Privacy Policy

Draft. Not yet reviewed by counsel — do not treat this page as final before general launch.

What we store

Your certificate's public core — wallet address, tier, issuance time, and any KYC/AML status — is stored and published on its certificate page. Your email address (received from Stripe at checkout) and payment details are stored separately and are never included in the signed certificate core or shown on any public page.

Identity verification data

Where identity verification is used (by Didit or Sumsub, as shown on your certificate), the documents and biometric data you submit are held by that provider under their own privacy terms; we receive only the review outcome (verified/rejected) and a timestamp. For Tier 3 the provider also screens your name against sanctions and politically-exposed-person lists as part of that review.

AML screening data

For Tier 3 certificates we submit the wallet address to Didit's wallet screening (blockchain analytics) on each network the certificate covers, and store the result (a status and a 0–100 risk score per network) on the certificate, where it is public like the rest of the certificate. No personal data is sent with the address.

Embedded wallet creation

If you choose "Create a wallet with email" instead of connecting an existing wallet, your email address is sent to Privy solely to authenticate you and create a non-custodial embedded wallet — Privy never gives us or anyone else access to the wallet's private key. This applies at every tier, not only where identity verification is used.

Third parties

We use Stripe for payment processing, Privy for embedded wallet creation (where chosen), WalletConnect (Reown) to connect a wallet app on your phone (where chosen), Didit and Sumsub for identity verification (where enabled), and Didit for AML wallet screening (Tier 3). Cloudflare hosts the site and its data store.

Contact

For data requests, contact Karl Finance Technologies Ltd.