Sinbad — Privacy Policy
Sinbad Tech Inc.
Last modified: August 9, 2026
This Privacy Policy explains what personal information Sinbad Tech Inc. ("Sinbad", "we", "us", "our") collects, why we collect it, who we share it with, how long we keep it, and what rights you have.
It applies to the Sinbad websites, mobile applications and related services (the "Platform"). It forms part of our Terms of Service.
Sinbad Tech Inc. is the controller of your personal information.
1. Summary
- We collect identity information because we are legally required to verify who our users are.
- We record the details of every trade, including the fiat payment, even though we never receive, hold or transmit fiat currency and never hold your digital assets.
- We keep anti-money-laundering records for as long as the law requires, and closing your account does not delete them.
- We do not sell your personal information.
2. Information We Collect
2.1 Identity and account information. Full legal name; date of birth; email address; phone number; residential or mailing address; nationality and country of residence; government-issued identity documents and a selfie or liveness capture; and, for business accounts, incorporation documents, ownership and control structure, and details of beneficial owners.
2.2 Transaction records. For every trade initiated through the Platform we record the digital asset and amount, the wallet addresses involved, the on-chain record of the trade, the fiat currency, amount, rate and payment method selected, any payment reference or proof of payment submitted by a party, the counterparty, and the status and timestamps of the trade.
Sinbad does not receive, hold, transmit or settle fiat currency. Fiat payments are made directly between users through the payment method they select. We record the details of those payments because we are required to; we are not a party to them.
2.3 Communications and dispute material. Messages and attachments exchanged between counterparties through the Platform, dispute submissions and supporting evidence, correspondence with our support team, and recordings of verification calls.
2.4 Screening and risk information. Results of sanctions, politically-exposed-person and adverse-media screening; blockchain analytics results relating to wallet addresses you use or transact with; internal risk ratings applied to your account.
2.5 Technical information. IP address, approximate location, device and browser identifiers, session and authentication events, and information about how you use the Platform.
2.6 Information about others. If you provide information about another person, you confirm you are authorised to do so.
3. Where We Get It
- Directly from you, when you register, verify, trade, dispute or contact us.
- From your counterparties, in the course of a trade or dispute.
- From service providers who verify your identity, screen for financial crime, or analyse blockchain activity on our behalf.
- From public and commercial sources, including sanctions lists, PEP databases, corporate registries, credit reference and fraud prevention agencies, and adverse media.
- From your device, through cookies and similar technologies (section 10).
4. Why We Use It
We use your personal information to:
| Purpose | Legal basis |
|---|---|
| Create and operate your account; provide the Platform | Performance of our contract with you |
| Verify your identity and eligibility | Legal obligation |
| Screen for sanctions, PEP status and financial crime risk; monitor transactions | Legal obligation |
| Maintain transaction records and make regulatory reports | Legal obligation |
| Operate the dispute process | Performance of contract; legitimate interests |
| Provide support and communicate with you about your account | Performance of contract |
| Prevent fraud, abuse and security incidents; enforce our Terms | Legitimate interests |
| Establish, exercise or defend legal claims | Legitimate interests; legal obligation |
| Improve and analyse the Platform | Legitimate interests |
| Send marketing communications | Consent (you may withdraw at any time) |
Where we rely on consent, withdrawing it does not affect processing carried out before withdrawal, and does not affect our ability to retain records under section 8.
5. Who We Share It With
5.1 Service providers. Identity verification providers (including Persona Identities Inc. — privacy policy), blockchain analytics providers, cloud hosting providers, communications and support tooling, and analytics providers. They may process your information only as we instruct.
5.2 Your counterparty. Limited information necessary to complete a trade — including the payment details you provide and your Platform display identity — is shared with the user you are trading with. Do not share more than the trade requires.
5.3 Arbitrators. Dispute submissions, evidence and trade records are made available to the independent arbitrator deciding your dispute.
5.4 Authorities. Regulators, financial intelligence units, law enforcement and courts, where required by law or valid legal process.
5.5 Corporate transactions. A successor or acquirer, in connection with a merger, acquisition, financing or sale of assets.
5.6 We do not sell your personal information and we do not share it with third parties for their own marketing purposes.
6. International Transfers
We may transfer personal information to, and process and store it in, countries other than the one in which you provided it. Our service providers may access it from those countries. Those countries may not offer the same level of data protection as your own, and your information may be accessible to their courts and authorities. Where required, we put appropriate safeguards in place with our providers.
7. Security
We use administrative, technical and physical safeguards designed to protect your information, including encryption in transit and at rest, access controls and logging. No system is completely secure, and we cannot guarantee absolute security. Keep your account credentials, device and recovery phrase confidential — we do not hold your keys or recovery phrase and cannot restore them.
If a breach affecting your personal information occurs and poses a real risk of significant harm, we will notify you and the relevant authorities as required by law.
8. Retention of Personal Information
8.1 General principle. We retain personal information for as long as necessary for the purpose for which it was collected, and for as long as we are required to retain it by law.
