Privacy Policy

Who we are

Firma Operations AG (“we”, “us”) is the controller for the personal data in this policy. We are a Swiss financial intermediary and a member of the VQF self-regulatory organization. We are subject to the Swiss Anti-Money Laundering Act (AMLA) and the Federal Act on Data Protection (FADP). We are at Dammstrasse 16, 6300 Zug, Switzerland. Write to privacy@firma.cash.

This policy covers two different sets of data. The website and the sales process are one. KYC and KYB for a client are the other. They are not kept in the same place, and they are not used for the same reason.

The website and the sales process

If you visit firma.cash, submit a form, book a call, or talk to us about an account, we collect a wide record of that activity. We use it for marketing and for sales inside Firma.

That record includes the pages you open, what you click, how far you scroll, your device and browser, your IP address, approximate location, the ad or link that brought you in, and identifiers from advertising cookies and pixels. Hotjar records the visit on screen: mouse movement, clicks, and the page as you saw it. We follow that activity through the sales cycle, from the first visit, through a form or a call, to a subscription or a decision to stop.

People at Firma use this for marketing and sales. AI tools use it as well, including xAI, to work on that marketing and sales material. This is not the file we keep for KYC or KYB.

Tools on the website and in sales

Hotjar records sessions and builds heatmaps of how the site is used.

PostHog measures visits, events, and activity on the site.

Meta runs our Facebook and Instagram ads. The Meta Pixel, also called the Facebook Pixel, measures those ads, builds audiences, and ties a visit to an ad.

LinkedIn Ads measures our LinkedIn campaigns and ties a visit to an ad.

Google Ads uses a Google tag, the Google pixel, to measure our Google ads.

GetSiteControl shows messages on the site and stores what you submit in them.

HubSpot is our CRM. It holds the sales record for a company from first contact through the rest of the cycle.

Typeform collects the contact-sales form.

Calendly books a call. The meeting is placed on Google Calendar.

xAI processes marketing and sales material for us.

Intercom runs the chat on the website.

These providers receive the data they need for that job. The advertising companies also process some of it under their own terms to deliver and measure ads. We do not sell personal data.

KYC and KYB

If you apply or become a client, we collect identity and company information for customer due diligence under the AMLA. That includes identification documents, name, date of birth, nationality, address, beneficial ownership, proof of address, source of funds or wealth, contact details for the account, and wallet addresses linked to a verified identity.

Didit checks identity for us, as our processor. We have opted out of model training on our Didit account. Didit describes its own processing at https://didit.me/terms/privacy-policy/.

We share KYC and KYB data with Dakota Finance, Inc. and with Lead Bank, Member FDIC, so they can open virtual bank accounts.

We store KYC and KYB records offline. They are not kept on the website. We do this to reduce the chance of a compromise, and because the AMLA requires us to keep them. Access is limited to compliance staff who need the file.

We keep those records for the client relationship and for 10 years after it ends. That is the retention duty in Article 7 AMLA. We cannot delete them sooner because you ask. Transactions on a public blockchain stay public. The link we hold between an identity and a wallet address is kept for the same 10 years.

Regulated services that require KYC are only for adults 18 and over. A self-custody wallet can be created without identity verification. We do not knowingly collect personal data from anyone under 18 for those regulated services.

Other recipients

We also disclose personal data when Swiss law requires it: to Swiss authorities, the VQF, courts, or another competent body, and to auditors bound by secrecy for an SRO audit. A request from a foreign authority has to come through the Swiss procedure that applies to it.

Countries

We are in Switzerland. The providers in this policy include companies in the United States and in other countries. Your data is processed there when you use the site, when we work a sale, when Didit checks an identity, and when Dakota Finance, Inc. or Lead Bank opens an account. Swiss and European law can require a contract or another safeguard for that transfer. Ask us if you want the safeguard that applies to a given provider.

How long we keep website and sales data

We keep website and sales records while they are useful for marketing and for the sales cycle, and for as long as we need them to show what we did. You can tell us to stop marketing to you. KYC and KYB follow the 10-year rule above, not this one.

Your rights

Under the FADP you can ask what we hold and ask us to correct it. You can object to marketing. You can ask us to delete website and sales data. We cannot delete KYC and KYB records before the 10-year AMLA period ends. We may refuse or limit access to those records where the AMLA, or another legal duty, requires that.

If you are in the EEA or the United Kingdom, you can also ask us to restrict processing, ask for a portable copy, and object where we rely on our own interests. You can complain to your local authority and to the Swiss Federal Data Protection and Information Commissioner (FDPIC) at https://www.edoeb.admin.ch.

Write to privacy@firma.cash. We answer within 30 days.

Changes

We update this page when the practice changes. The date at the top is the current version.

Contact

Firma Operations AG, Dammstrasse 16, 6300 Zug, Switzerland. Email: privacy@firma.cash.

This policy is effective as of October 9, 2026.