Last Updated: November 4, 2026
Introduction: Welcome to walllet.com ("walllet"), a smart contract-based non-custodial wallet service provided by PrimeUp LTD (UAE) ("Company," "we," "us," or "our"). We respect your privacy and are committed to protecting your personal data.
This Privacy Policy ("Policy") explains how walllet (our wallet app, website, and related services) collects, uses, discloses, and safeguards information in the course of offering our Services. We aim to follow privacy best practices of data minimization and transparency.
Important note: walllet does not require users to provide personally identifying information (PII) such as your name, address, or government ID to use the core wallet features (creating a wallet, holding, sending and receiving digital assets, on-chain swaps, and connecting to dApps). We have designed walllet as a privacy-preserving, non-custodial wallet that collects only the data necessary to operate the Service. However, some technical data and analytics information may be collected as described below.
Certain optional services accessible through walllet require additional information:
Virtual Account Service (personal and business fiat accounts) and Card Service: you must provide your email address and country of residence to walllet, and you must complete identity verification (and, for business accounts, business verification) directly with the applicable regulated Third-Party Provider.
Off-Ramp Service: you must provide your email address and country of residence to walllet, and the bank account details to which the fiat proceeds will be paid.
Tokenized Real-World Asset (RWA) Swaps: availability depends on your location, which we determine using an IP-derived location signal.
walllet does not perform identity verification itself and does not receive, access, or store the identity documents, selfies, or other identity verification data you submit to a Third-Party Provider. See Sections 1 and 4 for details.
By using walllet, you agree to the collection and use of information in accordance with this Policy. In regions where consent is required (e.g., EEA/UK), we do not activate non-essential analytics, attribution or marketing tools (including GA4, PostHog, Microsoft Clarity, AppsFlyer web attribution, and the marketing tools from Meta, X and AdRoll described in Section 2) until you provide consent via our cookie banner.
This Policy applies to information collected through our mobile application, website (walllet.com), and any other services or interactions you have with walllet (collectively, the "Services"). It should be read alongside our Terms of Service and other applicable policies (such as our Cookie Policy).
For clarity, if walllet's app or site integrates third-party services (such as analytics or regulated financial service providers), data handling by those third parties is governed by their respective privacy policies, as described in Sections 4 and 6 of this Policy. We act as the data controller for any personal data we directly collect and process, meaning we determine the purposes and means of such processing.
If you have any questions about this Policy or your data, please contact us at: [email protected].
1. Information We Collect
We endeavor to collect only the minimal information necessary to provide and improve our Services. Broadly, we may collect information in the following categories:
A. Information You Provide Directly: walllet does not require registration with personal details to create or use a wallet. You do not need to provide a name, username, email address, or phone number to create a walllet or to use the core wallet features. We do not collect any seed phrases, private keys, or passkey credentials from you – those remain on your device and are never sent to us. However, you provide certain information in the following contexts:
Virtual Account, Card and Off-Ramp Services: If you choose to use the Virtual Account Service, the Card Service, or the Off-Ramp Service, we collect and store:
Email address – used to identify your request for these services, to communicate with you about them (including service, security, and transaction-related messages), and to link your request with the applicable Third-Party Provider.
Country of residence – these services are not available in all countries or regions, so we use the country you report to determine which services you are eligible to request and to route your request to an appropriate Third-Party Provider.
Bank account details (Off-Ramp Service only) – the details of the bank account you designate to receive fiat proceeds (such as account holder name, bank name, and account number), which are transmitted to the applicable Third-Party Provider to process your payout.
Service and transaction records – records of your service requests and transactions made through these services (such as the status of your account or card request, transaction amounts, dates, statuses, and reference identifiers), which we display in the app and keep for support, security, and record-keeping purposes.
Identity Verification: Identity verification for the Virtual Account Service (including personal and business accounts) and the Card Service is carried out entirely by the applicable Third-Party Provider, usually through the provider's own verification flow (for example, an embedded web view). The identity documents, selfies, personal details, business documents, beneficial-owner information, and other verification information you submit go directly to that provider and are not received, accessed, or stored by walllet. walllet does not approve or reject verifications. See Section 1.C and Section 4.
Support or Communication: If you contact us for support or feedback (e.g., via email or an in-app chat using our support tool, such as Intercom), you may provide us with your email address, name, or details about your issue. We will use this information solely to assist you and will not retain it longer than necessary.
Surveys or Beta Programs: We might offer optional user surveys, beta testing sign-ups, or referral programs where you can choose to provide an email or other contact info. Participation in these is voluntary, and any data provided will be used only for the stated purpose (e.g., to send you beta access or gather feedback).
We emphasize that the core functionality of walllet does not involve collecting personal identifiers – you can download the app and use the core wallet features without providing any personal data like email or name. Users who do not use the Virtual Account, Card, or Off-Ramp Services may remain pseudonymous (identified only by wallet addresses) from our perspective.
B. Information Collected Automatically: When you use walllet (either the mobile app or the website), certain information is collected automatically about your device and usage of the Service. This data may include:
Device and Technical Information: We may collect device identifiers and technical information such as your device model, operating system type and version, browser type (for web usage), and device language settings. For mobile app users, this might include an anonymous device ID or push notification token (which does not reveal your identity but helps deliver notifications).
