1. Who we are
The controller of your personal data is Chain Bridge Corp., a corporation organized under the laws of the Republic of Panama, registered in the Public Registry of Panama under commercial folio No. 155790121, with its registered address in Panama City, Panama Province. Its resident agent is Pacifica Legal. We offer the Ursus service (the "Service"): a custodial crypto wallet and a crypto-linked payment card, available through our website and app. In this policy, "we", "us" and "Ursus" mean Chain Bridge Corp.
Privacy and legal contact: [email protected] · Website: ursus-wallet.com
2. Data we collect
| Category | Examples | Source |
|---|---|---|
| Account data | Email, phone number, password hash, 2FA settings, language | You |
| Identity data (KYC) | Full name, date of birth, nationality, residential address, ID document type, number, issue and expiry dates, photo of the document, selfie and liveness video, facial geometry derived from them | You, verification provider |
| Due-diligence data | Source of funds and wealth, occupation, expected account activity, tax residence, politically exposed person (PEP) status | You, screening databases |
| Screening results | Sanctions, PEP and adverse-media matches, fraud and risk scores | Screening providers |
| Wallet and transaction data | Deposit and withdrawal addresses, blockchain transaction hashes, amounts, timestamps, swap and card transactions | You, blockchain, our systems |
| Card data | Card status, masked card number, merchant name, amount, currency, location of transaction, delivery address for a physical card | You, card issuer, payment networks |
| Technical data | IP address, device identifiers, browser, operating system, approximate location, session logs | Your device |
| Communications | Support tickets, emails, call recordings if any | You |
We do not knowingly collect special-category data (health, religion, political views) except where it is revealed by an identity document or by a PEP check, and we use it only for compliance.
3. How we use your data
- To create and operate your wallet, execute transfers and swaps, and issue and manage your card.
- To verify your identity, assess risk, screen against sanctions and monitor transactions.
- To prevent fraud, abuse and unauthorized access, including device and behavior analysis.
- To provide support, send service and security notices, and handle disputes and chargebacks.
- To meet tax, accounting, regulatory and court-order obligations.
- To improve and secure the Service using aggregated or de-identified data.
We do not sell your personal data. We do not use KYC documents or biometric data for advertising or profiling unrelated to compliance and fraud prevention. Marketing messages are sent only with your consent where required, and you can opt out at any time.
4. Who we share data with
We share data only as needed, with:
- Verification, screening and analytics providers (section 3).
- Card issuer, program manager and payment networks, who need your identity and transaction data to issue and operate the card. They process it under their own privacy notices as independent controllers.
- Custody, liquidity and infrastructure providers: custodians, liquidity venues, cloud hosting and communications providers that help us run the Service.
- Professional advisers: auditors, lawyers, compliance consultants, bound by confidentiality.
- Authorities: financial intelligence units, regulators, tax authorities, law enforcement and courts, when the law requires or permits it.
- Corporate transactions: a successor entity, if we merge, are acquired or sell assets, on equivalent privacy terms.
Blockchain transactions are public and permanent. Once a transfer is broadcast, the address, amount and hash are visible to anyone and cannot be erased by us.
5. International transfers
We are based in Panama, and our providers may be located elsewhere, including the European Economic Area, the United Kingdom and the United States. Where required, we transfer data under safeguards such as standard contractual clauses or equivalent contractual protections, and we require recipients to protect your data to the standard described here.
6. Security
We use encryption in transit and at rest, strict role-based access to KYC data, multi-factor authentication for staff, segregated storage for identity documents, audit logging and regular security testing. Customer crypto-assets are held under the controls described in the Terms of Use. No system is fully secure: protect your password and two-factor device, and tell us immediately at [email protected] if you suspect unauthorized access. If a breach is likely to harm you, we will notify you and the competent authority as required by law.
7. Your rights
Under Panama's Personal Data Protection Law (Law 81 of 2019) and its regulations, and under the GDPR/UK GDPR where they apply to you, you may request:
- access to your data and a copy of it;
- correction of inaccurate data;
- deletion, where we have no legal ground to keep it;
- objection to or restriction of processing based on legitimate interests;
- data portability, where it applies;
- human review of an automated KYC decision;
- withdrawal of consent where processing is consent-based.
Write to [email protected]. We reply within 30 days and may ask you to prove your identity first. Limits: we cannot delete or hand back data that we must keep under AML and tax law (section 3), and we cannot tell you whether we filed a suspicious-activity report. If you are unhappy with our answer, you may complain to Panama's data protection authority (ANTAI) or, if you live in the EU/UK, to your local supervisory authority. California residents may have additional rights under the CCPA/CPRA; we do not sell or share personal data for cross-context advertising.
8. Cookies and similar technologies
We use cookies and similar technologies (pixels, local storage, software kits) in three groups.
- Strictly necessary. Login, session security, fraud prevention and remembering your cookie choice. These cannot be switched off.
- Analytics (Google). With your consent, we use Google Analytics, provided by Google LLC (Google Ireland Limited for users in the EEA and the UK), to understand how the site is used. It sets cookies such as _ga and _gid and collects page views, device and browser data, and your IP address (shortened where possible).
- Advertising and measurement (Google and Facebook). With your consent, we use Google tags (Google Ads conversion tracking) and the Meta (Facebook) Pixel, provided by Meta Platforms Ireland Limited and Meta Platforms, Inc., to measure the results of our ads and to show our ads to people who visited our site. They set cookies such as _gcl_au, _fbp and _fbc and may receive event data such as page views and sign-up events. Google and Meta act as independent controllers under their own privacy policies.
We do not load Google advertising tags or the Meta Pixel on pages where you are logged in or upload identity documents, and we never send Google or Meta your identity documents, wallet balances, transaction details or wallet addresses.
You can accept or reject non-essential cookies in the cookie banner and withdraw consent at any time, and you can block cookies in your browser. You can also use Google Ads Settings, the Google Analytics opt-out add-on and Facebook ad preferences. Read how Google and Meta use data in the Google Privacy Policy and the Meta Privacy Policy. If you opt out, you may still see ads, but they will not be based on your activity on our site.
10. Changes to this policy
We will post updates on this page with a new "Last updated" date and notify you of material changes by email or in the app before they take effect.
11. Contact
Chain Bridge Corp. (Ursus), registered office: Panama City, Panama Province, Republic of Panama · Email: [email protected] · Website: ursus-wallet.com · Panama commercial folio No. 155790121.