Privacy Policy

Last update:

September 18, 2026

TRM Labs, Inc. and its Affiliates (as defined herein) (collectively “TRM Labs” or “we”) know that you (“you”) care about how information about you is used and shared, and we take your privacy seriously. “Affiliates” means any entity that directly or indirectly controls, is controlled by, or is under common control with another entity, where “control” means possessing, directly or indirectly, the power to direct or cause the direction of the management, policies and operations of such entity, whether through ownership of voting securities, by contract or otherwise. Please read this Privacy Policy (“Privacy Policy”) to learn how we collect, use, disclose, store, and otherwise process (“Process”) personal information through www.trmlabs.com, www.chainabuse.com, and its related websites and social media pages (“Sites”) and TRM Labs’ products and services, including our SaaS-based offerings such as Orion, our AI product line for cyber investigations (“Solutions”). Collectively, our Sites and Solutions are our “Services.”

This Privacy Policy applies to individuals who interact with us through our Services, including visitors of our Sites, and individuals about whom we Process information in connection with our Services. .It does not apply to third-party websites, mobile applications, or services that may link to our Services or be linked to from our Services (such as when you conduct a search through our Services and receive a link to a third-party website with materials potentially relevant to your search). Please review the privacy policies on those websites and applications directly to understand their privacy practices.

We may make changes to this Privacy Policy from time to time. The date at the top of this page indicates when this Privacy Policy was last revised. If we make material changes, we will provide you with additional notice (such as by adding a statement to the Services or sending you a notification).

‍

1. Information We Collect

1.1 Information You Provide

If you are an authorized user of a TRM Labs’ enterprise customer, we may collect and Process the following types of information from you:

Contact and demographic information (e.g., names, phone number, company name, job title, email address, address, city, or country) and identifiers.
Login information.
Billing information, such as credit card number, expiration date, or security code.
Any other personal information you choose to provide when you post in our online forums and chatrooms, comment on content posted on our Services, submit as a testimonial or endorsement, complete a survey, contact our support team, participate in a contest, sweepstakes, or promotional offer, or otherwise contact us.

When you use the Chainabuse service, we collect any information you submit in a report of potential abuse as well as your contact information, including name, email, phone number, country, city, state, postal code.‍

1.2 Information We Process provided by Customers

We may Process information about you that is provided by our customers when using the Services. The information we receive and Process about you may include:

Contact information, identifiers, wallet addresses, IP addresses, demographic information, internet or other network or device activities, geolocation, and information about your business interests.
Other information provided by authorized users of our Services.

1.3 Information We Collect From Other Sources

We may collect information about you from external sources, such as third-party sources or publicly available information and media sources. We may enhance this information with the information that we already maintain to improve the accuracy of our records, in addition to other purposes described in this Privacy Policy. The information we collect and/or enhance from other sources includes:

Contact information, identifiers, demographic information, internet or other network or device activities, geolocation, inferences about you, and information about your business interests.
Publicly-available information, including information made available to the general public, such as by internet users or through publicly available media sources.
Other information provided to us from (i) publicly-available sources, and (ii) third parties we have engaged via API calls (automated requests between computer systems) that retrieve data in real time without permanently storing it. Publicly available information is used by our Services if it or associated blockchain intelligence indicates, on reasonable grounds, that information about you is relevant to the types of investigations and compliance checks described in this Privacy Policy.

Examples of sources for publicly available information and information from third parties include:

Open web results;
People-search providers;
Social media intelligence platforms;
Threat intelligence vendors; and
Corporate/sanctions screening services

1.4 Information We Process When You Use the Services

When you interact with the Services or otherwise with us, we may Process the following information about you and/or about devices or technology you may be using automatically.

Usage Information: Analytics about your interaction with our Services, including trafﬁc data, location data, weblogs and other communication data, the resources that you access, and how you reached our Services.
Device Information: Details regarding the device you use to access our Services, including, but not limited to, your IP address, operating system, and browser type.
Log File Data: Information automatically generated when you engage in digital or online interactions or transactions, such as online identifiers like usernames or handles, network identifiers such as IP address, date/time of interactions, inferred location, and information about activity conducted.
Interaction Data: Information about how you interact with our ads and newsletters, including whether you open or click links in any correspondence.
Information Collected from Web Technologies: We use cookies, web beacons, and other tracking technologies to provide features on our Services. We also partner with other companies that use these technologies to collect information about your use of our Services. For more information about the cookies that we use, how to disable them, and a list of our partners, please see our Cookie Policy.

1.5 Job Applicants

When you apply for a job with us, we collect your contact information (e.g., name, phone number, email address, address, city, or country), professional or employment information (e.g., previous work experience, names of current and previous employers), and any other information you choose to provide during your application or interview process.

We may also collect information about potential job applicants who may be a fit for positions at our company. This information may include: contact information, professional or employment information, and other information you may have made available for recruiting, or that may be publicly available about you. In either case, information may be collected about you in multiple ways: you may provide it to us in connection with your application; we may make observations in the application process or collect information from other companies, recruiting platforms, or public information sources; or you may authorize us to collect information from other sources, such as a former employer, reference or a credit reporting agency. In certain circumstances, you may submit your application for employment through a third-party service that displays our job posting. We do not control the privacy practices of these third-party services. Please review their privacy policies carefully prior to submitting your application materials.

