Privacy Policy

1. About this policy

This Privacy Policy explains how TrustCheck collects, uses, shares, stores and protects personal data when you use the website at trustcheckbot.com, the Telegram bot @trustcheckcom_bot, the web application and the API at api.trustcheckbot.com (the Service). It forms part of our Terms of Service.

The policy has two layers. Sections 2 to 16 apply to everyone, wherever you are. Section 17 adds short regional sections that describe the specific rights, transfer rules, authorities and contacts that apply in particular jurisdictions. If a regional section gives you more protection, it applies in addition to the general sections.

2. Who is responsible for your data

The controller (in some laws called the organisation, business, personal information controller, data fiduciary or personal data handler) responsible for your personal data is:

• Privacy contact: [email protected]
• Person accountable for privacy compliance (Canada, PIPEDA and Quebec Law 25): our Privacy Officer, reachable at the address above.
• Data Protection Officer: our Privacy Officer, reachable at [email protected]
• Representative in the European Union: under review; until one is appointed, contact us at [email protected]
• Representative in the United Kingdom: under review; until one is appointed, contact us at [email protected]

3. Personal data we collect

Data about third parties. An IBAN or a wallet address you check may relate to an identifiable person, such as your counterparty. We process this data to provide the check you request and to keep the check history described in section 7. You must have a lawful basis to submit it (see the Terms). Counterparties who want to exercise their rights may contact us at the address in section 2.

What we do not collect. We do not ask for government identity documents, biometric data, or data revealing racial or ethnic origin, health, religion or sexual orientation. Please do not send such data to us. We do not knowingly collect private keys or seed phrases, and you must never send them to anyone, including us.

4. Why we use your data and our legal bases

We use personal data only for the purposes below. Where a law (such as the GDPR or UK GDPR) requires a legal basis, the basis we rely on is shown for each purpose.

Where we rely on legitimate interests, we have balanced those interests against your rights and freedoms. You may ask us for more information about that assessment, and you may object as described in section 9.

In jurisdictions where consent is the main basis for processing (for example under some Asian and GCC laws), we rely on your consent given when you start using the Service, together with any other basis that the local law permits, such as contract performance or legal obligation. Where a law requires separate or explicit consent for a particular activity, we will ask for it.

5. Risk scores and automated processing

The Service produces risk scores automatically, using rules applied to public data and, in the future, third party data. We do not use these scores to make decisions about you that produce legal effects or similarly significant effects. The user who requests a check decides what to do with the result, and the Terms require users not to rely on a score alone. If you believe a score about a wallet, IBAN or card connected to you is wrong, you may contact us, and we will review the underlying data where we can.

6. Who we share data with

We do not sell personal data, and we do not share it for cross context behavioural advertising. We share personal data only with:

7. How long we keep data

Why we keep check history and IBAN data without a fixed limit

We want to be transparent: we keep the history of checks, including IBANs in encrypted form, without a fixed end date. We do so because:

• Fraud prevention. Repeat patterns across time help detect fraud, scams and abuse of the Service;
• Dispute handling. Users and counterparties sometimes raise questions or disputes months or years after a trade, and we need to be able to show what was checked and what result was shown at the time;
• Audit trail. A complete record of the checks performed by the Service supports its integrity and accountability; and
• Legitimate interest. We have assessed that these interests are legitimate and, given the encryption and access controls we apply, are not overridden by the rights of the persons concerned.

You may ask us to delete your check history and IBAN data at any time (see section 9). We will delete it, together with your account data, unless we have a legal obligation to keep some of it (for example record keeping duties under Canadian law that may apply to us) or need it to establish, exercise or defend legal claims. Where we must keep data, we restrict it to those purposes. Deleted data disappears from backups when they expire, within 35 days.

We periodically review whether keeping this data remains necessary for these purposes.

