1. Controller and scope
ESCROW LONDON LTD is the intended controller for the platform’s account, transaction and support data. Its registered address is The Grange – Level 5, 100 High Street, Level 5, London, England, N14 6BN. This notice describes the current application and intended live service. Payment and email providers may separately control information they receive under their own notices.
2. Information collected
Account data includes your name, email address, password hash, profile details and session records. Transaction data includes party email addresses, the asset description, agreed price, fees, timestamps, acceptance events, shared messages, disputes and settlement references. Verification requests include the legal name, country, business information, review notes and privately uploaded supporting documents.
Payment references and authenticated provider status are stored; we do not collect private keys or store cryptocurrency card details. Support requests store your name, email, subject, message and conversation replies. Two-factor authentication stores an encrypted authenticator secret and hashed recovery codes. Authentication and abuse controls use hashed identifiers and request counters. Hosting services may independently generate connection and security logs.
3. Purposes and legal bases
We process information needed to create accounts, operate agreements, provide messages and respond to support as necessary for a contract or steps requested before a contract. Security, fraud prevention and service reliability rely on legitimate interests, balanced against your rights. Where applicable, legally required identity checks, sanctions screening and record keeping rely on a legal obligation.
Optional marketing and non-essential tracking would require an appropriate separate choice before activation. The current application does not load marketing trackers or analytics cookies. We will not silently add such processing under an essential-cookie setting.
4. Sharing and international transfers
The other party to your agreement can see the agreement, transaction history and shared messages, including your name and email. Administrators can access information necessary for support, verification, disputes and settlement. Do not place unnecessary personal data or credentials in shared fields.
Hosting, database, payment and email providers receive data required for their service. We may disclose information to advisers or public authorities where lawful and necessary. We do not sell personal data. Provider contracts, hosting locations, retention schedules and international-transfer safeguards must be confirmed before the live service launches. Where required, transfers need adequacy coverage or approved contractual safeguards.
5. Retention and security
Live retention periods will be documented against the applicable contractual and legal requirements before launch. The application expires account-link tokens after one hour, session tokens after seven days and general rate-limit buckets after approximately 30 minutes. Account-email limits use a rolling one-hour window, and unfinished login challenges expire after five minutes. Identity-document content expires after 90 days. Transaction, support and verification records currently require an operator-managed retention and deletion process.
Passwords are stored as salted hashes. Session cookies are HTTP-only, and production cookies require HTTPS. Access to a transaction is restricted to its parties and administrators. Private document contents and authenticator secrets use authenticated encryption. Recovery codes are stored as hashes, and privileged operations accounts require two-factor authentication. Database infrastructure encryption and backups depend on deployment configuration. No system can guarantee absolute security.
6. Your rights and concerns
Subject to applicable conditions, you can request access, correction, erasure, restriction, portability or object to certain processing. You can withdraw consent where consent is the basis, without affecting prior lawful processing. We may need proportionate identity checks before responding and may retain records required by law or necessary for legal claims.
You can complain to the UK Information Commissioner’s Office at ico.org.uk. Use the contact form or registered office for privacy requests and indicate “Data protection request”. Children under 18 must not open accounts.
Write to ESCROW LONDON LTD, The Grange – Level 5, 100 High Street, Level 5, London, England, N14 6BN, or use the Contact page with the relevant transaction reference. Do not send passwords, recovery codes, private keys or full identity documents through general support messages.