Unvault Privacy Policy
Effective: September 21, 2026 · Version 1.0
1. Who we are and what this Policy covers#
1.1 This Privacy Policy explains how Unvault (BVI) Ltd (Unvault, we, us), a company incorporated in the British Virgin Islands with company number 2217283 and registered office at Suite 5, Oleander Building, Port Purcell, Tortola, VG1110, British Virgin Islands, handles personal data when you use the Unvault website, web application, APIs, and support channels (the Services). Unvault is the data controller for that processing under the Data Protection Act, 2021 of the Virgin Islands and, where it applies to you, the EU and UK General Data Protection Regulation.
1.2 This Policy does not cover the public blockchains on which your transactions are recorded, the wallet software you use, or third-party services you reach through the Services. Those are operated by others under their own terms and policies.
1.3 Capitalised words not defined here have the meanings given in the Terms of Service.
2. The nature of a public-blockchain service#
2.1 Your wallet address, the Digital Items it holds, and every transaction it has ever made are recorded on public blockchains that anyone can read, permanently, and that no one — including Unvault — can edit or erase. When you connect a wallet to the Services, Unvault reads that public record and displays it to you and to other users; Unvault does not create it and cannot delete it.
2.2 A wallet address is pseudonymous. It becomes personal data when it can be linked to you — for example, through a nickname you choose, a linked X account, an email address you give us, or information you send to support. This Policy is mostly about the data that can make that link, and about the small amount of data Unvault holds that is not on-chain.
3. The data we collect#
3.1 Data you give us.
- Profile details you choose to set: a nickname, an avatar (an image URL or one of your Digital Items), and a profile-visibility setting.
- A linked X (Twitter) account handle, if you connect one for a rewards campaign.
- An email address, if you give us one — for support, for an early-access application at onboarding.unvault.com, for a badge application, or to receive notices.
- The content of support requests, reports you file about others, appeals, legal notices, and any documents you attach (for example a police report under the Disputed Items Policy).
- Posts you submit for post-to-claim rewards, including the public URL of the post.
- For creators: collection metadata, artwork URLs, allowlists you upload (wallet addresses of other people), and royalty configurations.
- For developers: an application description, contact details, and the wallet address or organisation an API key belongs to.
3.2 Data created when you use the Services.
- Wallet addresses that sign in, and for each sign-in the time, the IP address, and browser and device information sent by your browser.
- Signed marketplace orders (listings and offers) you create, whether or not they are filled, and a record of the Orders you fill.
- Records of Drop eligibility (allowlist membership and mint vouchers issued to your wallet) and of DIVIT claim proofs generated for your wallet.
- Your watchlist and interface preferences (for example, chain filter, currency display, and theme).
- Server logs and error reports, including requests you make to the APIs under your API key.
- Feedback you leave on Help Center articles and bug reports you submit through the Report Bug control.
3.3 Data we read from public sources. Blockchain data associated with your wallet address (balances, Digital Items, transactions, approvals, vault status), which we index and display; and public information about a Collection or Creator that we use for verification and trust-and-safety review.
3.4 Data we do not collect. Unvault never collects your private keys, seed phrases, or wallet passwords; never takes custody of your assets; does not collect payment-card or bank details (the Services take no fiat payments); and does not collect government identity documents. We do not knowingly collect data from anyone under 18.
4. How we use the data, and the legal basis#
| Purpose | Data used | Legal basis |
|---|---|---|
| Provide the Services: display your assets and activity, run the order book, issue mint vouchers and DIVIT claim proofs, show your profile and watchlist | Wallet address, on-chain data, profile details, Orders, eligibility records, preferences | Performance of our contract with you (the Terms of Service) |
| Keep the Services secure: detect fraud, wash trading, sanctions exposure, abuse of Drops and rewards, and attacks on our systems | Sign-in records, IP address, device information, Orders, on-chain data, reports | Our legitimate interest in protecting the Services and their users; compliance with legal obligations |
| Handle reports, disputes, copyright and trademark notices, appeals, and law-enforcement requests | Report content, correspondence, attached documents, wallet address, on-chain data | Our legitimate interest in operating a safe marketplace; compliance with legal obligations |
| Run rewards campaigns and verify posts and disclosures | Linked X handle, post URLs, wallet address | Performance of our contract; our legitimate interest in preventing reward abuse |
| Support you and respond to your requests | Support correspondence, email address, wallet address | Performance of our contract; our legitimate interest in providing support |
| Improve the Services and understand how they are used | Aggregated usage data, error reports, Help Center feedback | Our legitimate interest in improving the Services |
| Send you service notices (for example, changes to the Terms or a security alert) | Email address, in-app notices | Performance of our contract; compliance with legal obligations |
| Comply with sanctions, anti-money-laundering, tax, and other laws, and respond to valid legal process | Wallet address, sign-in records, Orders, correspondence | Compliance with legal obligations |
We do not sell personal data, and we do not use it for third-party advertising or for building advertising profiles.
5. Who we share data with#
5.1 Other users. Your wallet address, nickname, avatar, Collections you create, and your on-chain activity are visible to other users, subject to your profile-visibility setting. Blockchain data is public regardless of that setting. If you launch a Collection, its on-chain address and metadata are public.
5.2 Service providers. We use providers who process data on our instructions and under contracts that protect it: cloud hosting and content delivery, blockchain node and indexing providers, email delivery, error and performance monitoring, and support tooling. Providers that operate independent services under their own policies include Particle Network (universal accounts used for cross-chain payments), the LayerZero messaging network, wallet providers, block explorers, and X (for account linking). We link to their privacy policies from the pages where you use them.
5.3 Counterparties and rights holders. When you file a copyright notice, trademark report, or stolen-item report, we pass the substance of your report, and the contact details the law requires, to the affected user so they can respond. When someone reports you, you receive their report the same way. See the Copyright Policy, Trademark Policy, and Disputed Items Policy for the details.
5.4 Authorities. We disclose data to law enforcement, regulators, and courts only as described in the Law Enforcement Guidelines: under a lawful order binding on Unvault, through mutual legal assistance, in an emergency involving risk to life, or voluntarily for limited non-content records in serious-crime investigations where disclosure is lawful and proportionate.
5.5 UV Tech Foundation. The Foundation owns the Protocol Contracts and does not receive personal data from Unvault, except where you interact directly with a Protocol Contract, in which case the public blockchain record is what the Foundation, like everyone else, can see.
5.6 Corporate events. If Unvault is reorganised, merged, or sells its business or assets, personal data may be transferred to the successor, who will be bound by this Policy until it is changed under Section 11.
6. Cookies and local storage#
The Services use a small number of first-party cookies and browser-storage entries that are necessary to run the Services: to keep you signed in during a session, to remember your wallet connection, chain filter, currency display, theme, and other interface preferences, and to remember Help Center feedback you have given. We do not use third-party advertising cookies. You can clear these entries through your browser at any time; the Services will then ask you to sign in and set your preferences again.
7. International transfers#
Unvault is established in the British Virgin Islands and uses service providers in the United States and the European Union. Where we transfer personal data of users in the European Economic Area, the United Kingdom, or Switzerland to countries that those jurisdictions have not recognised as providing adequate protection, we rely on standard contractual clauses approved by the relevant authority, together with supplementary measures where needed. Blockchain data is public worldwide by design and is not "transferred" by Unvault.
8. How long we keep data#
| Data | Retention |
|---|---|
| Sign-in and access logs (IP address, device information) | 12 months |
| Profile details, watchlist, preferences, linked X handle | Until you delete them or ask us to delete your profile data |
| Signed Orders | Until expiry or cancellation, then 5 years as part of the trading record |
| Reports, notices, disputes, appeals, and support correspondence | 5 years from closure |
| Records of eligibility, mint vouchers, DIVIT claim proofs, and rewards campaigns | 5 years |
| API keys and API logs | For the life of the key, then 12 months |
| Data preserved at the request of law enforcement | 90 days, renewable once for 90 days, then as required by any order received |
| Blockchain data | Public and permanent; not controlled by Unvault |
We may keep data longer where the law requires it or where it is needed for a dispute or legal claim that is under way.
9. Your rights#
9.1 You may ask us to tell you what personal data we hold about you and to give you a copy; to correct data that is wrong; to delete data we no longer need; to restrict or object to processing that relies on our legitimate interests; to receive data you gave us in a portable format; and, where processing is based on consent, to withdraw that consent. If you are in the EEA or the United Kingdom you also have the right to complain to your data-protection authority; in the British Virgin Islands the supervisory authority is the Office of the Information Commissioner.
9.2 To exercise a right, email legal@unvault.com from the address we hold for you, or sign the verification message we send so that we know the request comes from the wallet's owner. We respond within 30 days, and may extend that by a further 30 days for complex requests, telling you why.
9.3 Limits. We cannot delete, correct, or restrict data on a public blockchain, because we do not control it. We may decline a request where the law requires us to keep the data (for example, a record of a report), where deletion would prevent us from enforcing the Terms of Service or defending a legal claim, or where we cannot verify that the request comes from the data subject.
10. Security#
We protect the data we hold with access controls, encryption in transit, logging, and least-privilege access for staff and providers. Signing services that produce mint vouchers and DIVIT claim proofs are separated from the systems that serve the website. No system is perfectly secure, and you are responsible for the security of your own wallet and device. If we learn of a breach that is likely to put your rights at risk, we will notify you and the relevant authority as the law requires.
11. Changes to this Policy#
We may update this Policy. We will post the new version here with a new effective date and, for material changes, give notice in the Services or by email if we have your address, at least 14 days before the change takes effect.
12. Contact#
Privacy requests and questions: legal@unvault.com Postal address: Unvault (BVI) Ltd, c/o Leeward (BVI) Limited, Suite 5, Oleander Building, Port Purcell, Tortola, VG1110, British Virgin Islands