Privacy Policy

1.1 Personal Information: We collect information you provide directly, including:

• Name, email address, and contact information
• Galaxia ID and authentication credentials
• KYC verification documents (government ID, proof of address)
• Source of funds information (for compliance)
• Legal intake forms and case information

1.2 Transaction Information: For payment processing, we collect:

• Transaction amounts and currencies
• Wallet addresses (for cryptocurrency transactions)
• Travel Rule data (for transactions above thresholds)
• Payment method information

1.3 Technical Information: We automatically collect:

• IP address and geolocation data
• Device and browser information
• Usage data and analytics
• Cookies and similar tracking technologies

We use your information to:

• Provide and improve our services
• Process payments and transactions
• Comply with legal and regulatory requirements (KYC/AML)
• Detect and prevent fraud, money laundering, and other illegal activities
• Communicate with you about your account and services
• Send marketing communications (with your consent)
• Analyze usage patterns to improve user experience

For EU users, we process your data based on:

• Contract: To provide services you requested
• Legal Obligation: To comply with AML, KYC, and other regulatory requirements
• Legitimate Interest: For fraud prevention, security, and service improvement
• Consent: For marketing communications and optional features

4.1 We do not sell your personal information.

We may share your information with:

• Service Providers: Third-party services for payment processing, KYC verification, and infrastructure
• Regulatory Authorities: When required by law (e.g., SAR filings, regulatory requests)
• Law Enforcement: In response to valid legal requests or court orders
• Business Transfers: In connection with mergers, acquisitions, or asset sales
• With Your Consent: When you explicitly authorize sharing

IMPORTANT: We are legally required to report suspicious transactions to authorities (FinCEN, FCA, etc.) without notifying you.

5.1 Regulatory Requirements: We retain certain data for legal compliance:

• Transaction Records: Minimum 5 years (AML requirement)
• KYC Documents: Minimum 5 years after account closure
• Compliance Records: Minimum 5 years
• Legal Claims: Up to 7 years for potential legal proceedings

5.2 Account Data: We retain account information while your account is active and for a reasonable period after closure for legal and regulatory purposes.

5.3 Right to Erasure: You may request deletion of your data, subject to legal retention requirements. We will inform you if data must be retained for compliance.

You have the following rights:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate or incomplete data
• Erasure: Request deletion (subject to legal requirements)
• Restriction: Request limitation of processing
• Portability: Receive your data in a structured, machine-readable format
• Objection: Object to processing based on legitimate interests
• Withdraw Consent: Withdraw consent for processing (where applicable)
• Opt-Out: Opt out of sale of personal information (CCPA - we don't sell data)

To exercise these rights, contact us at privacy@galaxia.dev

Your data may be transferred to and processed in countries outside your jurisdiction. We ensure appropriate safeguards are in place:

• Standard Contractual Clauses (SCCs) for EU data transfers
• Adequacy decisions where applicable
• Encryption and security measures

We implement comprehensive security measures:

• Encryption: AES-256 encryption at rest, TLS 1.3+ in transit
• Access Controls: Role-based access, multi-factor authentication
• Monitoring: Continuous security monitoring and threat detection
• Audits: Regular security audits and penetration testing
• Incident Response: Breach notification procedures (72-hour GDPR requirement)

We use cookies and similar technologies for:

• Authentication and session management
• Security and fraud prevention
• Analytics and performance monitoring
• Marketing (with your consent)

You can manage cookie preferences through your browser settings or our cookie consent banner.

Our Service is not intended for users under 18 years of age. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately.

We may update this Privacy Policy from time to time. Material changes will be notified via email or through the Service. Continued use after changes constitutes acceptance.

For privacy-related questions or to exercise your rights:

Data Protection Officer
Email: privacy@galaxia.dev
Address: [Company Address]

EU Representative: [If required under GDPR]
UK Representative: [If required]