‍

2. How We Use Information About You

We may use the information we Process about you for the following purposes:

Provide, maintain, and improve our Services: To provide you with our Services (including through authorized partners), including to process payments; fulﬁll orders; ship product; detect, prevent, and report potential abuse; send you technical notices, updates, alerts, and service communications; provide news and information we think will be of interest to you; provide maintenance and support, professional services, and/or access to subscription services; identify, report, and repair errors that impair the functionality of our Services; conduct general business operations such as accounting, recordkeeping, and audits; and to develop new Services.
Analytics: To create data that allows us to improve and grow our business, including to measure the effectiveness of ads, understand how our Services are being used, understand our customer base and purchasing trends, understand the effectiveness of our marketing, and market our products.
Personalization and Ads: To personalize the Services to your preferences, send you personalized marketing and advertising about our Services, and deliver personalized advertising to you online, which may be based on your preferences or interests across Services and devices.
Security and Legal Compliance: To protect and secure our Services, assets, network, and business operations; to detect, investigate, and prevent activities that may violate our policies or be fraudulent, illegal, or involve potential threats to the physical safety of any person; comply with legal process, such as warrants, subpoenas, court orders, and lawful regulatory or law enforcement requests; assist law enforcement or others in detecting and preventing fraud and investigating potential fraud or other unlawful or wrongful conduct; defend against or pursue claims, disputes, or litigation; and to comply with legal requirements regarding our Services.
Jobs: We may use job application information or information about potential applicants in the following ways:
- To manage your job application with us and communicate with you.
- To evaluate whether you may be a fit for positions with us, and communicate with you about positions that may be a fit for you, as permitted by law. You can ask us to delete your information, or opt-out from job-related communications, by contacting us at [email protected].
- To enhance our hiring process. This may involve the use of AI-powered tools and automated technologies to assist with application review, screening and interview analysis. Specifically, we may use certain tools to (i) help select and evaluate applications based on criteria we have identified; (ii) record and transcribe interviews;(iii) structure interview feedback and candidate assessments; and (iv) improve our hiring models over time. Notwithstanding use of these tools, any decision as to who will engage and ultimately hire to fill an opening will be made by our team. By submitting your application, you acknowledge that we may use these technologies to process your information in accordance with our privacy practices.
As Otherwise Notified or Permitted: We may notify you of other purpose(s) for which we Process information about you (for example, through updates to our Privacy Policy), you may consent to other purposes for Processing information about you, or we may Process information about you as otherwise permitted by applicable law.

‍

3. How We Process Information About You in Relation To Our Services

Information about you may be Processed, including by creating inferences, by us to provide the Services if information available to our customers or third-party data providers indicates, on reasonable grounds, that it is relevant to a compliance, anti-money laundering, or financial crime investigation. This can arise in different ways, for example:

You are the subject of an investigation or check submitted directly by a customer, for example, as part of a transaction review or customer due-diligence process.
Information about you appears in publicly available sources, such as sanctions lists, regulatory announcements, or open blockchain records.
Information about you is provided by a third-party data provider supplying financial crime intelligence to us.

Information about you is typically Processed where relevant source data indicates that you are or have been:

named on a government or international sanctions list (such as those issued by the European Union, OFAC, or the UN);
listed on the website of a regulator, law enforcement authority, or governmental body in connection with money laundering, terrorist financing, bribery, corruption, or similar activities;
identified as a "politically exposed person" (“PEP”), or a close associate or family member of a PEP;
linked to terrorist financing or other financial crime-related activity;
accused of, investigated for, arrested, charged with, convicted of, or are suspected of involvement in offences that may be a precursor to money laundering or terrorist financing (predicate offences, e.g. fraud, arms trafficking, smuggling, organised crime, or sanctions evasion); or
identified in connection with a blockchain address, wallet, or transaction that our analytics associate, on reasonable grounds, with any of the above.

We are aware that publicly accessible information can be partial, mistaken, no longer current, or stripped of the context needed to understand it properly. For this reason, we operate investigative and verification procedures built to gauge how trustworthy a source is, to confirm significant details through additional evidence where reasonably feasible, and to keep out any material that is not relevant, disproportionate, or too weakly substantiated for the aims set out in this statement. We also require our third-party partners to apply such measures when they provide any information so that information processed in relation to our Services is accurate.
‍
The fact that information about you is Processed by us to provide the Services does not mean you are suspected of any wrongdoing. For example, you may appear in our Services simply because you are named on a public regulatory list or identified in connection with a blockchain transaction that one of our customers is investigating.

‍

4. How We Disclose Your Information

4.1 Enterprise Customers and Authorized Users

We disclose information to our enterprise customers and their authorized users in connection with providing our Solutions. This may include disclosing information about you that we collect from other sources, such as publicly available sources, media sources, and third-party data providers.

