Privacy Policy

Account information (email, phone if provided, authentication method), transaction records (orders, deposits, wallet balance history), and technical data (IP address, device/browser information, timestamps) needed to operate the service and meet our AML/KYC obligations.

To provide the service (process orders, maintain your wallet balance), to verify your identity per our AML Policy and KYC Verification Tiers, to communicate with you (OTP codes, order updates, support), and to detect and prevent fraud.

We retain account and transaction data for as long as your account is active, and for a further period after closure as required by applicable financial recordkeeping and AML regulations (typically 5 years from the date of the transaction, subject to final legal review). Technical logs are retained for a shorter period, typically 90 days, unless needed longer for a specific security investigation.

If you're in the European Economic Area (or otherwise covered by GDPR), you have the right to access, correct, or request deletion of your personal data, to object to or restrict certain processing, and to data portability. Some rights are limited where retention is required by AML/financial regulation — we'll explain the specific limitation if it applies to your request. Contact support to exercise any of these rights.

We use strictly necessary cookies (session authentication, language/theme preference, and the referral-attribution cookie described in our Referral Program terms) and do not use third-party advertising or tracking cookies. You can control cookies through your browser settings; disabling essential cookies may prevent you from logging in.

We share data with service providers only as needed to operate SamaPrime: our hosting/CDN provider, our SMTP email provider (for OTP codes and account emails), and our SMS number provider (5sim.net, for the verification-number product). Our live exchange-rate pages read public market data from ExchangeRate-API, CoinGecko, and Binance's public WebSocket feed — these are read-only data sources and never receive any of your personal information.

We encrypt sensitive data at rest, use two-factor authentication for sensitive account actions, and restrict internal access to personal data to what's needed to operate the service. No system is perfectly secure; see our Support & Complaints Policy if you believe your account has been compromised.

We may update this Privacy Policy from time to time. Material changes will be reflected by an updated "Last updated" date on this page.