8. International transfers

Our primary servers are in Germany (EU). We are based in Canada, and our service providers may process data in other countries, including the United States. When personal data is transferred across borders, we use the safeguards required by the applicable law, including:

• for transfers from the EU, EEA, UK or Switzerland to Canada, the European Commission adequacy decision for Canada (and the UK and Swiss equivalents), which covers organisations subject to PIPEDA;
• for transfers to the United States, the EU US Data Privacy Framework and its UK and Swiss extensions where the recipient is certified, and otherwise the European Commission Standard Contractual Clauses (SCCs), the UK International Data Transfer Addendum, and supplementary measures where needed;
• contractual commitments from our processors to protect personal data to a standard comparable to this policy; and
• any additional mechanism required by a regional law described in section 17, such as consent, standard contracts or filings.

You may request a copy of the relevant safeguards by contacting us.

9. Your rights

Depending on where you live, you may have the right to:

• know whether we process your data and get a copy of it (access);
• receive your data in a structured, commonly used, machine readable format and have it sent to another provider (portability). We offer an export of your data on request;
• correct inaccurate or incomplete data;
• have your data deleted. We offer deletion on request, subject to section 7;
• restrict or object to processing, including processing based on legitimate interests, and object at any time to direct marketing;
• withdraw consent where we rely on it, without affecting processing that took place before;
• not be subject to a decision based solely on automated processing that significantly affects you (see section 5); and
• complain to a data protection supervisory authority (see section 17 for the relevant authority).

How to make a request. Send a message to [email protected] or through the Telegram bot. To protect your data, we may ask you to confirm your identity, for example by sending a message from the Telegram account linked to the data. An authorised agent may make a request for you where the law permits, with proof of authority. We respond within the time required by law, normally within one month (GDPR), 30 days (PIPEDA and Quebec Law 25), or 45 days (US state laws), and we tell you if we need an extension that the law allows. Requests are free unless they are manifestly unfounded or excessive.

If we decline a request, we will explain why and tell you how to appeal or complain.

10. Security

We use technical and organisational measures appropriate to the risk, including encryption in transit (TLS), encryption of IBAN data at rest, encrypted backups, access controls based on least privilege, logging of administrative access, and protection by Cloudflare against network attacks. No system is completely secure. If a personal data breach occurs that is likely to create a risk to you, we will notify you and the relevant authorities as required by law.

11. Cookies and similar technologies

The TrustCheck website does not use advertising or analytics cookies and does not load third party trackers, fonts or scripts. It stores two small values in your browser's local storage, only to remember your choices:

• tc-theme: your light or dark theme choice; and
• tc-lang: the language you selected.

These are strictly necessary to provide the function you request, so under the EU ePrivacy Directive and similar laws they do not require consent. You can clear them at any time in your browser settings. Cloudflare may set strictly necessary security cookies (for example to detect bots or apply a security challenge). If we ever introduce non essential cookies, we will ask for your consent first and update this section.

Because we do not track you across sites, there is nothing for a Global Privacy Control or Do Not Track signal to switch off. We nonetheless treat a Global Privacy Control signal as a valid opt out of sale and sharing where the law requires it.

12. Children

The Service is only for people aged 18 or over. We do not knowingly collect personal data from anyone under 18. If you believe a minor has given us personal data, contact us and we will delete it.

13. Direct marketing

We do not send marketing messages without a lawful basis. Service messages (for example security notices or changes to our terms) are not marketing. You can opt out of any marketing at any time.

14. Third party services

The Service links to or relies on third party services, such as Telegram, block explorers and data providers. Their privacy practices are governed by their own policies, which we encourage you to read.

15. Changes to this policy

We may update this policy. We will post the new version here with a new "Last updated" date and, for material changes, notify you through the bot, by email if you gave us one, or on the website before the changes take effect.

16. Contact and complaints

If you are not satisfied with our response, you may complain to the authority listed for your jurisdiction in section 17. We would appreciate the chance to address your concern first.

