Company
Privacy notice
This privacy notice describes what actually happens to an enquiry. The form carries five field names: your name, your email address and your message, plus two for spam control. The handler emails them to one mailbox and stores nothing. An enquiry reaches a lender or a crypto OTC desk only after you agree to it. The site sets no cookies and runs no analytics.
Every field the enquiry form carries
The table lists every field name in the form's own markup, including the two that exist only to stop bots. Nothing is collected that is not in it. There are three fields to fill in, and none asks for a wallet address, an account number, a document or a phone number.
| Field | What it holds | Why it is asked |
|---|---|---|
| Name | Up to 120 characters | So a reply can be addressed; it becomes the display name in the email's Reply-To |
| Up to 254 characters | The only route by which you are answered; it becomes the Reply-To address | |
| Message | Up to 3,000 characters | What you hold, roughly how much, and what you need it to do |
| Website (hidden) | Empty for a person; only a bot fills it | Spam control. A filled one gets the confirmation page and no email is sent |
| Timestamp (hidden) | The second at which your browser loaded the page | Spam control. A form reported as completed in under three seconds is refused |
| The three fields you fill in are all required. They are stripped of control characters and cut to the lengths above, and the email address is checked for a valid form before anything is sent. | ||
Where the enquiry goes
The form posts to a handler on this site. Before it does anything else, the handler checks that the request came from this site rather than from another page pretending to be it, discards anything in the hidden honeypot field, and checks that the three fields you fill in are present and well formed.
What it then sends is one plain-text email to info@cryptoloanshq.com. Plain text rather than HTML, so there is nothing for a mail client to render and no tracking pixel to load. The sender is a no-reply address on this domain, so the message passes the domain's own sending checks, and the Reply-To is set to the name and address you gave, so that a reply goes to you rather than into a void.
A successful send lands you on a short confirmation page. A refused one returns you to the enquiry form with a short code in the address bar and a sentence explaining it. Your values are never put in that address bar: a URL ends up in browser history, in server logs and in anything watching them, so the form simply comes back and you re-enter what is missing. No automatic acknowledgement email is sent to you.
Nothing is written to a database. There is no submissions log, no customer record and no export. The email in one mailbox is the whole record of an enquiry.
The only file this site writes
The handler allows one successful enquiry per internet address per sixty seconds, so that a script cannot flood the mailbox. It does that with a single empty file in the server's temporary directory.
The file's name is a keyed hash (an HMAC-SHA-256) of the requesting IP address, not the address itself. The key matters: an unkeyed hash of an IPv4 address can be reversed by brute force in seconds, because there are only about four billion of them, so an unkeyed hash would be the address in a thin disguise. The file contains nothing at all. Only its modification time is read, and only to answer one question: was there a successful enquiry from this address in the last minute? No name, email address, message or enquiry detail is written to it or anywhere else on the server.
Ordinary server logs
Like any website, this one is served by a web server that keeps ordinary access logs: the requesting IP address, the date and time, the page requested, the response code, the referring page where the browser sends one, and the browser's user-agent string. Those logs belong to the hosting provider, are kept under its own retention period, and exist to run and secure the site rather than to build a profile of a visitor.
No enquiry content reaches them. The form posts its values in the body of the request rather than in the address, and the handler never puts a value into a URL, so a log line for an enquiry records that a request was made, not what was in it.
No cookies, no analytics, nothing from another origin
This site sets no cookies of any kind, so there is no cookie banner, nothing to consent to and nothing to refuse. It runs no analytics: no Google Analytics, no tag manager, no pixel, no beacon, no heat map and no session recorder.
Nothing on any page is loaded from another origin. The typeface is served from this domain rather than from a font service, the mark in the header and footer is drawn inline rather than fetched as an image, and there are no embeds, videos, maps, chat widgets or social buttons anywhere on the site.
One script file runs. It opens and closes the navigation menu and its dropdown panels, runs the loan-to-value calculator and the guide carousel, pauses the moving headline strip when asked, stamps the enquiry form with the time the page loaded, and turns the handler's error code into a readable sentence. It sets no cookie, writes nothing to local or session storage, and makes no network request of its own. A content security policy sent with every page enforces the rest: scripts, styles, images, fonts and form posts may come only from this site, and the browser blocks anything else.
If analytics is ever added, the security policy has to change in the same deployment, and this page changes with it in that deployment too.
Who the details are shared with
Sending the form shares nothing. Before an enquiry is shown to any lender or crypto OTC desk, we ask you by email whether you agree to it being shared with the lenders or desks whose criteria may fit, and it goes nowhere unless you agree. In the same email we ask you to confirm that you are not a retail consumer in the United Kingdom and that the introduction is not unlawful where you live or where your organization is established.
With that agreement, an enquiry is shown to a lender or a crypto OTC desk when that firm's published criteria fit what you have described, and only ever to firms in that position. It is not sold, rented, listed on a marketplace, posted to a panel at large or used to market anything else to you. If nothing fits, nobody sees it.
Once a firm has an enquiry, that firm holds its own copy under its own privacy notice, and it runs its own identity verification and anti-money-laundering checks. Those checks will ask for documents this site never asks for and never handles: identity documents, proof of address, source of funds and source of wealth material, and details of the wallets or accounts involved. Send those to the firm through its channel, never by reply to a website enquiry.
Two things this notice does not state
Two things a finished privacy notice states are not stated here. They are marked rather than filled with a plausible answer.
- Who the controller is. This website does not name the operator of Crypto Loans HQ, so this notice cannot name a data controller or give an address for one. If entity details are published, the controller is named here in the same change.
- How long an enquiry email is kept, and where. No retention period is stated, and the mailbox provider that holds the mailbox is not named. What is already true, and does not depend on either: nothing is written to a database, the only file the site writes is the rate-limit stamp described above, and no copy of an enquiry is held anywhere other than that one mailbox.
While neither is stated, the position is this. An enquiry email sits in one mailbox for as long as it takes to deal with the enquiry and any follow-up. You can ask for it to be deleted at any time, and the request is acted on whether or not a retention period has been published. The legal status of the service, and the regulatory questions that go with it, are covered separately in the legal notice.
How to ask for deletion
Depending on where you live, you may have rights to see the personal data an organization holds about you, to have it corrected, to have it deleted, to object to its use, and to withdraw a consent you gave. The statutory detail differs by jurisdiction, and the exact wording of this section has not been settled.
What you can do today does not wait for any of that. Write to info@cryptoloanshq.com from the address you used and ask for the enquiry to be deleted. The email and the thread around it are deleted from the mailbox, and no copy is held anywhere else, because no copy exists anywhere else.
One limit is worth stating plainly. If the enquiry had already been presented to a lender or a desk under the consent you gave, that firm holds its own copy, under its own privacy notice and its own record-keeping obligations, and a deletion request has to go to that firm as well. Ask, and the firms that received the enquiry are named to you so that you know where to send it.
To report a message that misuses the Crypto Loans HQ name, or a security problem with this site, write to info@cryptoloanshq.com. Crypto Loans HQ never asks you to send crypto assets to it, never asks for a seed phrase or a password, and never holds collateral or trade proceeds.
Changes to this notice
The version in force is the one on this page, and the published and last-reviewed dates at the top record when it last changed. A change that matters to someone who has already sent an enquiry, such as naming the controller or setting a retention period, is described here rather than slipped in.
The enquiry form itself is on the contact page, and how the pages themselves are researched and corrected in the editorial standards. The stages of an introduction are on how it works.
Where to go next
For anyone who has sent an enquiry, or is weighing one, the legal notice sets out the status of the service and the editorial standards set out how its pages are sourced.