1. Introduction & Data Controller Identity
At CryptoReview (https://cryptoreview.us/), we recognize that user privacy and data sovereignty are fundamental principles, especially within the cryptocurrency and Web3 ecosystem. This Privacy Policy details how we collect, process, safeguard, and respect your personal data in strict compliance with the General Data Protection Regulation (EU GDPR / UK GDPR), the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), and international privacy standards.
For the purposes of applicable data protection law, the Data Controller is CryptoReview Media Group. If you have questions regarding this policy or wish to exercise your statutory privacy rights, contact our Data Protection Officer at privacy@cryptoreview.us.
2. Categories of Personal Data We Collect
CryptoReview adheres to the principle of Data Minimization (GDPR Article 5(1)(c)). We collect only the data necessary to provide authentic, verifiable consumer reviews and ensure platform security:
- Review Verification Data: When you submit a review, we collect your email address solely to deliver an ownership confirmation link and prevent automated spam bots. Your email address is stored securely and never published, sold, or shared publicly.
- Public Profile Details: If you choose to provide a public display name and country/region code, these will be visible alongside your published review. Reviewers may submit anonymously.
- Transaction Evidence (Optional): Reviewers submitting dispute details or on-chain transaction hashes (TXIDs) or screenshot proofs provide this data voluntarily to obtain a "Verified Experience" trust badge.
- Technical & Anti-Fraud Logs: We collect cryptographically hashed IP addresses, browser user agents, and submission timestamps. These logs are used strictly for DDoS mitigation, rate limiting, and sybil-attack prevention.
3. Lawful Bases for Processing (GDPR Article 6)
We process personal data only when an established lawful basis applies:
- Consent (Art. 6(1)(a)): You give explicit consent when submitting a review, attaching transaction proof, or opting in to receive verification emails.
- Legitimate Interests (Art. 6(1)(f)): Processing technical logs and IP hashes to protect platform security, prevent fraudulent review attacks, and maintain fair consumer rating integrity.
- Legal Obligation (Art. 6(1)(c)): Complying with statutory notice-and-takedown requests under the EU Digital Services Act and DMCA regulations.
4. Zero Sale or Sharing of Personal Data (CCPA/CPRA)
CryptoReview does NOT sell, rent, monetize, or trade personal data or reviewer email lists to any third party, broker, or financial institution. Under CCPA/CPRA definitions, our platform does not "sell" or "share" personal information for cross-context behavioral advertising.
5. Your Global Privacy Rights
Depending on your jurisdiction (including the European Economic Area, United Kingdom, California, Canada, and Australia), you possess statutory privacy rights:
- Right to Access & Portability: You may request a copy of all personal information we hold concerning your submissions.
- Right to Rectification: You may correct inaccurate or outdated information in your reviewer profile.
- Right to Erasure ("Right to be Forgotten"): You may request the permanent deletion of your published reviews and associated email verification records at any time.
- Right to Restrict or Object: You may object to data processing conducted under legitimate interests.
- Non-Discrimination: We will never discriminate against you, restrict access, or degrade your service for exercising your privacy rights.
To exercise any of these rights, email privacy@cryptoreview.us. We respond to all verified statutory requests within 30 days.
6. Data Retention Schedule
We retain personal data only as long as necessary for the purposes outlined:
- Review verification records and email hashes are retained for the lifetime of the published review, or until deleted upon user request.
- Anti-spam firewall logs and rate-limiting IP tables are automatically purged after 90 days.
- User support tickets and email inquiries are archived for 12 months for quality assurance, then destroyed.
7. International Data Transfers
Our cloud hosting infrastructure operates globally via enterprise edge networks (Cloudflare and Netlify). Where personal data originating in the EEA or UK is transferred to servers outside those jurisdictions, transfers are safeguarded by European Commission-approved Standard Contractual Clauses (SCCs) and equivalent UK International Data Transfer Agreements.
8. Protection of Minors (COPPA)
CryptoReview is designed exclusively for adult cryptocurrency market participants and financial consumers aged 18 and older. We do not knowingly solicit or collect personal information from individuals under the age of 18. If we discover an account or review submitted by a minor, all associated records are purged immediately.
9. Contact the Data Protection Officer
For inquiries regarding our privacy architecture or to lodge a formal data request: