Privacy policy

The controller of your personal data is the operator of GlobalSwap, the service at globalswap.io.

You can reach the operator at support@globalswap.io or with a support request at globalswap.io/support, also for every question about your data.

You can use GlobalSwap without an account. We don't ask for your name, your phone number or identity documents. A partner may ask for them under its own policy, as our AML and verification policy explains.

Anyone who has your swap's tracking link can open its page and see the swap's details, including your addresses. Keep the link private.

To create the swap at the partner you chose, record which terms you accepted, show you its progress and help you if something goes wrong, we process:

• the coins, networks, amounts and rate type you chose, the partner and, with Trocador, the exchange that carries out your swap;
• your receiving address and memo, and your refund address and memo if you entered them;
• the language of the page;
• the date of the version of our terms you accepted, and when you accepted it;
• a scrambled version (a hash) of the code in your tracking link, never the code itself;
• what the partner tells us about your swap: its swap ID, the address to send to and its memo, any time limit, the amounts and the status history;
• the transaction IDs, and the link to the partner's own page for your swap;
• notes our team adds when it looks into your swap;
• a technical record of each attempt to create a swap, so that the same swap is never created twice. It can briefly hold your addresses.

We ask for your email address only for a support request. It identifies your request, and our team may use it to write to you about it from support@globalswap.io. We send no newsletters and no advertising.

We don't pass your email address on to the partner exchanges.

Our swap form doesn't ask for an email address, and our website sends no emails. Our replies to support requests appear on the request's page.

To limit abuse, we count new support requests per email address for one day. The counter holds only a scrambled version (a hash) of the address.

We use the data of a support request to answer you and, where needed, to look into your swap with the partner.

If you give your swap's tracking link, or the swap was created or opened in this browser, we use that only to confirm that the swap is yours. We don't store the link.

Before we save your messages, we remove anything that looks like a seed phrase or private key. Anyone who has your request's private link can read the conversation, so keep it private.

To keep out automated spam, your browser solves a small task before it sends the form. We check the result against a scrambled version of your browser type and language settings, and we store neither.

For a support request, we process:

• your email address, the topic, the language of the page and the swap ID you give us;
• the messages of the conversation, including our team's replies;
• your conversation with the help assistant, if you send it with “Talk to a person”;
• whether you showed, with the tracking link or this browser, that the swap you named is yours;
• a scrambled version (a hash) of the code in your request's private link;
• notes of our team, and which team member handles your request.

The help assistant answers from our help articles, on our server, and shows “Help search” while it does. No AI provider receives your questions.

To find an answer, your browser sends us your question, the last turns of the conversation and the page you are on. We don't store or log them.

If you ask about a swap created or opened in this browser, your browser also sends the ID and tracking code of up to three such swaps. We use them only to look up their status, as the swap's page does.

The conversation stays in this browser tab until you close it. Please don't enter personal data, seed phrases or private keys. “Talk to a person” turns the conversation into a support request, after you confirm.

If we switch on an AI model later, the assistant will say so, and we will first name its provider in this policy.

When you open a page, your browser sends your IP address and technical data, such as the page address and your browser type. Our hosting provider, Vercel, uses them to deliver the website and to protect it from attacks.

When you ask for offers, our server asks the partners. SideShift.ai, if it offers the coins you chose, receives your IP address with that request (see “Who receives data”). Vercel also tells our server the country of your IP address. We use it only to leave out partners whose terms exclude that country, and we don't store it.

Vercel keeps logs of these requests for us for one hour. They contain the full address of each request, your IP address and your browser type. Vercel's own use of data about its service is covered by its privacy policy.

Answers to “Was this helpful?” under our guides are stored without cookies and without personal data.

Our database never stores your IP address in readable form. We keep scrambled versions (hashes), made with a secret key. Because we could compare them with a known IP address, we treat them as personal data. We use them:

• for one to two days, in counters that limit how often one connection can create swaps or send support requests;
• for 90 days, shortened, in our security log for each swap created;
• for up to 90 days after a failed sign-in to our admin area, as one hash of the IP address and the email address entered, to stop password guessing.

To learn how many people visit the website and which pages they read, we use Vercel Web Analytics, a service of our hosting provider. It sets no cookies and stores nothing on your device.

When you open a page, a script from our own website sends Vercel the page's address, without any part after a question mark or hash sign. It also sends the website you came from, if you followed a link from another website, and the script's version. From the request itself, Vercel records your browser, operating system and type of device, and the approximate location of your IP address (country, region and city). The statistics don't contain the IP address itself.

To count visitors without a cookie, Vercel makes a scrambled value (a hash) from the request and discards it after 24 hours. We see only numbers, for example visitors per page, country or browser.

We don't count the pages of single swaps and support requests: swap details, a swap's page and receipt, tracking, support requests and our admin area. We count nothing when your browser sends a Global Privacy Control or Do Not Track signal.

Vercel keeps these statistics for at least one month and may keep them longer.

Our Telegram bot answers a message such as 0.1 btc eth with our partners' current offers and a link to swap on our website. It answers only when you write to it.

