Walloat Privacy Policy

This Privacy Policy explains how Walloat processes personal information when you use walloat.com, Walloat Telegram bots, Telegram Mini Apps, Exchange Benefits, UID registration, partner-attribution functions, Walloat Payback where available, alerts, and related Walloat services (collectively, the “Services”).

For the processing described in this Policy, the service operator and privacy contact is Walloat.

This Policy applies to Walloat's processing. Third-party exchanges, Telegram, and other external services process information under their own terms and privacy policies.

Depending on the feature you use, Walloat may process the following categories of information.

Walloat does not require your wallet seed phrase, private key, exchange password, or similar secret credential for the Services described in this Policy. Do not provide such information to Walloat.

Walloat obtains information in several ways:

• directly from you when you submit an exchange UID, select settings, make a request, or otherwise provide information;
• from Telegram when you open or authenticate through a Walloat bot or Mini App;
• from Walloat systems when service, consent, verification, Payback, or security records are created;
• from partner exchanges or partner systems when attribution, eligibility, or other program-related status is verified or reported;
• from infrastructure and service providers as necessary to operate, secure, diagnose, and maintain the Services.

Walloat does not treat information that a third party holds independently as Walloat-controlled personal information unless Walloat actually receives or processes that information.

Walloat processes personal information for purposes including:

• authenticating users and establishing Walloat service sessions;
• connecting Telegram users to Walloat internal user records;
• providing language, locale, and service preferences;
• registering exchange UIDs and preventing duplicate or unauthorized registrations;
• verifying partner attribution and benefit eligibility;
• administering Exchange Benefits and Walloat Payback where available;
• recording and demonstrating acceptance of applicable legal documents;
• providing alerts, support, and requested service functionality;
• detecting fraud, abuse, security incidents, and technical errors;
• maintaining service reliability and enforcing applicable terms;
• handling disputes, corrections, privacy requests, and legal obligations.

Walloat will not use personal information for a materially incompatible purpose without an appropriate legal basis or notice.

When you use a Walloat Telegram Mini App, Telegram provides signed initData that Walloat validates before creating or accessing a Walloat session.

The information processed during this authentication may include your Telegram user ID, first name, optional last name and username, language code, Telegram Premium status, authentication date, query ID if present, and integrity-verification values.

Some of these values are used only for authentication or the current service interaction and are not necessarily stored as persistent profile fields in Walloat's application database.

Walloat may store the identifiers and settings necessary to link your Telegram account to Walloat, such as Telegram user ID, Telegram chat ID, internal Walloat user ID, and selected locale.

Telegram is an independent third-party platform. Telegram's own processing of your Telegram account and platform data is governed by Telegram's policies.

If you use Exchange Benefits or Payback-related features, Walloat may process the exchange code and exchange UID that you submit.

Walloat may associate that information with your internal Walloat user ID and the relevant partner or exchange in order to:

• register or re-submit a UID;
• detect duplicate or conflicting registrations;
• verify partner attribution;
• determine whether a benefit or Payback policy can apply;
• maintain verification and account status;
• calculate, review, correct, settle, or pay eligible Payback amounts where the program is active;
• prevent fraud, duplicate claims, and misuse.

Submission of an exchange UID does not authorize Walloat to access your exchange password, private key, seed phrase, or unrelated account information.

Partner exchanges may independently process information under their own terms and privacy policies.

When Walloat requires acceptance of a legal document, Walloat may retain records showing:

• the internal user ID;
• the consent type;
• the version of the legal document;
• the locale;
• the source of the acceptance, such as WEB or TELEGRAM_MINI_APP;
• limited metadata relevant to the acceptance flow;
• the acceptance timestamp.

These records are used to determine whether required documents have been accepted and to demonstrate which version applied at the time of acceptance.

Walloat uses infrastructure and service providers to operate, secure, maintain, and support the Services.

Core Walloat web and database infrastructure is operated in South Korea using the Amazon Web Services Asia Pacific (Seoul) region. This is domestic processing for Walloat's core web and database services.

Certain Assistant or Telegram-related functionality is hosted on Railway infrastructure in California, United States. Where that functionality is used, the international processing arrangement is described below.

Walloat will review and update international-processing disclosures when providers, deployment regions, processed information, or applicable legal requirements change.

Walloat Services may depend on Telegram, cryptocurrency exchanges, blockchain networks, APIs, and other third-party platforms. These third parties are independent from Walloat and may process information under their own privacy policies.

When you use Walloat through Telegram, Telegram may provide Walloat with information needed for authentication or interaction, including Telegram user or chat identifiers and message, command, or Mini App data that you submit or make available through Telegram.

To provide Telegram bot functions and replies, Walloat also sends information to the Telegram Bot API, such as the relevant Telegram chat identifier and the message or response content required to deliver the requested function. Telegram processes that information through its own cloud infrastructure and under its own policies.

Telegram states that its cloud services may store or process data across data centers and group companies in multiple jurisdictions. Because the exact processing location may depend on Telegram's infrastructure and the user's Telegram service context, Walloat does not represent that all Telegram processing occurs in a single country.

Walloat will review and provide any additional country-specific international-transfer disclosures or notices required for Telegram-based processing under applicable law.

Partner exchanges and other external services may independently process account, eligibility, trading, verification, or other information under their own terms and privacy policies. Walloat is not responsible for a third party's independent privacy practices.

Walloat keeps personal information only for as long as reasonably necessary for the purpose for which it was processed, the operation of the relevant Service, dispute handling, fraud prevention, security, settlement, or applicable legal obligations.

In general:

• Telegram connection and preference data may be retained while the Walloat account or relevant connection remains active;
• exchange UID, attribution, verification, and Payback records may be retained while verification, settlement, correction, dispute, or fraud-prevention needs remain;
• legal consent records may be retained for as long as reasonably necessary to demonstrate the applicable legal-document version and acceptance history;
• records subject to a mandatory legal retention period may be retained for that required period.

When information is no longer required, Walloat will delete, anonymize, or otherwise securely dispose of it as appropriate.

Account deactivation does not necessarily result in immediate deletion of records that must remain available for pending settlement, disputes, security, fraud prevention, or legal obligations.

Walloat uses reasonable administrative and technical measures designed to protect personal information against unauthorized access, alteration, disclosure, loss, or misuse.

Measures may include authentication controls, signed Telegram initData validation, access restrictions, database controls, transport encryption provided by applicable infrastructure, service monitoring, and limiting stored data to what is operationally necessary.

No system can guarantee absolute security. You are responsible for maintaining control of your Telegram account, devices, exchange credentials, and other authentication methods.

Depending on applicable law, you may have rights to request access to, correction of, deletion of, or restriction or suspension of processing of your personal information, or to withdraw consent where processing is based on consent.

You may also request account deactivation or ask questions about how Walloat handles your information.

Walloat may need to verify your identity before completing a request and may refuse or limit a request where permitted or required by law, including where records must be retained for legal obligations, security, fraud prevention, disputes, or pending settlement.

Requests may be submitted to contact@walloat.com.

Walloat does not need and does not ask you to provide:

• wallet seed phrases or recovery phrases;
• private keys;
• exchange passwords;
• one-time authentication codes requested by another service;
• secret API keys that permit trading or withdrawal;
• another person's exchange UID or account information without authority.

If a person claiming to represent Walloat requests such secret credentials, do not provide them and contact Walloat through the official contact channel.

The Services are intended for users who have the legal capacity to use the relevant Walloat and exchange services.

Walloat does not knowingly seek to collect personal information from a child where parental or guardian consent would be required by applicable law.

If Walloat learns that personal information was collected in circumstances requiring consent that was not validly obtained, Walloat may restrict the relevant account and delete or otherwise handle the information as required by law.

Walloat may update this Privacy Policy when the Services, data practices, service providers, partner arrangements, or applicable legal requirements change.

Material changes will be identified by a new version and updated date and communicated where reasonably appropriate or legally required.

Where a change requires a new consent or separate notice under applicable law, Walloat will obtain or provide it before the relevant processing is applied.

Privacy contact: Walloat

contact@walloat.com

You may use this contact for privacy questions, data-subject requests, account-deactivation requests, or concerns regarding Walloat's processing of personal information.