17. Regional sections

The sections below apply in addition to sections 1 to 16 if you are located in, or the law of, the jurisdiction concerned applies to our processing of your data. They are summaries. To exercise any right, contact [email protected].

Europe

European Union and EEA (GDPR)

Your rights. Access, rectification, erasure, restriction, portability, objection (including to processing based on legitimate interests and to direct marketing), withdrawal of consent, and rights related to automated decision making under Articles 15 to 22 GDPR. The legal bases we rely on are listed in section 4.

Transfers. Data is hosted in Germany. Transfers to Canada rely on the adequacy decision for Canada. Transfers to the United States rely on the EU US Data Privacy Framework where the recipient is certified, or on Standard Contractual Clauses. Our representative in the EU under Article 27 GDPR is under review; until one is appointed, contact us at [email protected].

Authority and contact. You may lodge a complaint with the supervisory authority in the EU member state where you live, work, or where an alleged infringement took place. A list is available from the European Data Protection Board.

United Kingdom (UK GDPR) and Switzerland (FADP)

Your rights. The same rights as under the GDPR, as provided by the UK GDPR and the Data Protection Act 2018, and by the Swiss Federal Act on Data Protection.

Transfers. Transfers rely on UK and Swiss adequacy regulations for Canada, the UK Extension and Swiss Extension to the Data Privacy Framework, or the UK International Data Transfer Addendum and SCCs. Our UK representative is under review; until one is appointed, contact us at [email protected].

Authority and contact. United Kingdom: the Information Commissioner's Office (ICO). Switzerland: the Federal Data Protection and Information Commissioner (FDPIC).

ePrivacy. Our use of local storage and cookies under the ePrivacy Directive and national implementing laws is described in section 11.

North America

Canada (PIPEDA)

Your rights. Under the Personal Information Protection and Electronic Documents Act you may access the personal information we hold about you, ask for corrections, withdraw consent subject to legal or contractual restrictions and reasonable notice, and challenge our compliance. Provincial private sector laws in Alberta and British Columbia provide similar rights where they apply.

Transfers. Your information is stored in Germany and may be processed in the United States and other countries by our service providers. It may then be accessible to courts, law enforcement and national security authorities of those countries. We use contracts and other measures to protect it.

Authority and contact. Our person accountable for privacy compliance is our Privacy Officer, reachable at [email protected]. You may complain to the Office of the Privacy Commissioner of Canada.

Quebec (Law 25)

Your rights. Under the Act respecting the protection of personal information in the private sector, as amended by Law 25, you also have the right to be informed of the use of technology that profiles or identifies you, to data portability in a structured, commonly used technological format, to ask us to stop disseminating your information or to de index links where the law permits, and to be informed of and submit observations on decisions based exclusively on automated processing. We do not use profiling technology that you must activate, and the website stores no tracking identifiers.

Transfers. Before communicating personal information outside Quebec, we assess whether it will receive adequate protection, taking into account its sensitivity, the purpose, the safeguards and the legal framework of the destination, as required by section 17 of the Act.

Authority and contact. The person in charge of the protection of personal information is our Privacy Officer, reachable at [email protected]. You may complain to the Commission d'accès à l'information du Québec.

United States: California (CCPA, as amended by the CPRA)

Your rights. To the extent the California Consumer Privacy Act applies to us, California residents have the right to know what personal information we collect, use and disclose, to access and port it, to delete it, to correct it, to opt out of sale or sharing, and to limit the use of sensitive personal information. You also have the right not to be discriminated against for exercising these rights: we will not deny you the Service, charge a different price, or provide a different quality of service because you exercised them. You may use an authorised agent. In the preceding 12 months we collected these categories: identifiers (Telegram ID, username, email, IP address); customer records (email, and billing data once payments are live); commercial information (plan and check history); internet or network activity (logs); and inferences limited to risk scores about checked items. Sources and purposes are described in sections 3 and 4, and retention in section 7. We disclosed these categories for business purposes to the service providers in section 6.

