Introduction and Scope

This Privacy Policy explains how CryptoRamphub ("CryptoRamphub," "we," "us," or "our") collects, uses, shares, and protects personal information when you use our website at cryptoramphub.com, our mobile applications, and our crypto on-ramp, off-ramp, card, and cash-out services (collectively, the "Services").

This policy applies to all users of the Services, including visitors, registered users, and cardholders. It does not apply to third-party websites or services that we do not control, even if they are linked from our Services.

By using the Services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our practices, do not use the Services.

Information We Collect

We collect information in three ways: information you provide directly, information collected automatically, and information received from third parties.

Information You Provide

• Identity and contact data: name, email address, phone number, date of birth, residential address, and government-issued identification numbers.
• Verification data: photographs of government-issued IDs, proof of address documents, and, where required, a selfie or liveness check to verify identity.
• Financial data: bank account details, payment card numbers, transaction history, source-of-funds information, and tax identification numbers.
• Transaction data: crypto asset types, amounts, wallet addresses, on-ramp and off-ramp orders, card transactions, and cash-out requests.
• Communications: messages you send to support, survey responses, and records of calls where permitted by law.

Information Collected Automatically

When you use the Services, we collect device and usage data, including IP address, device type and operating system, browser type, pages viewed, referring URLs, and timestamps. We collect this data using cookies and similar technologies as described in the Cookies and Third-Party Services section below.

Information from Third Parties

We receive information from identity verification providers, payment processors, banking partners, card networks, blockchain analytics providers, and fraud prevention services. This may include verification results, risk scores, and sanctions or politically exposed person screening outcomes.

We do not intentionally collect information from children under 18. Our Services are not directed to minors.

How We Use and Process Your Information

We use personal information to:

• Provide the Services: process on-ramp and off-ramp orders, issue and manage cards, execute cash-out requests, and maintain your account.
• Verify identity and comply with law: conduct know-your-customer (KYC), anti-money laundering (AML), sanctions screening, and transaction monitoring as required by applicable regulations.
• Prevent fraud and secure the Services: detect and investigate suspicious activity, unauthorized access, and misuse of the Services.
• Communicate with you: send transaction confirmations, service notices, security alerts, and respond to your inquiries. With your consent where required, we may send marketing communications; you can opt out at any time.
• Improve the Services: analyze usage trends and troubleshoot technical issues.
• Enforce our terms: investigate violations of our Terms of Service and protect our legal rights.

We process personal information on the following legal bases, where applicable: performance of a contract, compliance with legal obligations, our legitimate interests (such as fraud prevention and service improvement), and your consent. Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.

We retain personal information for as long as needed to provide the Services and to meet legal, regulatory, and tax obligations. Records related to identity verification and transactions are typically retained for at least five years after the account is closed, or longer where required by law.

How We Share Information

We do not sell your personal information. We share it with:

• Service providers: identity verification vendors, payment processors, banking partners, card issuers and networks, cloud hosting providers, and customer support tools, under contracts that limit their use of your information to providing services to us.
• Financial and regulatory partners: banks, liquidity providers, and blockchain analytics firms as needed to process transactions and meet compliance obligations.
• Legal and safety: law enforcement, regulators, and courts when required by law or when we believe disclosure is necessary to protect rights, safety, or property.
• Business transfers: in connection with a merger, acquisition, financing, or sale of assets, subject to standard confidentiality protections.

We may also share aggregated or de-identified information that cannot reasonably be used to identify you.

Data Security Measures

We use administrative, technical, and physical safeguards designed to protect personal information, including:

• Encryption of data in transit using TLS and encryption of sensitive data at rest.
• Access controls, multi-factor authentication for personnel, and role-based permissions.
• Network monitoring, logging, and intrusion detection.
• Regular security assessments and vendor due diligence.
• Employee training on privacy and information security.

No method of transmission or storage is completely secure. We cannot guarantee absolute security, and you are responsible for keeping your account credentials confidential. If we become aware of a breach affecting your personal information, we will notify you and regulators as required by applicable law.

Your Rights

Depending on your location, you may have some or all of the following rights:

• Access: request a copy of the personal information we hold about you.
• Correction: request correction of inaccurate or incomplete information.
• Deletion: request deletion of your personal information, subject to legal retention requirements.
• Portability: request a machine-readable copy of certain information you provided.
• Restriction and objection: request that we restrict or stop certain processing.
• Opt-out of marketing: unsubscribe from marketing communications at any time.

To exercise these rights, contact us using the details in the Contact section below. We will verify your identity before fulfilling a request, which may require you to log in or provide identifying information. We will respond within the time required by applicable law. You may also designate an authorized agent to make a request on your behalf, subject to verification.

California residents (CPRA): You have the right to know what personal information we collect, use, and disclose; to delete; to correct; to opt out of the sale or sharing of personal information (we do not sell or share personal information as those terms are defined by the CPRA); to limit the use of sensitive personal information; and to be free from discrimination for exercising your rights. To exercise CPRA rights, contact [email protected].

Cookies and Third-Party Services

We use cookies and similar technologies to keep you signed in, remember preferences, measure site performance, and detect fraud. You can manage cookies through your browser settings; disabling certain cookies may affect how the Services work.

We use third-party services for identity verification, payment processing, card issuing, fraud prevention, analytics, and customer support. These providers may set cookies or collect information when you interact with their components of the Services. Their privacy policies govern their own practices.

Some jurisdictions require us to honor browser-based opt-out preference signals, such as Global Privacy Control. We honor such signals where required by law.

International Transfers

We may process and store personal information in the United States and other countries where our service providers operate. Where we transfer information from jurisdictions with data protection laws, we use appropriate safeguards, such as standard contractual clauses, as required.

Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through the Services before the changes take effect. The "Last updated" date below reflects the most recent revision.

How to Contact Us for Privacy Inquiries

If you have questions about this Privacy Policy, want to exercise your rights, or have a privacy complaint, contact us:

• Privacy email: [email protected]
• Phone: +1 (415) 555-0198
• Mailing address: 1712 20th Street, Suite 300, San Francisco, CA 94107

We will review and respond to privacy inquiries in accordance with applicable law.

Last updated: October 29, 2026