Privacy Policy | ChainBridge-Investments

1. Introduction & Scope

Welcome to ChainBridge-Investments ("ChainBridge", "we", "us", "our"). We are a crypto investment platform that allows you to deposit and manage cryptocurrency directly from your non-custodial wallet (e.g., MetaMask, Phantom, TrustWallet). We never take custody of your funds – all transactions are executed via smart contracts on Ethereum (ETH), Binance Smart Chain (BSC), Solana (SOL), and Polygon (MATIC).

This Privacy Policy explains how we collect, use, and protect your personal data when you access our website, connect your Web3 wallet, or interact with our investment plans. We combine the limited data collection approach of decentralized networks with the security and transparency of regulated financial platforms. We do not sell your personal data.

⚠️ Important note: Because we operate on public blockchains, your wallet address and transaction history with our smart contracts are inherently public. This is a feature of blockchain technology, not a privacy failure. You assume this risk when using a public blockchain.

2. Legal Basis & Your Consent

Depending on your jurisdiction, we process your personal data based on:

Contract performance – To execute your investments via smart contracts.
Legitimate interests – To secure the platform, prevent fraud, and analyze usage.
Legal obligations – To comply with AML/CFT laws, tax reporting, or court orders (where applicable).
Consent – For marketing communications and certain data transfers.

By connecting your wallet and using our services, you confirm that you understand and agree to this policy. If you are in the EEA, UK, Switzerland, or BVI, you have additional rights (see Section 11).

3. Information We Collect (Limited but Purposeful)

We collect only the data necessary to provide and secure our investment platform.

Category	Specific Data	Purpose	Retention
Wallet Information	Public wallet address (ETH, BSC, SOL, Polygon), transaction history, smart contract interactions.	Identify your account, execute investments, calculate returns, prevent front-running.	Active investment + 1 year.
Technical Data	IP address, device type, browser fingerprint, OS, referral source.	Security (anti-sybil, DDoS), analytics, geolocation for compliance.	90 days (analytics) / 1 year (security).
On-chain Data	Public blockchain data linked to your wallet (token balances, contract interactions).	Verify eligibility, calculate rewards, audit platform.	Indefinitely (public by design).
Communication Data	Email address, support tickets, feedback.	Respond to inquiries, send service updates, (with consent) marketing.	Until you unsubscribe or request deletion.
Optional Data	Referral codes, social handles.	Award referral bonuses, track campaigns.	As needed for campaign.

We do NOT collect: Government ID (unless required by law after certain investment thresholds), bank account details, credit card numbers, biometric data, or any off-chain financial information.

4. How We Collect Information

Directly from you: When you connect your wallet, fill out a contact form, or email us.
Automatically: Via cookies, log files, and blockchain explorers (Etherscan, Solscan, etc.).
From public blockchains: Your wallet's transaction history with our smart contracts is publicly available.
From third-party security services: We use blockchain analytics tools (e.g., Chainalysis, Elliptic) to screen wallet addresses for sanctions or illicit activity – without revealing your identity.

5. Use of Your Information

We use your data for the following limited purposes:

Core Service: Process deposits, calculate and distribute investment returns, manage withdrawals via smart contracts on ETH/BSC/SOL/Polygon.
Security & Fraud Prevention: Monitor for unusual activity, block known malicious addresses, prevent smart contract exploits.
Legal Compliance: Screen wallet addresses against OFAC, EU, and UN sanctions lists. Report suspicious transactions if required by law.
Communication: Send you transactional emails (e.g., "Deposit confirmed") – you cannot opt out of these. Send marketing emails only with your consent.
Analytics: Improve our website performance, investment plans, and user interface.

We do not – and will never – sell your wallet address or IP address to third parties for their own marketing or advertising.

6. Data Sharing & Disclosure

We share your personal data only in these specific circumstances:

Blockchain Networks (Inherently Public): Your wallet address and transactions are publicly visible on ETH, BSC, SOL, and Polygon. This is not "sharing" by us, but a feature of blockchain technology.
Service Providers (Limited & Bound by Contract): Hosting (Cloudflare, AWS), blockchain nodes (Infura, QuickNode, Helius), email delivery (SendGrid), analytics (Google Analytics with IP anonymization), security screening (Chainalysis).
Legal Obligations: If we receive a valid court order, subpoena, or law enforcement request, we may disclose IP logs and wallet addresses. We will notify you unless prohibited by law.
Business Transfers: If ChainBridge is acquired or merges, your data will be transferred under the same privacy commitments.

We do not share your data with advertisers, data brokers, or any third party for their own independent purposes.

