Privacy policy

Data controller and contact

ClearFiat is a service for converting crypto-assets into fiat currency. The data controller is the operator identified in the legal notice, which sets out its name, postal address and contact address. Send any questions relating to your personal data to that email address. No data protection officer has been appointed: the activity involves neither systematic large-scale monitoring of individuals nor processing of sensitive data within the meaning of Article 9 of the RGPD. Requests are handled directly by the operator.

• Data controller: the operator identified in the legal notice
• Contact address for data-related questions: the one published on the legal notice page
• Data protection officer: none has been appointed

Data we process

We only collect what is necessary for the operation of the service. An email address and a password are essential to open an account. The details of the receiving account are essential to execute the payment: without them, the conversion cannot be paid. The receiving methods available are SEPA transfer, SWIFT transfer and PayPal, and we only record the details corresponding to the method you choose. Identity details are only requested above the annual threshold described below, and refusing them results in the refusal of the transaction. No data is collected for advertising or statistical purposes.

• Account: email address, scrypt hash of the password, sessions, recovery codes
• Logs: security events linked to your account
• Transactions: quotes, chosen asset and network, amounts and currencies, deposit addresses, deposits observed, payment references, status history
• Payment: details of the receiving account you designate, stored encrypted, namely the IBAN and BIC for a SEPA transfer, the international bank details for a SWIFT transfer, or the account identifier for PayPal
• Identity: information requested solely for enhanced verification, beyond the equivalent of 12 000 EUR converted per year.

Purposes and legal bases

Each processing operation serves a specific purpose and has its own legal basis. The opening of the account, the quotation, the monitoring of the deposit and the payment of funds are based on the performance of the contract you enter into with the operator. The security of the service, the prevention of fraud and the control of execution parameters are based on the legitimate interest of the operator, details of which are provided below. The retention of accounting supporting documents meets a legal obligation. No processing is based on your consent: ClearFiat does not send any commercial prospecting and does not place any trackers subject to consent. You may obtain upon request the details of the balancing test carried out for processing based on legitimate interest.

• Creation and management of the account, authentication, sessions and recovery codes: performance of the contract, Article 6(1)(b) of the RGPD
• Quotation, deposit address, detection of the deposit, calculation of fees and payment in fiat currency: performance of the contract, Article 6(1)(b)
• Encrypted recording of the receiving account details and execution of the SEPA transfer, SWIFT transfer or PayPal payment: performance of the contract, Article 6(1)(b)
• Logging of security events, protection against unauthorised access and prevention of payment fraud: legitimate interest, Article 6(1)(f)
• Control of amount limits and of the maximum spread of 150 basis points between price providers: legitimate interest, Article 6(1)(f)
• Identity verification beyond the annual threshold: legitimate interest relating to the prevention of fraud, Article 6(1)(f)
• Retention of accounting and supporting documents: legal obligation, Article 6(1)(c)

Human verification and identity threshold

Fiat currency payments are triggered manually by the operator, after verification of the transaction, and no automatic reconciliation is carried out between the received transaction and the order. Beyond the equivalent of 12 000 EUR converted per year, enhanced identity verification is requested before proceeding. This verification is a fraud prevention measure decided by the operator and based on its legitimate interest: it does not constitute the performance of a legal obligation, the operator not currently holding an authorisation as a crypto-asset service provider. If such authorisation were obtained, the associated legal basis and retention period would change and this page would be updated. No decision producing legal effects concerning you is taken solely on the basis of automated processing, and no profiling is carried out. The quotation, valid for 120 seconds, and the check of the spread between price providers are price calculations, not automated individual decisions.

Retention periods

We distinguish between data retained to operate your account and data archived for accounting or evidential purposes. Archived data are no longer used for the current service and access to them is restricted. The deletion of your account therefore does not erase the history of operations already carried out. The applicable legal retention periods are those of the place of establishment of the operator identified in the legal notices.

