This page is a translation of the Portuguese text, produced with the help of artificial intelligence and not yet reviewed by a certified translator. If any passage raises a doubt, compare it with the Portuguese version.

Legal document

Privacy Policy

Last updated: September 15, 2026

This Policy explains what personal data PUROSWAP collects, why it collects it, who it shares it with and what your rights are, under Law No. 13.709/2018 (LGPD).

1. Controller and Data Protection Officer

Controller: LEX TREE LLC, incorporated in the United States, with address at 30 N Gould St, Ste R, Sheridan, WY 82801, United States — operator of the PUROSWAP platform.

Contact for data protection matters: Supportpuroswap@proton.me. This is the channel to use to exercise your rights or to ask questions about this Policy.

2. What data we collect

We collect the minimum needed for the operation to work and to comply with the law. We do not ask for an identity document, a selfie or a receipt in order to operate in crypto.

From every visit, automatically:

• IP address and the proxy chain of the request
• Browser and system (user-agent) and preferred language
• Network provider (ASN) and country estimated from the IP
• An indication that the access comes from a datacenter or VPN
• A random session identifier, stored in our own cookie

From the operation: the assets and networks chosen, the amount, the fees applied, the destination address you provided, the deposit address generated, the blockchain transaction identifiers and the status of the operation.

Only on routes with PIX: the name and CPF/CNPJ of the key holder, and the PIX key. Without these the bank does not complete the transfer.

Only on the direct support route: the Telegram contact you provide — it is requested only on that route, because it is the only one where someone may need to talk to you.

We do not collect: private key, recovery phrase, wallet password, card data, or any credential. We do not ask for them and we have nowhere to store them.

3. How we collect it

There are only three paths, and none of them involves registration:

• You type it in — the destination address, and on routes with PIX the key and the holder's CPF/CNPJ. This is the only moment when you provide anything directly.
• The site records it on its own — on each access, we store the IP, the browser, the device language, the internet provider, the country and an indicator of VPN use. It serves to detect fraud and automated use, and it is what the law requires as an access log.
• The blockchain and the exchange return it — the identifier (hash) of your deposit and of the sending, and the confirmation that the transfer went out.

There is no account at PUROSWAP. You do not create a login, you do not choose a password and you do not fill in any registration. What links an operation to you is an anonymous cookie generated in your browser — a random number, with no name inside it. It is what makes your history appear when you come back. See section 10.

On crypto-only routes, we neither ask for nor receive your name. Name and CPF/CNPJ only come in when there is PIX in the operation, because the Brazilian banking system does not transfer without them.

4. Why we process your data (purpose and legal basis)

Each piece of data has a purpose and a legal basis. Nothing is collected "just in case":

Operation data (assets, amounts, addresses, transactions)	Carrying out what you contracted — performance of a contract
Name and CPF/CNPJ on routes with PIX	Completing the bank transfer and meeting a requirement of the financial system — legal obligation and performance of a contract
IP, provider, country, VPN indication	Security: detecting fraud, automated use and abuse — legitimate interest
Session cookie	Linking you to your own operations without requiring registration — performance of a contract
Telegram contact	Talking to you about the direct support operation — performance of a contract
Access logs	Retention required by law and investigation of incidents — legal obligation

We do not use your data for advertising, we do not sell anything to anyone, we do not build behavior profiles for marketing and we do not decide anything about you on a solely automated basis.

5. Who we share with

We share the minimum, only with those the operation requires, and only what is needed for their part of it:

• Partner exchange — receives what it needs to carry out the conversion and the sending: assets, networks, amounts and the destination address. It does not receive your personal data on crypto routes.
• Settlement providers in reais — on routes with PIX, they receive the data the banking system requires: name, CPF/CNPJ and PIX key. Without these the transfer does not go out.
• Competent authorities — upon a valid order, limited to what the order determines.

What becomes public without passing through us: every blockchain transaction is public by nature. The amount, the source address and the destination address are recorded on the network, visible to anyone, permanently. This is not a choice of ours and we have no way to undo it.

We do not sell, rent or transfer your data for commercial purposes. There is no advertising partner, there is no data broker, there is no exchange of databases.

6. International transfer of data

Your data is processed outside Brazil. It is not a hidden technical detail: it is how the operation works, and you have the right to know before you use it.

• PUROSWAP's infrastructure is in the United States, including the backups, which are stored encrypted.
• LEX TREE LLC, the company that operates the platform, is a company incorporated in the United States.
• The partner exchanges that carry out the conversion and the transfer are located abroad. They receive what section 5 describes — on crypto routes, none of your personal data.

