Privacy Policy

August 2026 data update

For account-linked wallet recovery, we may store a client-encrypted backup envelope, envelope hash, format version, revision state, wallet fingerprint, download-challenge records and recovery-conflict warning. We do not receive the mnemonic, recovery passphrase, PIN or decryption key. The encrypted envelope is sensitive data even though the Provider cannot decrypt it.

To operate supported services we process public wallet addresses, chain and account index, quote and transaction identifiers, protocol position and debt data, settlement state, compliance decisions, feature eligibility, device and login-security events, and support or complaint records. Blockchain data remains public and may be analysed by independent network participants.

Where you separately consent, analytics and attribution processing may include install source, advertising click identifiers, app-instance or device identifiers, product-screen and funnel events, transaction category and value, and conversion status. Private keys, seed phrases and full wallet balances are excluded from analytics payloads. You may withdraw optional marketing or analytics consent without affecting essential security and transaction records.

Push, email, monitoring, RPC, pricing, bridge, protocol and settlement providers receive only the data reasonably required for their function. Current providers and transfer safeguards are maintained in the Sub-Processor Register at https://wallet.baysart.com/legal.

Wallet history and view-only keys (October 2026)

We keep a server-side record of the transaction history and balance history of the wallet addresses registered to your account, on every supported network, including periodic snapshots of your balances valued in fiat currency. The record is built from blockchain data, opened where needed with the view-only keys described below, and from reports sent by your device, and it is linked to your account, your account index and, if you have completed identity verification, your verified identity.

When you send a transaction through our servers (Bitcoin, Dogecoin, Litecoin, XRP, Cosmos, Polkadot, Cardano), we keep the signed transaction, its hash and the broadcast result, linked to your account. The app may also send us details of transactions it broadcasts from your device, such as the network, transaction hash, account index, asset and transaction type, and, for the Liquid network, the balances your device reads; we label these as device-reported.

When you use app version 1.0.6 or later and this feature is enabled, the app sends our server the extended public key (zpub) of each Bitcoin account in your wallet. From it, our server derives every receiving and change address of that account, which lets us see that account's complete Bitcoin transaction history and balances.

Under the same conditions, the app also sends the read-only SLIP-77 master blinding key of your Liquid wallet. On the Liquid network the amounts and assets of transactions are hidden (confidential transactions); this key lets our server reveal the amounts and assets of the outputs that belong to your Liquid wallet, which gives us full visibility of that wallet's amounts and history.

Neither key can sign a transaction or move funds: they only allow viewing. We never receive your seed phrase or spending keys in readable form; your encrypted recovery backup, if you use it, cannot be decrypted by us. We accept a key only if it matches a wallet address already registered to your account. Both keys are stored encrypted (Fernet), in the same way as your other sensitive personal data; we do not write them to our application logs and never return them through any interface. They are used only by our servers to read your wallet's blockchain history.

We process this data to show you your transaction history and balances, to detect and prevent fraud, and to meet our obligations under the legislation of the Republic of Azerbaijan on combating money laundering and the financing of terrorism (AML/CFT), including transaction monitoring and reporting to the financial-monitoring authority. This data is not sent to analytics or advertising providers. Sending these keys is part of how the wallet works, and there is no setting to turn it off.

These records and keys are kept without a fixed end date; see sections 8 and 9.

1. Who we are (data controller)

For the Baysart mobile application and related services, the controller of your personal data (data controller) is Baysart MMC (the "Provider", "we", "us", "our").

Taxpayer identification number (VÖEN): 1703115231. Registered (legal) address: Baku, Azerbaijan. Contact email: [email protected]. Support and documents: https://wallet.baysart.com.

For any privacy-related requests, you may contact our data protection officer (DPO): [email protected].

This Policy explains for what purposes and on what legal bases we collect your personal data, with whom we share it, how long we retain it, and what rights you have.

2. Bank-secrecy-grade confidentiality commitment

In the Republic of Azerbaijan, a bank-secrecy regime applies to user and transaction data. We commit to keeping information about your account, identity, balance and transactions confidential at a bank-secrecy grade.

User, account and transaction data may be disclosed to third parties only in the following cases, and is disclosed to no other third party.

• Based on your express and specific consent.
• Pursuant to an order (judicial act) of a competent court.
• To the financial-monitoring authority or law-enforcement authorities under the legislation on combating the legalization of criminally obtained funds and the financing of terrorism (AML).

3. Data we collect

Depending on the nature of the Services, we collect and process data in the following categories.

• Account and authentication: email address, optional phone number, password hash, OAuth identifiers for Apple/Google sign-in, and the full name or username you provide.
• Identity verification (KYC): only for the fiat (manat) ramp (Tier 2) — ID document image, selfie/liveness check, the name, date of birth, document number, nationality and address extracted from the document, face-match and fraud signals. This processing is carried out via an Identity Verification Provider.
• Device and technical data: device identifier, name and type, push-notification tokens, IP address, user-agent, app build, and language.
• Analytics: an analytics provider receives in-app events (registration, login, purchases/revenue, KYC status changes) and device identifiers.
• Financial and transaction data: fiat deposit records (card masks only — no full card numbers are stored), AZNS mint and burn records, saved-card masks, and on-chain addresses. On-chain transaction data is public and permanent. We also hold server-side transaction and balance history of your wallet addresses, the signed transactions you send through our servers and, where this feature is enabled, the extended public key (zpub) of each Bitcoin account and the read-only blinding key of your Liquid wallet (see "Wallet history and view-only keys").
• Contacts (optional): if you grant permission, the app reads your phone address book on your device only to show it in the send-recipient picker. The address book is not uploaded to our servers; only a phone number you choose as a recipient is used to process that transfer.