When you write to the bot, Telegram sends us your message, the ID of your chat and the language setting of your Telegram app. It also sends your Telegram name and username, which we don't use.

We use your message only to answer it and don't store it. Our logs record only the kind of answer and its language, never your chat ID, name or message.

To limit how often one chat can ask, our server keeps a scrambled version (a hash) of your chat ID in its working memory, never in our database. It is gone when that server restarts.

The bot asks our partners for offers without any data about you. Telegram processes the conversation under its own privacy policy.

Your browser keeps some data for this website: the swaps and support requests created or opened in it, with their private codes, and your appearance setting. While you create a swap or use the help chat, your entries stay in that browser tab until you close it. The cookie policy lists each item and how long it stays.

We don't ask for your consent for any processing. We process personal data only for these purposes and on these legal bases under the GDPR:

• creating the swap you ask for at the partner you chose, checking your addresses, and showing and following its progress: Article 6(1)(b), because this is our service to you and the steps you ask for before it;
• answering support requests and questions to the help assistant: Article 6(1)(b) where they concern a swap or our service to you, otherwise Article 6(1)(f), our legitimate interest in answering you;
• sending your IP address to SideShift.ai when you ask for offers or create a swap with it: Article 6(1)(b), as a step you ask for before a swap, because SideShift.ai gives offers only with your IP address;
• delivering the website, protecting it, our partners and our customers against attacks and abuse, limiting requests and keeping our security log: Article 6(1)(f), our legitimate interest in a safe, working service;
• short notices to our team in Discord: Article 6(1)(f), our legitimate interest in noticing new swaps, problems and support requests quickly;
• storing data on your device, as listed in the cookie policy: it is strictly necessary for a service you ask for (Article 5(3) of the ePrivacy Directive and the national laws based on it);
• complying with a legal duty, for example a binding order from an authority: Article 6(1)(c);
• passing information to a partner or an authority to prevent fraud or other crime: Article 6(1)(f), our legitimate interest and that of the people affected;
• recording which version of our terms you accepted and when, and keeping a swap or support request that we need for a legal claim: Article 6(1)(f), our legitimate interest in establishing, exercising or defending legal claims;
• using the country of your IP address to leave out partners whose terms exclude that country: Article 6(1)(f), our legitimate interest in keeping to our partners' terms and in showing you only offers from partners that serve you;
• counting visits for our visitor statistics, without cookies: Article 6(1)(f), our legitimate interest in knowing how the website is used and how visitors find it, so that we can improve it;
• answering your messages to our Telegram bot: Article 6(1)(b), as a step you ask for before a swap.

We pass on personal data only where it is needed for the purposes in this policy:

• The partner you choose receives what it needs to carry out your swap: coins, networks, amounts, rate type, your receiving address and memo, and your refund address and memo if you entered them. Each partner uses this data under its own privacy policy, linked on the Partners page. A partner may check the data against sanctions lists and share it with authorities.
• Trocador passes each swap to another exchange, named in the offer. That exchange receives the same data as Trocador, under its own terms and privacy policy.
• If the offer you chose is from ChangeNOW or Trocador, that partner also checks each receiving and refund address you type in, before you create the swap. It receives the address with its coin and network, even if you never create the swap.
• SideShift.ai (Paradigm Ltd) also receives your IP address when we ask it for offers. We ask it only when you ask for offers yourself: for example when you change the amount or the coins, press “Swap” or open the “Swap details” page. While those offers stay on screen, we refresh them about every 30 seconds, again with your IP address.
• We also send SideShift.ai your IP address when we check whether it serves your country, and when you create a swap with it, together with our swap ID. SideShift.ai uses the address to apply its country rules and its limits per visitor. No other partner receives your IP address.
• Vercel Inc. (USA) hosts the website and runs our server functions, so all data you send to the website passes through Vercel. Vercel also makes our visitor statistics (see “Visitor statistics”).
• Supabase stores our database, with swaps, support requests, our security log and our team's accounts, on servers in Frankfurt, Germany.
• Discord, a US service, carries short notices to our team and processes them under its own privacy policy. For swaps, the notices show the swap ID, coins, networks, amounts, rate type, partner, the partner's swap ID and status times.
• For support requests, the Discord notices show the request ID, topic, language, swap ID, whether that swap is verified as yours, where the request came from and its status. Discord notices never contain wallet addresses, memos, email addresses, tracking links or the text of your messages.
• Microsoft hosts our mailbox support@globalswap.io. It receives the emails you send us and our replies.
• Courts, police and other authorities receive data only when the law requires us to share it, or when we believe this is needed to prevent fraud or other crime. In those cases, and when we look into your swap for you, we may also pass information to its partner.
• We use no AI provider and no service that sends emails automatically.
• Telegram carries the messages between you and our Telegram bot and processes them under its own privacy policy.

Vercel runs our server functions in Frankfurt, Germany. It delivers pages through servers in many countries, so your IP address and the address of the page you open can also be processed outside the European Union. Our database is stored in Frankfurt, Germany.

