ChatterPay, a Cayman Islands exempted company (Registration No. CR-426282), registered office at 68 Fort Street, George Town, PO Box 31726, Grand Cayman KY1-1207, Cayman Islands ("ChatterPay", "we", "us").
This Policy explains how personal data is handled in the ChatterPay B2B platform: the B2B API, the official SDK, the Partner Signer Gateway, this developer portal and its Sandbox (together, the "Platform"). It is addressed to businesses that integrate the Platform ("Partner", "you") and forms part of the Terms of Service.
Read this first
There are two different roles in this Policy, and which one applies decides everything else.
- For personal data of your End Users that we process because you instructed us to — provisioning a wallet, quoting a transfer, executing it, reporting what happened — you are the controller and we are the processor. We act on your documented instructions, which are the Terms, your configuration of your Deployment, and the API calls you make.
- For personal data about your own people — the administrators of your Deployment, the developers using this portal, the person who signs the contract — we are the controller, and Sections 8 to 12 describe what we do with it.
- Anything published to a public blockchain is permanent and outside the control of either of us. Section 6 is the section to read before you answer an erasure request.
1. Whose data, and who decides
1.1 A Deployment is an isolated configuration of the Platform serving one Partner. Personal data inside a Deployment belongs to that Deployment and is not combined with any other Partner's data.
1.2 As processor we do not decide the purposes of processing End User data. We do not use it to build products of our own, to profile anyone, to advertise, or to train models. We do not sell it, and we do not share it for cross-context behavioural advertising.
1.3 Where we act as processor, the data subject's relationship is with you. A request from one of your End Users that reaches us is referred back to you rather than answered directly, unless the law requires otherwise or you have instructed us to answer it.
2. What the Platform processes on your instruction
Depending on which functions you enable:
- Identifiers you send us. The identifier by which you refer to an End User — typically a phone number or an identifier of your own — plus any display name you attach to it.
- Wallet and account data. Blockchain addresses provisioned for an End User, the networks their accounts exist on, and the reference that names their signing key. Not the key itself: signing key material is held by the Partner Signer Gateway and is never handed to the API.
- Instruction data. Quotes, confirmations, amounts, assets, destinations, and the operations and legs derived from them.
- Execution records. Transaction hashes, block numbers, fee and sponsorship data, and the status of each attempt, including refusals and failures.
- Message content, where you route an End User conversation through a messaging channel integrated with the Platform: what the End User writes, and what the Platform answers.
- Technical data. Request logs, credential and Deployment identifiers, IP addresses, timestamps, error and security signals.
We do not ask you for, and the Platform has no field for, government identity documents, selfies, proof of address, bank details, or special category data such as health, biometric, political or religious information. Do not send them.
3. What we do with it, and why
As processor, on your instruction and to perform the Terms:
| Purpose | Basis |
|---|---|
| Provisioning wallets and accounts | Your instruction, to perform our contract with you |
| Interpreting an instruction and constructing a transaction | Your instruction |
| Sponsoring network fees and routing through protocols | Your instruction |
| Reading balances and reporting history | Your instruction |
| Notifying your systems by webhook | Your instruction |
| Keeping records of what was executed and refused | Your instruction, and our own legal obligation |
As controller, for our own account:
| Purpose | Basis |
|---|---|
| Security, abuse prevention, rate limiting, capacity | Legitimate interests |
| Sanctions and address screening on our own behalf | Legal obligation and legitimate interests |
| Billing, collections, accounting, audit | Contract performance and legal obligation |
| Support to your team, and dispute resolution | Contract performance and legitimate interests |
| Measuring and improving the Platform, in aggregate | Legitimate interests |
| Marketing to your team about the Platform | Consent, or legitimate interests where the law allows it for business contacts |
| Analytics cookies on this portal | Consent |
Screening we perform is for our own protection. It is not a service to you, it does not discharge your own screening obligations, and you must not represent it as doing so.
4. Automated processing
4.1 Language models. Where a Deployment interprets End User messages with a third-party language model, the message content and the identifiers it contains are sent to that provider. Our agreements with those providers prohibit using the content to train their models. Which provider serves your Deployment is disclosed to you before it processes anything.
4.2 Screening. Addresses, transactions and Deployments are screened automatically against sanctions lists, blockchain analytics data and internal fraud signals. A flag may cause the Platform to decline to construct, sponsor or relay a transaction.
4.3 Contesting. A decision taken solely by automated means that produces a legal or similarly significant effect can be contested at privacy@chatterpay.com.ar and reviewed by a person. We do not carry out credit scoring or advertising profiling.
5. Sub-processors and who else sees the data
We engage sub-processors to run the Platform, under written terms imposing obligations equivalent to those in this Policy, and we remain responsible for what they do:
- Infrastructure: hosting, managed databases, object storage, logging and error monitoring.
- Blockchain access: RPC and indexing providers, bundlers, paymaster infrastructure, block explorers.
- Messaging platforms, where your Deployment reaches End Users through one.
- Language model providers, where the Deployment uses one.
- Compliance vendors for sanctions and analytics screening.
- Professional advisers — lawyers, auditors, accountants — under duties of confidentiality.
