← Alpha

Privacy Policy

Last updated: 2026-05-27

This Privacy Policy explains how Alpha collects, uses, retains, and shares information in connection with the Alpha institutional settlement orchestration platform.

1. Who We Are

Alpha is operated under the domain alpha-eta.biz. For data-protection enquiries, contact privacy@alpha-eta.biz.

2. Information We Collect

In the course of providing institutional settlement orchestration, we collect:

• Onboarding data: legal entity details, beneficial ownership information, KYC/KYB documentation, sanctions-screening results, source-of-funds attestation.
• Transaction evidence: bank payment messages (including MT103 and pacs.008 ISO 20022 messages), settlement confirmations, transaction reference identifiers (UETR, TRN), amounts, currencies, debtor/creditor identifiers, and timestamps.
• Operational data: API request and response logs, IP addresses, mTLS certificate fingerprints, role-key fingerprints, and audit trail metadata.
• Communications: email, support tickets, and other correspondence with Alpha staff.

3. How We Use Information

• Validate the authenticity and completeness of payment evidence.
• Coordinate execution instructions across regulated Providers.
• Comply with anti-money-laundering, counter-terrorism-financing, sanctions, and tax-reporting obligations.
• Produce immutable audit and reconciliation records.
• Investigate suspected fraud, abuse, or security incidents.
• Communicate operationally with onboarded Users.

4. Information Sharing

We share information only as necessary to provide the service or comply with applicable law:

• Providers: regulated third parties including but not limited to Triple-A, Mercury, Wintermute, Kraken, XRamp, and SFOX, each of which receives only the data required to execute the specific transaction the User has initiated.
• Custodians: approved custody providers such as BitGo and Fireblocks, where applicable.
• Regulators and law enforcement: where required by applicable law, court order, or regulatory request.
• Auditors and compliance reviewers: bound by confidentiality obligations.

We do not sell personal data. We do not share data for advertising or marketing purposes.

5. Retention

Compliance and audit records, including immutable transaction evidence, are retained for at least seven (7) years following the end of the business relationship, in accordance with EU AMLD5, US Bank Secrecy Act, and equivalent obligations. Records subject to active investigation are retained until the investigation is resolved. Operational logs not subject to a retention obligation may be deleted after twelve (12) months.

6. Security

We implement technical and organisational measures appropriate to the sensitivity of the data, including TLS in transit, encrypted storage of secrets in HashiCorp Vault, role-based and IP-restricted API access, separation-of-duties controls on sensitive actions, and append-only audit logging. No system is fully secure; Users must protect their own credentials and notify us of suspected compromise.

7. Your Rights

Depending on your jurisdiction, you may have the right to access, correct, or object to processing of your personal data. Note that the right of erasure is materially limited by our compliance and audit retention obligations. To exercise rights, contact privacy@alpha-eta.biz.

8. International Transfers

Information may be processed in jurisdictions outside the User's country of residence. Where required, we rely on appropriate safeguards including standard contractual clauses approved by the European Commission.

9. Children

Alpha is an institutional service. We do not knowingly process the personal data of individuals under sixteen (16) years of age.

10. Changes to This Policy

Alpha may update this Policy from time to time. Material changes will be communicated to onboarded Users via the contact details on file.

11. Contact

For privacy-related enquiries, contact privacy@alpha-eta.biz.