Vercel Inc. and Microsoft are based in the USA and certified under the EU-U.S. Data Privacy Framework. The European Commission has decided that this framework protects personal data adequately (Decision (EU) 2023/1795).

Discord processes our team notices in the USA. It relies on the same framework and on the EU standard contractual clauses.

Supabase, Inc. is a US company. Where its staff access our database from outside the EU, for example for support, it uses the EU standard contractual clauses (Decision (EU) 2021/914).

Some partners are based outside the EU, in countries without an EU adequacy decision. For example, ChangeNOW's company is registered in Saint Vincent and the Grenadines, and SideShift.ai gives an address in Saint Kitts and Nevis.

We send your data to the partner you chose, also for the address check before the swap, and your IP address to SideShift.ai when you ask for offers. We do this because it is necessary for the swap you ask for (Article 49(1)(b) GDPR). The law in those countries may protect your data less than EU law does.

Telegram processes the conversation with our Telegram bot under its own privacy policy, also outside the EU. We send our answers through Telegram because you asked there (Article 49(1)(b) GDPR).

You can ask us for a copy of the safeguards named here at support@globalswap.io.

Our server deletes data automatically once a day, so data can remain up to about one day after the periods below:

• swaps that ended (done, refunded, failed or expired): 7 days after their status last changed;
• swaps still waiting for a deposit: 7 days after they were created;
• every swap, also one that is still open or paused for a check: 30 days after it was created, at the latest;
• the technical record of each attempt to create a swap: at the first daily clean-up after one hour;
• closed support requests: 7 days after you sent them, or at the next daily clean-up after we close them if that is later;
• every other support request: 30 days after you sent it, at the latest;
• counters against abuse, which hold a scrambled version (a hash) of your IP address or email address: after one to two days;
• our security log: after 90 days. It records events such as a swap being created, with a shortened scrambled version of the IP address that created it, and sign-ins to our admin area. It holds no wallet addresses, customers' email addresses or tracking links;
• request logs at our hosting provider: after one hour;
• notices in our team's Discord: deleted together with the swap or support request (some notices posted before 18 October 2026 are not deleted automatically);
• a swap or support request that we need to meet a legal duty or for a legal claim: until that need ends, even beyond the periods above, with its Discord notices (Article 17(3)(b) and (e) GDPR);
• emails you send to support@globalswap.io: we delete them once your question is settled, unless we need them to meet a legal duty or to defend a legal claim;
• visitor statistics at Vercel: the hash that counts a visitor, after 24 hours; the statistics themselves are kept for at least one month, and Vercel may keep them longer;
• messages to our Telegram bot: not stored; the scrambled chat ID for its limits stays only in the server's working memory until that server restarts;
• copies in our database provider's backups and logs: until they expire under that provider's own periods;
• data on your device: until you remove it, as described in the cookie policy;
• partners keep their own records of your swap under their own privacy policies, linked on the Partners page.

You don't need to enter any personal data to compare offers. When you ask for offers that include SideShift.ai, it receives your IP address, as described under “Who receives data”.

To create a swap, you must enter a receiving address. Without it, we can't create the swap. If that address needs a memo, for example because it belongs to an account at an exchange, enter the memo too. We can't tell whether it needs one, and without it your coins can be lost.

A refund address is optional, except for swaps with SideShift.ai, which needs one for every swap.

For a support request, you must give an email address. Without it, we can't accept the request.

We make no decisions about you that are based solely on automated processing and have legal or similarly significant effects (Article 22 GDPR). Sorting offers by the amount you get is not a decision about you.

Partners may run automated checks under their own policies.

Under the GDPR, you can ask for access to your data and a copy of it (Article 15), and for its correction (Article 16), deletion (Article 17) or restricted use (Article 18).

You can also receive the data you gave us for a swap or a support request in a common, machine-readable format, or have it sent to another provider (Article 20).

To use these rights, write to support@globalswap.io or send a support request at globalswap.io/support. We have no accounts, so please add your swap ID or request ID. To protect your data, we may ask you to send your request through the support form, with your swap's tracking link, so we can confirm that the swap is yours.

We answer without undue delay and within one month at the latest, unless the law allows more time for a complex request (Article 12(3) GDPR). We can't restore or send you data we have already deleted.

Partners keep their own records of your swap. Ask them directly, through the links on the Partners page.

You can also complain to a data protection supervisory authority, in particular in the EU country where you live, where you work or where you think the law was broken (Article 77 GDPR).

Where we rely on our legitimate interests (Article 6(1)(f) GDPR), you can object at any time, on grounds relating to your particular situation (Article 21 GDPR).

We then stop, unless we show compelling legitimate grounds that override your interests, rights and freedoms, or we need the data to establish, exercise or defend legal claims.

To object, write to support@globalswap.io. You can also ask us there how we weighed our interests against yours.

We don't sell personal data and don't use it for advertising. If you open a block explorer or a partner's page from your swap's page, that website's own privacy policy applies.

We publish every change of this policy on this page, with a new date. If we want to use your data for a new purpose, we tell you here before we start.