Terms, privacy, and data processing

Terms of Service

Last updated: 2026-10-01 · Version v1.2

1. Scope of service

ChainBridge offers three services: ChainBridge Security (wallet approval checks and revocation), ChainBridge Connect (wallet connection and authentication), and ChainBridge Nodes (distributed RPC and chain data). Some features are still in development and are labeled as such.

2. Accounts and keys

• You are responsible for keeping the API keys and credentials under your account confidential, and for the calls and costs they generate.
• We store only key digests and prefixes, so we cannot recover your key in plain text.
• Admins and owners must enable multi-factor authentication; accounts without it can only have read-only roles.
• If a key leaks, disable it in the console immediately; disabling takes effect globally within 30 seconds.

3. Operating entity, regions, payments, and taxes

The operating entity, service regions, and payment details will be published here once confirmed.

4. Billing, quotas, and refunds

• Billing follows the rules published on the pricing page and in the API docs. CU weights and unit prices are versioned and carry an effective date.
• Failed requests are not billed. Cache hits are free and count zero CU. Batch requests are metered per item.
• Once a billing period is invoiced the bill is locked; discrepancies are handled only through adjustment notes, which require two-person review.
• Unused subscription fees are refunded pro rata by day; usage fees already incurred are not refunded. Enterprise contracts follow their contract terms.
• Going over your plan quota will never produce a surprise overage bill.

5. Prohibited conduct

• Do not use the service for attacks, fraud, money laundering, sanctions evasion, or any activity that violates applicable law.
• Do not attempt to obtain another person's wallet credentials or gain unauthorized access to any account.
• Do not run unauthorized penetration tests or load tests against the service, or circumvent rate limits; request approval before any load test.
• Do not resell or repackage the service to mislead users (including claims that assets can be “recovered”).

6. Disclaimers and limitation of liability

• Onchain data comes from public networks and multiple upstream sources. We cross-check where we can, but we cannot guarantee zero delay or zero error.
• We do not take custody of assets or sign on your behalf. You bear the outcome of any onchain transaction and its gas fees.
• Risk levels and risk amounts are estimates of exposure, not recoverable amounts; we do not promise to recover lost assets.
• The service is provided “as is”; availability commitments are governed by the SLA in your plan or contract.

7. Changes and termination

We may update these terms for feature changes or compliance requirements, and material changes are announced in advance on the site and status page. You may stop using the service and delete your platform records at any time; if you materially breach these terms, we may suspend or terminate the service.

8. Dispute resolution and contact

These terms are governed bythe laws of the operating entity's jurisdiction(entity details are in Section 3 and still pending confirmation); disputes go to negotiation first, and failing that follow the dispute resolution procedure agreed in the contract. Contact details are in the footer and support channels.

Privacy Policy

Last updated: 2026-10-01 · Version v1.2

1. What we collect

Provided by you

Email (for registration and notices), wallet address (public information), organization and billing details.

Required to run the service

API call metadata (method, chain, CU, latency, error code), key prefixes, and request IDs.

Technical logs

IP, User-Agent, timestamp, request path, and response code, used for security and troubleshooting.

We do not collect

Wallet passwords or any credential that can move your assets.

2. How we use it

• Running the service, metering and billing, and recalculating charges under the rules in force at the time.
• Security: detecting abuse, rate limiting, unusual sign-ins, and key-leak risk.
• Notices: service changes, security announcements, quota alerts, and billing reminders (turn off webhook or email delivery at any time).
• Product improvement: aggregated, de-identified statistics on feature usage.

3. What we do not do

• We do not sell your personal data, and we do not use risk conclusions to rank commercial promotions.
• We never change a risk level because of a commercial partnership; sponsored content is clearly labeled.

4. Cookies and local storage

We use necessary local storage to keep your session and interface preferences (such as language). We do not set third-party advertising cookies; if analytics cookies are introduced later, we will ask for consent first and provide a way to turn them off.

5. Sharing and retention

• Shared with sub-processors only as needed to provide the service, as described in the Data Processing Description.
• Usage details are kept for 90 days; billing and audit logs are kept for the statutory retention period and deleted automatically when it ends.
• When complying with regulatory or judicial requests, we disclose the minimum information necessary and only as the law allows.

6. Your rights

You may access, correct, export, or delete your records on this platform (public onchain data is unaffected), and you may object to or restrict certain processing. These controls live under “Account and data” in the console. You can also ask us through support; we reply within 30 days.

Data Processing Addendum

Last updated: 2026-10-01 · Version v1.2 · For enterprise customers and cases that need a DPA

1. Data categories and purposes

2. Processing roles

• For account and billing data, ChainBridge is the data processor (or the controller where the contract so provides).
• For business data you submit through the API, you are the controller and we process (forward) it only on your instructions.
• Enterprise customers can sign a Data Processing Agreement (DPA) covering scope, sub-processors, and audit rights.

3. Sub-processors

Changes to the sub-processor list are announced in advance; enterprise customers can agree to exclude certain categories.

4. Cross-border transfers and data residency

By default, data is stored in the region where the service runs. For cross-border transfers, we rely on contractual clauses and data minimization. Enterprise customers can agree on a data residency region and use a self-hosted gateway, so business requests never leave their network.

5. Security measures

• Encryption in transit (HTTPS/WSS) and at rest; keys are stored only as digests.
• Least privilege, multi-factor authentication, two-person review, and operational audit.
• Billing events are persisted before they are booked, support replay reconciliation, and are never silently dropped.
• Regular dependency scans, SBOMs, and release approval; emergency shutdown and disaster-recovery drills.

6. Deletion, export, and audit assistance

Export or delete platform records in the console — deletion cannot be undone. Onchain data is public by nature; we delete only your records on this platform. Enterprise customers can request audit assistance and compliance evidence.

7. Contact

Submit data protection requests through support and mark them “Data processing”; we respond within 30 days. For urgent security incidents, also contact us through the vulnerability disclosure process on the security page.