IP Address: Our servers (or third-party providers like AWS) may temporarily receive your device's IP address when you interact with the Services. However, we do not log or store IP addresses linked to your usage in a personally identifiable way. Any IP processing is transient – for example, to route your request to the nearest server or apply geographic controls (such as compliance with regional restrictions and determining whether features such as RWA Swaps are available in your location). We do not use IP for tracking individual users, and we take measures to anonymize or discard IP data promptly after use.
Usage Data: We collect information on how you interact with walllet, such as the features you use, pages or screens viewed, actions taken (e.g., initiated a swap or connected to a dApp), and timestamps of activities. This information is generally collected in aggregate or anonymized form and helps us understand usage patterns to improve the Service. For instance, we might track that "Feature X was used by 30% of active users this week" without knowing who those users are. We may use analytics tools (like Google Analytics for web or similar analytics for app) that provide us with this aggregated usage data. Such tools might use cookies or mobile SDKs – please see our Cookie Policy for details on analytics cookies and how to opt-out.
Log Information: Our servers may automatically maintain logs of certain events and errors. These logs can include the above device information, usage events, and error reports (which help us troubleshoot problems). They do not deliberately contain personal user identity data, but may include technical identifiers (like a wallet address or device ID if relevant to the log). We protect these logs and only retain them for short periods unless needed for security analysis.
C. Information from Third Parties: We do not collect identity verification data about our users from third-party sources. When you use the Virtual Account Service or the Card Service, the applicable Third-Party Provider carries out identity verification (and business verification for business accounts) and makes its own decision. We may receive from that provider only the information needed to provide the service through the walllet interface, such as:
the status of your verification or application (e.g., pending, approved, rejected, or more information required) and a provider reference identifier;
the details needed to display and operate the service in the app (for example, the virtual account details issued in your name, card status, and transaction statuses and amounts).
We do not receive the underlying identity documents, selfies, or other verification data you submit to the provider.
Similarly, if you follow us or interact on social media or community platforms (Twitter, Discord, etc.), we may see your public profile or username on those services, but we do not incorporate that into walllet's system.
Blockchain Data: Note that your blockchain public address and transactions are, by definition, public information on the blockchain. walllet may read and display data from public blockchains on your behalf – for example, to show your wallet balance, token holdings, or transaction history within the app. This blockchain data (wallet addresses, transaction hashes, token IDs, etc.) is not "personal data" in the traditional sense (it is pseudonymous and publicly available). However, if such data could be linked to you, it might be considered personal data under some data protection laws. We treat wallet addresses as sensitive pseudonymous identifiers. If you use the Virtual Account, Card, or Off-Ramp Services, your wallet address will be associated in our systems with the email address and country you provided, solely to deliver those services (for example, to credit converted funds to your wallet). We do not otherwise combine wallet addresses with off-chain personal info to identify you. Any processing of on-chain data is only to provide the Service to you (like showing your own transactions) or to improve features (like detecting spam token airdrops for security).
2. How We Use Your Information
We use the information collected for the following purposes, in line with applicable legal bases:
To Provide the Core Service: We process technical and usage data to deliver walllet's functionality to you. For example, your device data and public wallet address are used to connect you to the appropriate blockchain node providers (e.g., Alchemy) to fetch your balances and send your transactions. If you initiate a blockchain transaction through walllet, we use necessary information (your account address, the transaction details) to facilitate that request via our Services. Essentially, without processing some device and blockchain info, we cannot provide a functioning wallet service. This processing is based on fulfilling our contractual obligation to you (the Terms of Service).
To Provide the Virtual Account, Card and Off-Ramp Services: When you request one of these services, we use your email address, country of residence, wallet address, and (for the Off-Ramp Service) bank account details to: determine whether the service is available in your country; route your request to the applicable Third-Party Provider and direct you to its verification flow; display your account, card, and transaction information in the app; credit converted funds to your wallet; and send you service and transaction-related messages. This processing is necessary to perform our contract with you (the Terms of Service).
On-Chain Swaps and RWA Swaps: When you request a swap, we use your wallet address and the transaction details to obtain quotes and routes from on-chain aggregators and to prepare the transaction for you to sign. For RWA Swaps, we may use an IP-derived location signal to determine whether the feature is available in your location. This processing is based on our contractual obligation to you and on compliance with legal requirements.
Security and Fraud Prevention: We may use certain data (like IP region or device characteristics) to enhance the security of the Service. For instance, we might detect suspicious activity (like a high volume of failed transactions or an attempt to use our API in an abusive manner) and use logs to investigate or prevent malicious actions. Also, to comply with international sanctions and legal requirements, we might use IP-derived region data to block access from certain prohibited jurisdictions (though we do not store that data long-term). Our goal is to minimize personal data usage while still protecting the network and users. Security-related processing is based on our legitimate interest in maintaining a safe platform and complying with laws.
