This Privacy Policy explains what personal data Peerlyx collects, why, who receives it, how long it is kept and what choices you have. It applies to the Peerlyx website, phone app, marketplace and wallet ("Peerlyx").
1. Who we are
Peerlyx ("Peerlyx", "we", "us") operates Peerlyx and decides how your personal data is used (the "controller"). Questions and requests: support@peerlyx.com
Peerlyx is a peer-to-peer marketplace where people buy and sell crypto with each other, with a custodial wallet for deposits, withdrawals and trade escrow.
2. What we collect
Account details
- Email address, username, country, preferred language and currency.
- Your password and authenticator (two-factor) setup are held by our sign-in provider; we never store your password.
Verification
- Phone number, when you verify it.
- Identity verification is carried out by our verification provider, Didit, which collects images of your identity document, a selfie and a short liveness video, and device and connection data (such as your IP address) to prevent fraud. We receive and keep the result (approved or not) and the verification level; the documents stay with the provider.
- Proof of address, where needed for higher limits.
Wallet and trading
- Deposit addresses created for you, your balances, deposits, withdrawals, the addresses you withdraw to, and network fees.
- Offers you publish, trades (amounts, prices, payment method, status) and the payment details you save or share in a trade.
- Trade chat messages and attachments, dispute evidence, and feedback you leave or receive.
Security and technical data
- IP address, browser and device type, and sign-in times, used to protect accounts. When you sign in, we estimate your city and country from your IP address on our own servers to include in a sign-in alert email.
- Records of security checks, such as password and authenticator confirmations and rate-limit counters.
- Technical error reports from your browser and the phone app, to fix problems.
Communications
- Messages you send to support (in the support chat or by email), and the emails and notifications we send you.
We do not use advertising trackers. Optional website analytics are described in the monitoring notice below.
3. Why we use it
- To provide Peerlyx (our contract with you): your account, wallet, deposits and withdrawals, offers, trades, escrow, chat and notifications.
- To meet legal obligations: identity verification, anti-money-laundering and sanctions checks, record keeping, and responding to lawful requests from authorities.
- For legitimate interests: keeping accounts and funds secure, preventing fraud and abuse, resolving disputes between traders, enforcing our Terms of Service, and improving Peerlyx.
- With your consent: optional features such as browser push notifications. You can withdraw consent at any time.
4. What other users see
- Your public profile shows your username, country, verification level, trading statistics and feedback.
- In a trade, the other party sees what the trade needs: your username, the trade chat and, when you are the seller, the payment details you share for that trade.
- Your email address, phone number and identity documents are never shown to other users.
5. Cookies and storage on your device
- We use one essential cookie to keep you signed in. Staff accounts use a second, separate cookie for the operations panel.
- Your browser stores a few settings on your device, such as notification and sound preferences.
- Essential sign-in cookies are needed for Peerlyx to work; signing out removes the sign-in cookie. Optional analytics storage is described below.
6. Who receives your data
We share personal data only with services that help us run Peerlyx, and only what each needs:
- Google Cloud: hosting, databases, sign-in and two-factor authentication, phone verification by SMS, and bot protection (reCAPTCHA).
- Cloudflare (Turnstile): a bot check on the sign-up form. It receives technical browser and device signals and your IP address, sets no tracking cookies and is not used for advertising.
- Google (Gemini API): the AI assistant that answers questions in the Help Centre and the support chat. Your messages, and the account details needed to answer them (such as your trades, balances and verification level), are sent to it to write a reply. The assistant can make mistakes; you can ask for a person at any time.
- Mailgun: delivering emails such as verification, sign-in alerts and withdrawal confirmations.
- Zoho Mail: our support mailbox, support@peerlyx.com.
- Didit: identity verification (your identity document, selfie and liveness video, and device and IP data).
- Valtu: the custody service that holds wallet funds, creates deposit addresses and sends withdrawals.
- Bitrefill: when you buy a gift card, the order details needed to deliver it.