4.2 Advertising Partners

We partner with third parties that assist us in advertising our Solutions online. These third parties may use tracking technologies on our website to collect or receive information from our Sites and elsewhere on the internet and then use that information to target ads to you. We also disclose information to third parties for their own marketing purposes and to expand the reach and effectiveness of our own marketing campaigns. Depending on where you reside these activities may constitute“sales,” “sharing,” or use of information for “targeted advertising” and you may have the right to opt out of these disclosures.

4.3 Vendors and Service Providers

We engage vendors, service providers, contractors, and consultants to perform functions on our behalf, and they may receive information about you. The business functions our vendors support include services that support the Services, customer service, billing and collection, auditing and accounting, professional services, analytics services, security, information technology services, and marketing. Our service providers also support our systems status reporting, backend operations, and career portal.‍

4.4 Social Media Platforms

If you interact with us on social media platforms, the platform may collect information about you and your interaction with us. If you interact with social media “widgets” on our Services (for example, by clicking on a Facebook “like” button), both the platform and your connections on the platform may be able to view that activity. To control this disclosure of information, please review the privacy policy of the relevant social media platform.

4.5 In Response to Legal Process

We share information when we believe in good faith that we are lawfully authorized or required to do so to respond to lawful subpoenas, warrants, court orders, or other regulatory or law enforcement requests.

4.6 To Protect the Rights of TRM Labs and Others

We disclose information if we believe that an individual’s actions are inconsistent with our user agreements or policies, if we believe that someone has violated the law, or if we believe it is necessary to investigate and/or protect the rights, property, and safety of TRM Labs, our users, the public, or others. For example, we share reports made on our Chainabuse service with law enforcement when the person submitting the report consents to our doing so. Similarly, we may disclose information in connection with investigating, establishing, exercising, and/or defending legal rights or claims.

4.7 Professional Advisors

We disclose information to our legal, financial, insurance, and other professional advisors where necessary to obtain advice or otherwise protect and manage our business interests.‍

4.8 Change of Ownership or Corporate Organization

We may transfer to another entity or its affiliates or service providers some or all information about you in connection with, or during negotiations of, any merger, acquisition, sale of assets or any line of business, change in ownership control, or financing transaction.‍

4.9 Corporate Affiliates

Information is disclosed between and among TRM Labs and our parents, affiliates, subsidiaries, and other companies under common control and ownership.

4.10 Targeted Advertising and Analytics

We engage third parties to provide analytics services, serve advertisements, and perform related services across the web and in mobile apps. These entities may use cookies, web beacons, SDKs, device identifiers and other technologies to collect information about your use of the Services and other websites and applications, including your IP address and other identifiers, web browser and mobile network information, pages viewed, time spent on pages or in apps, links clicked, and conversion information. This information is used to deliver advertising targeted to your interests on other companies’ sites or mobile apps and to analyze and track data, determine the popularity of certain content, to better understand your online activity, and to maintain, improve, and develop our Services. Some of the activities described in this section may constitute “targeted advertising,” “selling,” or “sharing” personal information under some laws (for further details, see “Sales, Sharing, and Targeted Advertising” below, including how to opt out of these activities). You can also learn more about interest-based ads and opt out of having your web browsing information used for behavioral advertising purposes by companies that participate in the Digital Advertising Alliance by visiting www.aboutads.info/choices. Your device may also include a feature that allows you to opt out of having certain information collected through apps used for behavioral advertising purposes.

‍

5. Additional Information about Our Data Practices

5.1 Retention Periods

We retain information for different periods of time depending on the nature of the information and our legal obligations. In general, we will retain information about you to fulfill the purposes for which it was collected, as necessary to comply with our business requirements, legal obligations, resolve disputes, protect our assets, and enforce our agreements. We may also retain cached or archived copies of information about you for a reasonable period of time in accordance with applicable law.

5.2 Disclosure of Aggregated or De-Identiﬁed Information

We may use and disclose at our discretion information that has been aggregated (information that has been compiled into summaries or statistics) or de-identified (information that has been stripped of all unique identifiers such that it cannot be linked to a particular individual). We will not attempt to re-identify an individual from such information, except as permitted by law.

5.3 Cross-border Transfer of Data

If you use our Services outside of the United States, we may collect, process, and store your information in the United States and other countries. The laws in the United States regarding information may be different from the laws of your country. Any such transfers will comply with the legal requirements under applicable law.

5.4 Our Practices Regarding Information Belonging to Children

The Services are intended for users age 18 and older. TRM Labs does not knowingly collect information from children. If we discover that we have inadvertently collected information from anyone younger than the age of 18, we will delete that information.

‍

6. How We Secure Information

Information security is a priority for us. We maintain a comprehensive framework of physical, electronic and managerial controls designed to keep information secure. Our technical and organisational measures are benchmarked against international standards and are subject to regular review and updated to reflect evolving business requirements, technological developments and regulatory changes. The specific measures we deploy are calibrated to the sensitivity of the information in question and include data encryption, access controls, regular cyber security assessments and staff training on data protection.
We also place restrictions on users of the Services and on our third-party service providers, requiring them to use information solely in connection with our Solutions or the services they provide to us, and not to rely on the Solutions as their sole basis for decision making.

