Privacy Policy

Overview

Web3 Sync provides software tools for viewing, tracking and moving digital assets across multiple blockchain networks. This policy applies to our website, our web application, and any related services we operate under the Web3 Sync name.

We have written this policy to be read rather than skimmed. It describes the categories of information we handle, the specific purposes we handle them for, the third parties involved, the periods we retain information for, and how you can exercise your rights over it.

Where we make a material change to this policy, we will update the date shown above and notify you as described in section 14.

Who is responsible for your information

Web3 Sync is the controller of the personal information described in this policy. We determine why and how that information is processed, and we are accountable for processing it lawfully.

Some of the providers we work with act as our processors: they handle information only on our documented instructions and are contractually bound to protect it. Where a provider determines its own purposes for processing — for example, a blockchain network, a bot-protection service or a live-chat platform operating its own analytics — that provider is an independent controller of what it collects, and its own privacy notice applies.

Data protection enquiries, including requests made under the rights set out in section 11, can be directed to [email protected]. We aim to acknowledge every request within five working days and to resolve it within the period required by applicable law.

Information we collect

Information you provide to us

• Registration details, including your name and email address.
• Authentication data, comprising a hashed password and, where enabled, second-factor configuration.
• A transaction PIN, stored exclusively in hashed form.
• Support correspondence and any attachments you choose to send us.
• Identity verification records, where we are legally required to collect them.
• Preferences you set within the platform, such as notification settings.

Information generated by your use of the service

• Public blockchain addresses you link to your account. These are public by nature, though linking one associates it with your account.
• Transaction records created through the platform, including amounts, assets, networks, destination addresses and timestamps.
• Session and device data such as sign-in times, IP address, browser type and operating system.
• Records of actions taken within your account, retained for security, dispute resolution and audit purposes.
• Aggregate usage data that does not identify you, used to understand how the platform is used and where it can be improved.

Information we receive from third parties

• Fraud and abuse indicators supplied by security providers.
• Verification results returned by identity verification providers, where applicable.
• Bot-protection assessments used to prevent automated abuse of our registration and sign-in forms.

We do not intentionally collect special category information such as health data, religious beliefs or trade union membership, and we ask that you do not send us such information.

How we use information

We use personal information for the following purposes:

• To create, operate and administer your account, and to authenticate you when you sign in.
• To display balances, activity and analytics for the wallet addresses you link.
• To process the deposits, withdrawals, swaps, staking requests and card applications you initiate.
• To detect, investigate and prevent fraud, abuse, unauthorised access and security incidents.
• To provide customer support and to respond to your enquiries efficiently.
• To meet our legal, tax, accounting, anti-money-laundering and regulatory obligations.
• To send you service communications such as verification codes, security alerts and transaction confirmations.
• To improve the platform's reliability, performance and usability using aggregated information.
• To establish, exercise or defend legal claims.

We do not sell your personal information, we do not share it with advertising networks, and we do not use it to build advertising profiles.

Legal bases for processing

Where data protection law requires us to identify a legal basis for processing, we rely on the following:

• Performance of a contract — to provide the service you have requested, including creating your account, displaying your portfolio and executing transactions you initiate.
• Legitimate interests — to secure the platform, prevent fraud and abuse, maintain service reliability, and improve our offering. We balance these interests against your rights and do not process information in ways you would not reasonably expect.
• Compliance with legal obligations — including anti-money-laundering, sanctions screening, tax and accounting requirements.
• Consent — where we ask for it, such as for optional communications. You may withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

Where you are asked to provide information to meet a legal obligation and you decline, we may be unable to provide the service or continue to operate your account.

Cookies and analytics

We use cookies and similar storage mechanisms for three purposes. First, essential functions: keeping you signed in, protecting forms against cross-site request forgery, and maintaining session integrity. These are necessary for the service to operate and cannot be disabled without preventing sign-in. Second, preferences you set, such as interface choices. Third, where enabled, aggregate analytics that help us understand usage patterns.

Cookies we set for essential and preference purposes do not track you across other websites. Where an embedded third-party service sets its own cookies — for example, our live-chat widget, or a video player that only loads after you press play — those cookies are governed by that provider's policy and are only set once you interact with the relevant element.

You can block or delete cookies through your browser settings. Blocking essential cookies will prevent you from signing in, and we recommend leaving them enabled. Most browsers also allow you to browse in a private mode, which discards cookies when you close the window.

