Your data, kept minimal

This policy explains what personal data we collect when you use cryptosites.io, our accounts, listing alerts, our Telegram group and listings desk (Max), and our inquiry channels, why we collect it, and the rights you have. It is written to meet the EU and UK General Data Protection Regulation (GDPR) and applicable US privacy laws.

1. Who is responsible for your data

The controller of your personal data is CircleHash LLC, a Wyoming limited liability company doing business as CryptoSites.io, with its office at . Contact for anything about your data: privacy@cryptosites.io.

Where one of our affiliated companies in the European Union handles a transaction you are involved in, it processes your data for that transaction under this policy, and you can reach it through the same address.

2. What we collect, why, and on what legal basis

Accounts and verification. Your email address; your name, job title, phone, country of residence, date of birth, home address and the type, number, issuing country and expiry of an identity document (passport, national ID card or driver's license; we never ask for a US Social Security number); your company's details, its owners of 25% or more and its directors; what you are looking for and how you plan to fund it; your answers to our compliance questions; and the record of the agreement you sign (text version, typed name, date and time, IP address, country and browser).
Why: to confirm who you are and who owns the company, to run sanctions, fraud and risk checks, to decide on your application, to enter into and enforce the confidentiality and non-circumvention agreement, to match you with suitable sites and to keep the records the law requires.
Legal basis (EU/UK): performance of our agreement with you and steps you ask for before entering it (Art. 6(1)(b)); compliance with legal obligations, including sanctions law (Art. 6(1)(c)); and our legitimate interests in preventing fraud, protecting the site owners we introduce and defending legal claims (Art. 6(1)(f)).

Activity while signed in. The pages and listings you view while signed in, including the first time you open a site's full details, your sign-ins and your form progress.
Why: to record introductions under the agreement you sign, to secure your account and to improve the service. Legal basis: performance of the agreement and legitimate interests (Art. 6(1)(b) and (f)).

Listing alerts. Your email address, the criteria you chose, the dates you signed up and confirmed, and the country you signed up from.
Why: to email you matching listings. Nothing is sent until you confirm (double opt-in), and every email has a one-click unsubscribe link. Legal basis: your consent (Art. 6(1)(a)), which you can withdraw at any time.

Inquiry form, Telegram listings desk (Max) and messages to us. What you send us: your name, email, Telegram name, username and user ID, phone, and the details of your request or site, with the time you sent it. Before Max asks anything, you confirm you are 18 or older; that confirmation is recorded.
Why: to answer you and, if you ask, to match you with a site, buyer, landlord or provider. Legal basis: steps you ask for before a contract and our legitimate interest in answering inquiries (Art. 6(1)(b) and (f)). If you message us on Telegram or WhatsApp, those services also process your messages under their own privacy terms.

Sites you list with us. Details and photos of the site, and the contact details of the person submitting it.
Why: to review, publish (blurred and without owner details) and market the site. Legal basis: performance of our arrangement with you and legitimate interests (Art. 6(1)(b) and (f)).

Anonymous site statistics. For visitors who are not signed in we count page views, listing views, map clicks, filter use and clicks on contact buttons, with the country, device type and referring website. We do not store IP addresses or use cookies for this; each visit gets a random code that changes every day, so no one can be followed across days or websites.
Legal basis: our legitimate interest in understanding which sites and regions people are interested in (Art. 6(1)(f)).

3. Do you have to give us this data?

No law requires you to. But verification depends on it: if you do not provide the information in the verification form, we cannot review or verify your account. Alerts, the inquiry form and Max need only what each one asks for.

4. Automated checks and decisions

We check the names in your application against the U.S. OFAC sanctions lists automatically. A possible match is only a flag: a person on our team reviews every application and makes every decision. We do not make decisions about you based solely on automated processing.

5. Where data comes from

Mostly from you. To check what you tell us we may also use public sources such as company registers, sanctions lists published by governments, and your company's website and public profiles.

6. Who receives your data

We never sell personal data and never share it for marketing. It is seen by our team and by:

Service providers that process it on our behalf under contract: Cloudflare (hosting, database, email sending and receiving, security); Telegram and WhatsApp when you use them to talk to us.
Our affiliated companies, including those in the European Union, when they handle a transaction you are involved in.
A site owner, landlord, seller or provider, only when you ask us to go ahead with a specific site, and only what is needed.
Authorities, courts and professional advisers, where the law requires it or to establish, exercise or defend legal claims.

7. International transfers

We are based in the United States, and our providers run global networks, so your data is processed in the US and other countries that may not offer the same level of protection as your own. For data from the EU, EEA, UK or Switzerland, transfers to our providers are covered by the European Commission's Standard Contractual Clauses (and their UK and Swiss equivalents) in their data processing terms, and, where a provider is certified, by the EU–US Data Privacy Framework. Data you send to us directly in the US is transferred because it is necessary to provide the service you ask for. You can ask us for a copy of the safeguards.

8. How long we keep it

Accounts: while your account is open. After it is closed or an application is declined, we keep the application, screening results, signed agreements and introduction records for up to 10 years, because sanctions rules require screening records and because introductions and agreements may need to be proven, and then delete them.
Listing alerts: until you unsubscribe or ask us to delete them.
Inquiries and Max: up to 180 days after our last exchange, unless they lead to a deal (then as for accounts). Send /delete to Max to erase your Max inquiry at once.
Statistics: anonymous, with no personal data.
Sign-in links expire after 20 minutes; sessions after 30 days.

9. Security

Data is stored on Cloudflare's network, encrypted in transit and at rest. Sign-in links and session codes are stored only as one-way fingerprints, we do not use passwords, and access to account data is limited to our team through a secured admin login. If a breach affects your data and puts your rights at risk, we will tell you and the authorities as the law requires.

10. Your rights

Depending on where you live, you have the right to: access your data and get a copy; have it corrected; have it erased; restrict how we use it; receive it in a portable format (portability); object to processing based on our legitimate interests; and withdraw consent at any time, without affecting what was done before. Some data we must keep (see section 8) even if you ask us to delete it; we will tell you if so.

To use any of these rights, email privacy@cryptosites.io from the address on your account, or tell us how to confirm it is you. We answer within one month. There is no charge.

If you are in the EU, EEA or UK you also have the right to complain to a data protection authority, especially in the country where you live or work, or where you think the problem occurred. We would appreciate the chance to sort it out with you first.

US residents: where a US state privacy law applies to you, you may request access, correction and deletion in the same way, and we will not treat you differently for doing so. We do not sell or "share" personal data for targeted advertising.

11. Cookies and storage on your device

Visitors who are not signed in get no cookies. Signed-in members get one strictly necessary cookie (cs_s) that keeps them signed in for up to 30 days; it cannot be switched off without signing out. Your browser also remembers a few preferences on your device (for example light or dark mode), which never leave it. We use no advertising or third-party tracking cookies, and our pages load all fonts, scripts and map files from our own site, so your browser does not contact other companies when you visit. The office map on our About page loads Google Maps only if you click it.

12. Age

Our services are for adults acting for themselves or a business. You must be 18 or older (or the age of majority where you live). We do not knowingly collect data from children.

13. Changes

We will update this policy when our services or the law change, and show the date of the latest version below. If a change significantly affects how we use account data, we will tell account holders by email.

14. Contact

CircleHash LLC, doing business as CryptoSites.io ·
Email: privacy@cryptosites.io · or message us via the Telegram link at the top of this page.

Last updated: October 3, 2026