Our policies and measures include the following:

Accuracy and relevance controls: robust procedures governing the inclusion and maintenance of Information, designed to ensure that Information processed in connection with our Services is accurate and relevant;
Staff education and training: ongoing training programmes to ensure that our staff understand and comply with the policies, procedures and controls in place to keep Information secure, accurate and relevant;
Access restrictions: administrative and technical controls limiting staff access to Information on a need-to-know basis;
Business continuity and disaster recovery: a dedicated strategy designed to safeguard continuity of access to, and the security of, our Services; and
Compliance monitoring: ongoing oversight of adherence to our policies, procedures and controls.

‍

7. Information for Individuals Located in Certain U.S. States

7.1 For Residents of Certain U.S. States

Certain states, including California, have enacted state comprehensive privacy laws that grant their residents certain rights and require that we provide additional disclosures (“State Laws”). This section explains how we collect and process information about you as a “business” or “controller” and the information and rights that might be available to you under those State Laws.

In this section, “personal information” means information that the State Laws define as “Personal Information” or “Personal Data.” Personal information does not include information that is deidentified or aggregated or otherwise excluded from the scope of the State Laws.‍

7.2 Sources of Personal Information We Collect

We collect personal information from you when you provide it to us or automatically through our Services. We may also obtain information about you from other sources, such as our data partners, publicly available sources, and our own internally generated research, analysis, and data enhancement processes.

7.3 Collection, Use, and Disclosure of Personal Information

The following table summarizes the categories of personal information we collect, and in the preceding 12 months have collected, and whether we disclose, sell, or share those categories of information to service providers or third parties, respectively. We collect each type of personal information for the purposes described in the “Uses of Information” section above. More information about the entities to which we disclose or sell personal information is described in “How We Disclose Your Information” above.