Service Improvement and Analytics (consent-based in applicable regions): We use analytics and attribution tools—such as Google Analytics 4 (GA4), PostHog, Microsoft Clarity, and, where used, AppsFlyer web attribution—to understand feature usage, measure performance, improve UX, and combat fraud/abuse. We configure GA4 with IP masking enabled and rely on aggregated and/or pseudonymized reporting. In EEA/UK, non-essential analytics/attribution only run after you opt in via our cookie banner. Where permissible, our legal basis is legitimate interests in improving and securing the Service.
Marketing and Advertising Measurement (consent-based): On our website we use marketing and advertising measurement tools from Meta (Meta Pixel), X (X Pixel) and AdRoll, together with the advertising networks AdRoll works with, to measure the effectiveness of our marketing campaigns and to show walllet ads to people who have visited our website. These tools use cookies and similar identifiers and may receive information such as the pages you visit on walllet.com, a cookie or device identifier, your browser and device information, and your IP address. In regions where consent is required (e.g., EEA/UK), these tools run only after you opt in to the Marketing category in our cookie banner, and you can withdraw your consent at any time via "Cookie Preferences". Our legal basis for this processing is your consent.
Customer Support: If you reach out to us with a question or issue, we will use any contact information and details you provided to respond. For example, if you email support, we use your email to reply and the content of your message to troubleshoot and assist. Support communications may be stored (including via third-party support tools like Intercom or email services) so we have context on your issue and can follow up appropriately. We keep support data confidential and only accessible to authorized personnel. Using your info for support is based on your consent (implied by you contacting us and expecting a reply) or on our legitimate interest in providing effective customer service.
Transaction Facilitation: When you use walllet to access a service provided by a Third-Party Provider, we process the necessary data to connect you to that service. In these cases, we act mainly as a technology interface and do not store the personal data you give directly to those providers (such as identity verification data), except as needed to provide the service to you through walllet (e.g., your email, country, verification status, a provider reference ID, and transaction records). We use your data in this context simply to enable the features you request.
Legal Compliance: We may process and retain information as required by law or regulation. For example, if we are obligated to retain certain records for a period due to financial regulations, or to comply with a law enforcement request, we would do so. Additionally, we might use data to enforce our Terms of Service (e.g., investigating misuse or fraud). Processing for compliance is based on legal obligations or our legitimate interest in enforcing our rights.
Communications: We presently do not send marketing communications. If you have provided your email address to use the Virtual Account, Card, or Off-Ramp Services, we will use it to send you transactional and service messages related to those services (such as request and verification status updates, transaction notifications, security alerts, and policy updates). If in the future you opt into a newsletter or updates, we would use your provided contact to send you relevant news about walllet. You will have the ability to opt-out of marketing messages at any time.
We do not use your data for any kind of automated profiling or decision-making that has legal or significant effects on you. Eligibility and verification decisions for the Virtual Account and Card Services are made by the applicable Third-Party Provider, not by walllet. We also do not sell your personal data to third parties.
3. Cookies and Tracking Technologies
Our website uses cookies and similar tracking technologies to provide and improve the Services, as detailed in our Cookie Policy. When you visit walllet.com, we may place a small amount of data on your browser in the form of cookies. Some cookies are essential for the site to function (e.g., to remember your cookie preferences or enable core features). Other cookies are optional, such as analytics or marketing cookies. We will request your consent for non-essential cookies where required by law.
Types of Cookies Used:
Essential Cookies: These are necessary for the website's core functionality and cannot be turned off in our system. For example, they may be used for load balancing or to remember that you have logged in (if applicable). They do not store personally identifiable information and are typically session-based.
Analytics Cookies: We use these to understand how visitors engage with our site, so we can enhance user experience. For instance, Google Analytics cookies allow us to count visits, see traffic sources, and understand which pages are most popular. The data collected is aggregated and anonymized; we cannot directly identify you from analytics cookies. These cookies are only placed if you consent (via the cookie banner settings). If you opt out, your site visit will not be included in our analytics.
Functionality Cookies: These cookies enable enhanced features and personalization on the site. For example, if our site has a feature to remember your preferences (like language selection or dark mode), a cookie may store that choice. They may be set by us or third-party providers whose services we've added. Disabling these may affect site functionality or your user experience.
Advertising/Marketing Cookies: walllet does not show third-party ads on its own website. We use marketing cookies and similar technologies from Meta, X and AdRoll (together with the advertising networks AdRoll works with) to measure our marketing campaigns and to show walllet ads on other websites and platforms to people who have visited walllet.com. These cookies are only placed if you consent to the Marketing category in our cookie banner where consent is required. Details are in our Cookie Policy.
For more details, please refer to our separate Cookie Policy. It provides information on what cookies we use and why, and how you can manage your preferences.
Do-Not-Track Signals: Our website currently does not respond to "DNT" or "Do Not Track" browser signals, as there is no industry standard for these signals. However, we provide you control over cookies via our cookie consent tool.
Mobile App Tracking: The walllet mobile app does not use third-party advertising SDKs. It may use analytics/attribution SDKs—such as Google Analytics for Firebase/GA4, PostHog (where used), and the AppsFlyer SDK—for product analytics, performance, and anti-fraud. On iOS we request permission where required (e.g., App Tracking Transparency for access to IDFA), and on Android we respect the device's "Opt out of Ads Personalization."
