Privacy Policy

This website is operated by Dark Fusion Holdings S.A., trading as SQRL Enterprise, a company registered in Luxembourg (“we”, “us”, “our”).

Our registered office is: 2173 Salk Ave, Suite 250CarlsbadCalifornia 92008US

We are the controller of the personal data described in this policy. For data-protection enquiries, contact support@sqrl.tech. As we are established in Luxembourg, our lead supervisory authority is the Commission nationale pour la protection des données (CNPD). Our data protection officer is [ TO BE CONFIRMED ].

This policy covers the public website at https://sqrl.xyz. It does not cover the SQRL Enterprise product application at https://app.sqrl.xyz, access to which is governed by the separate written agreement between us and your institution, nor does it cover any third-party website you reach by following a link from here.

We have deliberately kept this website to a minimum. The only personal data we handle is:

Server logs

Our hosting provider, [ TO BE CONFIRMED ], records standard technical information when a page is requested: IP address, timestamp, the page requested, HTTP status, referrer, and user-agent string. This is generated automatically by the act of loading a web page and cannot be switched off without breaking the site.

Correspondence

If you email an address published on this site, we receive your email address, your name if you give it, and whatever you choose to put in the message. We keep the thread so we can reply and keep a record of what was said.

Cookie choice

Your accept-or-decline choice is stored in your own browser’s local storage. It never reaches our servers and is not personal data in our hands. See the Cookie Policy.

We do not operate contact forms, newsletters, accounts, analytics, advertising pixels, session recording, or A/B testing on this website. We do not buy personal data, and we do not build profiles of visitors.

Security and delivery

To serve the site, keep it available, and investigate abuse or attack. Lawful basis: our legitimate interests in operating and defending our own infrastructure, which we consider not to be overridden by your interests given the narrow scope of the data.

Responding to you

To answer an email you sent us. Lawful basis: our legitimate interests in responding to enquiries, or the steps necessary to enter into a contract where your message concerns onboarding.

Legal obligations

To comply with law, regulation, or a valid order of a court or regulator. Lawful basis: compliance with a legal obligation.

We do not sell personal data, and we do not share it for anyone else’s marketing. We disclose it only to:

• our hosting and email providers, acting as processors on our written instructions;
• our professional advisers — lawyers, auditors, insurers — where they need it and are bound by confidentiality;
• a court, regulator, or law-enforcement body where we are legally required to, or where disclosure is necessary to establish, exercise, or defend legal claims;
• an acquirer or successor, if our business is reorganised, sold, or merged, subject to equivalent protections.

We are established in Luxembourg, and our providers may process data in other countries. Where personal data leaves the European Economic Area, we rely on an adequacy decision of the European Commission or on the Commission’s Standard Contractual Clauses, together with any additional safeguards a transfer risk assessment shows to be necessary. You can ask us for details of the safeguards in place for a particular transfer.

Server logs are retained for no longer than is necessary for security and diagnostics, and in any event for a period not exceeding twelve (12) months unless a specific incident requires us to preserve them for longer. Correspondence is retained for as long as needed to deal with the matter and then for the period required by applicable limitation periods and record-keeping rules.

Subject to the conditions and exemptions in the applicable law, you have the right to:

• ask what personal data we hold about you, and get a copy;
• have inaccurate personal data corrected;
• have personal data erased, or its processing restricted, in certain circumstances;
• object to processing that we carry out on the basis of legitimate interests;
• receive personal data you gave us in a portable format, where the right applies;
• withdraw consent at any time, where we rely on consent, without affecting processing already carried out.

To exercise any of these, write to support@sqrl.tech. We will respond within one month, and will tell you if we need longer. We may ask you to verify your identity before we act.

We would rather hear from you first, but you may complain to a supervisory authority at any time. In Luxembourg that is the Commission nationale pour la protection des données, cnpd.public.lu. If you are in another EU or EEA country, you may complain to the authority where you live, work, or where the alleged infringement took place.

This website is directed at institutional and professional audiences. It is not intended for children, and we do not knowingly collect personal data relating to them.

We may update this policy. The date at the top of this page tells you when it last changed materially. If a change affects what we do with personal data we already hold, we will take reasonable steps to bring it to your attention rather than relying on this page alone.