> For the complete documentation index, see [llms.txt](https://docs.visionmakers.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.visionmakers.io/legal/privacy.md).

# Privacy Policy

Version 2.0 · Effective 24 October 2026

This Policy explains what personal data **Vision Makers Technologies Inc.** collects, why, who we share it with, and the
rights you have. It applies to the website, web application, Telegram Mini App, Telegram bot,
mobile applications and API.

## 1 · Controller and contact

Vision Makers Technologies Inc., Republic of Panama, is the controller of personal data described here.
Contact: [admin@visionmakers.io](mailto:admin@visionmakers.io).

<div class="callout">
<span class="callout-label">Appointments to confirm</span>
Where required, a Data Protection Officer and EU/UK Article 27 representatives must be appointed
and named here. Confirm with counsel whether thresholds are met and insert details before
publication.
</div>

## 2 · What we collect

#### You give us

| Data | When |
| --- | --- |
| Email address, username | Registration, newsletter |
| Public wallet address(es) | Wallet connection |
| Identity documents, selfie, proof of address, date of birth, nationality | KYC, where required |
| Support correspondence | When you contact us |
| Preferences, alert rules, watchlists, agent configurations | In-product use |
| Social handles | Quests, competitions, referrals |

#### Collected automatically

IP address, approximate location derived from it, device and browser characteristics, operating
system, language, referring URL, pages and features used, session timing, and diagnostic logs.

#### From third parties

KYC verification results from identity providers, blockchain analytics risk signals on wallet
addresses, sanctions and PEP screening results, quest-platform completion data (Zealy, TaskOn),
and Telegram-supplied account identifiers when you use the Mini App.

#### Public blockchain data

We read public blockchain data, including addresses you connect and their transaction history.
**This data is public and permanent, and we do not control it.** We cannot delete or alter
anything recorded on a blockchain.

## 3 · What we do not collect

**We never collect your private keys, seed phrases or recovery material.** No feature requires
them and no employee will ever ask for them.

## 4 · Why we process it, and on what basis

| Purpose | Lawful basis (GDPR Art. 6) |
| --- | --- |
| Providing the Service you requested | Contract |
| Account creation and authentication | Contract |
| Processing payments and subscriptions | Contract |
| KYC, AML, sanctions screening, Travel Rule | Legal obligation; substantial public interest |
| Fraud prevention, abuse detection, platform security | Legitimate interests |
| Service improvement, analytics, model quality | Legitimate interests; consent where cookies require it |
| Marketing communications | Consent (withdrawable) |
| Non-essential cookies and similar technologies | Consent |
| Responding to lawful authority requests | Legal obligation |
| Establishing or defending legal claims | Legitimate interests |

Where we rely on legitimate interests we have assessed that our interest is not overridden by
your rights; you may request a summary of that assessment.

Identity documents and biometric comparison data are **special category or sensitive data** in
some jurisdictions. We process them only where necessary for identity verification under legal
obligation or substantial public interest, and retain them under the schedule below.

## 5 · AI and automated processing

The Service produces AI-generated interpretation. Your prompts and interactions may be processed
by third-party model providers (see [Sub-processors](/legal/sub-processors)).

- We do **not** sell your prompts.
- We contractually require that content sent to model providers is **not used to train their
  general-purpose models**, where the provider offers that commitment. Confirm the current
  position per provider in the sub-processor list.
- We may use aggregated and de-identified interaction data to improve our own scoring models.

Automated decisions that produce legal or similarly significant effects, principally **automated
KYC rejection and sanctions-screening matches**, are subject to human review on request. See
[AI Transparency](/legal/ai-transparency).

## 6 · Who we share with

- **Sub-processors**: listed and kept current at [Sub-processors](/legal/sub-processors).
- **Identity and screening providers**: for KYC, sanctions and PEP checks.
- **Blockchain analytics providers**: for wallet risk scoring.
- **Professional advisers**: lawyers, auditors, accountants, under confidentiality.
- **Authorities**: where legally required; see [Law Enforcement Requests](/legal/law-enforcement).
- **Acquirers**: in a merger, acquisition or asset sale, subject to this Policy.

**We do not sell personal data**, and we do not share it for cross-context behavioural
advertising.

## 7 · International transfers

We operate globally and transfer data outside your country, including to the EEA, UK, US and
Panama. For transfers from the EEA or UK we rely on adequacy decisions where available, otherwise
**Standard Contractual Clauses** (with the UK Addendum where relevant) plus a transfer risk
assessment. Copies of the mechanism are available on request.

## 8 · How long we keep it

| Category | Retention |
| --- | --- |
| Account and profile | Life of account + 12 months |
| KYC records and verification results | **5 years** after relationship ends, or longer where local law requires |
| Transaction and order records | 5 years |
| Sanctions screening records | 5 years |
| Support correspondence | 24 months |
| Marketing consent records | Duration of consent + 24 months as proof |
| Security and access logs | 12 months |
| Analytics (aggregated) | Indefinite, de-identified |
| Cookie consent records | 12 months |

Public blockchain data cannot be deleted by us.

## 9 · Your rights

Subject to jurisdiction and verification, you may: **access** your data; obtain **rectification**;
request **erasure**; request **restriction**; **object** to processing based on legitimate
interests or direct marketing; obtain **portability**; **withdraw consent** at any time; and
**not be subject** to solely automated decisions with significant effects.

**EEA/UK:** you may complain to your supervisory authority.
**California:** you have rights to know, delete, correct, and to opt out of sale/sharing, we do
neither, and not to be discriminated against for exercising them.
**Brazil, Canada, Switzerland and others:** equivalent rights apply.

Exercise any right at [admin@visionmakers.io](mailto:admin@visionmakers.io). We respond within **30 days** (extendable once
where permitted) and verify identity before acting. There is no charge unless a request is
manifestly unfounded or excessive.

**Limits.** We cannot erase data we must retain for AML or sanctions purposes, and we cannot
alter blockchain records.

## 10 · Security

Encryption in transit and at rest, role-based access control on a least-privilege basis, network
segmentation, logging and monitoring, vendor due diligence, and incident response. See
[Fraud and Security](/legal/fraud-and-security) and
[Data Breach Notification](/legal/data-breach).

No system is perfectly secure, and we cannot guarantee absolute security.

## 11 · Children

The Service is not for anyone under 18. We do not knowingly collect children's data; if we learn
we have, we delete it. Contact [admin@visionmakers.io](mailto:admin@visionmakers.io) if you believe a child has provided data.

## 12 · Cookies

See the [Cookie Notice](/legal/cookies).

## 13 · Changes

We will post changes here with a new effective date and notify you of material changes through
the Service or by email.

## 14 · Contact

Vision Makers Technologies Inc., [admin@visionmakers.io](mailto:admin@visionmakers.io)