4. How We Share Your Information
PrimeUp LTD treats user data with care and does not sell or rent your personal information to third parties. We share information only in the following circumstances:
Service Providers: We use reputable third-party companies to facilitate our Services – for example, cloud hosting (AWS), blockchain node providers (Alchemy), Account abstraction contract, Paymaster and bundler provider (ZeroDev), Analytics and attribution services (Google Analytics 4, PostHog, Microsoft Clarity, and AppsFlyer), customer support platforms (Intercom), and other providers described in this Policy. These third parties may process certain data on our behalf as "data processors." We only share with them the information necessary for them to perform their function. For instance, our cloud hosting will inevitably handle any data that passes through our app/website servers; our analytics provider will receive usage data and possibly your IP in the course of providing analytics. Each of these providers is bound by contract to protect your data and to use it only for the purpose of providing their services to us. Where feasible, we enable privacy-friendly settings (like IP anonymization in Google Analytics). A list of key subprocessors includes:
Amazon Web Services (AWS): Hosts our infrastructure and databases. Data stored on AWS could include server logs, the email address and country you provide for the Virtual Account, Card, and Off-Ramp Services, service and transaction records, and any information you input on our site. AWS adheres to high security standards.
PostHog (Product Analytics): Processes pseudonymized usage events (e.g., feature usage) to help us improve UX and performance; runs subject to consent where required.
AppsFlyer (Attribution & Anti-Fraud): Where used for web/app attribution, processes install/referral and device identifiers (e.g., IDFA/GAID) subject to platform settings and consent where required.
Microsoft Clarity (Website Analytics): Processes pseudonymized usage data, such as how visitors interact with our web pages, to help us understand and improve our website; runs subject to consent where required.
Meta, X and AdRoll (Marketing and Advertising Measurement): Receive cookie or device identifiers and information about your visits to walllet.com to measure our marketing campaigns and to show walllet ads; they may also use this data for their own purposes as independent controllers under their own privacy policies; run only with your consent where required.
Blockchain API Providers (e.g., Alchemy, Moralis): When the app queries blockchain data or submits a transaction, it may communicate with a third-party node provider. These providers might log requests for performance and abuse monitoring, which could incidentally include your IP or wallet address. Such data is generally used to provide the service (node connectivity) and troubleshoot. They do not get personal info like name or user accounts from us.
ZeroDev (Account Abstraction service): If walllet uses ZeroDev for bundling transactions or sponsoring gas fees, certain transaction data will pass through ZeroDev's systems. They may log transactions or addresses for security and analytics. We ensure no extra personal data is attached to those requests beyond what's needed (essentially blockchain transaction metadata).
Intercom (Customer Support and Chat): If you use a support chat or provide feedback in-app, Intercom might process your messages and any contact info you provide. Intercom will also gather basic device info to provide context (like app version, OS) and possibly assign you an anonymous identifier. They act as our processor to manage support tickets.
CoinMarketCap API: If we fetch token prices, your app might directly request price data from CoinMarketCap or via our servers. This typically doesn't involve personal data, but the API provider may see your app's request (with IP) to their service. They use it for rate limiting and performance.
We take care to only integrate with service providers that have strong privacy and security commitments. Where required by law (e.g., for European users), we execute appropriate Data Processing Agreements (DPAs) or Standard Contractual Clauses with these providers to ensure your data is protected in compliance with GDPR and other regulations.
Regulated Third-Party Providers (Virtual Account, Card and Off-Ramp Services): The Virtual Account Service, the Card Service, and the Off-Ramp Service are provided by independent, regulated Third-Party Providers (such as account providers and their partner banks, card issuers and program managers, payment institutions, and off-ramp providers), not by walllet. When you request one of these services, we share with the applicable provider the information needed to deliver it, such as your email address, country of residence, wallet address, request and transaction details, and, for the Off-Ramp Service, the bank account details you designate. These providers act as independent data controllers for the information they collect and process, including the identity verification information you submit directly to them. Their processing – including identity and business verification, customer due diligence, sanctions screening, fraud checks, and transaction monitoring – is governed by their own privacy policies and legal obligations. The applicable provider and its terms and privacy policy are made available to you in the walllet interface before you use the relevant service, and you should review them before submitting your information.
On-Chain Aggregators (Swaps and RWA Swaps): To provide on-chain swaps and RWA Swaps, walllet uses on-chain aggregators to obtain quotes and route transactions. In doing so, your wallet address and transaction details (such as the assets, amounts, and network) are shared with the aggregator. No other personal data is attached to these requests.
Other Third-Party Services You Use via walllet: If you connect your wallet to a third-party dApp through our app's browser, any data you provide to that dApp (like signing a message with your wallet address) is between you and that dApp. We facilitate the connection but do not intercept or store the data exchanged. However, note that by virtue of connecting, the dApp will see your wallet public address and any info you provide to it. Always review third-party terms and privacy notices when engaging. walllet's role is simply intermediary in those interactions, not a controller of the data you share with third parties.