Transfers. No sale or sharing. We do not sell personal information and we do not share it for cross context behavioural advertising, and we have not done so in the preceding 12 months. We do not knowingly sell or share the personal information of consumers under 16. We do not use or disclose sensitive personal information for purposes that would give rise to a right to limit.

Authority and contact. Submit requests to [email protected]. We will verify your request by matching information you provide with what we hold, for example by confirming control of the linked Telegram account. California residents may also contact the California Privacy Protection Agency.

Other US states

Your rights. Residents of states with comprehensive privacy laws, including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky, Nebraska and Rhode Island, may, to the extent those laws apply to us, have rights to confirm processing, access, correct, delete and port personal data, and to opt out of targeted advertising, sale and profiling with legal or similarly significant effects. We do not sell personal data, use it for targeted advertising, or profile people in furtherance of such decisions.

Transfers. Transfers are handled as described in section 8.

Authority and contact. If we decline your request, you may appeal by replying to our decision with the subject "Privacy appeal" at [email protected]. We will respond within the time required by your state law. If you are not satisfied, you may contact your state Attorney General.

Asia

Singapore (PDPA 2012)

Your rights. Access to your personal data and information about how it has been used or disclosed in the past year, correction, withdrawal of consent with reasonable notice, and data portability once the relevant provisions take effect. We will notify you and the Personal Data Protection Commission of notifiable data breaches.

Transfers. We transfer personal data outside Singapore only where the recipient is bound by legally enforceable obligations providing a standard of protection comparable to the PDPA, such as contracts or binding corporate rules.

Authority and contact. Data protection officer contact: [email protected]. Authority: Personal Data Protection Commission (PDPC).

Japan (APPI)

Your rights. Disclosure of retained personal data and records of third party provision, correction, addition or deletion, and suspension of use or of provision to third parties where the Act on the Protection of Personal Information allows. Our purposes of use are listed in section 4.

Transfers. Your data is provided to recipients in Germany, Canada and the United States. Germany is in the EU, which Japan recognises as having an equivalent level of protection. For Canada and the United States, we rely on your consent or on recipients that maintain systems conforming to APPI standards. Information on the data protection systems of these countries is published by the Personal Information Protection Commission, and we will provide further information on request. Our security control measures are described in section 10.

Authority and contact. Requests: [email protected]. Authority: Personal Information Protection Commission (PPC).

South Korea (PIPA)

Your rights. Access, correction, deletion and suspension of processing, withdrawal of consent, and the right to refuse or ask for an explanation of automated decisions, under the Personal Information Protection Act. When data is no longer needed or you ask for deletion, we destroy it in an irrecoverable way, subject to legal retention duties.

Transfers. Items transferred: the data in section 3. Destination countries: Germany, Canada and the United States. Timing and method: continuously, over encrypted network connections when you use the Service. Recipients: those listed in section 6. Purpose and retention: as set out in sections 4 and 7. You may refuse the overseas transfer, but we cannot then provide the Service, because it is hosted outside Korea.

Authority and contact. Chief privacy officer: our Privacy Officer, [email protected]. Domestic agent: to be appointed where required by law. Authorities: Personal Information Protection Commission (PIPC) and the KISA Privacy Center (telephone 118).

Mainland China (PIPL)

Your rights. To know and decide, to restrict or refuse processing, to access and copy, to request portability, to correct and supplement, to delete, to withdraw consent, and to ask us to explain our processing rules, under the Personal Information Protection Law. Close relatives of a deceased person may exercise certain rights where the law allows. Bank account information such as an IBAN may be sensitive personal information under the PIPL. We process it only to provide the check you request, with strict protection measures, and with your separate consent where required.

Transfers. Cross border transfer. Using the Service involves transferring your personal information outside mainland China to Germany, Canada and the United States. Overseas recipient: the operator of TrustCheck (contact details in section 2) and the processors in section 6. Purpose, method and categories: as described in sections 3, 4 and 6. You may exercise your rights against overseas recipients by contacting [email protected]. By using the Service from mainland China you give your separate consent to this transfer. Where the law requires, we will also use the China standard contract, certification or a security assessment.

