Swaps XYZ Privacy Policy

Effective Date: Jun 17, 2026

Swaps XYZ Ltd, a British Virgin Islands business company ("Swaps XYZ," "we," "us," or "our") provides API-based backend infrastructure and smart contract protocol for facilitating digital asset swaps across multiple blockchain networks (collectively, our “Services” or the “Swaps API”). This Privacy Policy (this “Policy”) addresses our processing of personal data that is transmitted to us by the independent applications, wallets, or platforms that integrate our Services. The operator of the third-party application maintains its own separate privacy policy governing its direct relationship with its users.

Who This Policy Covers

This Policy uses the following terms:

• "End Users" or "you": Individuals who perform digital asset swaps through apps, wallets, or services that integrate the Swaps API. You are an End User if you used another company's product to swap tokens between chains, and that product uses our Services in the background.
• "Developers": The apps, wallets, blockchain networks, and other businesses that integrate the Swaps API to enable digital asset swaps for their users. Developers are responsible for their own privacy practices and for informing you that your data will be shared with Swaps XYZ. See "Information for Developers" below for details specific to Developers.

If you have questions about this Policy, please contact our Data Protection Officer at [email protected].

Who We Are

Swaps XYZ Ltd is a British Virgin Islands business company and a wholly owned subsidiary of MoonPay Inc., a Delaware corporation.  Swaps XYZ is the data controller for personal data processed through the Services as described in this Policy.

Scope of This Policy

This Policy applies to personal data we process when you perform digital asset swaps through applications or services powered by the Swaps API. It also applies to Developers who integrate the Swaps API (see "Information for Developers" below).

This Policy does not apply to personal data processed by the Developer whose application you may be using to access the Services. Developers maintain their own privacy policy governing their relationship with you. For details about how a Developer uses your data, please refer to their privacy policy directly. It also does not apply to other MoonPay group services. For information about those services, please see the MoonPay Global Privacy Policy.

Our Role as Data Controller

Swaps XYZ acts as an independent data controller for the processing activities described in this Policy. This means we determine the purposes and means of processing your personal data in connection with:

• Facilitating on-chain swap transactions through the Swaps API
• Conducting wallet screening and compliance checks
• Maintaining the security and integrity of our Services
• Fulfilling our legal and regulatory obligations

The Developer whose application you use to initiate a swap is a separate data controller for the data they collect from you directly. For information about how a Developer collects and uses your data, please refer to their privacy policy.

Personal Data We Collect

We may collect the following categories of personal data in connection with our Services:

• Wallet and Transaction Data: Blockchain wallet addresses, token types, swap amounts, destination addresses, and other parameters required to facilitate swap transactions.
• Technical Data: IP addresses, API request metadata, timestamps, and diagnostic logs collected automatically when you interact with our Services.
• Communications and Support Data: Correspondence with our team, or data received from Developers in order to address End User troubleshooting or support requests they’ve received.

Swaps XYZ does not collect government-issued identification documents, bank account or payment card information, biometric data, or other sensitive personal information.

How We Use Personal Data

We use your personal data for the following purposes:

• Transaction Facilitation: Operating the Swaps API and facilitating cross-chain swap transactions, including price discovery, route optimization, and on-chain execution.
• Compliance and Security: Screening wallet addresses for potential sanctions exposure or illicit activity, preventing fraud and abuse, and maintaining the security and integrity of our Services.
• Service Operation: Operating, maintaining, debugging, and improving our Services.
• Legal Compliance: Responding to lawful requests from governmental authorities and enforcing our Terms of Service.

Where required by applicable law, we process personal data on the basis of our legitimate business interests (such as operating and securing our Services), to comply with legal obligations, or as necessary to perform services requested by you or the Developer acting on your behalf.

International Data Transfers

Swaps XYZ and its service providers operate in multiple countries. Where required by applicable law, we implement appropriate safeguards for international transfers of personal data, which may include, Binding Corporate Rules (BCRs), standard contractual clauses, adequacy decisions, or other approved transfer mechanisms.

Data Retention

We retain personal data only for as long as necessary to fulfill the purposes described in this Policy, unless a longer retention period is required or permitted by law. When determining retention periods, we consider the nature of the data, the purposes for which it was collected, and our legal obligations. When personal data is no longer required, we delete or anonymize it in accordance with our data retention schedules.

Due to the nature of cryptocurrency transactions, information associated with our Services is recorded on public, decentralized blockchain ledgers which Swaps XYZ does not control. This data, including wallet addresses, transaction hashes, amounts, and timestamps, is immutable and cannot be modified or deleted by Swaps XYZ.

Data Security

We implement technical and organizational measures designed to protect personal data against unauthorized access, alteration, disclosure, or destruction. These measures include encryption of data in transit and at rest, access controls, and regular review of our security practices. We also maintain policies and procedures to help ensure that personal data is handled appropriately and in accordance with industry best practices.

Your Privacy Rights

Depending on your location, you may have rights regarding your personal data, including the right to access, correct, delete, restrict processing of, or port your data. You may also have the right to object to certain processing or withdraw consent where applicable.

Given the pseudonymous nature of wallet data, we may require additional information to verify your identity before responding to such requests. Please note that transaction data recorded on public blockchains cannot be deleted or modified by Swaps XYZ.

To exercise your rights, please reach out to our data protection officer at [email protected]. Depending on your location, you may also have the right to lodge a complaint with your local privacy or data protection authority.

Our Services are not directed to individuals under the age of 18. We do not knowingly collect personal data from children.

Our Services may interact with third-party services, including blockchain networks and wallet providers, which are not operated by Swaps XYZ. This Privacy Policy does not apply to those third-party services.

We may update this Privacy Policy from time to time. If we make material changes, we will update the "Effective Date" at the top of this Policy. Your continued use of our Services after any changes constitutes acceptance of the updated Policy.

If you have questions about this Privacy Policy, please contact our data protection officer at [email protected].

Information for Developers

This section applies to Developers, defined as businesses and individuals who integrate the Swaps API into their applications.

Your Role as Data Controller

If you integrate the Swaps API, you act as a data controller for personal data you collect from your End Users. Swaps XYZ acts as an independent data controller for the processing we conduct through our Services, not as your processor. This means that both you and Swaps XYZ have independent obligations under applicable data protection law.

Your Responsibilities

Developers are responsible for ensuring that the privacy rights of their End Users are respected, including ensuring that appropriate disclosures are made about Swaps XYZ's data practices. Before transmitting wallet addresses or other personal data to Swaps XYZ, you must:

1. Provide Notice: Disclose to your End Users in your own privacy policy that their wallet address and transaction data will be shared with Swaps XYZ for swap facilitation and compliance screening.
2. Ensure Legal Compliance: Ensure you comply with applicable privacy and data protection laws when sharing personal data with Swaps XYZ.
3. Direct End Users to This Policy: Inform End Users that Swaps XYZ's processing of their data is governed by this Privacy Policy.

Suggested Disclosure Language

You may use or adapt the following language in your privacy policy:

We use Swaps XYZ Ltd to facilitate cryptocurrency swap transactions. When you initiate a swap, your wallet address and transaction details are shared with Swaps XYZ for transaction processing and compliance screening. Swaps XYZ's privacy policy is available at [URL FOR THIS POLICY].

Developer Account Data

When you create a Developer account or integrate the Swaps API, we collect API credentials, registration information, and contact details. We use this data to administer your account, provide API access, communicate service updates, and provide support. We process this data as necessary to perform our contract with you and to manage our business relationships.