Affiliates: PrimeUp LTD may share data with its affiliates (for instance, if we establish subsidiaries or related entities in other jurisdictions) for business and operational purposes. Any affiliate will uphold the same privacy protections as outlined in this Policy. For example, if we have a support team operating under a related company, they might access support tickets to assist you. All affiliates are bound to protect your data to the same degree.
Legal and Compliance: We may disclose information about you if required to do so by law or legal process, or if we have a good faith belief that such disclosure is reasonably necessary to (i) comply with a legal obligation (e.g., a subpoena, court order, or regulatory demand), (ii) enforce our Terms of Service or other agreements, (iii) address fraud, security, or technical issues, or (iv) protect our rights, property, and safety or that of our users or the public. We will aim to notify you of requests for your data (for example, a law enforcement request) unless we are legally prohibited from doing so. Keep in mind, however, that our ability to disclose is limited to the data we actually hold. For users of the core wallet features, this is often nothing beyond possibly an IP log or transaction hash. For users of the Virtual Account, Card, or Off-Ramp Services, it may also include the email address, country, wallet address, bank account details (for off-ramp), and service and transaction records described in Section 1. We do not hold identity verification documents, which remain with the applicable Third-Party Provider.
Business Transfers: In the event that PrimeUp LTD or walllet is involved in a merger, acquisition, financing due diligence, reorganization, bankruptcy, receivership, sale of assets, or transition of service to another provider, your data may be transferred as part of that transaction. We would ensure the acquiring entity or new provider is bound by terms that are at least as protective of your privacy as this Policy. You would be notified via the app or website of any change in data handling ownership. For example, if another company acquires walllet, the user information (however limited) we have would likely be one of the transferred assets, but the commitments of this Policy would continue to apply to your data (unless you're notified of changes and given a chance to opt-out or delete your data).
With Your Consent: In scenarios not covered above, we will ask for your consent before sharing your personal data with third parties. For instance, if we ever want to publish a user testimonial or share your feedback publicly with attribution, we'd seek your explicit permission.
Importantly, we do not sell your personal data. Apart from the marketing and advertising measurement tools described in Sections 2 and 4, which run only with your consent where required, we do not share data for marketing purposes with third-party advertisers. Any other sharing is functional (to run the service) or protective (to comply with law or security needs).
5. International Data Transfers
PrimeUp LTD is based in the United Arab Emirates (UAE) and our users are global. The data we collect will likely be processed in several countries, including outside of the European Economic Area (EEA) or your home country. For example, our main servers might be hosted in data centers in the European Union or United States (AWS regions), and our support team might operate in UAE or another country. Additionally, some of our service providers, and the regulated Third-Party Providers that provide the Virtual Account, Card, and Off-Ramp Services, may be located in the US or other countries. This means your information may be transferred to and stored on servers in a country different from where you reside, which may have data protection rules that are different (and potentially less stringent) than your country.
However, we take steps to ensure that appropriate safeguards are in place to protect your personal data in line with this Policy and applicable law. These include:
European Union Users: If you are in the EEA, UK, or Switzerland, and we transfer personal data to countries not deemed "adequate" by the European Commission (such as the US), we rely on approved transfer mechanisms like the European Commission's Standard Contractual Clauses (SCCs) or the UK International Data Transfer Agreement, as applicable. These contractual obligations require our service providers to handle EEA personal data in compliance with EU data protection standards. We also assess, on a case-by-case basis, whether additional technical or organizational measures are needed to ensure equivalent protection. For instance, when possible we use encryption and pseudonymization to protect data during transfer.
Other Regions: For users in other regions with cross-border data transfer requirements (like Brazil or Canada), we similarly ensure compliance with local law by implementing necessary contractual and security measures.
By using walllet, you understand that your information may be transferred to our facilities and to those third parties with whom we share it as described in this Policy, which may be located in other jurisdictions. We will strive to protect your data regardless of where it is processed.
If you have questions about international data transfers or want more information about the safeguards in place, you can contact us (see Section 12).
6. Third-Party Services and Links
walllet integrates or allows access to third-party services (as described earlier). Whenever you leave our app or website to use a third-party service, or if you provide data directly to a third-party within our app (like an embedded web view for identity verification or a dApp), their privacy policy governs the handling of that data. We do not control how third parties use your information, so we encourage you to review their privacy notices. Here are a few relevant scenarios:
Regulated Financial Services: When you request the Virtual Account Service or the Card Service, you complete identity verification (and business verification, for business accounts) directly with the applicable Third-Party Provider, usually through its own verification flow inside an embedded web view. When you use the Off-Ramp Service, the provider processes the bank account details you designate. The provider's terms and privacy policy govern the information you submit to it, and the provider decides whether to approve, reject, or request more information. If you want to access, correct, or delete the identity verification data you gave to a provider, you must contact that provider directly, as walllet does not hold that data.
