Privacy Policy

1. Who is responsible

Bifrost AG i.G., Vaduz, Liechtenstein, is the controller of personal data processed on the platform. Questions and requests can be sent to the support desk at /support. We process personal data under GDPR-equivalent Liechtenstein data-protection law regardless of where you live.

2. What we collect

Account data: your display name, username, email address and account settings. Verification data: the identity information and documents collected under our KYC programme, processed through a specialised verification provider. Transaction data: your orders, listings, offers, redemptions and support conversations. Technical data: server logs (IP address, time, requested page) kept for security and kept brief.

We do not collect browsing profiles, we do not run third-party advertising or analytics trackers, and we do not buy data about you from anyone.

3. Why we process it

We process account and transaction data to perform our contract with you: running the market, the vault and redemptions. We process verification data to meet legal obligations under anti-money-laundering and travel-rule requirements. We process technical logs in our legitimate interest of keeping the platform secure. We send transactional messages (order confirmations, shipping notices) as part of the service; marketing messages only with your consent, which you can withdraw at any time.

4. The public chain

Certificate ownership and transfer history are recorded on a public blockchain under pseudonymous account addresses. This record is public and permanent by design — it is what makes your certificate trustworthy — and it cannot be altered or erased by Bifrost or anyone else. We never write your name, contact details or verification data to the chain. The link between your identity and your account address is held off-chain by Bifrost and disclosed only where the law requires it.

5. Sharing and retention

We share data only with the parties needed to run the service: the vault operators (shipment and slot data), our insurers and auditors (custody records), our identity-verification provider (KYC data), carriers (delivery details) and authorities where legally compelled. We never sell personal data. Verification records are retained for the period required by anti-money-laundering law and then deleted; account data is deleted or anonymised when your account closes, except where retention is legally required.

6. Your rights

You may request access to, correction of, or deletion of your personal data, object to processing based on legitimate interest, and receive your data in a portable format. Deletion cannot extend to the public chain record, which contains no direct identifiers, or to records we must keep by law. You may complain to the Liechtenstein Data Protection Authority. Requests to the support desk at /support are answered within one month.