7. International Data Transfers

Your data may be processed on servers located in the United States, Germany, or Singapore. For users in the EEA, UK, or Switzerland, we ensure appropriate safeguards:

EU-US Data Privacy Framework (for transfers to certified US entities).
Standard Contractual Clauses (SCCs) with our service providers.

By using our platform, you consent to these transfers. EEA users who refuse cross-border transfer consent may be limited to viewing the website only (no wallet connection or investments).

8. Data Security – Bank-Level Protection

We implement security measures consistent with our "Bank-Level Security" commitment:

Encryption: TLS 1.3 for all web traffic. We never see your private keys – wallet signatures are handled by your wallet.
Access Control: Only 2–3 core team members access server logs or email addresses. All access is logged.
Smart Contract Security: Our investment contracts are audited by a third-party firm (report available upon request).
Monitoring: Real-time intrusion detection (IDS), rate limiting, and DDoS mitigation.

🔒 Your responsibility: No system is 100% secure. You are solely responsible for securing your wallet private keys. We cannot reverse blockchain transactions or recover lost funds.

9. Data Retention

Data Type	Retention Period
Wallet address & on-chain history	Active investment + 1 year after last activity.
IP address logs	90 days (analytics) or 1 year (security).
Email (transactional)	Until you close your account (withdraw all funds and disconnect).
Email (marketing)	Until you unsubscribe.
Support tickets	2 years after resolution.

After retention expires, we delete or anonymize the data. On-chain data cannot be deleted – it is permanent by design. We recommend using a dedicated wallet for this platform.

10. Cookies & Tracking Technologies

We use only essential and functional cookies to maintain session, remember your preferred blockchain, and prevent CSRF attacks. We do not use advertising cookies, cross-site tracking, or third-party targeting cookies.

Cookie Name	Purpose	Duration
`session_id`	Keep you logged in (wallet session)	Session
`chain_pref`	Remember your last used blockchain	1 year
`csrf_token`	Security	Session

You may disable cookies in your browser, but the website may not function properly. We do not respond to "Do Not Track" signals as we do not engage in cross-site tracking.

11. Your Rights (GDPR for EEA/UK & Global)

Depending on your jurisdiction, you may have the right to:

Access – Request a copy of all personal data we hold.
Rectification – Correct inaccurate data (e.g., your email).
Erasure (Right to be Forgotten) – Request deletion of email and IP logs. We cannot delete on-chain transaction history, but we can disassociate it from your email.
Restrict Processing – Limit how we use your data.
Data Portability – Receive your data in a machine-readable format.
Object – Object to processing based on legitimate interests.
Withdraw Consent – For marketing or optional data sharing.
Lodge a Complaint – With your local data protection authority.
Human Review of Automated Decisions – For wallet blocks or risk scoring.

To exercise these rights: Contact privacy@chainbridge-investments.com. We will verify your identity by asking you to sign a message with your connected wallet (proving ownership).

12. Automated Decision-Making & Smart Contracts

We use limited automated decision-making:

Smart Contracts: Deposits and withdrawals are executed automatically by code. No human reviews each transaction.
Risk Screening: Wallet addresses are automatically screened against sanctions lists. If a match occurs, your connection is blocked. You may request a manual review at compliance@chainbridge-investments.com.
Investment Calculations: Returns are calculated algorithmically.

For any automated decision that has a legal or significant effect on you, you have the right to request human intervention. We will respond within 30 days.

13. Children's Privacy

Our platform is not intended for persons under 18 years of age (or the age of majority in your jurisdiction). We do not knowingly collect data from minors. If we discover that a minor has connected a wallet, we will delete all associated off-chain data and lock the wallet from further interaction. On-chain funds can be withdrawn by the minor's parent/guardian contacting support.

14. Changes to This Privacy Policy

We may update this policy to reflect changes in supported blockchains, legal requirements, or our data practices. If we make material changes, we will:

Post the updated policy with a new "Effective Date".
Notify you via email (if provided) and/or a banner on the website.

Your continued use after changes constitutes acceptance. If you disagree, disconnect your wallet and withdraw all funds.

15. Contact Information

Data Protection Officer (DPO):
📧 privacy@chainbridge-investments.com
(Allow 5–10 business days for response)

Physical Address (Legal Correspondence):
ChainBridge-Investments Ltd.
[Your Registered Address] – Insert your legal address here
Attn: Privacy Office

EEA/UK Representative:
📧 gdpr-rep@chainbridge-investments.com

16. Your Acceptance

By connecting your wallet and using ChainBridge-Investments, you acknowledge that:

You have read and understood this Privacy Policy.
You understand that blockchain transactions are public and irreversible.
You are solely responsible for the security of your wallet private keys.
We are not a bank; your investments are not insured by any government deposit insurance scheme.