Privacy Policy

1. Who We Are and What This Covers

TetraFi Ltd ("TetraFi", "we", "us") operates non-custodial settlement, liquidity, and compliance infrastructure for institutions transacting in stablecoins and tokenized real-world assets. This policy sets out what personal data we handle when you visit tetrafi.io, speak to our team, or use the platform, and what you can ask us to do about it.

For data collected through this website and through our own onboarding, due diligence, and record-keeping, TetraFi is the data controller. Where we process data inside a client's workflow - screening that client's counterparties, settling that client's trades - we act as processor on that client's documented instructions, under the data processing terms of their agreement with us.

Our registered office is 167-169 Great Portland Street, 5th Floor, London, England, W1W 5PF. Anything to do with this policy goes to privacy@tetrafi.io.

2. Data We Collect

What you give us directly. Name, work email, phone number, employer, role, and anything else you choose to include when you request a demo, contact the team, subscribe to updates, or open an account.

Onboarding and due diligence records. For institutional onboarding, we and our verification partners collect entity registration details, registered address, ownership and control structure, identity documents for directors and beneficial owners, and the outcome of the checks run against them. We collect this because anti-money-laundering law obliges us to, not to build a fuller picture of you.

Platform and transaction records. Wallet and account addresses, instruction and settlement details, quote and routing metadata, screening outcomes, policy decisions, and the audit entries generated as a trade moves through escrow.

Technical records. IP address and the approximate location derived from it, device and browser characteristics, pages and endpoints requested, timestamps, and security and error telemetry. We use a small number of cookies and equivalent identifiers to keep sessions working and to understand site usage in aggregate; where a non-essential cookie needs consent, we ask before setting it.

3. Why We Use It, and on What Legal Basis

We process personal data to operate and secure the platform and settle the instructions submitted through it; to verify who our clients are and who controls them; to screen parties and addresses against sanctions and risk sources; to validate Travel Rule information for transfers that require it; to produce and retain the compliance evidence our regulators and our clients expect; to answer enquiries and provide support; and to tell you about product changes or material relevant to your role.

Our lawful bases under the UK GDPR and EU GDPR are: performance of a contract, for anything needed to deliver services you or your organization asked for; legal obligation, for identity verification, screening, reporting, and record retention; legitimate interests, for platform security, fraud prevention, service improvement, and business-to-business communication, weighed each time against your own interests; and consent, where we ask for it - which you may withdraw at any point.

We do not sell personal data, we do not share it for cross-context behavioral advertising, and we do not profile individuals for marketing. Pre-execution screening operates on institutional counterparties and blockchain addresses rather than on individual profiles, and where an automated decision materially affects an individual, that person may ask us to have it reviewed.

4. Who We Share It With

Service providers acting on our instructions. Identity verification and KYB providers, blockchain analytics and sanctions-screening providers, Travel Rule solution providers, infrastructure and hosting providers, and ordinary business tooling for email, support, and analytics. Each is bound by a written data processing agreement, may use the data only to deliver its service to us, and a current list of our sub-processors is available on request.

The institution on the other side of a transfer, where a Travel Rule obligation applies. Transfers above the applicable threshold require originator and beneficiary details to be made available to the counterparty institution in the prescribed format. We share only what the rule requires, and nothing further.

Regulators, auditors, and law enforcement, where we are legally required to respond, or where disclosure is necessary to investigate suspected fraud or abuse or to protect someone's safety. We may be prohibited by law from telling you when such a disclosure is made.

Professional advisers, and a prospective investor or acquirer in connection with a financing, merger, or sale of the business - in each case under confidentiality, and with notice to you where the law requires it.

5. Where It Lives, and How Long We Keep It

Our production infrastructure runs in the United Kingdom and the European Economic Area. Where a provider processes data outside the UK or EEA, we rely on the UK International Data Transfer Addendum, the European Commission's Standard Contractual Clauses, or an adequacy decision, and we assess the transfer before it starts.

Due diligence and transaction records are kept for as long as anti-money-laundering and financial record-keeping law requires, generally at least five years after a business relationship ends. Compliance evidence written to our append-only audit ledger is retained on the same basis.

Enquiry and marketing records are kept for up to two years after our last exchange with you, and technical and security logs for up to twelve months, unless an investigation or a legal claim obliges us to hold them longer. Once a retention period ends, data is deleted or irreversibly anonymized.

6. How We Protect It

Data is encrypted in transit using TLS 1.3 and at rest using AES-256, with key material held in hardware security modules. Access is granted on a least-privilege basis, tied to named accounts with multi-factor authentication, and every access is logged and monitored.

The platform is deployed across multiple regions with automatic failover, monitored continuously, and subject to regular vulnerability assessment and independent testing. Further independent security assessments and certification work are in progress, and we can share their current status with clients and prospective clients on request.

Personal data does not go on-chain. What settles publicly is a cryptographic attestation that a check passed - never the identity documents or personal details behind it.

If a personal data breach occurs and the legal thresholds are met, we notify the Information Commissioner's Office within 72 hours of becoming aware of it, and we inform affected individuals without undue delay where the risk to them is high.

7. Your Rights

Where the UK GDPR or EU GDPR applies to you, you may ask us for a copy of the personal data we hold about you; ask us to correct it where it is wrong; ask us to delete it; ask us to restrict or stop a particular use; object to processing we base on legitimate interests, including direct marketing, which we will always stop on request; ask for a portable copy of data you provided to us; and withdraw a consent you previously gave, without affecting anything we did lawfully before you withdrew it.

Write to privacy@tetrafi.io and we will respond within one month. We may need to verify your identity first, and we will explain any part of a request we are unable to meet.

Two limits are worth stating plainly. Records we are legally required to hold - due diligence files, transaction and screening evidence - cannot be erased on request until their retention period expires, and entries in our append-only audit ledger cannot be altered at all; where that applies we restrict further use instead, and we tell you that we have done so. Where we hold data as a processor for one of our clients, we will pass your request to that client and support their response.

If you are unhappy with how we have handled your data we would like the chance to put it right. You may also complain to the UK Information Commissioner's Office at ico.org.uk, or to the supervisory authority in your EU member state.

8. Changes and Contact

We update this policy when our processing changes or the law does. The current version always sits on this page with its effective date at the top, and where a change materially affects you we will give notice through the site or by email before it takes effect.

Privacy requests go to privacy@tetrafi.io; general enquiries to enquiries@tetrafi.io.

TetraFi Ltd 167-169 Great Portland Street, 5th Floor, London, England, W1W 5PF