This Privacy Policy explains how Blob Engineering Pte. Ltd. ("Superbridge", "we", "us"), a company incorporated in Singapore, collects and uses personal data when you use the Superbridge interface at superbridge.app, bridge interfaces we host for our customers, and our related services (together, the "Interface").
The short version: we do not ask who you are. You connect a wallet; we never collect your name, passport, or bank details to let you bridge. What we do process is described below — mostly wallet addresses, transaction data, and standard technical data — and much of it is inherently public on the blockchains you transact on.
1. Whose policy applies
Some bridge interfaces powered by Superbridge are operated by our customers under their own brand ("Rollies" deployments). Where you use a customer's branded interface, that customer is responsible for its own collection and use of your data and has its own privacy policy; this Policy applies to the processing Superbridge itself performs to run the underlying service. Where you use superbridge.app directly, this Policy applies in full.
2. What we collect
| Category | Examples | Where it comes from |
|---|---|---|
| Blockchain data | Wallet addresses, transaction hashes, chains, tokens, amounts, routes, status, timestamps | Your use of the Interface; public blockchains |
| Technical data | IP address, browser/user agent, request metadata | Automatically, when you use the Interface |
| Derived location | Country or region inferred from IP address | Derived by us, for jurisdictional access control |
| Support data | Correspondence and details you share when you contact support or use chat | You |
| Analytics data | Pages viewed, interface interactions, error reports | Analytics and error-monitoring tools on Superbridge-operated properties |
What we do not collect for your use of the Interface: your name, identity documents, bank or card details, or contact details — unless you choose to give us contact details by reaching out to support. We never have custody of your wallet or your assets, and we cannot access, retrieve, or transfer them.
3. How we use it
- To provide the Interface — quoting and routing bridge and swap transactions, showing transaction status and history, and operating the underlying infrastructure. (Legal bases: performance of a contract; legitimate interests.)
- Compliance screening — wallet addresses transacting through the Interface are screened against sanctions and illicit-finance risk data (using providers and systems that may include TRM Labs and Superbridge-operated screening software). We may decline transactions involving flagged addresses. (Legal bases: legal obligation; legitimate interests.)
- Security and abuse prevention — monitoring, logging, and investigating abuse, fraud, and security incidents. (Legal basis: legitimate interests.)
- Service improvement — analytics and error monitoring on Superbridge-operated properties, and aggregated, de-identified usage statistics. (Legal basis: legitimate interests.)
- Legal compliance and records — where laws that apply to us require processing or retention. (Legal basis: legal obligation.)
We do not sell personal data, and we do not use personal data for third-party advertising. We do not use data that identifies you to train artificial-intelligence models.
4. Who we share it with
- Infrastructure and service providers acting for us — cloud hosting (Amazon Web Services, United States), edge and security services (Cloudflare), compliance screening (TRM Labs), error monitoring (Sentry), and email delivery for correspondence (Mailgun). A current list of processors for business customers is maintained at superbridge.app/legal/sub-processors.
- Our customers — where you use a customer's branded deployment, that customer can see transaction and usage information relating to its own interface.
- Authorities and advisers — where required by law, legal process, or to protect our rights, users, or the public.
- Public blockchains — transactions you initiate are broadcast to public, decentralised networks. Anything written to a blockchain is public, permanent, and outside anyone's control, including ours.
5. International transfers
We are established in Singapore and host the Interface in the United States. Where data protected by European, UK, or Swiss law is transferred to countries without an adequacy decision, we rely on appropriate safeguards, including the EU Standard Contractual Clauses. As a Singapore-incorporated company, we also take contractually appropriate steps to meet our transfer obligations under Singapore’s Personal Data Protection Act.
6. How long we keep it
- Transaction and indexing records: for as long as needed to provide transaction history through the Interface, then deleted in line with our retention practices.
- API request logs (including IP addresses): 90 days.
- Short-lived operational logs: around 7–30 days depending on system.
- Screening records: as required to evidence compliance with the sanctions and anti-money-laundering obligations that apply to us.
- Support correspondence: for as long as needed to handle the matter and maintain records.
- Backups: rotate on a short cycle (currently 7 days).
Data recorded on public blockchains cannot be deleted by us or anyone else.
7. Your rights
Depending on where you live, you may have rights to access, correct, delete, restrict, or port your personal data, to object to processing, and to complain to a supervisory authority — in Singapore, the Personal Data Protection Commission (PDPC); in the EEA/UK, your local data protection authority.
Two honest limits, inherent to how blockchains work:
- We often cannot identify you. Where we hold only pseudonymous data (a wallet address, a transaction hash) and cannot link it to you, we may be unable to act on a request without additional information — and we are not required to collect more data about you just to identify you.
- We cannot change a blockchain. Data recorded on a public network is immutable and replicated beyond anyone's control. Rights to rectification or erasure can only apply to data held in systems we control.
To exercise a right, contact [email protected].
8. Cookies and analytics
Superbridge sets no cookies of its own. Analytics and error-monitoring tools on Superbridge-operated properties load only after you accept them via the consent prompt (or the Cookies & Analytics toggle in Settings, where you can change your choice at any time). Until you accept, no non-essential cookie is set and no analytics run.
Cookies set by those tools when you have accepted:
| Cookie | Set by | Purpose | Retention |
|---|---|---|---|
| _ga | Google Analytics | Distinguishes visitors | 2 years |
| ga* | Google Analytics | Session state | 2 years |
| ph_*_posthog | PostHog (where configured) | Distinguishes visitors | 1 year |
Independently of your choice, the following remain in use because the Interface cannot function safely without them: Cloudflare security cookies for bot mitigation on protected endpoints, and local browser storage holding functional state only — your display preferences, dismissed notices, consent choice, and locally tracked in-flight transactions. None of these identify you or track you across sites.
Bridge interfaces operated by our customers may configure their own analytics on their deployment; those are governed by the customer's own privacy policy (see Section 1).
9. Children
The Interface is not directed at children, and we do not knowingly collect personal data from anyone under the age of digital consent in their jurisdiction.
10. Changes to this Policy
We will post any updates at this address and update the date at the top. Material changes will be highlighted on the Interface. Previous versions are available at superbridge.app/legal/archive.
11. Contact
Blob Engineering Pte. Ltd., 160 Robinson Road, #14-04 Singapore Business Federation Center, Singapore 068914.
Data Protection Officer: reachable at [email protected]