8.2 Anti-money laundering records. We are subject to record-keeping obligations under anti-money laundering and counter-terrorist financing legislation in the jurisdictions in which we operate. We retain the following for as long as we are required to keep them, and for as long as they remain necessary for the purposes described in section 4. We do not delete them when your account is closed, and no fixed end point applies:
- identity verification records, identity documents, verification results and the methods used to verify you;
- beneficial ownership and control records for business accounts;
- sanctions, PEP and adverse-media screening results, including negative results;
- the complete transaction records described in section 2.2, including fiat payment details, counterparty identity and wallet addresses;
- Platform communications, dispute submissions, evidence and dispute outcomes;
- blockchain analytics results and internal risk assessments;
- account access, authentication and device records associated with any transaction.
Records subject to a production order, preservation demand, investigation, audit or legal proceeding are retained until that matter is fully concluded.
8.3 Legal basis and effect on your rights. We retain the records described in section 8.2 because we are legally required to, not because you have consented. Closing your account, withdrawing your consent, or asking us to delete your information does not oblige us — and does not permit us — to delete those records. We will honour deletion and consent-withdrawal requests only in respect of information that is not subject to a retention obligation, and we will tell you which categories we are retaining and why.
8.4 Reporting. Where we are required to report a transaction or account to a financial intelligence unit or other authority, we retain the report and its supporting records for the period prescribed by law. Where the law prohibits us from disclosing that such a report has been made, we will neither confirm nor deny its existence, and we may decline to explain a decision to suspend, restrict or close an account.
8.5 What is deleted. Marketing preferences, analytics data not tied to a transaction, support correspondence unrelated to a trade or verification, and optional profile information are deleted or anonymised on request.
8.6 Blockchain data. Information recorded on a public blockchain is outside our control and cannot be deleted, amended or anonymised by us or by anyone else.
8.7 Records are not assets. These retention obligations relate to information about your activity. They do not give Sinbad any interest in, access to, or control over the digital assets in your wallet, which remain yours at all times.
9. Your Rights
Subject to section 8, you may:
- request access to the personal information we hold about you;
- request correction of inaccurate or incomplete information;
- withdraw consent to processing that relies on consent;
- request deletion of information not subject to a retention obligation;
- request a copy of your information in a portable format;
- object to processing based on our legitimate interests.
To make a request, contact us at compliance@getsinbad.com. We will verify your identity before responding, and will respond within 30 days. If we refuse a request in whole or in part, we will tell you why and identify the basis for the refusal.
Accountability. We have designated an individual who is accountable for our compliance with this Policy and with applicable privacy law. You can reach them at compliance@getsinbad.com. We will identify that individual by name on request.
10. Cookies and Similar Technologies
10.1 What they are. A cookie is a small file stored on your device when you visit a website. We also use similar technologies, including local storage, pixels and software development kits in our mobile applications.
10.2 What we use them for.
| Category | Purpose | Consent required |
|---|---|---|
| Essential | Signing you in, keeping your session active, security and fraud prevention, load balancing, remembering your cookie choices | No — the Platform cannot function without them |
| Functionality | Remembering your language, currency, timezone and display preferences | Yes |
| Performance and analytics | Understanding how the Platform is used so we can improve it, and diagnosing errors and crashes | Yes |
| Advertising | Measuring the effectiveness of our campaigns and showing you relevant advertising on other sites | Yes |
10.3 Third-party cookies. Some cookies are set by our service providers rather than by us, including analytics and advertising providers. Those providers may be able to recognise your device across other websites that use the same service. We do not control how they use the information they collect; their own privacy policies apply.
10.4 Your choices. When you first visit, we present a consent banner allowing you to accept or reject each non-essential category. You can change your choices at any time through your in-app privacy settings. You can also block or delete cookies through your browser settings, and reset your advertising identifier in your device settings. Rejecting non-essential cookies will not prevent you from using the Platform, but some features and preferences may not work as intended.
10.5 How long they last. Session cookies are deleted when you close your browser. Persistent cookies remain for the period set when they are placed, and expire or are deleted at the end of that period, or earlier if you withdraw consent or clear them.
10.6 Do Not Track. The Platform does not currently respond to browser "Do Not Track" signals. You can manage tracking through the controls in section 10.4.
11. Children
The Platform is not directed at anyone under 18 and we do not knowingly collect information from children. If we learn that we have, we will delete it, subject to any retention obligation in section 8. If you believe a child has provided us with information, contact compliance@getsinbad.com.
12. Automated Decision-Making
We use automated screening and risk-scoring to support identity verification, sanctions checks and transaction monitoring. Decisions with a significant effect on you — such as refusing verification or closing an account — are reviewed by a person. You may ask for human review of any such decision by contacting compliance@getsinbad.com, except where we are prohibited by law from discussing the basis of the decision (section 8.4).
13. Changes to This Policy
We may update this Policy. Updates take effect when published, and the "last modified" date above reflects the current version. We will notify you of material changes by email or in-app notice. Prior versions are available on request from support@getsinbad.com.
14. Contact
Sinbad Tech Inc.
compliance@getsinbad.com