Privacy Policy

1. Who is responsible for your data

Valtora is a brand of 2ndline Inc., a Florida corporation (United States), which operates this website and platform. 2ndline Inc. is the controller of your personal data. Our partners and service providers are separate companies; section 6 explains what each one receives.

Questions about your data, or a request to use your rights: our contact form (privacy).

2. What we collect

Identity checks can involve biometric data: our verification partner compares your selfie with your document photo. Where the law treats this as special category data, we process it only with your explicit consent or where the law allows it for preventing fraud and financial crime.

3. Where it comes from

• You, when you apply, use the app or contact us.
• Our verification partner, which checks your identity and documents and screens against sanctions and politically exposed person lists.
• Our custody partner, which reports deposits and transfers.
• Public sources: company registers (for UK companies, Companies House, including its lists of directors and people with significant control), sanctions lists, and public blockchain records of transactions to and from your addresses.
• A colleague who invites you to a business account, or who lists you as an owner or director of a company applying for one; an agent who introduced you to us.

4. Why we use it, and our legal basis

You must give us the information the law requires for verification. Without it, we can't open or keep your account. We don't send marketing without your agreement, and you can opt out at any time.

5. Automated checks

Our verification partner checks documents and selfies automatically, and our systems check transactions automatically for signs of fraud and financial crime. A person at Valtora reviews any decision to refuse your application or close your account. You can ask for a person to review a decision, give your view, and challenge it.

Where our verification partner isn't used for your application, our staff check the information and documents you send us through Secure messages themselves, and a second staff member approves the decision.

6. Who we share it with

We share your data only as needed for the purposes above, with:

• Service providers working for us, under contracts that require them to protect it and use it only on our instructions:
  • identity verification and screening: our banking partner, once connected; until then our own staff;
  • crypto custody and transfers: our regulated crypto custody partner;
  • hosting and database: Vercel and Neon;
  • address suggestions while you type an address: Loqate and Google (they receive what you type, not who you are);
  • email: Resend (sending) and Google Workspace (our mailboxes);
  • text-message alerts, if you choose them, through our SMS provider.
• The agent who introduced you, if any: your name or business name, your application status, and the monthly revenue and commission figures for your account.
• Your browser's push service (run by your browser's maker), if you turn on notifications on a device. It delivers the alert; the alert never contains your message.
• The receiving firm when you send crypto to an account at another provider, as the travel rule requires.
• Authorities: regulators, law enforcement, tax authorities and courts, where the law requires or allows it.
• Professional advisers, such as auditors and lawyers, under a duty of confidentiality.
• A buyer or successor, if our business is sold or reorganised, under the same protections.

We don't sell your personal data.

7. International transfers

2ndline Inc. is based in the United States, and some of our providers process data there or elsewhere outside the UK and the European Economic Area. Where data leaves those areas, we use the safeguards the law requires, such as an adequacy decision or approved standard contractual clauses. Ask us through our contact form (privacy) for details or a copy.

8. How long we keep it

• Verification records and transaction records: at least five years after our relationship ends, or longer where the law of a country we serve requires it.
• Our transaction ledger and audit records can't be edited or deleted, so we can show what happened and when.
• An application that doesn't become an account: as long as the law requires for verification records.
• Where you got to in an application you didn't submit: 12 months after you were last active on it.
• Other data: only as long as we need it for the purpose we collected it for.

9. How we protect it

Data travels encrypted and is stored encrypted. Sign-in uses passkeys, and important actions need a second confirmation. Staff see only what their role needs, every access to client documents is logged, and actions that move money need two people.

Passkeys

When you create a passkey, your device or passkey provider (for example your phone, a security key, or a password manager that syncs passkeys) makes a pair of keys. The private key stays with your authenticator or passkey provider and is never sent to us. Your fingerprint, face or device PIN only unlocks the passkey on your device; we never receive it. For each passkey we store:

• its public key and credential ID, which let us check a sign-in;
• a signature counter, which helps us spot a copied key;
• how your authenticator says it can connect (for example built in, USB or nearby phone);
• whether the passkey can be synced between devices, and whether it was backed up when you created it;
• its name, when you created it and when you last used it.

We don't ask your authenticator to identify its make or model. If your passkey provider syncs passkeys, you can sign in on any device where that provider has your passkey, not only the one you created it on. A passkey that isn't synced, such as one on a security key, works only where it's stored. If you lose access to your passkeys, we can restore your sign-in after checking it's you. Where two of our staff agree that you can use an authenticator app instead, we keep its secret encrypted.

10. Your rights

Depending on where you live, you can:

• ask for a copy of your data;
• ask us to correct it;
• ask us to delete it, where we don't have to keep it by law;
• ask us to restrict how we use it, or object to our use based on legitimate interests;
• ask for data you gave us in a format you can reuse;
• withdraw consent, where we rely on it, without affecting what we did before;
• ask for a person to review an automated decision.

Use our contact form (privacy). We reply within one month, or tell you within that month if we need longer and why. Sometimes the law stops us from giving or deleting information, for example where it would prejudice an investigation.

11. Complaints about how we use your data

Please contact us first. You can also complain to the data protection authority where you live or work, or where you think a breach happened, for example: the Information Commissioner's Office (United Kingdom), your national data protection authority (European Economic Area), the Federal Data Protection and Information Commissioner (Switzerland), the Office of the Privacy Commissioner of Canada, the Personal Data Protection Commission (Singapore), the Office of the Privacy Commissioner for Personal Data (Hong Kong), or the UAE Data Office.

12. Children

Our services are for people aged 18 and over. We don't knowingly collect data about children.

13. Cookies

We use cookies to keep you signed in and to protect shared document links. If you allow it, we also keep an agent's referral code in your browser for up to 30 days. The Cookie Policy lists each one and how to change your choice.

14. Changes to this policy

We'll tell you about important changes in the app before they take effect.