Analytics and Tracking: We use Google Analytics and Microsoft Clarity on our website; these providers may set cookies and collect usage data (possibly including IP, though we enable anonymization when possible). Their use of the data is governed by their own terms and privacy policies. We only see aggregated or pseudonymized results. With your consent where required, we also use marketing tools from Meta, X and AdRoll, which may use the data they receive for their own purposes under their own privacy policies. You can opt out by adjusting your cookie settings ("Cookie Preferences") or by using browser opt-out tools. In the app we use analytics and attribution SDKs (Google Analytics for Firebase, PostHog where used, and the AppsFlyer SDK), as described in Section 3.
ZeroDev / Blockchain Providers / On-Chain Aggregators: If transaction bundling or gas sponsoring is done via a service like ZeroDev, or a swap is routed through an on-chain aggregator, your transaction data passes through them. They might have their own logging and data policy, but those interactions mainly involve your public blockchain data and are done to execute your requested transaction. They do not get personal info like your name or email from walllet, only the transaction content. Nonetheless, using the service implies acceptance of their terms (if any). We act as a technical intermediary and do not hand them additional personal data.
External Links: Our site and communications may include links to external websites (for example, a link to our community forum, blog, or documentation on another domain). If you follow these links, this Policy no longer applies, and whatever data you provide or is collected by that external site is subject to their policies. We are not responsible for the content or data practices of external sites.
Social Media and Community: We maintain a presence on social media platforms like Twitter (X) and communities like Discord or Telegram. If you engage with us on those platforms, any information you share is visible to others and subject to the privacy rules of those platforms. We do not import your social media data into walllet's systems (unless you explicitly give it for a support issue). If you mention us or tag us, we might use that feedback internally to improve, but we won't publish or share your handle or content outside those platforms without permission.
To summarize, third-party integrations are an integral part of walllet's ecosystem (that's the nature of a wallet that interacts with blockchain and other services). We do our best to ensure your data is protected and only necessary data is exchanged. However, you should always exercise caution and read third-party privacy policies when using external services through walllet. We are happy to provide more information on specific integrations upon request.
7. Your Rights and Choices
Depending on your jurisdiction and applicable data protection laws, you may have certain rights regarding your personal data. We are committed to honoring those rights. Below is a summary of rights that may be available (primarily focusing on the EU GDPR rights, which are similar in some other countries). Please note that these rights apply to "personal data" we hold. In walllet's case, because we keep minimal personal data, some rights might be less applicable (for example, if you only use the core wallet features and we cannot link any data to you as an individual, fulfilling a data access request might not yield much). Identity verification data submitted to a Third-Party Provider is held by that provider, so requests concerning that data must be made to the provider directly. Nonetheless, we address each:
Right of Access: You have the right to request that we provide you with a copy of the personal data we hold about you, and to information about how we process it. This is often called a Subject Access Request. We will provide the data in a commonly used format, and explain the categories of data, purposes of processing, and any parties it's been shared with. Depending on the features you use, this may include an email (if you contacted support or used the Virtual Account, Card, or Off-Ramp Services), your reported country, bank account details you provided for off-ramp, service and transaction records, or some device logs. We will search our systems by the information you provide (e.g., your email or device ID) to gather what exists.
Right to Rectification: If you believe that any personal data we have about you is incorrect or incomplete, you have the right to request that we correct it. For example, if you provided an email and you want to update it, or if a record is wrong. We'll make corrections as needed, subject to any restrictions that apply to information already shared with a Third-Party Provider (which you may also need to correct with that provider).
Right to Deletion (Erasure): You can request that we delete the personal data we hold about you. This is sometimes known as the "right to be forgotten." We will honor such requests to the extent required by law. For walllet, if you want to be "forgotten," we would delete contact info (like support emails and the email you provided for our services), your reported country, and purge any logs that could be linked to you. Note that we cannot delete public blockchain data (obviously, that is on the blockchain), but that data isn't stored by us off-chain in personal form. If you have an active virtual account or card, deleting your data may mean you can no longer use those services through walllet. Also, if you used the Virtual Account, Card, or Off-Ramp Services, you'd have to request deletion of the data held by the applicable Third-Party Provider from that provider separately. We may retain certain information if necessary for legal obligations or legitimate interests (for example, we might need to keep transaction records or a record of a support request resolution to defend against future disputes, or retain logs for security for a short period), but we'll inform you if so. In general, our aim is to permanently delete or anonymize your data upon request. Deleting the app from your device does not automatically notify us; if you want us to remove any residual data, please contact us.
Right to Restrict Processing: In certain circumstances, you can ask us to restrict (pause) processing of your data. For instance, if you contest the accuracy of data or the lawfulness of processing, we can mark it as restricted until resolved. Given our minimal processing, this right might be exercised by, say, opting out of analytics (which restricts us from processing your usage data beyond core service). We respect such choices via our cookie settings and other opt-outs.
Right to Object: You have the right to object to processing of your data in some cases, particularly if we're processing it under legitimate interests. For example, you can object to using your data for direct marketing (note: we currently do no direct marketing). If you object to any analytics or other processing, let us know – if it's not something you can self-manage (like disabling cookies), we will stop processing your data for that purpose unless we have compelling legitimate grounds to continue.
