screen resolution, connection type, battery level, origin of your first visit (affiliate link, campaign, or referring site) and, with your permission, device location (section 4).

3. Purpose of Processing & Security

Your information is processed strictly for the following operational objectives:

• Administration of segregated on-chain custody and algorithmic settlement protocols.
• Fulfillment of global financial compliance, sanction-screening, and fraud prevention obligations.
• Execution of real-time security alerts, transaction verification, and multifactor authentication (2FA).
• Continuous optimization of institutional system performance and server resilience.
• Usage analysis and improvement of the platform's experience, performance, and communication.

4. Access, Device & Location Data

Each time you access the portal, we automatically record the access and device data described in section 2. We use it to protect your account by identifying unusual access and preventing fraud, and to understand which devices, connections, and regions use the platform, guiding improvements in compatibility, speed, and support.

• Location: After you log in, your browser asks for permission to share your device location. It is collected only if you allow it. If you decline, we record only the refusal and do not ask again for 30 days. You can revoke this permission at any time in your browser or phone settings.
• Browser storage: We use our own cookies and the browser's local storage to keep your session, store the origin of your first visit, and avoid repeated permission requests. We do not read cookies or data from other websites.
• Legal bases: Location is processed based on your consent (LGPD art. 7, I; GDPR art. 6(1)(a)). Other access and device data are processed based on legitimate interest in security and service improvement (LGPD art. 7, IX; GDPR art. 6(1)(f)) and compliance with legal and regulatory obligations (LGPD art. 7, II; GDPR art. 6(1)(c)).
• Retention: Access logs (IP, date and time) are kept for at least 6 months, as required by the Brazilian Internet Civil Framework (Law 12.965/2014, art. 15). Other data is kept while your account is active, subject to regulatory retention periods.

This data is never sold or shared for advertising. Access is restricted to the SnowBridge team and to the infrastructure providers that host the platform, under contract.

5. Social Sign-On Integrations (Meta, Google, Apple)

When you choose to authenticate or link your account using social providers (such as Meta/Facebook Login, Google Sign-In, or Apple ID):

• We request only baseline profile permissions (name, verified email, user ID).
• We do not post on your social feeds, access private friends lists, or access social media communications.
• You can unlink social accounts or request full deletion of provider data at any time via your account settings or our Data Deletion Instructions.

6. Asset Segregation & Cryptographic Security

We deploy defense-in-depth security architectures: end-to-end TLS 1.3 encryption, automated database encryption at rest (AES-256), multi-party cold custody vaults, and rigorous session isolation to safeguard platform participants.

7. Data Subject Rights

Under international privacy legislation, you retain the full right to:

• Verify whether personal data is processed and request an export of your information.
• Request immediate rectification of inaccurate or outdated profile attributes.
• Revoke third-party login authorizations.
• Request permanent erasure of non-statutory personal data, subject only to mandatory international AML/CFT legal retention periods.

8. Data Protection Officer (DPO)

For inquiries regarding privacy, exercising your data rights, or contacting our legal compliance counsel, reach out via our dedicated confidential channel: