Privacy Policy

We may collect the following categories of personal information:

• Account information: email address, full name, and authentication identifiers when you create or access an account.
• Identity and compliance information: information required for Know Your Customer (KYC) and anti-money laundering (AML) processes, collected through our regulated partners.
• Transaction information: records related to fiat and digital asset transactions you initiate through the Services.
• Technical information: IP address, browser type, device information, and usage logs necessary to operate and secure the Services.

If you choose to sign in or register using Google (via Google Sign-In / OAuth), we access certain information from your Google account as permitted by you during the authorization flow. This may include:

• Your Google account email address
• Your name (given name and family name)
• Your Google account unique identifier (Google user ID)
• Your profile picture URL (if made available by Google and requested by the authentication scope)

How we use Google user data

We use Google user data solely to:

• Authenticate you and verify your identity when signing in to the Services
• Create and maintain your user account
• Associate your account with platform activity and compliance workflows you initiate
• Provide, maintain, and improve user-facing features of the Services

Sharing and disclosure of Google user data

We do not sell Google user data. We do not share, transfer, or disclose Google user data to third parties except:

• To service providers that help us operate the Services (such as Clerk for authentication and Supabase for database hosting), strictly to provide or improve the Services
• To regulated partners (such as Bridge.xyz) when required to complete onboarding, KYC, or transaction services you request
• When required by applicable law, regulation, legal process, or governmental request
• To protect the rights, property, or safety of 21D, our users, or others

We do not transfer Google user data to third parties for advertising, data brokerage, credit worthiness determination, lending, personalized or interest-based advertising, or any purpose unrelated to providing or improving the Services.

Protection of Google user data

• Data in transit is protected using industry-standard encryption (TLS/HTTPS).
• Access to personal data is restricted to authorized personnel and systems on a need-to-know basis.
• We rely on reputable infrastructure providers with security controls appropriate to the sensitivity of the data.

Retention and deletion of Google user data

• We retain Google user data for as long as your account is active and as needed to provide the Services, comply with legal obligations, resolve disputes, and enforce our agreements.
• When you delete your account or request deletion, we will delete or anonymize your personal information within a reasonable timeframe, except where retention is required by law or legitimate business purposes (such as compliance record-keeping).
• To request access, correction, or deletion of your data, contact us at legal@just21d.com.

Prohibited uses of Google user data

We do not use Google user data for:

• Selling to third parties or data brokers
• Targeted, personalized, retargeted, or interest-based advertising
• Determining credit-worthiness or lending purposes
• Creating databases unrelated to providing the Services
• Training artificial intelligence or machine learning models

We use personal information to:

• Provide, operate, and maintain the Services
• Authenticate users and manage accounts
• Facilitate onboarding, KYC, and transaction processing through regulated partners
• Comply with AML, CTF, sanctions, and other legal obligations
• Detect, prevent, and address fraud, security issues, and prohibited use
• Communicate with you about the Services
• Improve the functionality and reliability of the Services

We limit our use of personal information to providing and improving user-facing features of the Services. We do not use personal information for advertising or unrelated commercial purposes.

We may share personal information with:

• Authentication providers (e.g., Clerk, Google when you use Google Sign-In)
• Infrastructure and hosting providers (e.g., Vercel, Supabase)
• Regulated financial and compliance partners (e.g., Bridge.xyz and other Partners described in our Terms of Service)
• Professional advisors and authorities when required by law

We do not sell your personal information. We do not share personal information with third parties for their independent marketing purposes.

We implement administrative, technical, and organizational measures designed to protect personal information against unauthorized access, alteration, disclosure, or destruction. No method of transmission or storage is completely secure; we cannot guarantee absolute security.

We retain personal information for as long as necessary to fulfill the purposes described in this Privacy Policy, including providing the Services, meeting legal and compliance obligations, and resolving disputes. When retention is no longer required, we delete or anonymize the information.

Depending on your jurisdiction, you may have rights to access, correct, delete, or restrict processing of your personal information, or to object to certain processing. To exercise these rights, contact legal@just21d.com. We will respond within the timeframes required by applicable law.

Your information may be processed in countries other than your country of residence. Where required, we implement appropriate safeguards for cross-border data transfers.

We may update this Privacy Policy from time to time. If we change how we use Google user data or other personal information in a material way, we will update this page and, where appropriate, notify you through the Services. The "Last updated" date at the top reflects the most recent revision.

For privacy-related questions or requests, contact Twenty-One Dragmas LTD at legal@just21d.com. See also our Terms of Service.