Privacy Policy

1. Categories of Data We Process

Because BreezeSwap is an accountless, non-custodial software interface, we do not collect your full name, residential address, date of birth, tax identification number, or banking details during normal platform operation. When you initiate a swap, we process the following limited technical categories:

• Blockchain Routing Data: Source and destination asset tickers, selected blockchain networks, destination wallet address, optional refund wallet address, Destination Tag/Memo, and public on-chain transaction hashes (`txHash`).
• Network & Security Telemetry (all exchange types, including Private Swaps): Client IP address, approximate location (country, region, city and network operator as provided by our CDN, Cloudflare), HTTP User-Agent string, browser language settings (Accept-Language), CDN request identifier, and system timezone. We also log the IP address and User-Agent each time an order status page is opened.
• Device & Browser Fingerprint: When you create an exchange, our page reads characteristics of your device and browser: screen resolution and colour depth, operating system and platform, browser family and version, device type, number of CPU cores, device memory, touch support, preferred languages, a hash of a canvas drawing test, the graphics card (WebGL) renderer and vendor, the referring page and the page on which the exchange was started (without query parameters). From these we compute a device fingerprint hash. This is used for fraud prevention, abuse protection and AML record-keeping.
• Support Communications: Any email address, Order ID, or message content you voluntarily submit via our live chat widget or compliance email desk.

2. Legal Basis for Processing (GDPR Article 6)

We process technical and transaction data under the following legal bases established by the EU General Data Protection Regulation (GDPR):

• Performance of a Contract — Art. 6(1)(b): Processing your wallet addresses, asset pair, and routing parameters is technically indispensable to generate deposit addresses and settle your requested swap. Reading device characteristics at order creation is treated as strictly necessary for providing a secure exchange service.
• Legal Obligation — Art. 6(1)(c): Enforcing automated geo-blocking against sanctioned territories (OFAC/UN/EU), keeping records of exchange transactions and the associated connection and device data, and disclosing them in response to lawful requests (warrants, court orders, subpoenas) from competent authorities.
• Legitimate Interests — Art. 6(1)(f): Protecting our routing infrastructure against automated botnet scraping, quota exhaustion, and illicit money laundering.
• Consent — Art. 6(1)(a): Deploying optional analytics or functional live-support cookies only when explicitly enabled by you via our Cookie Consent Manager.

3. Data Sharing with Independent Execution Partners

3.1. Zero Data Monetization: BreezeSwap never sells, rents, auctions, or monetizes user data to advertisers, data brokers, or marketing agencies.

3.2. Liquidity & Settlement Routing Disclosures: To calculate real-time quotes and execute standard or Private Tunnel swaps, BreezeSwap transmits your transaction parameters (asset pair, amount, payout/refund addresses) together with required compliance headers (client IP address, User-Agent, and timezone) via encrypted TLS API channels to our vetted, independent third-party liquidity providers and settlement partners (“Execution Partners”). Other service providers that process data on our behalf: Cloudflare (CDN, security, optional human-verification check), our hosting provider, Google Analytics (only with your consent) and Tawk.to live chat (only with your consent).

3.4. Disclosure to Authorities: We disclose order records, including the connection and device data described in Section 1, to competent law enforcement or regulatory authorities when we receive a valid legal request, as described on our Law Enforcement page. This applies to all exchange types, including Private Swaps.

3.3. Third-Party KYC Providers (Triggered Holds Only): If and only if an incoming blockchain deposit is flagged as high-risk by an Execution Partner's automated KYT security engine, the Execution Partner (or its accredited identity verification vendor, such as Sumsub or equivalent) may directly collect identity documents and Source of Funds evidence from you in accordance with their independent regulatory obligations. BreezeSwap does not store your passport or biometric verification files on its servers.

4. Search Engine Isolation & Order Anonymity

Every order status page (`/exchange/[publicId]`) uses a random 16-character identifier and is served with `X-Robots-Tag: noindex, nofollow` headers, so it is not indexed by search engines. Anyone who knows this link can view the order status, amounts, addresses and transaction hashes — share it only with people you trust. Analytics scripts are not loaded on order pages, and order identifiers are not sent to analytics or chat providers.

5. Cookies & Google Consent Mode v2

We utilize a granular Cookie Consent Banner supporting Google Consent Mode v2:

• Strictly Necessary Storage: LocalStorage preferences (`breezeswap_cookie_consent`) and session rate-limiting tokens required for exchange functionality.
• Analytics Storage (Opt-In): Aggregated, anonymized traffic metrics to monitor swap latency and UI error rates. Denied by default until accepted.
• Functional / Support Storage (Opt-In): Powers our 24/7 live support chat widget so support agents can assist you with active order tracking.