We also disclose data to authorities where we are legally required to, and to an acquirer in a merger, financing, reorganisation or sale of assets, subject to equivalent protections.
Changes to the list. We maintain the current list of sub-processors for the Platform and provide it on request to privacy@chatterpay.com.ar. We give you notice before adding a sub-processor that processes End User personal data, and you may object on reasonable data-protection grounds; if we cannot resolve the objection, either of us may terminate the affected function.
6. Blockchain data is permanent
6.1 A transaction published to a public blockchain is permanent, worldwide, and readable by anyone. Neither we nor you can amend it, delete it, or restrict its processing.
6.2 Addresses are pseudonymous, not anonymous. A third party may link an address to an identity by combining it with data we never had.
6.3 No right of erasure, rectification or restriction can be exercised against a public blockchain. This is a property of the technology, not a choice in our design, and you must tell your End Users so before they transact.
7. The Sandbox
7.1 Do not put real personal data in the Sandbox. Use synthetic identifiers. The Sandbox exists to test an integration, runs on test networks with assets that have no value, and is not covered by the arrangements described here for production processing.
7.2 Sandbox data may be reset or deleted at any time without notice, and is retained no longer than needed to operate the environment.
7.3 Real End User data you submit to the Sandbox is submitted on your own responsibility.
8. International transfers
We are established in the Cayman Islands and our providers operate in several countries, including the United States and the European Union. Where data is transferred out of a jurisdiction that restricts transfers, we rely on an adequacy decision, standard contractual clauses, or another lawful transfer mechanism. The mechanism applicable to a given transfer is available on request at privacy@chatterpay.com.ar.
9. Retention
| Data | Retained |
|---|---|
| Deployment configuration and credential records | For the term, plus 24 months |
| Wallet, account and operation records | For the term, plus 5 years, for audit and legal defence |
| End User message content, where processed | 12 months, then deleted or aggregated |
| Request, security and error logs | 12 months |
| Compliance and screening records | As law requires, typically 5 years |
| Partner contract, billing and tax records | As law requires, typically 10 years |
| On-chain data | Permanent, outside anyone's control |
On termination we delete or return End User personal data we hold as processor within 90 days, except what we must keep by law and what exists on-chain. Backups expire on their own cycle; data in a backup is not restored into service.
10. Security
10.1 We apply technical and organisational measures appropriate to the risk: encryption in transit and at rest, least-privilege access control, audit logging, dependency review, and separation between Deployments.
10.2 The signing boundary is part of the design. Signing key material lives in the Partner Signer Gateway. The API holds a reference that names a key, never the key, so a compromise of the API is not a compromise of the ability to sign.
10.3 Your side of it. API credentials identify your Deployment and authorise every request made with them. Keep them out of source control, rotate them on suspicion of compromise, and tell us at contacto@chatterpay.com.ar without undue delay when a compromise affects your Deployment.
10.4 We will never ask you for a private key, recovery phrase, or credential secret over any channel.
10.5 Breach. Where we become aware of a personal data breach affecting data we process for you, we notify you without undue delay and give you the information you need to meet your own notification duties. Notifying regulators and data subjects is your decision as controller, unless the law puts it on us.
11. Rights
11.1 Your End Users' rights are exercised through you. As controller you answer their requests; as processor we assist you with the technical means to do so, taking account of Section 6.
11.2 Your own people's rights. Where we are controller, a person may ask us to access, correct, erase, restrict, object to, or port their data, and may withdraw consent at any time. Write to privacy@chatterpay.com.ar. We answer within 30 days, or sooner where local law requires it.
11.3 Complaints. A person may complain to their supervisory authority: the Office of the Ombudsman in the Cayman Islands, the national data protection authority in the EEA or the UK, the Agencia de Acceso a la Información Pública in Argentina, or the Autoridade Nacional de Proteção de Dados in Brazil.
11.4 Frameworks. We apply the Cayman Islands Data Protection Act (2021 Revision) and, where they apply to a given processing, the GDPR, the UK GDPR, Argentina's Ley 25.326 and Brazil's LGPD.
12. Children
The Platform is not directed at persons under 18 and we do not knowingly process their data. You are responsible for the age eligibility of your End Users. If you become aware that a person under 18 holds a Wallet in your Deployment, tell us at privacy@chatterpay.com.ar and we will delete what can be deleted — which does not include anything already on-chain.
13. Cookies on this portal
This portal uses strictly necessary cookies to function, and analytics cookies only with consent. It sets no advertising cookies. Consent can be changed or withdrawn from the cookie banner or in your browser.
14. Changes
We may update this Policy with a new version number and effective date, and we give advance notice of material changes through the Platform or to the administrative contact of your Deployment. Where a change affects processing you instruct as controller, it takes effect on notice and your continued use is acceptance.
15. Contact
ChatterPay 68 Fort Street, George Town, PO Box 31726 Grand Cayman KY1-1207, Cayman Islands Registration No. CR-426282 Privacy: privacy@chatterpay.com.ar General: contacto@chatterpay.com.ar
Version 1.0. Effective 15 August 2026.