CurrenSea (“CurrenSea,” “we,” “our,” or “us”) operates a premium Over-the-Counter (OTC) trading platform that enables individuals and institutions to convert INR to stablecoins such as USDT, and vice versa, through secure bank-settled transactions and self-custodied Web3 wallets.

This Privacy Policy explains how we collect, process, store, and protect your personal and financial information when you use currensea.in, our web applications, and any related services. Our practices are aligned with the Digital Personal Data Protection (DPDP) Act, 2023, the Prevention of Money Laundering Act (PMLA), 2002, applicable FIU-IND guidelines, and internationally recognized ISO/IEC 27701 (Privacy Information Management) and ISO/IEC 27001 (Information Security Management) principles.

To deliver a secure, compliant, and reliable trading experience, CurrenSea collects the following categories of information:

• Identity & Profile Data

  Full legal name, date of birth, nationality, email address, mobile number, and — for corporate accounts — business entity details such as CIN, GSTIN, authorized signatories, and ultimate beneficial ownership information.

• KYC & AML Verification Data

  Government-issued identification (PAN, Aadhaar reference, Passport, Driving Licence), proof of address, selfie and liveness verification captures, and sanctions / PEP screening outcomes processed through accredited third-party verification providers.

• Financial & Settlement Data

  Bank account number, IFSC code, UPI identifiers, payment proof uploads (bank slips, UTR screenshots), transaction UTR / reference numbers, order history, and public blockchain wallet addresses used to receive or send stablecoins.

• Wallet & Web3 Data

  Public wallet addresses provisioned or linked through our embedded wallet provider (Privy), signed message payloads used purely for authentication, and on-chain transaction hashes associated with your CurrenSea orders. CurrenSea never has access to your private keys or seed phrases.

• Technical & Device Data

  IP address, browser type and version, device identifiers, operating system, session timestamps, referral codes, cookie identifiers, and interaction events used for fraud detection, analytics, and service performance monitoring.

• Support & Communication Data

  Service request tickets, attachments you upload, chat transcripts with our concierge support team, and email correspondence sent to or received from CurrenSea.

We process your personal data only for clearly defined, lawful purposes, including:

• Executing, settling, and confirming your Buy, Sell, and Swap orders between INR and supported digital assets such as USDT.
• Verifying your identity and performing enhanced due diligence (KYC, KYB, AML, and sanctions screening) as required by Indian regulators and FIU-IND reporting obligations.
• Preventing fraud, impersonation, account takeover, payment reversal abuse, chargebacks, and on-chain illicit-fund exposure.
• Operating, maintaining, and improving the CurrenSea platform — including quote pricing, transaction routing, bank-rail reconciliation, and user interface improvements.
• Communicating service updates, transaction confirmations, compliance notices, and responding to your support tickets.
• Maintaining tamper-evident audit logs and record-keeping as mandated by PMLA (five-year retention) and tax authorities.

Our legal bases include your consent, performance of our contract with you, compliance with legal obligations, and our legitimate interests in operating a secure and lawful trading platform.

CurrenSea applies a layered set of technical and organizational controls aligned with ISO/IEC 27001:

• Encryption at Rest & in Transit

  Sensitive data is encrypted using AES-256 at rest. All browser-to-server traffic is secured with TLS 1.2+ and HSTS; authenticated API calls include a bearer access token scoped to your session.

• Field-Level Tokenization

  High-sensitivity identifiers such as PAN and Aadhaar reference numbers are hashed or tokenized before persistence, so they cannot be read by developers or support staff in plain text.

• Role-Based Access Control

  Internal access to systems containing personal data is restricted on a strict need-to-know basis, enforced through role-based access control, mandatory multi-factor authentication, and continuous access reviews.

• Non-Custodial Settlement

  USDT and other digital assets are released directly to the wallet address you control. CurrenSea does not custody your funds beyond the brief settlement window required to execute your order.

• Secure Payment Proof Handling

  Payment-proof images are uploaded directly to our hardened object storage layer with server-side encryption, scoped signed URLs, and strict object-level access policies.

• Session Integrity

  Access tokens are bound to the active browser session, invalidated on logout, and rotated when wallet or account state changes. Suspicious sessions can be revoked by our security team.

CurrenSea does not sell your personal data. We disclose personal data only to the limited categories of recipients required to operate the service:

• Licensed KYC & AML providers: Perform identity verification, liveness detection, and sanctions / PEP screening on our behalf.
• Banking & payment partners: Involved in collecting INR deposits and reconciling bank transfers (IMPS, NEFT, RTGS).
• Liquidity & settlement partners: Help us source competitive quotes and settle digital-asset legs of your orders.
• Infrastructure & analytics providers: Cloud hosting, embedded wallet infrastructure (Privy), email delivery, product analytics, and error monitoring.
• Regulators, law enforcement, and auditors: Where disclosure is required by law, court order, or legitimate compliance request.

All processors are bound by written data-processing agreements that obligate them to equivalent confidentiality and security standards.

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected and to meet statutory obligations:

• KYC records and transaction logs are retained for a minimum of five (5) years from the date of the last transaction, as required under PMLA.
• Account support history and audit trails are retained for the life of your account and for a reasonable period thereafter for fraud prevention and dispute resolution.
• Marketing-preference data is retained only while you remain opted-in.

Once retention periods expire, we securely anonymize or permanently erase personal data using industry-standard cryptographic and destruction methods.

Subject to applicable law, you may:

• Access the personal data CurrenSea holds about you.
• Request correction of inaccurate or outdated information.
• Request a portable export of your transaction history and profile data.
• Withdraw consent for optional processing (such as marketing communications).
• Request closure of your CurrenSea account, subject to our statutory record-keeping obligations.
• Lodge a grievance with our Data Protection Officer, or with the Data Protection Board of India once operational.

To exercise any of these rights, write to privacy@currensea.io. We will respond within statutory timelines after verifying your identity.

CurrenSea uses strictly necessary cookies and browser local storage to keep you signed in, remember your preferences, and secure your session. Your access token is stored in local storage so the platform can authenticate API requests on your behalf; tab and draft-order state is held in session storage to preserve work in progress.

A small number of analytics and anti-abuse cookies help us detect fraud, prevent CSRF and replay attacks, and understand aggregated product usage. Clearing site storage will log you out and remove any unsaved drafts.

CurrenSea does not knowingly offer services to, or collect data from, individuals under the age of 18. Any account identified as belonging to a minor will be suspended and its data erased in accordance with applicable law.

We may update this Privacy Policy from time to time to reflect changes in regulation, product scope, or security practices. The revised version will be posted on this page with an updated “Last Updated” date. Material changes will be communicated to you via email or an in-app notice.

For privacy questions, data subject requests, or grievance redressal, please reach out to our security and compliance team: