Overview & Ecosystem Scope
Platform scope, entities involved, and non-custodial boundaries
This Privacy Policy applies to the digital asset management services, multi-chain portfolio tracking, decentralized smart contract routing, and institutional wealth management portals operated by Capitaral (“Capitaral”, “we”, “our”, or “us”), including our integration with the Trust Wallet partner client ecosystem.
By visiting our interfaces, connecting an external cryptographic address, or interacting with our smart contract integrations, you acknowledge the collection and handling practices detailed herein. As a decentralized finance (DeFi) technology platform, our technological stack is engineered to enforce zero-knowledge data custody, guaranteeing that sovereign digital ownership remains in your hands at all times.
Non-Custodial Architecture & Seed Phrase Security
Our fundamental mathematical guarantee regarding your private keys
Capitaral will never ask for, transmit across open networks, or store your 12-word seed phrase or private spending keys in plaintext on any centralized server.
When you initialize a wallet or connect an existing seed phrase through our Trust Wallet integration, key derivation is performed exclusively in your local client runtime using deterministic derivation paths (BIP-39 / BIP-44 standards).
Client-Side Cryptography
Transaction signing takes place strictly within your local browser sandbox or mobile secure enclave. Only the mathematically signed, broadcastable payload leaves your device.
User Sole Responsibility
Because we do not custody private keys, Capitaral has no technical ability to restore or reset a lost seed phrase. You must preserve your recovery words in a secure, offline environment.
Information We Collect
Categorization of data points necessary for platform operation
To provide real-time balance calculations, multi-asset portfolio accounting, and security monitoring, we process the following categories:
A Public Blockchain Ledger Data
Public wallet addresses (e.g. Ethereum 0x… format), token balances, smart contract execution logs, and published transaction hashes. Please note that public distributed ledgers are inherently transparent, immutable, and accessible worldwide.
B Account & Identity Credentials (Off-Chain)
When you create a registered user profile or institutional tier account: email address, display handle, cryptographically salted password hashes (Argon2id/Bcrypt), interface language preferences, and optional notification settings.
C Technical Telemetry & Security Logs
Internet Protocol (IP) addresses, device hardware architecture, browser user-agent strings, RPC latency metrics, and API request timestamps. These logs are processed strictly for DDoS mitigation, bot detection, credential-stuffing prevention, and operational debugging.
D What We Explicitly NEVER Collect
We never collect your unencrypted private keys, plaintext seed phrases, biometric data, credit card CVV codes, or canvas browser fingerprints for tracking purposes.
Legal Basis for Processing (GDPR & UK GDPR)
Lawful criteria under European and international privacy directives
Under Article 6 of the General Data Protection Regulation (GDPR), we process your personal data only when substantiated by a lawful basis:
1. Contractual Performance
Processing is required to provide the core services requested by you, such as synchronizing token valuations and routing signed transaction data.
2. Legitimate Interests
Defending our infrastructure against cybersecurity threats, mitigating sybil attacks, and optimizing the efficiency of our RPC routing networks.
3. Legal & Regulatory Obligations
Complying with statutory anti-money laundering (AML), sanctions screening lists, and court-ordered disclosure mandates where applicable by law.
4. Explicit Consent
Where you actively opt into optional communications, beta feature programs, or customer assistance ticketing.
How We Use Information
Specific operational objectives for processing
- Real-Time Portfolio Syncing: Querying distributed nodes and smart contract states to aggregate holdings, staking yields, and historical transaction graphs.
- Mempool Broadcasting: Relaying client-signed transactions directly to decentralized consensus validators without inspecting or modifying payload logic.
- Threat Detection & Platform Integrity: Analyzing access patterns to mitigate malicious exploit payloads, credential stuffing, and botnets.
- Customer Support Inquiries: Reviewing user-submitted diagnostics during technical support sessions when explicitly authorized.
- Compliance & Sanctions Screening: Ensuring that protocol interaction does not breach international sanctions regimes (e.g., OFAC list screening).
Blockchain Nodes & External Infrastructure
Third-party service providers, RPC endpoints, and price oracles
To operate without relying on a single centralized point of failure, Capitaral interfaces with audited third-party service providers and decentralized networks:
EVM & Layer-1 RPC Providers
We utilize high-throughput RPC endpoints (e.g. Infura, Alchemy, Cloudflare Web3, QuickNode) to transmit read queries and transaction payloads to Ethereum, BSC, and Polygon networks.
Cryptocurrency Price Oracles
Aggregated valuation tickers are retrieved from reputable market feeds such as CoinGecko and Binance APIs to calculate real-time fiat values for tokens.
Cloud & DDoS Shielding
Edge routing and web application firewall protection are provided via enterprise cloud partners to prevent denial-of-service disruptions.
No Advertising Brokers
We do not embed ad tracking SDKs, marketing trackers (e.g. Meta Pixel, TikTok Pixel), or commercial data-reselling integrations into our web client or app bundle.
Account Deletion & Data Retention
GDPR Art. 17 “Right to Erasure”, CCPA, and App Store Compliance
In adherence with GDPR Article 17, the California Consumer Privacy Act (CCPA), and global mobile application guidelines, you possess the unconditional right to request the deletion of your Capitaral user account and off-chain records.
Off-Chain Purge
Account profiles, email credentials, session tokens, and telemetry logs are de-identified within 30 days of submission.
Crypto Remains Yours
Account deletion has zero impact on decentralized blockchain balances. Your tokens remain accessible through your 12-word seed phrase.
Immediate Access
You can execute an erasure request at any moment through our dedicated self-service portal or via automated API endpoints.
International Data Transfers
Cross-border data flows and international safeguarding mechanisms
Because public blockchain networks are globally distributed across validator nodes in multiple jurisdictions, transaction data broadcasted to public mempools is inherently transmitted internationally.
For off-chain personal data (such as account email addresses), if transfers outside of the European Economic Area (EEA) or the United Kingdom occur, Capitaral ensures an equivalent standard of protection through the implementation of European Commission Standard Contractual Clauses (SCCs) and UK International Data Transfer Agreements (IDTAs).
Your Privacy Rights (GDPR, CCPA & Global Frameworks)
Universal rights available regardless of your geographic residency
Capitaral extends comprehensive privacy safeguards to all users globally:
Right of Access & Portability
Request a portable machine-readable copy (JSON/CSV) of off-chain personal records held in connection with your account.
Right to Rectification
Update or amend inaccurate profile information, communication addresses, or notification configurations at any time.
Right to Erasure ("To Be Forgotten")
Demand permanent de-identification and deletion of all off-chain user accounts and associated metadata.
Right to Restrict or Object
Restrict or object to processing carried out under the legal basis of legitimate interest or direct communications.
Non-Discrimination Assurance
We strictly guarantee that exercising your privacy rights will never result in downgraded platform capabilities, higher protocol fees, or denied service access.
Children's Privacy Protection
Strict compliance with COPPA, GDPR Article 8, and financial regulations
Our platform, wealth management portals, and decentralized wallet tools are not directed to individuals under the age of 18 (or the age of legal majority in your country). We do not knowingly collect personal data from minors. If you become aware that a minor has provided us with off-chain personal data, please contact our Data Protection Office immediately at privacy@capitaral.com for prompt removal.
Institutional Security & Cryptographic Audits
Defense-in-depth technical and operational safeguards
Capitaral deploys defense-in-depth cybersecurity controls across all application touchpoints:
Mandatory TLS 1.3 transport encryption utilizing modern cipher suites with Perfect Forward Secrecy (PFS).
Cloud database storage is encrypted with AES-256-GCM within isolated, firewalled Virtual Private Clouds (VPC).
Systems are structured around SOC 2 Type II trust principles and smart contracts undergo formal third-party bytecode verification.
We sponsor continuous vulnerability assessments and maintain an active responsible security disclosure channel.
Amendments & Policy Updates
Transparent versioning and material change notifications
We may update this Privacy Policy from time to time to mirror regulatory evolutions, technological enhancements, or novel smart contract deployments. When material changes occur, we will update the "Effective Date" at the top of this document and publish a prominent banner notification on the web application dashboard.
We encourage users to periodically review this page to remain informed of our ongoing data safeguarding practices.
Contact & Data Protection Officer (DPO)
Direct institutional channels for privacy requests and regulatory inquiries
For questions, formal inquiries regarding this policy, or to submit a verified privacy request, please reach out to our compliance desk:
- Operating Entity
- Capitaral • Capitaral Ecosystem
- Privacy Department
- privacy@capitaral.com
- Data Protection Officer
- dpo@capitaral.com
- Erasure Portal
- capitaral.com/delete-user
- Turnaround SLA
- Formal response within 48 business hours