Privacy Policy
Last updated 7 October 2026
This policy explains what personal data Rampy Technologies, Inc. (“we”) collects when you use Rampy.money, why we collect it, who we share it with, and what rights you have. For data protection purposes we are the controller for the data described here.
1. What we collect
| Category | Examples | Why |
|---|---|---|
| Account | Email address, sign-in codes, session records | To create your account and keep you signed in |
| Verification status | Whether you are verified, the outcome, and your provider customer ID | To let you transact and to meet legal obligations |
| Transaction | Amounts, currencies, networks, wallet addresses, status, timestamps | To carry out and display your orders |
| Wallet | Public wallet addresses you connect or enter | To send assets where you asked |
| Technical | IP address, device and browser information, logs | Security, fraud prevention, debugging |
What we do not collect: we do not receive or store your identity documents, selfies, or government ID numbers. Those are submitted directly to our verification partner. We do not store your bank account number in full, and we never have your private keys.
2. Why we may use it (legal bases)
- To perform our contract with you — creating your account, executing orders, support.
- To comply with legal obligations — anti-money-laundering checks, sanctions screening, record keeping.
- Legitimate interests — keeping the service secure, preventing fraud and abuse, improving reliability.
- Consent — where we ask for it, such as optional marketing. You can withdraw it at any time.
3. Who we share it with
We share only what is necessary, with:
- Bridge ('Bridge Building Inc' in the US, 'Bridge Building S.A.' in the EEA, 'Bridge Building Limited' elsewhere) — payments, custody of fiat during settlement, stablecoin conversion. Their privacy notice.
- Privy — authentication and self-custodial wallet infrastructure. Their privacy notice.
- Persona — identity verification performed on Bridge's behalf. Their privacy notice.
- Infrastructure providers — hosting, managed database and email delivery, acting on our instructions.
- Address search — when you use “Find your address”, the text you type is sent from our servers to Photon, an OpenStreetMap geocoder operated by Komoot in Germany, to suggest matching addresses. Nothing else about you is sent with it, and you can always type your address in by hand instead.
- Google — Google Analytics, and only if you allow it. It receives your IP address, approximate location, device and browser, and which pages you viewed. It is never loaded unless you have agreed, and it is never used inside your account, so it does not see your transactions. Their privacy notice.
- X (Twitter) — the X advertising pixel, and only if you allow marketing. It receives your IP address, device and browser, and which of our public pages you viewed, so we can tell whether an advert led anywhere useful. Nothing is requested from X until you agree — refuse and its script is never fetched — and it is never used inside your account, so it does not see your transactions. Their privacy notice.
- Authorities — where we are legally required to disclose, or to establish or defend legal claims.
We do not sell your personal data. If you allow marketing, the X pixel shares the page and device details above with X so we can measure our own advertising; that is the only advertiser anything reaches, it happens only with your agreement, and it stops when you withdraw it.
4. International transfers
Our providers may process data outside your country, including in the United States. Where data leaves the UK or EEA we rely on appropriate safeguards such as the UK International Data Transfer Agreement or the European Commission’s Standard Contractual Clauses.
5. How long we keep it
Financial services law requires us and our partners to retain customer and transaction records, typically for five years after the end of the relationship, and longer where a specific legal obligation or investigation applies. Sign-in codes expire in minutes; sessions expire after 30 days. Technical logs are kept for a short period for security purposes.
Because of these obligations, closing your account does not always mean immediate deletion.
6. Your rights
Depending on where you live, you may have the right to:
- access a copy of your data, and to have it corrected if it is wrong;
- have it erased, where no legal retention duty applies;
- restrict or object to certain processing;
- receive your data in a portable format;
- withdraw consent where processing is based on it; and
- complain to your data protection authority.
To exercise a right, email privacy@rampy.money. We respond within one month. Requests about your identity documents should go to the verification provider that holds them; we will point you to the right contact.
If you are in California, you also have rights under the CCPA/CPRA, including the right to know, to delete, and to opt out of sale or sharing. We do not sell or share personal information as those terms are defined.
7. Security
Data is encrypted in transit and at rest. Access is limited to those who need it. Sign-in uses one-time codes or a third-party authentication provider rather than passwords we store. Webhook events from our payment partner are cryptographically verified before they are accepted. No system is perfectly secure, and you are responsible for your own wallet security.
8. Cookies
See our Cookie Policy.
9. Children
The service is not for anyone under 18 and we do not knowingly collect their data.
10. Changes and contact
We will post any update here and change the date above. Questions or complaints: privacy@rampy.money, or write to Rampy Technologies, Inc., 2810 North Church Street, Wilmington, DE 19802, United States.