Privacy Policy

• Account data — email, name, username, hashed password, avatar.
• Transaction data — wallet balances, deposits, withdrawals, escrows, and their timestamps.
• Listing & messaging content — what you post and send on the platform (auto-moderated for scams).
• Identity verification data — where you complete KYC, the documents and OCR-extracted fields described in our KYC Policy.
• Technical data — IP address (rate limiting, fraud prevention), session tokens, browser type.

• We don't sell your data to anyone — ever.
• We don't store plaintext passwords (bcrypt) or plaintext escrow credentials (AES-256-GCM encrypted).
• We don't read your DMs except via automated scam-pattern moderation or during dispute review.
• We don't share your account data, wallet activity, or escrow details with advertisers. We do use Google Analytics, Google AdSense and the Meta Pixel on public pages for usage measurement and advertising — see our Cookie Policy for details and how to opt out.

We share the minimum data necessary with these processors:

• NOWPayments — Crypto payment processing (wallet addresses, transaction amounts).
• Cloudinary — Image and document hosting (uploaded listing images and encrypted KYC document files).
• Brevo — Transactional email delivery (email address and message content, e.g. escrow and verification notifications).
• Google OAuth — Authentication (email and profile name for login).
• OpenAI and/or Google Gemini — Vision-capable AI models used only to assist human review of submitted KYC documents (OCR-style field extraction and image-quality/tamper checks) as described in our KYC Policy. These providers receive only the specific document images needed for that single check, never a bulk export.

Each processor receives only the minimum data needed for its function. We do not share browsing behavior, messages, or financial history with any third party.

Several of the processors listed above — including Cloudinary, Brevo, our AI-assisted KYC review providers, and NOWPayments — operate infrastructure in the United States or other countries outside your own. If you are located outside those countries, using AccsMarkets means your personal data (including account, transaction, and where applicable KYC data) may be transferred to, stored, and processed in a country whose data-protection laws differ from those where you live.

We select processors that maintain appropriate security and confidentiality commitments, and we rely on contractual safeguards (such as standard contractual clauses, where applicable) to protect data that crosses borders in this way.

• Passwords are hashed with bcrypt (cost factor 12).
• Escrow credentials and KYC document references are encrypted with AES-256-GCM at rest.
• All connections use HTTPS/TLS.
• Session tokens are HttpOnly, Secure, and SameSite.
• Rate limiting and automated fraud detection on all sensitive endpoints.

Retention periods vary by data category:

• KYC identity documents — a minimum of 5 years from submission, or 5 years after account closure, whichever is later, as required by AML law. See our KYC Policy for details.
• Transaction and financial records (deposits, withdrawals, escrows) — retained for a minimum of 5 years for accounting, tax, and fraud-prevention purposes.
• Listing and chat messages — retained for as long as your account is active so we can moderate for scams and assist with disputes; messages tied to a completed dispute or a flagged conversation are retained under the same 5-year schedule as the related transaction record.
• Account data (profile, settings) — retained while your account is active.
• Technical/security logs (IP addresses, device fingerprints) — retained only as long as needed for rate-limiting and fraud-detection purposes, then deleted or aggregated.

You may request full account deletion at any time. Upon deletion, non-financial personal data is removed or anonymized within 30 days; data subject to one of the legal retention periods above (financial records, KYC documents, dispute-related messages) is retained only for that period and is not used for any other purpose in the meantime.

AccsMarkets is not directed at, and is not intended for use by, anyone under 18 years old — our Terms of Service require all users to be at least 18. We do not knowingly collect personal data from anyone under 18. If we learn that we have collected personal data from someone under 18, we will delete the associated account and data as soon as reasonably possible. If you believe a minor has created an account, please contact us using the details below.

Depending on your jurisdiction, you may have the right to:

• Access — Request a copy of all personal data we hold about you.
• Rectification — Correct inaccurate personal data.
• Erasure — Request deletion of your account and associated data, subject to the legal retention periods above.
• Restriction — Ask us to limit processing of your data while a dispute or a rights request is resolved.
• Portability — Receive your data in a machine-readable format.
• Objection — Object to processing for specific purposes.
• Withdraw consent — Where we rely on your consent (for example, non-essential cookies), withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

You can start most of these requests from Settings → Privacy in your account, or by contacting us directly. We may need to verify your identity before actioning a request that involves sensitive account or financial data.

For privacy questions, data requests, or concerns:

• Email: [email protected]
• Use the contact form on our website

We respond to all data subject requests within 30 days.