Privacy Policy

Name: Carbium Solana Swap Aggregator
Brand: Carbium

Last updated: October 31, 2026

This Privacy Policy explains how Carbium Corporation, a Wyoming corporation ("Carbium", "we", "us"), collects, uses and shares personal data when you use the Services described in our Terms of Service: our websites at carbium.io, carbium.sh and their subdomains, Carbium Swap at dex.carbium.io, Carbium accounts, and our Developer Services, including the Swap API and the RPC. Carbium is responsible for this data. Contact details are in Section 12.

1. In short

We do not sell your personal data and do not use it for advertising.
Our websites and Carbium Swap use no advertising trackers. The only third-party analytics is Cloudflare Web Analytics, which measures page views and load times (Section 4). Our own records of your activity are described in Section 2.
Wallet addresses and transactions are public on the blockchain. We cannot change or delete them.
We keep IP addresses in logs and sign-in records for security, abuse prevention and sanctions compliance.

2. What we collect

2.1 When you use Carbium Swap.

The public address of the wallet you connect and the name of the wallet app.
Your trading activity: the tokens you pick and the amounts, quotes and routes of the swaps you prepare, their transaction signatures, whether they landed or failed (with error details), and the USD values we compute for them. We record this together with the connected wallet address, a random identifier for your browser tab and the pages you open in the Interface.
Technical data in our server logs: IP address, browser and device type (user agent), the requested address and its parameters (which can include your wallet address), and the time of each request.
Preferences stored on your device (Section 5).

2.2 When you create or use an Account.

Sign-in details: the wallet addresses you link; your email address if you sign in with email; your Google account ID and, if Google has verified it, your email address (we do not keep your Google name or photo); your X account ID. Our developer dashboards keep the email address, name and profile picture link that Google, Discord or X provide, or the wallet address or email you sign up with.
Your profile: a display name and a profile picture you upload. We store the picture as uploaded, including any information embedded in the file.
Sign-in and security records: a hashed session token, your IP address and user agent, sign-in times, and a security log of sign-ins and of added and removed sign-in methods, with IP addresses. Sign-in codes are stored only as hashes and expire after 10 minutes.

2.3 When you use the Developer Services.

Your API keys, IP allowlists and other settings; usage counts per key, endpoint and day; and request logs (IP address, the request and its parameters, which can include wallet addresses, status and timing).
For abuse prevention, the IP address and network you signed up from.
Billing: your name, email address, plan, the paying wallet address, transaction signature, amount, and the payment processor's records of the payment. We do not receive card numbers.

2.4 When you contact us or use our websites and blog.

Contact form: your name, email address, company, topic, message, preferred meeting times and time zone. Partner applications: project name and links, contact name, work email, role, Telegram handle and details. Meeting bookings: what you enter on our booking page.
Blog: your email address and name if you become a member, the pages you read and the site or link that brought you there in the 24 hours before you sign up (kept in your browser's session storage and saved with your membership), and any comments you post.
On our websites other than Carbium Swap: the pages you open and how long they take to load, measured by Cloudflare Web Analytics.

2.5 When you use the Bridge. Our server sends your source and destination addresses, chains, tokens and amounts to deBridge to prepare the order, and sends your EVM address to public EVM RPC providers to read your balances.

2.6 Public blockchain data. Transactions you send are recorded on public blockchains, where anyone can see them and link them to your wallet address. We read public blockchain data to run the Services.

3. How we use it

To provide the Services: to show quotes and balances, prepare and send transactions, run Accounts, provide the Developer Services, and bill paid plans.
For security and to prevent abuse: rate limits, detecting fraud and attacks, and protecting Accounts.
To comply with law: sanctions screening and blocking access from restricted places using IP and wallet addresses, answering lawful requests, and keeping tax and accounting records.
To communicate with you: sign-in and approval codes, service, billing and renewal emails, and replies to your messages. We send blog newsletters only if you subscribe.
To understand and improve the Services: measuring use and performance and fixing errors. If we start a rewards program based on past activity, we will publish its terms before it starts.

If you are in the European Economic Area, the United Kingdom or Switzerland, we rely on these legal bases: performing our contract with you (providing the Services), our legitimate interests (security, abuse prevention, understanding and improving the Services), legal obligations (sanctions, tax and accounting), and your consent where the law requires it (for example newsletters). You can withdraw consent at any time.

