Privacy Policy

1 Information We Collect

The information CrypTap collects depends on how you interact with the Services.

A. Account and Business Information

When you create or use a CrypTap account, we may collect information such as:

• Name
• Email address
• Business name
• Business contact information
• Merchant or business information
• Account identifiers
• Login and authentication information
• Wallet addresses
• Blockchain network preferences
• Onboarding information
• Merchant operational information
• Communications with CrypTap
• Customer support inquiries

If you use a third party authentication service, such as Google authentication, we may receive information from that provider necessary to authenticate your account, such as your name, email address, account identifier, or other information you authorize the provider to share with CrypTap.

CrypTap does not receive your password for a third party authentication service.

B. Transaction and Payment Information

When the Services are used to facilitate or monitor a payment, CrypTap may process and maintain information relating to the payment interaction, including:

• Merchant account identifiers
• Payment intent information
• Public wallet addresses
• Invoice or payment contract addresses
• Smart contract addresses
• Transaction hashes
• Blockchain network
• Token or digital asset type
• Payment amount
• Timestamps
• Transaction and payment status
• Device or session information
• Payment confirmation information
• Webhook delivery information
• Transaction metadata
• Operational records associated with the payment

We may use this information to operate the payment infrastructure, determine transaction status, provide merchant reporting and analytics, generate or support receipts, provide customer support, prevent fraud, maintain security, conduct compliance reviews, resolve disputes, maintain records, and improve the Services.

CrypTap does not need to take custody of customer or merchant funds in order to process or maintain this information.

C. Technical and Usage Information

We may automatically collect technical and usage information, including:

• IP address
• Browser type
• Operating system
• Device identifiers
• Dashboard activity
• Website or application interactions
• Session information
• Diagnostics information
• Performance and analytics information
• API usage
• Interaction logs
• Device connectivity information
• Error and crash information
• Security events
• Operational infrastructure telemetry

CrypTap may also collect limited technical information concerning CrypTap hardware, including operational wallet infrastructure status, blockchain communication diagnostics, gas balance status indicators, device status, smart contract interaction activity, and NFC or Bluetooth communication performance.

We use this information for platform functionality, security, fraud prevention, operational reliability, analytics, troubleshooting, debugging, and improving the Services.

D. Blockchain Information

CrypTap interacts with public blockchain networks. As a result, CrypTap may process, display, monitor, or maintain information including:

• Public blockchain addresses
• Transaction hashes
• Blockchain transaction information
• Smart contract interactions
• Network identifiers
• Token information
• Transaction amounts
• Protocol level information
• Operational wallet interaction metadata

Blockchain networks are generally public. Information recorded on a public blockchain may remain publicly accessible indefinitely.

CrypTap does not control public blockchain networks and generally cannot modify, erase, reverse, conceal, or delete information recorded on them.

Although blockchain information may already be publicly available, CrypTap may associate blockchain information with a merchant account, payment, device, or other information maintained through the Services. Where blockchain information constitutes personal information under applicable law, CrypTap will process it in accordance with this Privacy Policy and applicable law.

E. Device Based Operational Wallet Infrastructure

Certain CrypTap hardware devices may generate and locally store cryptographic keypairs used for operational blockchain interactions. During ordinary operation, CrypTap does not collect, centrally store, transmit, or maintain custody of:

• Customer private keys
• Customer seed phrases
• Merchant settlement wallet private keys
• Merchant seed phrases
• Operational device private keys generated and stored locally on CrypTap hardware devices

Operational device private keys are designed to remain locally stored on merchant controlled CrypTap hardware. This section describes the intended operation of CrypTap's production architecture and should be read together with the applicable Terms of Service and technical documentation.

