Privacy Policy

Last updated: Oct 08, 2026 · Effective: Oct 08, 2026 · Bright Dragon Solutions Limited

1. Introduction

Bright Dragon Solutions Limited ("Walletarch", "we", "us", or "our") operates Walletarch, a non-custodial cryptocurrency wallet application and associated services (collectively, the "Service"). This Privacy Policy describes how we collect, use, share, and protect personal information about you ("you" or "User") when you use our Service.

Walletarch is designed with privacy as a foundational principle. We do not collect, store, or have access to your private keys, seed phrases, recovery phrases, or live wallet balances. Blockchain transactions are recorded on public distributed ledgers and are outside our control or responsibility. This policy covers information we do handle — specifically information related to your use of our application, customer support interactions, and technical interactions with our infrastructure.

By accessing or using the Service, you acknowledge that you have read and understood this Privacy Policy and agree to the collection and use of your information in accordance with its terms.

2. Information We Collect

2.1 Information You Provide Directly

When you create an account or contact us, you may provide:

• Account credentials: wallet name (username) and password
• Customer support communications: your email address (if provided), message content, and any attachments you include
• Feedback and survey responses: voluntary information you choose to share about your experience

2.2 Information Collected Automatically

When you use our Service, we automatically collect certain technical information:

• Device information: device type and model, operating system name and version, browser type and version, screen resolution
• Network information: IP address, approximate country-level geolocation derived from IP, internet service provider
• Usage data: features accessed, screens viewed, session start and end times, in-app navigation patterns, swap requests (asset type only, not amounts)
• Crash reports and diagnostics: application error logs, stack traces, performance metrics
• Server log files: access timestamps, endpoint paths, HTTP status codes, response times

2.3 Information We Explicitly Do Not Collect

We wish to be explicit about categories of information we do not collect or store:

• Private keys or seed phrases: your cryptographic keys are generated and stored exclusively on your device and are never transmitted to our servers
• Live wallet balances: we do not query blockchain nodes on your behalf to retrieve account balances for storage
• Transaction amounts or counterparties: individual transaction details including send amounts, recipient addresses, and swap quantities are not logged to our systems
• Financial account information: we do not integrate with banking systems, payment card networks, or fiat payment processors
• Government-issued identity documents: standard wallet use does not require identity verification, and we do not collect identity documents unless specifically required by applicable law

3. How We Use Your Information

3.1 To Provide the Service

• Create and maintain your application session
• Authenticate you when you return to the application
• Facilitate in-app features including wallet management, asset overview, and swap routing
• Restore your preferences and settings across sessions

3.2 To Improve the Service

• Analyze aggregated usage patterns to prioritize new features and improvements
• Identify and resolve technical bugs, crashes, and performance bottlenecks
• Conduct internal research and testing on new functionality before release

3.3 To Communicate With You

• Respond to customer support inquiries and resolve reported issues
• Send important service notices, including changes to our terms or policies
• Provide security alerts relevant to your account if we detect unusual access patterns

3.4 For Security and Fraud Prevention

• Detect, prevent, and investigate unauthorized access attempts and account compromise
• Identify and mitigate distributed denial-of-service attacks, bot activity, and infrastructure abuse
• Maintain audit logs sufficient to investigate security incidents

3.5 To Comply with Legal Obligations

• Respond to lawful requests from regulatory authorities, courts, and law enforcement
• Maintain records required under applicable financial, tax, or data protection law
• Resolve legal disputes to which Walletarch is a party

4. Legal Basis for Processing (GDPR)

For users in the European Economic Area (EEA) and United Kingdom, we process your personal data under the following legal bases as defined in Article 6 of the General Data Protection Regulation (GDPR):

• Performance of a contract (Art. 6(1)(b)): Processing your account data and usage information is necessary to provide you with the Service under our Terms of Service
• Legitimate interests (Art. 6(1)(f)): Security monitoring, fraud prevention, service improvement, and technical diagnostics — where our interests do not override your fundamental rights
• Legal obligation (Art. 6(1)(c)): Compliance with applicable laws including data retention requirements, regulatory reporting, and responses to valid legal process
• Consent (Art. 6(1)(a)): Where we rely on your consent for optional data processing activities such as analytics or marketing communications, you may withdraw consent at any time without affecting the lawfulness of prior processing

5. Data Sharing and Disclosure

We do not sell, rent, or trade your personal data to third parties for their own marketing or commercial purposes. We may share your information in the following limited circumstances:

5.1 Service Providers

We engage vetted third-party service providers who assist us in operating the Service, including:

• Cloud infrastructure providers for application hosting and database management
• Content delivery networks for performance optimization
• Analytics platforms for aggregated service usage analysis
• Customer support software for managing and responding to support inquiries

All service providers are bound by data processing agreements (DPAs) that restrict use of your data strictly to the purposes of providing services to us and prohibit any independent use, sale, or disclosure.

5.2 Legal Requirements

We may disclose your information if we determine in good faith that disclosure is required or permitted by applicable law, regulation, court order, subpoena, or government request. Where permitted by law and not prohibited by urgency or legal restriction, we will notify you of any such request and provide you with a reasonable opportunity to seek a protective order.

5.3 Business Transfers

In the event of a merger, acquisition, restructuring, bankruptcy, dissolution, or sale of all or substantially all of Walletarch's assets, your personal data may be transferred to the successor entity. We will provide notice of any such transfer and the privacy choices available to you, including the right to delete your account prior to the transfer.

5.4 Protection of Rights

We may disclose information when we reasonably believe such disclosure is necessary to protect the rights, property, or safety of Walletarch, our users, or the broader public, including to prevent fraud, enforce our Terms of Service, or address security threats.