<table class="legal-table_component"><thead class="legal-table_head"><tr class="legal-table_row"><th class="legal-table_header">Category of Personal Information</th><th class="legal-table_header"> Categories of Entities to which We Disclose Personal Information for Business Purposes </th><th class="legal-table_header"> Categories of Entities to which We Sell or Share Personal Information for Targeted Advertising </th><th class="legal-table_header">Uses of Personal Information</th></tr></thead><tbody class="legal-table_body"><tr class="legal-table_row"><td class="legal-table_cell"><div class="legal-table_rich-text w-richtext"><p>Personal Identifiers</p><p>Examples:</p><ul role="list"><li>Contact information (name, phone number, address)</li></ul></div></td><td class="legal-table_cell"><div class="legal-table_rich-text w-richtext"><ul role="list"><li>Corporate Affiliates</li><li>Service Providers</li><li>Enterprise customers and authorized users (to provide our intelligence Solutions)</li></ul></div></td><td class="legal-table_cell"><div class="legal-table_rich-text w-richtext"><ul role="list"><li>Enterprise customers and authorized users (to provide our intelligence Solutions)</li></ul></div></td><td class="legal-table_cell"><div class="legal-table_rich-text w-richtext"><ul role="list"><li>Provide, maintain, and improve our services,</li><li>Process payments,</li><li>Provide news and information we think will be of interest to you,</li><li>Conduct general business operations such as accounting, recordkeeping, and audits,</li><li>Develop new products and services,</li><li>Understand our customer base and purchasing trends,</li><li>Understand the effectiveness of our marketing, and market our products,</li><li>Manage your job application</li></ul></div></td></tr><tr class="legal-table_row"><td class="legal-table_cell"><div class="legal-table_rich-text w-richtext"><p>Characteristics of Protected Classifications Under California or Federal Law (from job applicants)</p><p>Examples:</p><ul role="list"><li>Gender, race/ethnicity, citizenship status, veteran status, certain results of pre-employment screenings, and similar protected characteristics, as permitted by law or voluntarily provided.</li></ul></div></td><td class="legal-table_cell"><div class="legal-table_rich-text w-richtext"><ul role="list"><li>Corporate Affiliates</li><li>Service Providers</li></ul></div></td><td class="legal-table_cell"><div class="legal-table_rich-text w-richtext"><p>N/A</p></div></td><td class="legal-table_cell"><div class="legal-table_rich-text w-richtext"><ul role="list"><li>Provide, maintain, and improve our services,</li><li>Manage your job application</li></ul></div></td></tr><tr class="legal-table_row"><td class="legal-table_cell"><div class="legal-table_rich-text w-richtext"><p>Commercial Information</p><p>Examples:</p><ul role="list"><li>Billing and payment records</li><li>Order history</li><li>Log file data</li></ul></div></td><td class="legal-table_cell"><div class="legal-table_rich-text w-richtext"><ul role="list"><li>Corporate Affiliates</li><li>Service Providers</li></ul></div></td><td class="legal-table_cell"><div class="legal-table_rich-text w-richtext"><p>N/A</p></div></td><td class="legal-table_cell"><div class="legal-table_rich-text w-richtext"><ul role="list"><li>Provide, maintain, and improve our services,</li><li>Process payments,</li><li>Develop new products and services,</li><li>Understand our customer base and purchasing trends,</li><li>Understand the effectiveness of our marketing, and market our products</li></ul></div></td></tr><tr class="legal-table_row"><td class="legal-table_cell"><div class="legal-table_rich-text w-richtext"><p>Internet or Other Electronic Network Activity Information, including:</p><ul role="list"><li>IP address</li><li>Device identifier (e.g., MAC)</li><li>Information provided in URL string (e.g., search keywords)</li><li>Cookie or tracking pixel information</li><li>Information about your interaction with our website, app, or email correspondence</li><li>Publicly available data</li><li>Log file data</li></ul></div></td><td class="legal-table_cell"><div class="legal-table_rich-text w-richtext"><ul role="list"><li>Corporate Affiliates</li><li>Service Providers</li><li>Advertising Partners</li><li>Enterprise customers and authorized users (to provide our intelligence Solutions)</li></ul></div></td><td class="legal-table_cell"><div class="legal-table_rich-text w-richtext"><ul role="list"><li>Advertising Partners</li><li>Enterprise customers and authorized users (to provide our intelligence Solutions)</li></ul></div></td><td class="legal-table_cell"><div class="legal-table_rich-text w-richtext"><ul role="list"><li>Provide, maintain, and improve our services,</li><li>Develop new products and services,</li><li>Understand our customer base and purchasing trends,</li><li>Understand the effectiveness of our marketing,</li></ul></div></td></tr><tr class="legal-table_row"><td class="legal-table_cell"><div class="legal-table_rich-text w-richtext"><p>Geolocation (via IP address)</p></div></td><td class="legal-table_cell"><div class="legal-table_rich-text w-richtext"><ul role="list"><li>Corporate Affiliates</li><li>Service Providers</li><li>Enterprise customers and authorized users</li></ul></div></td><td class="legal-table_cell"><div class="legal-table_rich-text w-richtext"><ul role="list"><li>Enterprise customers and authorized users (to provide our intelligence Solutions)</li></ul></div></td><td class="legal-table_cell"><div class="legal-table_rich-text w-richtext"><ul role="list"><li>Provide, maintain, and improve our services,</li><li>Develop new products and services,</li><li>Understand our customer base and purchasing trends,</li><li>Understand the effectiveness of our marketing, and market our products</li></ul></div></td></tr><tr class="legal-table_row"><td class="legal-table_cell"><div class="legal-table_rich-text w-richtext"><p>Audio information</p><ul role="list"><li>Recordings of support team or other calls where permitted by law</li></ul></div></td><td class="legal-table_cell"><div class="legal-table_rich-text w-richtext"><ul role="list"><li>Corporate Affiliates</li><li>Service Providers</li></ul></div></td><td class="legal-table_cell"><div class="legal-table_rich-text w-richtext"><p>N/A</p></div></td><td class="legal-table_cell"><div class="legal-table_rich-text w-richtext"><ul role="list"><li>Provide, maintain, and improve our services</li></ul></div></td></tr><tr class="legal-table_row"><td class="legal-table_cell"><div class="legal-table_rich-text w-richtext"><p>Professional or employment-related information</p><ul role="list"><li>Current employer, position, title, and contact information</li><li>Work experience</li><li>Current and previous employers</li><li>Resumes</li></ul></div></td><td class="legal-table_cell"><div class="legal-table_rich-text w-richtext"><ul role="list"><li>Corporate Affiliates</li><li>Service Providers</li><li>Enterprise customers and authorized users (to provide our intelligence Solutions)</li></ul></div></td><td class="legal-table_cell"><div class="legal-table_rich-text w-richtext"><ul role="list"><li>Enterprise customers and authorized users (to provide our intelligence Solutions)</li></ul></div></td><td class="legal-table_cell"><div class="legal-table_rich-text w-richtext"><ul role="list"><li>Manage your job application</li></ul></div></td></tr><tr class="legal-table_row"><td class="legal-table_cell"><div class="legal-table_rich-text w-richtext"><p>Education information</p><ul role="list"><li>Educational background</li><li>Certifications or licenses</li></ul></div></td><td class="legal-table_cell"><div class="legal-table_rich-text w-richtext"><ul role="list"><li>Corporate Affiliates</li><li>Service Providers</li></ul></div></td><td class="legal-table_cell"><div class="legal-table_rich-text w-richtext"><p>N/A</p></div></td><td class="legal-table_cell"><div class="legal-table_rich-text w-richtext"><ul role="list"><li>Manage your job application</li></ul></div></td></tr><tr class="legal-table_row"><td class="legal-table_cell"><div class="legal-table_rich-text w-richtext"><p>Content You Provide</p><ul role="list"><li>Content in correspondence</li><li>Content posted to forums</li><li>Content submitted to chat functions</li><li>Survey responses</li></ul></div></td><td class="legal-table_cell"><div class="legal-table_rich-text w-richtext"><ul role="list"><li>Corporate Affiliates</li><li>Service Providers</li></ul></div></td><td class="legal-table_cell"><div class="legal-table_rich-text w-richtext"><p>N/A</p></div></td><td class="legal-table_cell"><div class="legal-table_rich-text w-richtext"><ul role="list"><li>Provide, maintain, and improve our services,</li><li>Develop new products and services,</li><li>Understand our customer base and purchasing trends,</li><li>Understand the effectiveness of our marketing, and market our products</li></ul></div></td></tr><tr class="legal-table_row"><td class="legal-table_cell"><div class="legal-table_rich-text w-richtext"><p>Inferences</p><ul role="list"><li>Inferences based on the other categories of information described in this Privacy Policy</li></ul></div></td><td class="legal-table_cell"><div class="legal-table_rich-text w-richtext"><ul role="list"><li>Corporate Affiliates</li><li>Service Providers</li><li>Advertising Partners</li></ul></div></td><td class="legal-table_cell"><div class="legal-table_rich-text w-richtext"><ul role="list"><li>Enterprise customers and authorized users (to provide our intelligence Solutions)</li></ul></div></td><td class="legal-table_cell"><div class="legal-table_rich-text w-richtext"><ul role="list"><li>Provide, maintain, and improve our services,</li><li>Develop new products and services,</li><li>Understand our customer base and purchasing trends,</li><li>Understand the effectiveness of our marketing, and market our products</li></ul></div></td></tr><tr class="legal-table_row"><td class="legal-table_cell"><div class="legal-table_rich-text w-richtext"><p>Sensitive Personal Information</p><ul role="list"><li>Account log-in credentials</li><li>Certain protected characterizations described above</li></ul></div></td><td class="legal-table_cell"><div class="legal-table_rich-text w-richtext"><ul role="list"><li>Corporate Affiliates</li><li>Service Providers</li></ul></div></td><td class="legal-table_cell"><div class="legal-table_rich-text w-richtext"><p>N/A</p></div></td><td class="legal-table_cell"><div class="legal-table_rich-text w-richtext"><ul role="list"><li>Provide, maintain, and improve our services</li><li>Manage your job application</li></ul></div></td></tr></tbody></table>

