Privacy policy

1. Preamble

Web3 Digital Wallet is committed to protecting personal data and operating in accordance with the General Data Protection Regulation (GDPR) and applicable data protection laws.

Wallet Provider is used by organizations to configure and distribute wallet experiences, manage members, expose public guest access pages, and connect external systems through API keys.

2. Data controller and processor roles

Web3 Digital Wallet operates the Wallet Provider platform. For data processed to operate the platform itself, Web3 Digital Wallet may act as data controller.

When an organization uses Wallet Provider to create members, configure wallets, distribute access links, or manage API keys for its own purposes, that organization may act as data controller. In that case, Web3 Digital Wallet may act as service provider or processor according to the agreement in place with the organization.

Web3 Digital Wallet is a company headquartered in France, SIREN 910 399 435, RCS Chartres, with its registered office at 112 Rue des Tuileries, 28260 Saint-Ouen-Marchefroy, France.

3. Definitions

Personal data: Any information that identifies or can identify an individual.
Member: A user account or organization membership created or managed through Wallet Provider.
Guest access: A public or shared wallet configuration access method generated by an administrator.
API key: A secret credential created by an administrator to allow external systems to access organization APIs.
Verifiable credential: A digital credential issued by an issuer and stored or presented by a compatible wallet.

4. Personal data we may process

Depending on how the platform is used, we may process the following categories of data:

Organization and administrator data

administrator email address and account information;
organization name, website, and status;
admin roles and organization memberships;
audit and security events.

Member data

email address;
first name and last name when provided;
organization membership, role, and status;
access distribution events, such as generated guest or named-user access.

Wallet configuration data

branding information, colors, logo URLs, and configuration options;
external issuer configuration;
technical wallet configuration and protocol settings.

Technical data

IP address, request metadata, browser or device information where required for operation or security;
logs necessary to secure, debug, and operate the service;
API key metadata such as name, prefix, last characters, status, and creation date.

5. Information we do not ask for

Web3 Digital Wallet does not ask users to disclose wallet private keys, recovery phrases, PIN codes, seed phrases, or other wallet secrets. API keys are displayed only once when created and are stored only in hashed form.

6. Purposes of processing

Personal data may be processed for the following purposes:

providing and securing the Wallet Provider platform;
allowing administrators to manage organizations and members;
generating wallet configuration links and QR codes;
operating API access and authenticating API keys;
sending or preparing access information for users where requested by an organization;
monitoring security, preventing abuse, and maintaining auditability;
responding to support, legal, or compliance requests.

7. Data retention

We retain personal data only for as long as necessary for the purposes described above, for the duration of the contractual relationship with the organization, or as required by law.

API keys are not stored in clear text. When an API key is revoked, its metadata may be retained for security, audit, and traceability purposes.

Organizations may request deletion or correction of member data according to their administrative rights and applicable data protection obligations.

8. Security

Web3 Digital Wallet applies technical and organizational measures designed to protect the confidentiality, integrity, and availability of the platform and the personal data processed through it.

These measures may include:

administrator authentication and role-based access;
organization scoping for admin pages and APIs;
hashed storage of API keys;
audit logs and operational monitoring;
access restriction and revocation mechanisms.

9. Third-party services

The platform may reference or connect to third-party services, such as external credential issuers, identity services, infrastructure providers, or email services. These third parties may process personal data according to their own terms and privacy policies.

When an organization configures a third-party issuer or service, that organization is responsible for ensuring that the configuration and use of that service complies with applicable law.

10. International transfers

Where personal data is transferred outside the European Economic Area, Web3 Digital Wallet will seek to use appropriate safeguards required by applicable data protection laws, such as standard contractual clauses where necessary.

11. Your rights

Under the GDPR, individuals may have the right to access, rectify, delete, restrict, object to processing, and request portability of their personal data. They may also have the right to withdraw consent where processing is based on consent.

If your data was created or managed by an organization using Wallet Provider, you may need to contact that organization first because it may act as data controller.

You also have the right to lodge a complaint with the CNIL or another competent supervisory authority.

12. Cookies

The service may use cookies or session storage strictly necessary for authentication, security, and operation of the platform. These technical cookies are used to maintain sessions and provide the service.

13. Changes to this policy

This Privacy Policy may be updated from time to time. The applicable version is the one published on this page.

14. Contact

For privacy questions, contact Web3 Digital Wallet at: contact@talao.io.