- Your browser's push service (for example Google, Apple or Mozilla), and Expo with Google Firebase for the phone app: delivering push notifications if you turn them on.
- Sentry: crash and error reports from the phone app, without your name, email address, IP address or message contents.
- Other users: as described in section 4.
- Professional advisers and authorities: lawyers, auditors, and law enforcement or regulators when the law requires it or to protect users and Peerlyx.
- A buyer of our business: if Peerlyx is sold or merged, under the same protections as this Policy.
Service providers process data on our instructions and under contracts that require them to protect it. We do not sell personal data.
7. International transfers
Peerlyx runs on Google Cloud in Singapore, and some providers process data in other countries. Where data leaves your country, we rely on the safeguards the law requires, such as standard contractual clauses.
8. Public blockchains
Deposits, withdrawals and sweeps are transactions on public blockchains. Addresses, amounts and times recorded on a blockchain are public, permanent and cannot be changed or deleted by anyone, including us. A wallet address can become personal data when linked to your account, so we keep that link off-chain and protected.
9. How long we keep data
- Account, wallet and trade records are kept while your account is open and afterwards for as long as the law requires us to keep financial and anti-money-laundering records, usually five years after the account is closed or the transaction is completed.
- Trade chats and dispute evidence are kept for the same period, because they may be needed to resolve disputes or answer authorities.
- Security logs are kept for 12 months.
- When data is no longer needed, we delete it or make it anonymous.
10. How we protect it
Data is encrypted in transit and stored in access-controlled cloud databases. Staff access is limited to what each role needs, requires two-factor authentication and is recorded. Sensitive actions on your account ask for your password and authenticator code. No system is perfectly secure; if a breach affects you, we will tell you and the authorities as the law requires.
11. Your rights
Depending on where you live, you can ask us to:
- give you a copy of your personal data, or send it to another service;
- correct inaccurate data;
- delete your data, where we are not required to keep it;
- restrict or object to certain uses;
- withdraw consent you gave.
Some details can be changed in your account settings. For other requests, write to support@peerlyx.com. We may need to confirm your identity first, and we will reply within one month. You may also complain to your local data protection authority.
12. Children
Peerlyx is not for anyone under 18, and we do not knowingly collect their data.
13. Changes to this Policy
We may update this Policy. The date of the latest version appears on this page, and for important changes we will notify you by email or in Peerlyx before they take effect.
14. Contact
Peerlyx, Email: support@peerlyx.com
Website analytics and error monitoring — updated 19 October 2026
With your permission, we use PostHog (EU hosting) for website page analytics and technical browser error reports. Reports include a random browser-session identifier, browser and device type, generic page paths, referring website domain and sanitized technical error information. We do not attach your account identity to analytics. We remove query strings and identifiers from page paths, disable IP-based location enrichment, and reset the analytics identifier when you sign in or sign out.
We do not record your screen or capture form inputs, chat messages, payment details, wallet addresses, identity documents, passwords or authentication codes in PostHog. The browser connects to PostHog only after you allow analytics. PostHog necessarily receives network connection information when accepting these requests; we disable IP capture and geographic enrichment in our events.
Your analytics choice is stored on your device. If you allow analytics, an optional session-storage identifier supports page and session counts. You can decline without affecting trading, and change your choice using Analytics preferences on this page. Do Not Track and Global Privacy Control signals disable optional analytics. Withdrawing consent stops new browser analytics; it does not delete reports already collected. Contact support@peerlyx.com about data requests.
We also send sanitized, account-independent server exception summaries to PostHog to diagnose service failures. These reports contain the error category, generic route and deployed software revision, without request bodies, headers, cookies, account identifiers or raw error messages. Existing first-party security and service logs remain necessary to operate Peerlyx. Server diagnostics are used for our legitimate interest in providing a reliable service.
PostHog is an additional service provider for these purposes. Its EU hosting does not change the locations of our other providers described above.