• Account, email address and password hash: for the entire duration of the relationship, then deletion after the account is closed.
• Sessions and SHA-256 token hashes: until the expiry or revocation of the session.
• Recovery codes: until they are used or replaced, and no later than the closure of the account.
• Quotations not followed by a deposit: for the time necessary for the technical monitoring of the operation, the quotation ceasing to be valid after 120 seconds and the deposit window after 30 minutes.
• Security event logs: only for the period necessary for the detection, analysis and proof of an incident, then deletion.
• Receiving account details: for the duration of the relationship, then deletion from the active database, subject to archived payment supporting documents.
• Operations, payment references and status history: archiving for the accounting retention period applicable to the operator, then deletion.
• Elements kept as evidence in the event of a dispute concerning a transaction: until expiry of the limitation period applicable to the corresponding action, then deleted
• Identity data collected beyond the annual threshold: archiving limited to the time necessary for fraud prevention and proof of the transactions concerned.

Recipients and processors

Your data are not sold, rented or transferred for commercial purposes. They are accessible to the persons responsible for operating the service, within the limits of their duties, and to a limited number of technical service providers that act on the documented instructions of the operator and are bound by a data processing agreement. No advertising network, marketing provider or audience measurement tool is used on ClearFiat. Data may be disclosed to judicial or administrative authorities upon lawful request.

• Cloudflare, provider of the network placed in front of the origin server and of the D1 database containing accounts, transactions and encrypted receiving details.
• The host of the origin server, a dedicated server located in Europe.
• The banking institutions that execute SEPA transfers and SWIFT transfers.
• PayPal, when you choose this means of receipt.
• Judicial or administrative authorities, upon lawful request.

Transfers outside the European Union

Le serveur d'origine de ClearFiat est situé en Europe, mais le site est placé derrière le réseau Cloudflare et la base de données est un service Cloudflare, groupe établi aux États-Unis et exploitant des points de présence dans le monde entier. Nous ne pouvons donc pas affirmer que vos données restent en permanence sur le territoire de l'Union européenne, et nous préférons vous le dire clairement. Ces transferts sont encadrés par les garanties que le RGPD prévoit pour les transferts internationaux : une décision d'adéquation de la Commission européenne lorsque l'entité destinataire en relève, ou les clauses contractuelles types adoptées par la Commission dans les autres cas. Lorsque vous demandez un versement par virement SWIFT, son exécution implique en outre des établissements situés hors de l'Union européenne, ce transfert étant nécessaire à l'exécution du contrat que vous avez conclu. Vous pouvez obtenir l'indication de l'entité destinataire, de la garantie retenue et une copie de celle-ci en écrivant à l'adresse de contact publiée dans les mentions légales.

Data not collected directly from you

2 categories of data reach us from a source other than you. The information read from public crypto-asset networks, namely the Bitcoin network for BTC, the Ethereum network for ETH and the network you explicitly choose for USDT and USDC without any fallback network being applied, comprises the address from which the funds originate, the amount and the timestamp of the transaction. These addresses and transaction identifiers are processed as personal data once they are linked to your account, it being specified that we have no means of individually informing a sender whom we cannot identify. When the receiving account you designate belongs to a person other than yourself, we process that third party's contact details: you must inform them before communicating those details to us, and we ourselves inform them of the processing within 1 month where we have a means of contacting them. That person has the same rights as you over the data concerning them and may exercise them at the contact address published in the legal notices. We can erase our own records, but we have no power over the entries recorded on the Bitcoin and Ethereum networks, which are public and permanent.

Data security and breaches

We apply technical and organisational measures proportionate to the sensitivity of the data processed. Internal access is restricted to persons who need it to operate the service. In the event of a data breach, the operator notifies the competent supervisory authority without undue delay and, where feasible, within 72 hours. Where the breach is likely to result in a high risk to your rights, you will be informed. Each incident, whether notified or not, is recorded in an internal register.

