OneSwap Privacy Policy

01 Who we are

This Privacy Policy explains how Terminal Systems Corp, a company organized under the laws of the Republic of Panama, trading as OneSwap.cc (“OnePump”, “we”, “us”), collects, uses and shares personal data when you use the OnePump website, application, waitlist, community features and related services (the “Service”). We are the data controller for the personal data described here.

Contact: privacy@oneswap.cc. Postal address: Ricardo Arias Street, Advanced Tower, 1st Floor, Panama City, Republic of Panama.

This Policy should be read together with our Terms of Service.

02 What we collect

Information you give us

Account and waitlist data: email address, X (Twitter) handle, Telegram handle if provided, display name, referral code used, and your answers to any waitlist or application forms.
Creator data: token name, ticker, image, description and any contact details you provide when applying to launch or to a creator program.
Communications: messages you send us by email, DM, support forms or community channels.
Contest entries: posts, stories and other content you submit for contests or giveaways.
Verification data, where required: identity documents and related information collected through a third-party verification provider.

Information collected automatically

Usage data: pages viewed, features used, referral source, timestamps, errors.
Device and connection data: IP address, approximate location derived from it, browser type, operating system, device identifiers, language.
Cookies and similar technologies, as described in Section 10.

Information from the blockchain and third parties

Ledger data: your OneSwap account identifier, Canton party ID and the transactions associated with it (token creations, trades, transfers, graduations). See Section 5.
Bridge data: transaction details from the OneSwap Bridge and its providers when you move assets to or from Canton.
Social data: public information from your social media profiles when you connect an account, complete a social task or interact with our official accounts.
Partner data: information from referral partners, agencies or communities that introduce you to the Service.

We do not knowingly collect special categories of personal data (such as health, religion or biometric data) unless an identity verification provider processes them on our behalf to meet a legal requirement.

03 How we use it

We use personal data to:

create and manage your account and waitlist position;
operate the Service, including token creation, trading, graduation and rewards;
calculate and credit diamonds, referral credits, queue positions and contest prizes;
generate citizen cards and similar personalized content;
send service messages (launch notices, security alerts, changes to terms) and, with your consent where required, marketing messages you can opt out of at any time;
provide support and respond to your requests;
detect, investigate and prevent fraud, wash trading, bot activity, sanctions violations and other misuse;
comply with legal obligations, including sanctions screening and lawful requests from authorities;
analyze and improve the Service, measure campaigns and understand how features are used;
enforce our Terms and protect our rights, users and the Service.

We do not sell personal data.

04 Legal bases

Where data protection law requires a legal basis for processing (for example in the EEA, the United Kingdom or Panama under Law 81 of 2019), we rely on:

Contract: to provide the Service you signed up for, including the account, waitlist and rewards.
Legitimate interests: to secure and improve the Service, prevent misuse, measure marketing and run our business, balanced against your rights.
Consent: for marketing emails where required, non-essential cookies, and connecting social accounts. You can withdraw consent at any time.
Legal obligation: for sanctions screening, identity verification where required, tax and record-keeping duties, and responses to lawful requests.

05 On-chain data

Canton is a permissioned network with privacy at the ledger level: transactions are visible only to the parties involved and the validators that process them, and there is no public mempool. However, data recorded on the ledger is permanent and cannot be edited or deleted by us. Token creations, trades and transfers linked to your account identifier are retained on the network for as long as it exists, and may be visible to validators, Super Validators, the OneSwap protocol and network explorers to the extent the network design allows.

We cannot delete or change ledger data in response to a privacy request. Requests regarding ledger data are limited to the off-chain data we hold.

We share personal data only as needed to run the Service:

OneSwap: the account, wallet and trading infrastructure that OnePump runs on. OneSwap and OnePump are operated by the same company and share account data.
Service providers acting on our instructions: hosting and infrastructure, email delivery, analytics, customer support tools, identity verification, fraud and sanctions screening, and design or content tools used to generate citizen cards.
Bridge and network providers: the OneSwap Bridge is powered by third-party routing providers (currently Squid) and the networks you bridge from and to. Those providers process transaction data under their own policies.
Canton Network participants: validators and the network protocol process transaction data as described in Section 5. Where we apply for or hold Featured App or Featured Asset status, aggregate activity data may be shared with the Canton Foundation and Digital Asset.
Partners: referral partners, agencies and genesis creators receive aggregate campaign results. We share identifiable data with a partner only where you have joined a program run with that partner and we tell you at the time.
Authorities: where required by law, court order or to protect the rights, safety or property of users, us or others.
Corporate transactions: a buyer or successor in a merger, acquisition or reorganization, under confidentiality.

Public parts of the Service, such as token pages, holder counts, leaderboards and citizen cards you choose to share, display information you have made public or that is derived from ledger activity. Your email address is never displayed publicly.

07 International transfers

We operate globally and our service providers may process data in countries other than yours, including countries without an adequacy decision from your regulator. Where required, we use safeguards such as standard contractual clauses or equivalent mechanisms. Contact us for details.

08 How long we keep it

Data retention periods
Data	Retention
Account and waitlist data	While your account is active and for 2 years after closure, unless a longer period is required by law
Verification data	5 years after the relationship ends, or longer where required by anti-money-laundering law
Usage, device and analytics data	Up to 24 months, then aggregated or deleted
Support and communications	3 years after the last contact
Contest entries and user content	For the duration of the licence in our Terms, or until you ask us to remove it from our channels
Ledger data	Permanent on the network; outside our control

We may keep data longer where needed to resolve disputes, enforce our Terms or comply with legal obligations.

09 Your rights

Depending on where you live, you may have the right to:

access the personal data we hold about you and receive a copy;
correct inaccurate or incomplete data;
delete your data, subject to legal retention duties and the limits in Section 5;
restrict or object to certain processing, including direct marketing;
receive your data in a portable format;
withdraw consent where processing is based on consent;
lodge a complaint with your data protection authority.

To exercise a right, email privacy@oneswap.cc from the address linked to your account. We may ask for information to verify your identity. We respond within the time required by applicable law, normally within 30 days.

You can unsubscribe from marketing emails using the link in any email. Service messages (security, legal, launch notices affecting your account) are sent regardless, as they are part of the Service.

California residents. We do not sell or share personal data for cross-context behavioral advertising. You have the rights to know, delete, correct and to non-discrimination described above.

10 Cookies and analytics

We use cookies and similar technologies for:

Essential functions: login sessions, security, remembering your preferences. These cannot be switched off.
Analytics: understanding how the Service is used, measuring campaigns and referral links. We use Google Analytics and similar analytics tools, which may set their own cookies and process data under their own policies. Where required, we ask for consent before setting these.
Social: embedded content from X or other platforms may set their own cookies under their policies.

You can control cookies through your browser settings. Blocking essential cookies may stop parts of the Service from working.

11 Security

We use technical and organizational measures appropriate to the risk, including encryption in transit, access controls, logging and monitoring. No system is completely secure. You are responsible for keeping your account credentials, email account and devices secure. If you believe your account has been compromised, contact us immediately at privacy@oneswap.cc.

12 Children

The Service is not directed at anyone under 18. We do not knowingly collect personal data from children. If you believe a child has provided us with data, contact us and we will delete it.

13 Changes and contact

We may update this Policy from time to time. The “Last updated” date shows the current version. Material changes will be announced through the Service or our official channels.

Questions or requests: Terminal Systems Corp, trading as OneSwap.cc, Ricardo Arias Street, Advanced Tower, 1st Floor, Panama City, Republic of Panama. Email: privacy@oneswap.cc.