Right to Data Portability: You can request a copy of your personal data in a machine-readable format, and/or for us to transmit it to another service where technically feasible. For users of the core wallet features, there's not much to port. For users of the Virtual Account, Card, or Off-Ramp Services, the most "portable" data is likely your email, reported country, and service and transaction records, along with any support history. Blockchain data is already portable by nature (your wallet addresses can be used in other wallets freely). If you need a structured export of whatever data we have, we will provide it in CSV/JSON or similar formats.
Right to Withdraw Consent: In scenarios where we rely on your consent to process data (e.g., for optional cookies or a newsletter), you have the right to withdraw that consent at any time. Withdrawal will not affect the lawfulness of any processing we did based on consent before withdrawal. For example, if you gave consent for analytics cookies but later change your mind, you can update your cookie preferences (via our website footer "Cookie Preferences" link) and we will stop the related analytics or marketing tracking going forward. For the mobile app, if we ever prompt for a permission or data use (like sending diagnostic data) and you consent, you can disable it later in settings.
Right not to be subject to Automated Decisions: walllet does not engage in any fully automated decision-making (without human involvement) that produces legal or similarly significant effects on users. Therefore, this right is not applicable to walllet's own processing. Rest assured, no AI or algorithm is making determinations about you individually in our system. Verification and eligibility decisions for the Virtual Account and Card Services are made by the applicable Third-Party Provider under its own policies; questions about those decisions should be directed to that provider.
To exercise any of your rights, please contact us at [email protected] with your request. We may need to verify your identity to process certain requests (for example, if you're asking for deletion of an email we have on file, contacting us from that email helps verify, but we might ask for additional info if needed). We will respond to requests within the timeframe required by law (typically within 30 days for GDPR, with extension if necessary). There is no fee for making a request, unless it is manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse.
If you are in the EEA/UK and have concerns about our handling of your personal data, you have the right to lodge a complaint with your local Data Protection Authority. For example, in the UK it's the ICO, in France the CNIL, etc. We encourage you, however, to contact us first so we can try to resolve your issue directly. We take privacy seriously and will do our best to address any problems.
8. Data Retention
We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, as outlined in this Policy, and to comply with applicable legal or regulatory obligations. Our retention practices are as follows:
Service-related data (Virtual Account, Card and Off-Ramp Services): The email address and country of residence you provide, the bank account details you designate for off-ramp, and your service and transaction records are kept for as long as you use these services and, after that, for as long as needed to handle support requests, resolve disputes, and meet applicable legal, accounting, and regulatory record-keeping requirements. When this data is no longer needed, we delete or anonymize it. Identity verification data is not held by walllet; its retention is determined by the applicable Third-Party Provider under its own policies and legal obligations.
Support data: Since walllet doesn't have traditional accounts for the core wallet features, we have no ongoing profile to retain for users of those features. If you provided an email for communication, we keep that communication history as long as needed to address your inquiry or maintain a support record. For instance, an email you sent to support might be retained in our support inbox for future reference (so if you email again, we have context). We will periodically review and purge old support tickets that are no longer needed. If you want your support emails deleted sooner, you can request that, and we will scrub or anonymize them in our systems unless required to keep them.
Technical logs: Our server logs that contain IP addresses and usage events are generally kept for a short duration, typically 30 days or less, unless needed longer for security. We implement rolling deletion of logs – e.g., logs older than 30 days are automatically deleted – to limit storage of potentially identifying info. Some security-related logs (for instance, logs of important system events or errors) might be kept up to 90 days for forensic purposes, but these are protected and only used if investigating incidents.
Analytics data: Data in Google Analytics or similar systems is usually kept in aggregate form. Google Analytics retains user-level data (associated with cookies or device identifiers) for a set period (we configure it to the shortest practical period, e.g., 14 months or less). After that, it's deleted automatically. Aggregated reports (which have no personal identifiers) may be kept indefinitely. If you opt out of analytics, new data won't be collected.
Blockchain data caching: Sometimes, to improve performance, the app or our backend might cache certain blockchain data (like the list of tokens in your wallet or recent transactions). These caches are usually short-term and tied to your wallet address, not your identity. Cache data might be stored for convenience but is not personal data. Regardless, caches are regularly refreshed and old data removed.
Cookies: Cookies have varying lifespans. Some (like session cookies) expire when you close your browser, others (like a preference cookie or Google Analytics cookie) may persist for months or a couple of years. Our Cookie Policy outlines cookie durations. You can clear cookies at any time via your browser, which effectively 'deletes' that data from our site's perspective.
Legal retention: If we are required by law to retain certain data for a specified period, we will do so. For example, if financial regulations require retention of transaction records related to the Virtual Account, Card, or Off-Ramp Services, or if we must keep records for tax or accounting purposes. If we ever have to retain data related to sanctions compliance (e.g., blocking a certain region), we might keep evidence of compliance. Also, if involved in a legal dispute, we may retain relevant info until it is resolved.
When we no longer have a legitimate need to process your personal data, we will delete, anonymize, or isolate it (so that it is removed from active use). For instance, if you withdraw consent for an optional feature that stored some data, we will delete that data. If you delete walllet and do not interact with us again, over time any residual data (like support chats or analytics) will age out and be removed per our routines, subject to the record-keeping requirements described above.
