Last updated: August 17, 2026
HOLD is software. Every regulated financial activity in the app — opening a fiat account, executing a payment, converting between fiat and stablecoins — is performed by a licensed institution acting in its own name. This page lists those institutions and our other suppliers, and says what each one receives. We keep it current: when an integration changes, this page changes with it.
Providers marked Not yet enabled are built into the app, but the feature they power is not switched on in the public release yet. They are listed in advance so that nothing about where your data goes is a surprise on the day a feature ships.
These providers hold the licences under which regulated features operate. Each performs its own customer onboarding and screening under its own programme, and each decides for itself whether to accept a customer. HOLD does not hold client money and does not settle fiat at any point.
Bridge
Not yet enabledBridge Building Inc., Delaware, United States (NMLS #2450917, money transmitter licences across all 50 US states and the District of Columbia). For residents of the European Economic Area: Bridge Building S.A., RCS Luxembourg B298785.
What they do: Fiat accounts (USD, EUR and GBP), on-ramp and off-ramp, and conversion between fiat and stablecoins.
What they receive: Your verification result and the identifying and compliance data Bridge requires to open and operate an account in your name, plus the details of the payments you instruct.
Crossmint
Not yet enabledWhat they do: Card-based purchase of stablecoins, delivered to your own wallet address.
What they receive: The details you enter for the purchase. Crossmint runs its own checks and may ask you for information directly.
Identity verification, liveness and biometric checks, proof of address, and sanctions, PEP, watchlist and adverse-media screening are performed by Sum and Substance Ltd. ("Sumsub"), company number 09688671, registered in England and Wales at 30 St. Mary Axe, London EC3A 8BF.
Sumsub acts as our data processor under a Data Processing Agreement and processes your data on our documented instructions. Your identity documents, selfie and biometric data are captured and held by Sumsub, not by HOLD; we receive the verification outcome and the minimum data required for compliance. Sumsub is registered with the UK Information Commissioner's Office and maintains ISO/IEC 27001, 27017 and 27018, SOC 2 Type 2, and PCI DSS.
These power the non-financial things you can buy in the app. They perform no regulated financial activity and receive no identity verification data.
liteAPI (Nuitée)
Not yet enabledWhat they do: Hotel and accommodation inventory, and the booking payment, for in-app stays. liteAPI is the merchant of record for the booking; HOLD is not.
What they receive: The details needed to make and hold a booking, such as guest name and dates. No identity verification data.
eSIM Go
Not yet enabledWhat they do: Mobile data plans (eSIM) bought in the app.
What they receive: The technical details needed to issue and activate a data plan on your device. No identity verification data.
The services we use to run the product itself. They are processors acting on our instructions and are not given identity verification data.
Supabase
What they do: Database and authentication for your HOLD account.
What they receive: Your account record and the app data described in the Privacy Policy.
Render
What they do: Hosting for our backend services.
What they receive: Processes data in transit as part of running the service.
Sentry
What they do: Crash and error reporting.
What they receive: Technical diagnostics such as error traces, device model and app version.
Mixpanel
What they do: Product analytics.
What they receive: Usage events, so we can see which parts of the app are used.
Resend
What they do: Transactional email delivery.
What they receive: Your email address and the content of the message being sent to you.
Versions of our Terms of Service and Privacy Policy published before August 13, 2026 named Bitso and MoonPay as downstream regulated providers. That reflected an integration plan we did not proceed with. We have no contractual relationship with either and neither is integrated in the live product. They are named here so that anyone who read the earlier wording can see it was corrected rather than quietly removed.
Transactions you authorise are broadcast to public blockchain networks — Solana, Polygon, Base and Ethereum. These are public, permissionless networks operated by no one in particular. Data written to them is public, permanent, and outside the control of HOLD or any provider on this page.
For questions about this page or about how a specific provider handles your data, contact us at privacy@hihodl.xyz. See also our Privacy Policy and Terms of Service.