6. Data Retention

We retain personal data only as long as necessary for the purposes described in this Privacy Policy or as required by applicable law. Our general retention schedules are as follows:

• Account data (username, password hash, settings): Retained for the duration of your active account, plus 36 months following voluntary account termination or deletion, to satisfy legal hold obligations and dispute resolution purposes
• Customer support records: Retained for 24 months from the date the issue was resolved
• Server and application logs: Retained on a rolling 90-day basis; aggregated metrics are retained indefinitely in anonymized form
• Security and fraud investigation records: Retained for 5 years from the date of the incident
• Financial and compliance records (where applicable): Retained for 5 to 7 years as required under applicable EU financial regulations

When data reaches the end of its retention period, we securely delete or irreversibly anonymize it so that it can no longer be attributed to you.

7. International Data Transfers

Bright Dragon Solutions Limited is incorporated and headquartered in Hong Kong. We may transfer your personal data to service providers or infrastructure located outside Hong Kong, including in countries that may not provide the same level of data protection as your home jurisdiction.

When we transfer personal data outside the EEA, we implement one or more of the following safeguards:

• Standard Contractual Clauses (SCCs) in the form approved by the European Commission (2021/914/EU)
• Binding corporate rules, where the receiving entity has obtained approval from a competent supervisory authority
• Transfer to countries covered by an EU adequacy decision
• Transfer impact assessments (TIAs) to evaluate supplementary measures for high-risk jurisdictions

8. Your Rights

Depending on your country of residence, you may have the following rights with respect to your personal data:

• Right of Access (Art. 15 GDPR): Request a copy of the personal data we hold about you, including information about the processing purposes, data categories, recipients, and retention periods
• Right to Rectification (Art. 16 GDPR): Request correction of personal data that is inaccurate, outdated, or incomplete
• Right to Erasure / "Right to be Forgotten" (Art. 17 GDPR): Request deletion of your personal data, subject to our legal obligations to retain certain records
• Right to Restriction of Processing (Art. 18 GDPR): Request that we temporarily suspend processing of your data in specified circumstances, such as while the accuracy of data is contested
• Right to Data Portability (Art. 20 GDPR): Receive your data in a structured, commonly used, machine-readable format (JSON or CSV), and transmit it to another controller
• Right to Object (Art. 21 GDPR): Object to processing based on legitimate interests or for direct marketing purposes
• Right to Withdraw Consent (Art. 7(3) GDPR): Where processing is based on your consent, withdraw that consent at any time without affecting the lawfulness of prior processing
• Right to Lodge a Complaint: Lodge a complaint with the Office of the Privacy Commissioner for Personal Data (PCPD) in Hong Kong, or with the relevant data protection authority in your country of residence if you are located outside Hong Kong

To exercise any of these rights, submit a request to contact@walletarch.com. We will respond within 30 days, which may be extended to 60 days for complex requests, with prior notice to you.

9. Security Measures

We implement comprehensive technical and organizational measures to protect your personal data against unauthorized access, disclosure, alteration, or destruction.

Despite these measures, no system or transmission over the internet can be guaranteed to be 100% secure. If you suspect your account has been compromised, contact us immediately at support@walletarch.com.

Technical Measures

• TLS 1.3 encryption for all data in transit between your device and our infrastructure
• AES-256 encryption for sensitive data at rest in our databases
• Role-based access controls and least-privilege principles for staff access to production systems
• Multi-factor authentication required for all administrative access
• Regular automated vulnerability scans and annual penetration testing by independent third-party security firms
• Secure software development lifecycle (SSDLC) with mandatory security review before deployment
• Continuous monitoring and alerting for anomalous access patterns

Organizational Measures

• Formal data classification policy and information handling procedures
• Privacy-by-design and data-minimization principles embedded in product development processes
• Mandatory annual security awareness training for all staff with access to personal data
• Documented incident response procedure with defined roles, escalation paths, and 72-hour regulatory notification timeline
• Vendor due diligence and security assessment for all third-party data processors
• Data protection impact assessments (DPIAs) for high-risk processing activities

10. Cookies and Tracking Technologies

Our web application uses cookies and similar technologies. The specific types of cookies we use, their purposes, duration, and how you can control them are described in detail in our Cookie Notice, which forms part of this Privacy Policy and is incorporated by reference.

11. Children's Privacy

The Service is not directed to individuals under the age of 18. We do not knowingly collect personal data from minors. If a parent or guardian becomes aware that their child has created an account or provided personal data without consent, they should contact us at contact@walletarch.com. Upon verification, we will promptly delete the relevant account and associated data.

12. Third-Party Links and Integrations

The Service may contain links to third-party websites, decentralized protocols, or external services. We are not responsible for the privacy practices, content, or data security of those third parties. We encourage you to review the privacy policies of any third-party services you access through Walletarch. The inclusion of a link does not imply endorsement by Walletarch.

13. Changes to This Privacy Policy

We reserve the right to update this Privacy Policy periodically to reflect changes in our data practices, the Service, or applicable legal requirements. We will notify you of material changes by updating the "Last Updated" date at the top of this page. For significant changes that materially affect your rights, we will provide advance notice via in-app notification at least 14 days before the changes take effect. Your continued use of the Service after the effective date of changes constitutes your acceptance of the updated policy. If you do not agree to the changes, you must stop using the Service and may delete your account.

14. Contact Information

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

• Privacy inquiries: contact@walletarch.com
• Security incidents: support@walletarch.com
• Postal address: Bright Dragon Solutions Limited, No 2 Cape Drive, Chung Hom Kok, 999077, Hong Kong
• Response time: We aim to respond to all privacy inquiries within 5 business days