Authority and contact. Designated representative in mainland China: to be appointed where required by law. Authority: the Cyberspace Administration of China and other competent departments.

Hong Kong (PDPO)

Your rights. Under the Personal Data (Privacy) Ordinance you may request access to and correction of your personal data. We may charge a fee that is not excessive for complying with a data access request. We use data only for the purposes in section 4 or directly related purposes, and we do not use your data for direct marketing without your consent.

Transfers. Data is transferred outside Hong Kong to Germany, Canada and the United States for the purposes described in this policy, with contractual protection.

Authority and contact. Requests: [email protected]. Authority: Office of the Privacy Commissioner for Personal Data (PCPD).

India (DPDP Act 2023)

Your rights. As a Data Principal under the Digital Personal Data Protection Act 2023 and its rules, you may obtain a summary of your personal data and the processing activities, request correction, completion, updating and erasure, withdraw consent as easily as you gave it, use grievance redressal, and nominate a person to exercise your rights in the event of death or incapacity. We process your data on the basis of your consent and for legitimate uses permitted by the Act. You may give, manage or withdraw consent through a registered Consent Manager once available.

Transfers. Personal data may be transferred outside India to countries not restricted by the Central Government, including Germany, Canada and the United States.

Authority and contact. Grievance contact: [email protected]. We respond to grievances within the time required by the rules. If unresolved, you may complain to the Data Protection Board of India.

Thailand (PDPA B.E. 2562)

Your rights. Access and copy, portability, objection, erasure or anonymisation, restriction and rectification, and withdrawal of consent under the Personal Data Protection Act. Our legal bases include contract, legitimate interests and legal obligation, as described in section 4.

Transfers. Transfers outside Thailand to Germany, Canada and the United States rely on appropriate safeguards under the Act, such as contractual clauses, or on your consent or contract performance where permitted.

Authority and contact. Requests: [email protected]. Representative in Thailand: to be appointed where required by law. Authority: the Personal Data Protection Committee (PDPC Thailand).

Philippines (Data Privacy Act 2012)

Your rights. To be informed, to access, to object, to erasure or blocking, to rectification, to data portability, to file a complaint, and to be indemnified for damages sustained due to inaccurate, incomplete, outdated, false, unlawfully obtained or unauthorised use of personal data.

Transfers. We remain accountable for personal information transferred to third parties, including processors outside the Philippines, and use contractual means to provide a comparable level of protection.

Authority and contact. Data protection officer: [email protected]. Authority: National Privacy Commission (NPC).

Malaysia (PDPA 2010, as amended in 2024)

Your rights. Access, correction, withdrawal of consent, preventing processing likely to cause damage or distress, preventing processing for direct marketing, and data portability where it is technically feasible. We will notify the Commissioner and, where required, you of personal data breaches.

Transfers. Transfers outside Malaysia take place where the destination has laws substantially similar to the Act or ensures an adequate level of protection, or where another ground in the Act applies, such as your consent or performance of a contract.

Authority and contact. Data protection officer: our Privacy Officer, reachable at [email protected], [email protected]. Authority: the Personal Data Protection Commissioner (Jabatan Perlindungan Data Peribadi).

Vietnam (personal data protection law)

Your rights. Under Decree 13/2023/ND-CP and the Law on Personal Data Protection that took effect on 1 January 2026, you may be informed, give and withdraw consent, access, correct, delete, restrict and object to processing, obtain your data, complain and claim compensation. Bank account data may be sensitive personal data, which we protect accordingly.

Transfers. Transfers of personal data of Vietnamese citizens abroad are carried out with the impact assessment dossier and notifications required by law, filed with the competent authority of the Ministry of Public Security where applicable.

Authority and contact. Requests: [email protected]. Authority: the Department of Cybersecurity and High Tech Crime Prevention (A05), Ministry of Public Security.

