Privacy Policy

1. Who we are

OrangeRamp is operated by OR Digital Holdings LLC, a Wyoming limited liability company (“we”, “us”). We are the controller of the personal information described in this policy, which means we decide how and why it is used.

You can contact us about privacy at any time at privacy@orangeramp.io.

2. The short version

3. Providers are separate controllers

When you continue to a Provider’s checkout, the Provider collects information from you directly, such as your payment details, identity documents and verification results. The Provider is an independent controller of that information and handles it under its own privacy policy, which it will show you. This policy does not cover what Providers do with your information. We recommend reading the Provider’s privacy policy before you complete a transaction.

4. Information we collect

Information you give us

• Account details: your email address and, if you choose, your name and country.
• Order details: the asset, network, amount, currency and payment method you choose, and the wallet address you enter to receive crypto (or the refund address for a swap).
• Communications: messages you send to our support team, complaints, and survey responses.
• Business contacts: if you apply for API access, your name, work email, company details and information about your intended integration.

Information we collect automatically

• Device and usage data: IP address, browser and device type, operating system, language, pages viewed, and the date and time of your visit.
• Approximate location: the country and region derived from your IP address, which we use to show available Providers and payment methods and to prevent access from restricted locations.
• Security and log data: records of sign-ins, API requests and errors, used to keep the Service secure and working.
• Preferences: such as your choice of light or dark theme, stored in your browser. See our Cookie Policy.

Information we receive from others

• From Providers: your order’s reference number, status, final amounts, transaction hash, and, where you have agreed and the Provider supports it, whether you have completed the Provider’s identity verification. We do not receive copies of your identity documents or your payment card details.
• From blockchain analytics and sanctions screening services: risk information about wallet addresses you provide, such as whether an address is linked to sanctioned persons or known illicit activity.
• From businesses that integrate us: if you reach us through a partner’s app, the partner may pass us your order details and, in some cases, your email address and wallet address.
• From public blockchains: transaction information that is publicly visible on the relevant network.

We do not intentionally collect sensitive categories of personal information, such as health data or biometric data. Selfie and document checks are performed by Providers, not by us.

5. How we use your information and our legal bases

If you are in the European Economic Area (EEA) or the United Kingdom, we must have a legal basis for each use of your personal information. The table below sets out what we do and why.

Where we rely on legitimate interests, we have balanced our interests against yours. You can ask us for more information about this balancing, and you have the right to object (see Section 9).

We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects. Automated sanctions or risk screening may cause an order to be paused for manual review by a person.

6. Who we share your information with

We share personal information only as described below.

• The Provider you choose. We pass your order details, wallet address and, where needed to pre-fill checkout, your email address and country, so the Provider can complete your transaction.
• Service providers who process information on our behalf under contract and only on our instructions: cloud hosting and databases, email delivery, customer support tools, error monitoring, sanctions screening and blockchain analytics.
• The business that referred you, if you reached us through a partner’s app or website. We share the status of your order so the partner can show it to you.
• Authorities and others where required by law. We disclose information to regulators, law enforcement, courts or other parties when we are legally required to, or where we believe in good faith that disclosure is necessary to prevent fraud or financial crime, protect someone’s safety, or establish, exercise or defend legal claims. Our approach is described in our Compliance & AML page.
• A buyer or successor, if our business is reorganised, merged or sold, subject to this policy.
• Anyone else, with your consent.

We do not sell personal information, and we do not share it with third parties for their own advertising.

7. Public blockchains

Crypto transactions are recorded on public blockchains. Wallet addresses, amounts and timestamps are permanently visible to anyone and cannot be altered or deleted by us, by the Provider or by you. Anyone who can link a wallet address to you may be able to see your transaction history on that network. Consider using a fresh address if this concerns you.

8. International transfers

We are based in the United States and our service providers may process information in the United States and other countries. Those countries may not have data protection laws equivalent to those where you live. When we transfer personal information from the EEA, the United Kingdom or Switzerland, we use safeguards recognised by law, such as the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum, or rely on an adequacy decision such as the EU-US Data Privacy Framework where the recipient is certified. You can ask us for a copy of the relevant safeguards at privacy@orangeramp.io.

9. Your rights

Depending on where you live, you may have the right to:

• access the personal information we hold about you and receive a copy;
• correct information that is inaccurate or incomplete;
• delete your information, subject to our legal obligations to keep certain records;
• restrict or object to our use of your information, including use based on legitimate interests;
• receive your information in a portable format;
• withdraw consent where we rely on it, without affecting earlier processing; and
• not be discriminated against for exercising your rights.

To exercise a right, email privacy@orangeramp.io from the address linked to your account. We may need to verify your identity before responding, and we will respond within the time required by law (one month in the EEA and UK, 45 days in California and most other US states, which may be extended where the law allows). You may use an authorised agent; we will ask the agent for proof of authority.

If you are in the EEA or UK, you also have the right to complain to your local data protection authority. In the UK this is the Information Commissioner’s Office. We would appreciate the chance to address your concern first.

If we decline your request, we will tell you why. Residents of some US states may appeal a decision by replying to our response with the subject line “Privacy appeal”; if you are not satisfied with the appeal, you may contact your state Attorney General.

10. Additional information for US residents

This section applies to residents of California and other US states with comprehensive privacy laws. In the past 12 months we have collected the following categories of personal information, for the purposes described in Section 5, and disclosed them for business purposes to the categories of recipients in Section 6:

We do not sell personal information or share it for cross-context behavioural advertising, and we have not done so in the past 12 months. We do not knowingly sell or share the personal information of anyone under 16. We do not use or disclose sensitive personal information for purposes that would give rise to a right to limit its use. We treat Global Privacy Control browser signals as a valid request to opt out of sale and sharing.

11. How long we keep information

We keep personal information only for as long as we need it:

• Order records (including wallet addresses and screening results): five years after the order, to meet record-keeping, tax and financial crime obligations and to deal with disputes.
• Account details: while your account is open, and for five years after it is closed if you placed orders, or 90 days if you did not.
• Support communications: three years after the conversation ends.
• Security and access logs: up to 12 months.
• Marketing preferences: until you unsubscribe, and then a suppression record so we do not contact you again.

We may keep information longer where we are required to by law or where it is needed for an ongoing investigation or legal claim. When information is no longer needed, we delete or anonymise it.

12. How we protect information

We use technical and organisational measures designed to protect personal information, including encryption in transit and at rest, access controls based on role and need, multi-factor authentication for staff, logging and monitoring, and contractual obligations on our service providers. No system is completely secure. If you believe you have found a security vulnerability, please report it to security@orangeramp.io. If a breach affects your personal information, we will notify you and the relevant authorities where required by law.

13. Children

The Service is not intended for anyone under 18, and we do not knowingly collect personal information from children. If you believe a child has given us personal information, contact privacy@orangeramp.io and we will delete it.

14. Marketing

We send marketing emails only if you have asked to receive them or where the law otherwise allows. Every marketing email includes an unsubscribe link. You will still receive service messages about your account and orders.

15. Changes to this policy

We may update this policy as our Service or the law changes. The date at the top shows when it was last updated. If we make a material change, we will tell you by email or on the Service before it takes effect.

16. Contact us

For any question about this policy or your personal information, contact OR Digital Holdings LLC at privacy@orangeramp.io.