F. Cookies and Similar Technologies

CrypTap may use cookies and similar technologies for:

• Authentication
• Session management
• Security
• Fraud prevention
• Analytics
• Performance monitoring
• Remembering user preferences
• Improving functionality

Users may be able to restrict certain cookies through browser settings. Disabling necessary cookies may prevent portions of the Services from functioning correctly. Where required by applicable law, CrypTap will obtain consent before using nonessential cookies or similar tracking technologies.

2 How We Use Information

CrypTap may use information to:

• Create and manage accounts
• Authenticate users
• Provide and operate the Services
• Facilitate merchant onboarding
• Create and manage payment intents
• Maintain blockchain interaction infrastructure
• Determine and display payment status
• Operate CrypTap hardware
• Maintain operational wallet infrastructure
• Provide transaction records and merchant analytics
• Provide customer and merchant support
• Detect and prevent fraud, abuse, or security threats
• Conduct sanctions, compliance, and risk reviews where applicable
• Troubleshoot technical problems
• Maintain and improve platform performance
• Analyze product and Service usage
• Communicate with users and merchants
• Enforce our Terms of Service and other policies
• Protect CrypTap, merchants, customers, and third parties
• Comply with legal, regulatory, tax, law enforcement, or other lawful obligations
• Establish, exercise, or defend legal claims

CrypTap may also use aggregated, deidentified, or anonymized information to analyze and improve hardware performance, wallet compatibility, blockchain infrastructure, merchant functionality, payment functionality, security, and the Services generally. We will not attempt to reidentify information that has been properly deidentified except where permitted by law.

3 Legal Bases and Consent

Depending on your jurisdiction and the circumstances, CrypTap may process personal information based on:

• Performance of a contract
• Steps necessary to enter into a contract
• Consent
• Legitimate business interests where recognized by applicable law
• Compliance with legal obligations
• Fraud prevention and security
• Protection of CrypTap, our users, merchants, and others
• Establishment, exercise, or defense of legal claims
• Other grounds permitted by applicable law

Where consent is required, CrypTap will seek consent appropriate to the nature and sensitivity of the information and the purposes for which it is collected, used, or disclosed. You may withdraw consent where applicable, subject to legal or contractual restrictions and reasonable notice. Withdrawal of consent may affect CrypTap's ability to provide certain Services.

4 Limiting Collection and Use

CrypTap seeks to collect personal information reasonably necessary for the purposes described in this Privacy Policy and for operating, securing, and improving the Services. We do not intend to collect personal information that is unnecessary for those purposes. CrypTap will generally use and disclose personal information for the purposes identified when it was collected, purposes reasonably related to those purposes, purposes subsequently authorized by the individual, or as otherwise permitted or required by law.

5 Non-Custodial Nature of CrypTap

CrypTap provides non-custodial blockchain payment infrastructure. CrypTap does not:

• Custody customer payment funds
• Custody merchant settlement balances
• Maintain pooled customer or merchant balances
• Maintain omnibus customer accounts
• Hold customer private keys or seed phrases
• Hold merchant settlement wallet private keys or seed phrases

Users and merchants remain responsible for their wallets, private keys, seed phrases, device security, blockchain transaction authorization, and other credentials under their control. CrypTap's ability to observe, process, log, or associate blockchain transaction information with a merchant account does not mean CrypTap controls or takes custody of the underlying digital assets.

6 How We Share Information

CrypTap does not sell personal information for money. CrypTap may disclose or make information available to service providers and other parties where reasonably necessary to operate the Services, including:

• Cloud hosting and infrastructure providers
• Authentication providers
• Analytics providers
• Security and fraud prevention providers
• Blockchain infrastructure and RPC providers
• Wallet and blockchain technology providers
• Error monitoring and diagnostics providers
• Email and communications providers
• Customer support providers
• Compliance and sanctions screening providers
• Payment, conversion, or settlement infrastructure providers where applicable
• Professional advisors such as lawyers, accountants, auditors, and insurers

CrypTap may also disclose information where reasonably necessary to comply with applicable law, regulation, legal process, court order, or governmental request; investigate suspected fraud, unlawful activity, or security incidents; protect CrypTap's rights, property, users, merchants, or others; enforce our Terms of Service or other agreements; establish, exercise, or defend legal claims; or complete or evaluate a merger, acquisition, financing, restructuring, sale of assets, bankruptcy, or similar corporate transaction.