Notice: We may sell your sensitive personal data.

7.4 Sales, Sharing, and Targeted Advertising

The State Laws require that we provide transparency about, and allow consumers to opt out of, any “sales” or “sharing” of their personal information, or use of their personal information for “targeted advertising,” which for the purposes of the State Laws, broadly means scenarios in which TRM Labs has shared personal information with third parties in exchange for valuable consideration or shared personal information for cross-context behavioral advertising or targeted advertising. Certain cookies used on the TRM Labs site and apps may share personal information for the purpose of engaging in advertising activities, and this may be considered “selling” or “sharing” of personal information for targeted advertising under the State Laws. Additionally, certain personal information about you that we receive from other sources may be transmitted to our enterprise customers in connection with the investigation Solutions we provide, which may also be considered “selling” under the State laws. In the preceding 12 months, we may have “sold” or “shared” the categories of personal information, or used the categories of personal information for “targeted advertising” as identified above. However, in the preceding 12 months, we have not “sold” or “shared” personal information of individuals we know to be under 18 years of age. You can see our Cookie Policy for more information about cookie use. You have the right to opt out of any sale or sharing of your personal information for targeted advertising. To opt-out of our sales, sharing, and targeted advertising, use the “Your Privacy Choices” link in the footer on our site, or visit our Services with a legally-recognized opt-out preference signal enabled (such as the Global Privacy Control). TRM does not collect, use, or sell personal information for the purpose of training large language models.

7.5 Privacy Rights

Depending on your location and subject to applicable law, you may have the following rights with regard to personal information we control about you:

The right to confirm whether we process your personal information and to know the categories of personal information we have collected, sold, shared, or disclosed about you, as well as the sources of such personal information, the purposes, the specific pieces of personal information we have collected about you, and the specific third parties or categories of third parties, service providers, or contractors to whom such personal information is disclosed.
The right to access, correct, or delete the specific pieces of personal information we have collected about you.
The right to opt out of the “sale” of your personal information, the “sharing” of your personal information for cross-context behavioral advertising, and the processing of your personal information for targeted advertising.
The right to opt-out of profiling in furtherance of producing legal or significant decisions concerning a consumer.
The right not to be retaliated against for exercising your privacy rights under the State Laws, including when you are an applicant to a job application, an employee, or an independent contractor.
If your personal information is profiled in furtherance of decisions that produce legal or similarly significant effects concerning you, you have the right to question the result of the profiling, to be informed of the reason that the profiling resulted in the decision, and, if feasible, to be informed of the actions you might have taken to secure a different decision and the actions that you might take to secure a different decision in the future. You also have the right to review your Personal Information used in the profiling, and if applicable, have the data corrected and the profiling decision reevaluated based upon the corrected data.