When we share information

We share personal information only in the following circumstances:

• With service providers — the processors described in section 8, who act on our instructions under written contracts.
• With blockchain networks — when you initiate a transaction, the details you confirm are broadcast publicly and permanently to the relevant network. This is inherent to how blockchains work and cannot be reversed or made private.
• With professional advisers — lawyers, auditors, accountants and insurers, where reasonably necessary and under duties of confidentiality.
• With authorities — where we are required by law, court order or a binding regulatory request, or where disclosure is necessary to investigate suspected financial crime. Where we are permitted to do so, we will notify you of such a request.
• In a corporate transaction — if we merge with, acquire or are acquired by another organisation, information may be transferred as part of that transaction. We will require the recipient to honour this policy, and we will notify you of any change of controller.

We do not sell personal information, and we do not share it with third parties for their own marketing purposes.

Service providers

We rely on a deliberately small number of external providers to operate the platform. These currently include:

• Live chat and support tooling — for conversations you initiate with our support team.
• Bot protection — to protect registration and sign-in forms from automated abuse.
• Video hosting — educational videos are embedded from YouTube. Players load only when you press play, and YouTube's own privacy policy applies once they do.
• Font, icon and script delivery networks — to serve typography and interface icons.
• Market data providers — to supply the pricing information displayed within the platform.
• Hosting, database and infrastructure providers — to run and back up the service.
• Email delivery providers — to send verification codes, security alerts and service notifications.

Each provider is permitted to process information only for the purpose we engaged them for, and each is bound by a written agreement that includes confidentiality and security obligations.

How long we keep data

We keep account information for as long as your account remains open. After closure, we retain records for the period required by applicable financial, tax and anti-money-laundering rules, after which they are securely deleted or irreversibly anonymised.

• Account and transaction records — retained for the statutory record-keeping period applicable to us, which is typically five to seven years after the end of the relevant relationship or tax year.
• Support correspondence — retained for a limited period so that we can resolve follow-up questions and evidence the service we provided.
• Security and access logs — retained for a short period, extended only where needed for an active investigation or legal claim.
• Aggregate analytics — retained indefinitely in a form that does not identify you.

Where information is needed for an ongoing investigation or legal proceeding, we may retain it beyond these periods until the matter is concluded.

How we protect data

Traffic between your browser and the platform is encrypted in transit. Passwords and transaction PINs are stored only in hashed form, using deliberately slow algorithms. Sensitive records are encrypted before being written to storage. Access to production data is limited to staff who require it, and administrative actions are logged.

Account access is protected by a second authentication factor, and outgoing transfers require a separate transaction PIN.

No system can be guaranteed to be perfectly secure. If a breach affects your personal information, we will notify you and any relevant regulator without undue delay, as required by applicable law. Our security overview describes these practices in more detail.

Your rights and choices

Depending on your location, you may have the right to:

• Access — obtain confirmation of whether we process your personal information, and a copy of it.
• Rectification — have inaccurate or incomplete information corrected.
• Erasure — request deletion of information we are not required to retain.
• Restriction — ask us to limit processing while a concern is investigated.
• Objection — object to processing we carry out on the basis of legitimate interests, and to direct marketing at any time.
• Portability — receive information you provided to us in a structured, commonly used, machine-readable format.
• Withdraw consent — where processing is based on consent, at any time.
• Complain — lodge a complaint with your local data protection authority. We would appreciate the opportunity to resolve your concern first.

To exercise any of these rights, email [email protected]. We will verify your identity before acting on a request, which protects your account from impersonation. We will respond within the timeframe required by applicable law.

Some rights are qualified. For example, we cannot erase records we are legally required to keep, and we cannot delete information already written to a public blockchain, because we do not control it.

International transfers

Some of our service providers operate outside the country in which you live. Where personal information is transferred internationally, we take steps to ensure it continues to receive an equivalent level of protection. These steps include entering into recognised contractual safeguards such as standard contractual clauses, and assessing the legal environment of the destination country before transferring information there.

A copy of the safeguards we rely on can be requested from [email protected].

Children

The platform is not intended for, and is not directed at, anyone under the age of 18. We do not knowingly collect personal information from children. If you believe a minor has provided us with personal information, please contact us and we will delete it promptly.

Changes to this policy

We may update this policy to reflect changes in our practices, the service, or the law. When we do, we will revise the date at the top of this page.

Where a change is material — for example, a new purpose for processing, or a new category of recipient — we will provide reasonable advance notice by email or through the platform before it takes effect. We will always keep previous versions available on request.

How to contact us

Questions about this policy, requests to exercise your rights, and complaints about how we have handled your information can all be sent to [email protected]. You can also reach us through live chat on the contact section of our homepage.

If you are not satisfied with our response, you have the right to complain to the data protection authority in your country of residence.