CrypTap does not disclose merchant seed phrases, customer seed phrases, or locally stored operational device private keys because CrypTap's production architecture is designed so that CrypTap does not possess those credentials.

7 Data Retention

CrypTap retains personal information only for as long as reasonably necessary for the purposes for which it was collected or subsequently authorized, including to:

• Provide the Services
• Maintain merchant and transaction records
• Meet legal, regulatory, accounting, or tax obligations
• Maintain security and fraud prevention systems
• Resolve disputes
• Enforce agreements
• Establish or defend legal claims
• Maintain operational and technical records

Different categories of information may have different retention periods depending on their purpose, sensitivity, legal requirements, and operational necessity. CrypTap will periodically review its retention practices and delete, anonymize, or otherwise securely dispose of personal information when it is no longer reasonably required, subject to applicable law. Information recorded independently on public blockchain networks may remain publicly available permanently and is outside CrypTap's ability to delete.

8 Accuracy

CrypTap takes reasonable steps appropriate to the circumstances to maintain personal information that is sufficiently accurate, complete, and current for the purposes for which it is used. Users and merchants are responsible for keeping information associated with their accounts accurate and current, particularly merchant information, contact information, and wallet information. Individuals may contact CrypTap to request correction of inaccurate personal information as described below.

9 Security

CrypTap uses reasonable administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, use, disclosure, alteration, loss, or destruction. Depending on the information and system involved, safeguards may include:

• Encryption
• Authentication controls
• Access restrictions
• Infrastructure monitoring
• Security logging
• Cloud security technologies
• Network security controls
• Operational security procedures
• Device level security mechanisms

CrypTap's hardware architecture is designed so that operational device private keys remain locally stored on merchant controlled CrypTap hardware devices during ordinary operation. No electronic system, storage mechanism, blockchain network, hardware device, or method of transmission can be guaranteed to be completely secure.

10 Security Incidents

Despite reasonable safeguards, security incidents may occur. CrypTap maintains procedures intended to identify, investigate, contain, and respond to security incidents. Where required by applicable law, CrypTap will notify affected individuals and applicable regulators of qualifying security breaches. CrypTap may also maintain records of security incidents where required by applicable law. CrypTap cannot guarantee prevention of third party wallet compromises, phishing attacks, blockchain exploits, unauthorized device access, or attacks against infrastructure outside CrypTap's reasonable control.

11 Third Party Services

CrypTap may integrate with or rely on third party systems, including blockchain networks, wallet providers, RPC providers, cloud infrastructure providers, authentication providers, analytics services, settlement providers, compliance providers, open source software, and other technical infrastructure. Third parties may have their own privacy policies and terms governing information they independently collect or process. CrypTap is not responsible for the independent privacy practices of third parties that are not processing information on CrypTap's behalf. Where CrypTap transfers personal information to a service provider for processing on CrypTap's behalf, CrypTap will take reasonable measures appropriate to applicable law and the circumstances to protect that information.

12 International and Cross-Border Data Transfers

CrypTap is a United States company and may use service providers or infrastructure located in the United States, Canada, or other jurisdictions. As a result, personal information may be processed or stored outside the country or province in which an individual resides. Information processed in another jurisdiction may be subject to the laws of that jurisdiction and may, where legally permitted, be accessible to courts, law enforcement agencies, regulators, national security authorities, or other governmental authorities. Where consent or another transfer mechanism is required by applicable law, CrypTap will take appropriate steps before transferring the information.