You may submit a request to exercise any of your rights using the contact information below. We may have a reason under the law why we do not have to comply with your request or may comply with it in a more limited way than you anticipated. If we do, we will explain that to you in our response. You may have the right to use an authorized agent to make requests on your behalf through these means. If you would like to submit a request as an authorized agent, we may request proof of your authorization such as a valid power of attorney or signed permission. Please do not provide any sensitive personal information in connection with this request, such as a driver’s license or other government-issued ID. We may also contact the individual who is the subject of the request to verify their own identity, or confirm that the authorized agent has permission to submit the request. In order to process your request, we verify your identity to protect your and others’ information in accordance with applicable law.

If you have an account with us, we will use your account credentials to authenticate you. This will result in faster processing of your request.
If you do not have an account with us, we verify your identity by asking you to provide personal identifiers we can match against information we may have collected from you previously. We will also confirm your request using the email or telephone account stated in the request. We will not use personal information we collect in connection with verifying or responding to your request for any purpose other than responding to your request, except as otherwise permitted or required by law. If we deny your request, you may have the right to appeal our decision by contacting us at [email protected]. If you have concerns about the result of an appeal, you may contact the attorney general in the state where you reside.

7.6 Nondiscrimination

We will not discriminate against you for exercising your privacy rights.

7.7 Retention period

We retain information for different periods of time depending on the nature of the information and our legal obligations. In general, we will retain your personal information to fulfill the purposes for which it was collected, as necessary to comply with our business requirements, legal obligations, resolve disputes, protect our assets, and enforce our agreements. We may also retain cached or archived copies of your personal information for a reasonable period of time in accordance with applicable law.

‍

8. Information for Individuals Located in the European Economic Area, United Kingdom, or Switzerland

If you are located in the European Economic Area (“EEA”), the United Kingdom (“U.K.”), or Switzerland, the following section applies to you.

Legal Basis of Processing

When we process information about you as described above, we do so in reliance on one or more of the following lawful bases:

To perform our responsibilities under our contract with you (e.g., processing payments for and providing the Services you requested).
When we have a legitimate interest in processing information about you, including to provide the Services, operate our business or protect our interests (for details on our legitimate interests for providing the Solutions see below).
To comply with our legal obligations (e.g., to maintain a record of your consents and track those who have opted out of marketing communications).
When we have your consent to do so (e.g., when you opt in to receive marketing communications from us). When consent is the legal basis for our processing of information about you, you may withdraw such consent at any time.

Our Legitimate Interests for Providing the Solutions

We may Process information about you in our Solutions, including Orion, on the basis of legitimate interests pursued by us (e.g., to provide, maintain, and improve our products and services, conduct data analytics, and communicate with you) and by our customers.

We carried out a legitimate interest assessment to demonstrate that our interests do not take precedence over your interests, rights, and freedoms. This balancing exercise weighs several considerations against one another.

Among these are the character of the data undergoing Processing (for instance, blockchain intelligence, threat data supplied by partners, and compliance queries submitted by customers), the effect such processing may have on individuals, the reasonable expectations individuals hold concerning the public and proprietary data drawn upon during investigations, and the controls we keep in place. Those controls encompass API vaulting, boundary redaction of sensitive identifiers, restrictions placed on AI tasks, human-approval checkpoints, customer project spaces that remain access-isolated, and mechanisms for responding to data subject rights.

Having weighed all of this, we conclude that your interests, rights, and freedoms are not overridden. The decisive factor is the strong public interest in tackling illicit activity, financial crime, money laundering, and fraud across the digital asset space. This conclusion is reinforced where the relevant data originates from public or compliance sources that you could reasonably expect third parties to access.

In the absence of services such as our Solutions, each customer would have to gather and evaluate information on individuals from public sources and threat feeds on their own, generating a separate screening every time. This would cause the issue that data subjects would bear a heavier burden, because their information would be collected and searched over and over again. Further, crime prevention would suffer, since it is inherently inefficient for every organisation to compile the same data independently. We solve this by offering a single, professionally analysed source (and/or access to it), which lowers both the overall volume of data Processed and the likelihood of misidentification.‍

Exception for Processing Sensitive Data

To the extent we process sensitive categories of information (excluding criminal offences data), we primarily rely on substantial public interest. This includes substantial public interest conditions relevant to preventing or detecting unlawful acts, dishonesty, fraud and other misconduct.

In limited cases, where we have clear evidence that the data subject has intentionally made the information public, we may also rely on the exception for information manifestly made public.

For certain ancillary activities such as exercising our rights and defending against claims, receiving services from third-party data partners, and complying with regulatory requests, we rely on the exception for the establishment, exercise or defence of legal claims.