4. Purposes and legal bases of processing

We process each category of data only for a specific purpose and on the appropriate legal basis.

• Account and authentication data — processed to perform our contract with you (providing the service, enabling sign-in). Legal basis: performance of a contract.
• KYC data — processed to comply with obligations under AML/KYC legislation. Legal basis: legal obligation.
• Device and technical data — processed for fraud detection, security and service stability. Legal basis: legitimate interest.
• Analytics and marketing data — processed only where you have given consent. Legal basis: consent (withdrawable at any time).
• Financial and transaction records — processed to perform the contract and to meet the requirements of AML legislation. Legal basis: performance of a contract and legal obligation. This includes AML transaction monitoring and fraud prevention based on the wallet history and view-only keys described above.

5. Self-custody and zero-knowledge

Your wallet operates on a self-custody (under your sole control) principle. The Provider never holds your private key or seed phrase — these are generated and encrypted on your device.

This means the Provider cannot move your funds without your consent and cannot sign transactions on your behalf.

Any security breach that may occur on our servers cannot drain the funds in your wallet, because the keys are not stored on our servers but only on your device.

The Bitcoin extended public key (zpub) and the Liquid blinding key described in "Wallet history and view-only keys" are view-only: they show us your transaction history and amounts but cannot sign transactions or move funds.

6. On-chain transactions are public

Transactions carried out on the blockchain are public, permanent, and beyond the Provider's control. A transaction written to the blockchain cannot be deleted, altered or reversed.

Blockchain addresses are pseudonymous, but pseudonymity is not anonymity. The public transaction history can be analyzed to establish links between addresses.

At a fiat ramp, linking your blockchain address to your KYC data may lead to your identity being determined (deanonymization). With this in mind, you are advised to use your addresses with care.

7. Sharing of data and sub-processors

We share your data only where necessary and only by category of processor, with the parties listed below.

Specific vendor names are not listed in this Policy; they are recorded in a separately maintained and versioned "Sub-Processor Register": https://wallet.baysart.com/legal.

Some processors may process data outside Azerbaijan. Such international transfers are carried out only on the basis of appropriate safeguards.

• Identity Verification Provider — to carry out KYC verification.
• Payment Partner — to process card payments.
• Settlement/Liquidity Partner — to execute orders (in anonymized form).
• Infrastructure Providers — for blockchain node/RPC, email, push-notification and analytics services.

8. Retention period

AML/KYC data, transaction records and your account record (including contact details) are retained to meet our record-keeping obligations under AML/CFT legislation. We currently keep them without a fixed end date, and in any case for at least 5 (five) years after the end of the relationship; they are not erased on request.

An erasure request does not delete these records; instead, processing is restricted — the data is kept but used only to meet legal obligations.

Analytics data is retained until you withdraw your consent.

A request to delete your account is carried out with a 30 (thirty)-day grace period, during which you may reverse your decision. After the grace period the account is deactivated, not erased: you can no longer sign in, we stop recording new history for your wallet addresses, and the records described in this section, including the wallet-history records, balance snapshots and view-only keys described in "Wallet history and view-only keys", are retained.

9. Your rights

You have the following rights regarding your personal data.

To exercise your rights, you may contact us at [email protected] or via https://wallet.baysart.com. We respond to your request within 1 (one) month.

Note: the right to erasure is limited by our record-keeping obligations under AML/CFT legislation (see section 8); data subject to those obligations is not deleted, but its processing is restricted.

Your rights of access and portability apply to the wallet-history records described in "Wallet history and view-only keys". The view-only keys themselves are never returned through any interface.

• Right of access — to learn which of your data we process.
• Right to rectification — to request correction of inaccurate or incomplete data.
• Right to erasure — to request deletion of your data (subject to AML retention requirements).
• Right to restriction of processing.
• Right to portability — to receive and transfer your data in a structured format.
• Right to object — to object to processing based on legitimate interest.

10. Security

We apply technical and organizational measures to protect your data: data is encrypted both in transit and at rest.

Your seed phrase and private key are encrypted on your device — client-side — and are not transmitted to our servers.

If a security breach (data breach) affecting your personal data occurs, we notify the relevant authority, and where necessary you, without undue delay, within 72 (seventy-two) hours where applicable.

11. Children

The Services are not intended for persons under 18 years of age. We do not knowingly collect data from persons under 18. If we discover that such data has been collected, we delete it.

12. Changes to this Policy

We may update this Policy from time to time. The updated version takes effect from the moment it is published in the application, and the "Last updated" date above changes accordingly.

We notify you of material changes in advance via in-app notice or email.