13 Your Privacy Rights

Depending on where you live and applicable law, you may have rights concerning your personal information, including the right to:

• Request access to personal information CrypTap maintains about you
• Request correction of inaccurate or incomplete information
• Request deletion of certain personal information
• Obtain information concerning how CrypTap uses or discloses your personal information
• Request portability of certain information
• Object to or restrict certain processing
• Withdraw consent where processing is based on consent
• Submit a complaint concerning CrypTap's privacy practices

These rights are subject to applicable exceptions and limitations. CrypTap may need to verify your identity before fulfilling a privacy request. We may retain information where permitted or required by law, including for security, fraud prevention, legal compliance, recordkeeping, dispute resolution, or establishment and defense of legal claims. Public blockchain information may not be capable of being modified or deleted by CrypTap. Privacy requests may be submitted to contact@cryptap.xyz.

14 Canadian Privacy Rights

Where Canadian privacy law applies, including the Personal Information Protection and Electronic Documents Act (PIPEDA) or applicable provincial privacy legislation, individuals may have rights concerning CrypTap's handling of their personal information. Subject to applicable law, you may request:

• Confirmation of whether CrypTap holds personal information about you
• Access to personal information under CrypTap's control
• Information about how that information has been used
• Information about organizations to which the information has been disclosed, where required
• Correction of inaccurate or incomplete personal information

CrypTap may refuse or limit a request where permitted or required by applicable law. Questions, access requests, correction requests, or complaints concerning CrypTap's handling of personal information may be directed to the Privacy Officer at contact@cryptap.xyz. Individuals may also have the right to complain to the applicable federal or provincial privacy regulator.

15 California Privacy Rights

California residents may have additional rights under applicable California privacy laws. Depending on whether the applicable statutory requirements apply to CrypTap and the particular individual, these rights may include rights to:

• Know what categories and specific pieces of personal information CrypTap has collected
• Know the categories of sources from which personal information was collected
• Know CrypTap's business or commercial purposes for collecting, using, or disclosing personal information
• Know categories of third parties to whom information is disclosed
• Request correction of inaccurate personal information
• Request deletion of certain personal information
• Obtain a copy of certain personal information
• Opt out of certain sales or sharing of personal information where applicable
• Limit certain uses or disclosures of sensitive personal information where applicable
• Exercise applicable privacy rights without unlawful discrimination

CrypTap does not sell personal information for monetary consideration. California privacy requests may be submitted to contact@cryptap.xyz. CrypTap may verify the identity and authority of individuals submitting requests as permitted by law.

16 Children's Privacy

CrypTap's Services are intended for adults and businesses and are not directed to individuals under the age of 18. CrypTap does not knowingly collect personal information from children through merchant account creation. If CrypTap learns that it has collected personal information from a child in circumstances where such collection is prohibited, CrypTap will take reasonable steps to delete the information as required by applicable law.

17 Communications

CrypTap may send service related communications concerning accounts, transactions, security, legal notices, product functionality, and other operational matters. Where CrypTap sends marketing communications, recipients may opt out of marketing emails using the unsubscribe mechanism provided in the communication or by contacting CrypTap. Opting out of marketing communications does not prevent CrypTap from sending necessary transactional, security, account, or legal communications. CrypTap will comply with applicable requirements governing commercial electronic communications.

18 Privacy Policy Changes

CrypTap may update this Privacy Policy periodically to reflect changes to the Services, technology, legal requirements, or privacy practices. When changes are made, CrypTap will update the "Last Updated" date at the top of this Privacy Policy. Where required by applicable law, CrypTap will provide additional notice or obtain consent before implementing material changes to the collection, use, or disclosure of personal information. Changes will apply prospectively except where otherwise permitted by applicable law.

19 Contact and Privacy Complaints

Questions, concerns, privacy requests, or complaints regarding this Privacy Policy or CrypTap's handling of personal information may be directed to:

CrypTap will review privacy inquiries and complaints and respond in accordance with applicable law.