9. Data Security
We employ a range of administrative, technical, and physical security measures to protect your information from unauthorized access, alteration, disclosure, or destruction. Security is a top priority for a wallet application. Key measures include:
Encryption: All network communications between walllet (app or website) and our servers or third-party APIs are encrypted via HTTPS/TLS. This prevents eavesdropping on data in transit. Additionally, personal data at rest, such as the email address, country, and bank account details you provide, is encrypted on our cloud storage. Your private keys and passkeys are always encrypted and stored on your device's secure storage (like the Secure Enclave or Android Keystore) – they never touch our servers in unencrypted form (indeed, they never touch our servers at all).
Access Controls: Within our organization, access to systems that contain any user data is limited to authorized personnel who need it to perform their job (principle of least privilege). For example, only a couple of key engineers/devops can access the server logs, and support staff can access support tickets and the service information needed to assist you. All access is protected by strong authentication (e.g., multi-factor authentication) and logged for auditing. We train our team about data security and privacy best practices.
Secure Development: We follow secure coding practices and conduct code reviews. The smart contracts and application code underlying walllet are audited for security issues. We keep our software dependencies updated to patch security vulnerabilities. We may also run a bug bounty or engage external security testers to find any weaknesses.
Network and Infrastructure Security: Our servers are hosted in secure facilities (like AWS data centers) that have robust physical security. We use firewalls and network segmentation to protect our environment. Services are configured with security in mind (e.g., restricting inbound access, using private networks for internal communication, etc.). We monitor for intrusions or anomalies in our infrastructure.
Third-Party Security: We vet the security of third-party providers we use. For example, we choose providers with a strong security reputation and compliance certifications (AWS has numerous security certifications, Intercom and Google Analytics similarly have enterprise-grade security). We ensure through contracts or assessments that these providers will protect data to high standards.
Incident Response: We have a process in place to handle any data security incidents. If we detect a breach or unauthorized access affecting personal data, we will investigate promptly and take appropriate action, including notifying users or authorities as required by law. We aim for transparency in such events.
Despite all measures, it's important to note that no method of transmission over the Internet or method of electronic storage is 100% secure. Cryptocurrency and blockchain introduce additional security considerations. For instance, if your device is compromised by malware, an attacker might misuse your wallet regardless of our server security. We cannot guarantee absolute security, but we strive to protect data to the best of our ability.
User Responsibilities: Security is also a shared responsibility. We urge you to take steps to protect yourself: use strong device passwords, keep your device OS updated, do not install untrusted apps that could log keystrokes or screen data, protect access to the email address you provided to walllet, and never share your passkey or allow others to add their biometrics to your device if you wouldn't trust them with your wallet. Be cautious of phishing attempts; walllet will never ask for your private key or passphrase. If you suspect any unauthorized access to your walllet or your device, please contact us immediately. We will assist you in understanding if any of our systems were involved or if further action is needed.
10. Children's Privacy
walllet is not directed to children under the age of 18, and we do not knowingly collect personal information from children. Our Services are intended for adult use (or at least the age of majority in your jurisdiction) given the financial nature of cryptocurrency transactions. If you are under 18, you should not use walllet or provide any information to us. We cannot prevent minors from accessing blockchain technology, but our Terms of Service do not permit anyone under 18 (or the age of majority in their jurisdiction) to use walllet. The Virtual Account, Card, and Off-Ramp Services are available only to adults who satisfy the applicable Third-Party Provider's requirements.
If we become aware that we have inadvertently collected personal data from anyone under 18 (or the age of majority in their jurisdiction), we will take steps to delete such information as soon as possible. For example, if a minor emailed support and gave their name or age, we would remove that data once we realize the age. If you are a parent or guardian and you believe your child has provided us with personal information, please contact us so we can investigate and delete any such data.
Note: This section is about personal data collection. The nature of blockchain is that anyone of any age could generate a wallet and do transactions, and that pseudonymous activity would appear in our app whenever the wallet is accessed with its passkey. We have no realistic way to know the age of a wallet holder unless they explicitly tell us. So this Policy focuses on not knowingly collecting or storing data about minors. Parents should be aware if a minor is using any crypto apps and should educate them on risks; we disclaim responsibility for unauthorized minor usage.
11. Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make changes, we will update the "Last Updated" date at the top of this Policy. If the changes are significant, we will provide a more prominent notice (such as on our website homepage or via an in-app notification) to inform you of the updates. We encourage you to review this Policy periodically to stay informed about how we are protecting your information.
Your continued use of walllet after any modifications to this Policy will signify your acceptance of the revised terms, to the extent permitted by law. If you do not agree with any changes, you should discontinue using the Services and can request us to delete your data.
12. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your data, please feel free to contact us:
Email: [email protected]
Postal Mail: PrimeUp LTD – Privacy Team, Office A, RAK DAO Business Centre, Al Rifaa, Sheikh Mohammed Bin Zayed Road, Ras Al Khaimah, UAE
We will respond to your inquiries as promptly as possible. Your privacy is extremely important to us, and we welcome feedback on how we can improve our policies and practices.