Indonesia (PDP Law, Law No. 27 of 2022)

Your rights. To obtain information, complete and correct, access and obtain a copy, delete or destroy, withdraw consent, object to automated decisions with significant effects, restrict processing, port your data, and claim compensation.

Transfers. Transfers outside Indonesia take place where the destination provides an equal or higher level of protection, where adequate and binding safeguards are in place, or with your consent.

Authority and contact. Requests: [email protected]. Authority: the personal data protection agency established under the PDP Law, and the Ministry of Communication and Digital Affairs until that agency is operational.

Gulf Cooperation Council (GCC)

United Arab Emirates (PDPL, Federal Decree Law No. 45 of 2021), DIFC and ADGM

Your rights. Under the federal PDPL you may obtain information and a copy of your data, request portability, correction and erasure, restrict and stop processing, and object to automated decisions. If the Dubai International Financial Centre Data Protection Law No. 5 of 2020 or the Abu Dhabi Global Market Data Protection Regulations 2021 apply to your data, you have similar rights under those laws, including access, rectification, erasure, restriction, portability and objection.

Transfers. Transfers outside the UAE take place to countries with adequate protection or on the basis of contractual safeguards, your consent, or another ground permitted by the applicable law.

Authority and contact. Requests: [email protected]. Authorities: the UAE Data Office (federal); the DIFC Commissioner of Data Protection; the ADGM Office of Data Protection.

Saudi Arabia (PDPL)

Your rights. Under the Personal Data Protection Law and its implementing regulations you have the right to be informed, to access and obtain a copy of your data in a readable format, to correct, complete or update it, and to request its destruction when no longer needed. Financial data may be sensitive data, which we protect accordingly.

Transfers. Transfers outside the Kingdom are made in accordance with the Regulation on Personal Data Transfer outside the Kingdom, using adequacy decisions, appropriate safeguards such as standard contractual clauses, or another permitted ground.

Authority and contact. Requests: [email protected]. Authority: the Saudi Data and Artificial Intelligence Authority (SDAIA).

Qatar (PDPPL, Law No. 13 of 2016)

Your rights. To withdraw consent, object to processing, request deletion, correction and access, and be notified of processing and of inaccurate disclosures.

Transfers. We do not take measures that limit the cross border flow of data except where the law requires, and we protect transferred data as described in sections 8 and 10.

Authority and contact. Requests: [email protected]. Authority: the National Data Privacy Office of the National Cyber Security Agency.

Bahrain (PDPL, Law No. 30 of 2018)

Your rights. To be informed, to access, to object to processing likely to cause material or moral damage, to object to direct marketing, to object to decisions based solely on automated processing, and to request rectification, blocking or erasure.

Transfers. Transfers outside Bahrain are made to countries with adequate protection as determined by the Authority, or on another ground permitted by the law, such as your consent or performance of a contract.

Authority and contact. Requests: [email protected]. Authority: the Personal Data Protection Authority.

Oman (PDPL, Royal Decree No. 6 of 2022)

Your rights. To withdraw consent, to request modification, update or blocking, to obtain a copy of your data, to request deletion where it is no longer needed, to be informed of breaches, and to complain.

Transfers. Transfers outside Oman are made in accordance with the conditions set out in the PDPL and its executive regulation.

Authority and contact. Requests: [email protected]. Authority: the Ministry of Transport, Communications and Information Technology.

Kuwait (CITRA Data Privacy Protection Regulation)

Your rights. Under the Data Privacy Protection Regulation issued by the Communication and Information Technology Regulatory Authority, you may be informed of processing, give and withdraw consent, access, correct and request deletion of your data, and be notified of breaches.

Transfers. Transfers outside Kuwait comply with the conditions of the Regulation, including adequate protection and appropriate safeguards.

Authority and contact. Requests: [email protected]. Authority: the Communication and Information Technology Regulatory Authority (CITRA).