We may Process criminal offenses data in compliance with applicable laws (including EU Member State laws) and in a way that is limited to what is necessary and proportionate for the investigations and compliance checks and subject to safeguards, including specific purpose limitations on data use and data minimization.‍

Data Subjects Requests

If you are in the EEA, U.K., or Switzerland, you have certain rights. You may:

Request from us access to information held about you or request transmission of certain information you have provided to a third party.
Request that we rectify inaccurate or incomplete information we hold about you.
Request that we erase information when such information is no longer necessary for the purpose for which it was collected, when you withdraw consent and no other legal basis for Processing exists, or when you believe that your fundamental rights to data privacy and protection outweigh our legitimate interest in continuing the Processing.
Request that we restrict our Processing if there is a dispute about the accuracy of the data, if the Processing is unlawful, if the Processing is no longer necessary for the purposes for which it was collected but is needed by you for the establishment, exercise or defense of legal claims, or if your request to object to Processing is pending evaluation.
Object to Processing of your information based on our legitimate interests or for direct marketing (including profiling). We will no longer process the information unless there are compelling legitimate grounds for our Processing that override your interests, rights, and freedoms, or for the purpose of asserting, exercising, or defending legal claims.

You may submit a request to exercise any of your rights using the contact information below.

If you have a concern about our Processing of information that we are not able to resolve, you have the right to lodge a complaint about our Processing with your data protection authority. Contact details for data protection authorities are available here.

‍

9. Participation in the EU-US DPF, UK Extension to the EU-US DPF, and Swiss-US DPF

TRM Labs complies with the EU-U.S. Data Privacy Framework (“EU-U.S. DPF”), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (“Swiss-U.S. DPF”) as set forth by the U.S. Department of Commerce. TRM Labs has certified to the U.S.Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (“EU-U.S. DPF Principles”) with regard to the Processing of information received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom (and Gibraltar) in reliance on the UK Extension to the EU-U.S. DPF. TRM Labs has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (“Swiss-U.S. DPF Principles”, and collectively with the EU-U.S. DPF Principles, the “Principles”) with regard to the Processing of information received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this Privacy Policy and the Principles, the Principles shall govern. To learn more about the Data Privacy Framework (DPF) program, and to view our certification, please visit https://www.dataprivacyframework.gov/.

In compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF and the Swiss-U.S.DPF, TRM Labs commits to resolve DPF Principles-related complaints about our Processing of information. EU, UK and Swiss individuals with inquiries or complaints regarding our Processing of information received in reliance on the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF should first contact TRM Labs at [email protected].

Further, TRM Labs commits to refer unresolved complaints concerning our handling of information received in reliance on the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF to the International Centre for Dispute Resolution (“ICDR”), an alternative dispute resolution provider based in the United States. If you do not receive timely acknowledgment of your Principles-related complaint from us, or if we have not addressed your Principles-related complaint to your satisfaction, please visit https:/go.adr.org/dpf_irm.html for more information or to file a complaint. The services of ICDR are provided at no cost to you. In the event your DPF Principles-related complaint is not resolved through the channels described above, you may, under certain conditions, invoke binding arbitration before the Data Privacy Framework Panel established under Annex I of the DPF Principles, for residual claims not resolved by other means. Before invoking this option, you must: (1) raise the claimed violation directly with TRM Labs via email to [email protected] and give us an opportunity to resolve it; (2) make use of the Independent Recourse Mechanism described above, at no cost to you; and (3) raise the issue through your data protection authority to the U.S. Department of Commerce, at no cost to you. To invoke binding arbitration, you must deliver a written notice to [email protected] and follow the procedures and conditions set forth in Annex I of the DPF Principles, available at https://www.dataprivacyframework.gov.

The Federal Trade Commission has jurisdiction over TRM Labs’ compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF. In accordance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF, TRM Labs may be responsible for the processing of information received under the Principles that is subsequently transferred to third parties acting as agents on TRM Labs’ behalf, if and as required by the Principles and applicable law.

‍

10. Your Options to Control Your Information and Exercise Your Rights

You can manage the information we Process about you in the following ways. Please see our U.S. and EEA, U.K. and Switzerland disclosures for information about your rights under their laws.

10.1 Note about our role as a data “processor” to our corporate clients

When we provide our Solutions to our enterprise customers, we may receive information that is considered personal information under applicable law. If you seek to exercise the rights you may have under the applicable privacy laws with us, we may direct you to our customer instead because we may have a legal and contractual obligation to do so.

10.2 Your Account

‍If you are an enterprise customer of TRM Labs, please visit your account portal to update your contact information, and other preferences.

10.3 Email Unsubscribe

If at any time you would like to unsubscribe from receiving future emails, you can click the unsubscribe link at the bottom of any email you receive from us or email us at [email protected]. Please be aware that your choice to unsubscribe will not affect our transactional communications with you.

10.4 Cookies

You may use your browser’s settings to block or limit cookies on our Sites. If you delete your cookies or if you set your browser to limit or block cookies, some features of the Services may not be available, work, or work as designed.

‍

11. Contact and Questions

If you have any privacy- or security-related questions, please contact us by sending an email to [email protected] or you can write to us at:

TRM Labs, Inc.
Attention: Privacy
450 Townsend Street
San Francisco, CA 94107

Subscribe to our latest insights

You can unsubscribe at any time. Read our Privacy Policy.