Service providers that help us run the Services: Cloudflare (network, security and delivery for our websites, which sees the traffic to them, and page view and load-time statistics through Cloudflare Web Analytics); Google (sign-in, sending sign-in emails through Gmail, partner applications through Google Apps Script, and Google Fonts on some of our websites); X (sign-in, and images in posts embedded on our website); Discord (sign-in to our developer dashboards); Resend (contact form emails); Twilio SendGrid (billing and renewal emails, with images hosted on Amazon Web Services); Cal.com (meeting bookings); the email provider of our blog and jsDelivr (blog scripts); and MoonPay Commerce (formerly Helio) and Stripe (payments).
Services you use through us: deBridge and public EVM RPC providers when you use the Bridge. When you pay for an RPC plan from your wallet, the RPC dashboard reads your balance from the public Solana RPC (api.mainnet-beta.solana.com), which receives your IP address and wallet address. Token images and the logo on our status page are loaded by your browser directly from the sites that host them, which then receive your IP address.
Our affiliates that help us run the Services, under this policy.
Authorities and others when the law requires it, or to protect our rights, our users or the public, or to enforce our Terms.
A buyer or successor if we are involved in a merger, acquisition or sale of assets.
Anyone else with your consent.

We do not sell personal data and do not share it for cross-context behavioural advertising.

5. Cookies and storage on your device

Needed to run the Services: cb_user keeps you signed in to Carbium Swap (30 days, ending after 14 days without use); cb_nonce (15 minutes) and cb_oauth (10 minutes) protect sign-in; our developer dashboards keep a sign-in cookie for 30 days, and the RPC dashboard also keeps your email address or wallet address in a cookie for 30 days.
Preferences: your language, slippage and suggested tokens (cookies that end with your browser session) and whether the RPC dashboard's sidebar is open (a cookie kept for 7 days); and in your browser's storage, your selected and recent tokens, the last balance shown for each token of your connected wallet (stored with its address), your agreement to the Terms, the version of the Interface you last loaded and connection timing samples, which stay on your device.
Activity: a random identifier in your browser's session storage that groups the Interface activity of one tab, and on the blog, the pages you read and how you arrived in the last 24 hours (Section 2.4).

We use no advertising cookies. You can clear cookies and storage in your browser settings; the Services may not work without the ones needed to run them.

6. How long we keep it

Account data, linked wallets and profile: until your Account is closed.
Trading activity records and sign-in records (including IP addresses): currently kept without a fixed end date.
Security log of Account actions: 7 days, or the latest 5,000 entries.
An email address entered for a sign-in that was not finished: until a new code is requested for it or you ask us to delete it.
Server logs: overwritten automatically as new logs are written; RPC dashboard request logs are kept for 21 days.
Swap API usage counts: 90 days. Developer Services error logs are currently kept without a fixed end date.
Billing records: as long as accounting and tax law require.
Contact, partner and booking information: as long as needed to handle your request and our relationship with you.
Blog membership: until you unsubscribe or ask us to delete it.

7. Your rights and choices

You can ask us to give you a copy of your personal data, correct it, delete it, or send it to you in a portable format, and you can object to or ask us to limit our use of it. Email [email protected]. We will check your identity first, for example by asking you to sign a message with your wallet or to confirm from your email address, and we will answer within one month, or tell you if we need longer.

Some data cannot be deleted. Blockchain records are permanent, and we may keep data we need for legal obligations, security, or to establish or defend legal claims.

If you are in the European Economic Area, the United Kingdom or Switzerland, you can also complain to your data protection authority. If you are in California, you can review and ask us to change your personal data by emailing us; we do not sell or share personal information, and our websites do not respond to Do Not Track signals, because we do not track you across other companies' websites.

8. Security

We protect data with encryption in transit, hashed session tokens and sign-in codes, and access limited to people who need it. No system is completely secure, and we cannot guarantee the security of your data. Please report security problems to [email protected].

9. International transfers

Carbium is a U.S. company. Our servers are in Switzerland, and our service providers process data in the United States and other countries whose laws may protect it less than the laws where you live. Where the law requires it, we rely on safeguards such as the European Commission's standard contractual clauses and their UK and Swiss equivalents.

10. Children

The Services are not for anyone under 18, and we do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

11. Changes to this policy

We may change this policy. We will post the new version here with a new "Last updated" date and, for a material change, tell you through the Services or by email where we have your address.

12. Contact

Carbium Corporation, 30 N Gould St, Ste 40292, Sheridan, WY 82801, USA. Email: [email protected].