• Password stored only in the form of a scrypt hash, never in plain text.
• Session token stored only in the form of a SHA-256 hash.
• Receiving account details encrypted using a dedicated application key.
• Data transport encrypted between your browser and the service.
• Logging of security events and restriction of internal access.
• Dedicated origin server, located in Europe

Cookies and absence of a consent banner

ClearFiat sets only 2 cookies, both necessary for the operation of the site and set by ClearFiat itself. One maintains your session when you are logged in to your account; it ends with the session or when you log out. The other stores the display language you have chosen: it contains only a language value, no identifier, and therefore does not allow you to be recognised. These 2 trackers fall within the exceptions to prior consent reserved for trackers strictly necessary for the provision of the service you request: the absence of a consent banner results from this technical choice and not from an oversight. You can block or delete these cookies from your browser settings, it being specified that blocking the session cookie prevents login to your account.

• Authentication session cookie: maintains your connection, ends with the session or upon its revocation
• Language preference cookie: remembers the site's display language, without any identifier
• No audience measurement, advertising, social network or third-party partner cookies

Your rights regarding your data

You have the rights provided for by the GDPR over your data, as set out below. Some of these rights are subject to limitations arising from the nature of the service: your password is held only in hashed form and cannot be recovered, and erasure does not extend to archived accounting records, to items retained for the establishment or defence of legal claims, or to public entries recorded on crypto-asset networks. The right to object only applies to processing based on legitimate interests, i.e. the security of the service and fraud prevention, and it may be overridden where there are compelling legitimate grounds relating to the protection of the service and other clients. The right to data portability only covers data that you have provided and that are processed on the basis of the contract, which in particular excludes security event logs.

• Right of access and right to obtain a copy of your data
• Right to rectification of inaccurate data
• Right to erasure, within the limits indicated above
• Right to restriction of processing
• Right to data portability of the data you have provided and that are processed on the basis of the contract
• Right to object to processing based on legitimate interests
• Right to lodge a complaint with a supervisory authority

Exercising your rights and lodging a complaint with a supervisory authority

Requests are sent, free of charge, by email to the contact address published in the legal notice, which is the only channel for receiving such requests. The operator responds within 1 month from receipt of the request. This period may be extended by 2 months for a complex request, in which case you will be informed within the initial period. A request sent from the email address registered on the account is sufficient in principle; additional proportionate information is requested only in the event of serious doubt as to the requester's identity. A refusal, in whole or in part, is reasoned within the same time limit. You may lodge a complaint with the supervisory authority of the state in which you habitually reside, your place of work or the place of the alleged infringement, as well as with the authority competent for the operator identified in the legal notice. You also have a judicial remedy against the operator.

Accounts opened by minors

Opening an account requires the capacity to enter into the conversion contract, and the minimum age required is set out in the general terms and conditions of the service. Since no processing by ClearFiat relies on consent, the rules specific to children's consent do not apply here. If we learn that an account has been opened by a person who has not reached the required age, that account is closed and the associated data are deleted, subject to documents that must be retained in respect of operations already executed.

Fate of your data after your death

You may define general or specific instructions relating to the retention, erasure and disclosure of your data after your death. Specific instructions concerning data processed by ClearFiat must be sent to us at the contact address published in the legal notice; you may designate the person responsible for carrying them out, and you may amend or revoke them at any time. In the absence of instructions, your heirs may ask us to take account of the death, to access the data necessary for the settlement of the estate and to close the account. Transactions already executed remain retained for the archiving periods indicated above.

Language versions and changes to this policy

This policy is drafted in French and translated into the 14 other languages of the site, the translations being updated at the same time as the French version. In the event of any discrepancy between the versions, the French version shall prevail. This version has been in force since 7 September 2026. Any substantial amendment is published on this page before it takes effect, together with the date from which it applies. If a new purpose were to be added, you would be informed before its implementation.