Privacy Policy

1. Scope

This policy applies to information we collect through our website, communications, and any related services we offer. Where we operate as a regulated financial service provider in your jurisdiction, additional jurisdiction-specific notices may apply and will take precedence over this policy where required.

2. Information we collect

• Account information: name, email, phone number (when provided via sign-in), username, country, currency preference, and profile details you choose to add.
• Financial information: payment and transaction history on Bruce, wallet addresses linked to your account, invoices, payment links, and escrow activity.
• Optional identity verification: if we introduce Know Your Customer (KYC) or partner screening, we may collect date of birth, government-issued identification, or similar data required by law. We do not collect these documents today unless a verification flow is enabled for your account.
• Technical and usage information: IP address, browser type, device identifiers, operating system, pages viewed, referral sources, timestamps, and first-party analytics events.
• Device permissions you grant: contacts (for invites), precise location (optional profile city), camera (QR / attachments), photos (avatar), and push notification tokens.
• Waitlist signups: name, email, country, and any optional message you provide when joining the Bruce waitlist on our homepage.
• Communications: messages sent through our contact forms, email, or support channels.
• Third-party information: data from authentication and wallet providers (e.g. Privy), fiat onramps, and publicly available sources used to operate the service and comply with applicable law.

3. How we use information

• Provide, operate, and maintain our services.
• Verify your identity and comply with legal and regulatory obligations when KYC, AML, sanctions screening, or tax reporting applies to your use of the service.
• Process and settle transactions.
• Detect, prevent, and investigate fraud, security incidents, and prohibited activities.
• Communicate with you about your account, our services, and changes to our policies.
• Improve, personalize, and develop our products.
• Conduct analytics, research, and risk modelling.
• Enforce our Terms of Service and protect the rights, property, and safety of Bruce, our users, and others.

4. Legal bases for processing (GDPR / UK GDPR)

Where applicable, we rely on the following legal bases:

• Performance of a contract - to provide services you request.
• Legal obligation - to comply with applicable laws including financial services, tax, and anti-money laundering regulations.
• Legitimate interests - to operate, secure, and improve our services in a manner balanced against your rights.
• Consent - for activities that require it, such as certain marketing communications, where you may withdraw consent at any time.

5. Sharing and disclosure

We share information only as necessary to deliver our services and meet our legal obligations. Recipients may include:

• Service providers and processors that support payments, hosting, identity verification, fraud prevention, customer support, and analytics, all bound by contractual confidentiality and data protection obligations.
• Banking, payment, and stablecoin partners that facilitate the movement and custody of funds.
• Regulators, law enforcement, courts, and government authorities where required by law, valid legal process, or as part of our regulatory cooperation obligations.
• Professional advisors including auditors, accountants, and counsel.
• Acquirers or successors in connection with a merger, acquisition, financing, restructuring, or sale of assets, subject to confidentiality protections.

We do not sell your personal information.

6. International transfers

Bruce operates internationally and your information may be transferred to, stored, or processed in countries other than the one in which you reside. Where such transfers occur from the European Economic Area, United Kingdom, or other regulated jurisdictions, we implement appropriate safeguards including Standard Contractual Clauses or equivalent legal mechanisms.

7. Data retention

We retain personal information for as long as your account is active and thereafter for the period required to satisfy our legal, regulatory, accounting, audit, dispute resolution, and tax obligations. Records relating to KYC, transactions, and regulatory matters are typically retained for a minimum of five to seven years from the end of the relevant relationship, in line with applicable financial services regulations.

8. Security

We implement administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, alteration, disclosure, or destruction. These include encryption in transit and at rest, access controls, hardened infrastructure, segregation of duties, monitoring, and regular security reviews. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. Your rights

Depending on your jurisdiction, you may have the right to:

• Access the personal information we hold about you.
• Request correction of inaccurate or incomplete information.
• Request deletion via in-app Settings → Delete account, or at bruce.money/account-deletion, subject to applicable retention obligations.
• Restrict or object to certain processing.
• Receive your information in a portable format.
• Withdraw consent where processing is based on consent.
• Lodge a complaint with a supervisory authority.

We will respond to legitimate requests within the timeframes required by law. Some rights may be limited where overriding regulatory or legal obligations apply.

10. Cookies and similar technologies

We use cookies and similar technologies to operate our website, remember preferences, measure performance, and improve user experience. You may control cookies through your browser settings. Where required, we will request your consent for non-essential cookies.

11. Children

Our services are not directed to individuals under the age of 18, and we do not knowingly collect personal information from children.

12. Third-party sites and services

Our website may contain links to third-party sites and integrate with third-party services. We are not responsible for the privacy practices of those third parties.

13. Regulatory cooperation

As a financial technology platform, we cooperate fully with regulators, financial intelligence units, and law enforcement in accordance with our legal obligations. This may include reporting suspicious activity, responding to lawful information requests, and disclosing information necessary to prevent or investigate financial crime.

14. Changes

We may update this Privacy Policy from time to time. The "Last updated" date at the top reflects when changes were made. Material changes will be communicated through our website or directly to account holders.

15. Contact

Browills Limited (trading as Bruce) is the data controller for personal data described in this policy. Registered office: Office 2287, 182-184 High Street North, East Ham, London E6 2JA, United Kingdom.

For privacy questions, requests to exercise your rights, or to contact our Data Protection Officer, write to privacy@bruce.money. For company contact: info@browills.com or call +44 7360 498963. Account deletion instructions: bruce.money/account-deletion.