The international transfer is necessary to carry out what you contracted for, under art. 33, II, of the LGPD. Without it there is no operation: the conversion happens outside Brazil.

The protection measures in section 8 apply wherever the data is.

7. How long we keep your data

To be direct, because this is where most policies get vague:

• Operation records (assets, networks, amounts, addresses, transaction identifiers) — kept for an indefinite period. They are financial records and proof that the operation happened; the applicable law does not allow us to delete them on request.
• Access logs (IP, browser, country) — kept for the minimum time frame set by the Marco Civil da Internet, and today kept beyond that for the same audit reason.
• Name, CPF/CNPJ and PIX key, on routes with PIX — they stay linked to the financial record of that operation, for the same time frame as that record.
• Anonymous cookie — it lasts one year in your browser, and you can delete it whenever you want. See section 10.

"Hide from history" does not delete anything. The button removes the operation from your list, so you no longer see it. The record stays intact in the database — it is financial history, and deleting it would destroy the proof of the operation, including the proof that protects you in a dispute.

An honest limit: today there is no automated routine that deletes old records. Until one exists, the data above stays stored. When there is one, this section will state the exact time frame.

8. How we protect your data

What actually exists, with no vague promises:

• Encryption in transit (HTTPS/TLS) across the whole site, with HSTS.
• Strict content security policy — the browser refuses to run any script that does not come from the site itself, which blocks the most common form of data theft on a web page.
• The session cookie is HttpOnly: no script can read it, not even a malicious one.
• You only see your own operations. The database query always filters by your session identifier — even if someone enters the number of someone else's order, the response comes back empty.
• Audit log of accesses and of sensitive actions, including those taken by our team.
• Request limit per origin, against automated scanning.
• Encrypted backups, with the decryption key kept off the server.
• Restricted access to the internal panel, by named user, with the password stored only as a hash (scrypt) and a record of who did what.

What does not exist, and why it is not missed: there is no password of yours, no two-factor authentication and no lockout after failed login attempts — because there is no login. With no account, there is no credential of yours for anyone to steal. On the other hand, anyone with access to your browser sees your history: the cookie is what identifies you.

No system is immune. In the event of a relevant security incident, we will report the incident to you and to the ANPD, as provided in art. 48 of the LGPD.

9. Your rights

The LGPD (art. 18) guarantees you the right to:

• confirm that processing exists and access your data;
• correct incomplete, inaccurate or outdated data;
• request the anonymization, blocking or deletion of data that is unnecessary or processed in non-compliance with the law;
• request portability;
• obtain information about sharing;
• withdraw consent, when the processing is based on it;
• object to processing carried out on the basis of legitimate interest.

To exercise them, write to Supportpuroswap@proton.me. We may ask for information to confirm your identity before acting — that is a protection for you.

An honest limit: some data cannot be deleted on request, because the law requires us to keep it (financial and access records). In those cases we will explain the reason and the time frame.

10. Cookies

We use a single cookie, and it is not used for advertising or for tracking.

• What it is — a random number generated in your browser on the first visit. It does not contain your name, e-mail or any data of yours.
• What it is for — linking operations to you, so that your history appears when you come back. It is the substitute for the login the platform does not have.
• How long it lasts — one year, renewed on each visit.
• How it is protected — marked HttpOnly (no script reads it), Secure (it only travels over an encrypted connection) and SameSite=Lax (it is not sent from another site).

We do not use advertising cookies, social network pixels, third-party analytics or any cross-site tracker.

If you delete the cookie, nothing is lost on the system side: the operations stay recorded and the exchange keeps executing. What happens is that your history stops appearing in that browser, because the site loses the thread that links you to it.

11. Data of children and adolescents

The platform is not intended for people under 18 and we do not intentionally collect data from them.

Since there is no registration, we have no way to verify age before the operation — and it is more honest to say that than to describe a control that does not exist. If we identify that an operation was carried out by someone under 18, we will delete the personal data that the law allows us to delete and we will refuse future operations identified as belonging to that person. The financial record itself remains, for the reason explained in section 7.

If you are a guardian and believe that a minor in your care used the platform, write to Supportpuroswap@proton.me.

12. Changes to this Policy

We may update this Policy. The version in force is always the one published on this page, with the date at the top. Relevant changes will be communicated through the available channels.

13. Contact

Questions about privacy or the exercise of rights: Supportpuroswap@proton.me or on Telegram at t.me/+447480206848.

You may also file a complaint with the Autoridade Nacional de Proteção de Dados (ANPD).