> For the complete documentation index, see [llms.txt](https://docs.cwallet.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.cwallet.com/normative-documents/privacy-policy.md).
# Privacy Policy
**ALPHA IT LTD**
Effective date: 2026-11-06 | Last updated: 2026-11-06
## 1. Introduction and Scope
This Privacy Policy explains how **ALPHA IT LTD** (the “Company”, “Cwallet”, “we”, “us” or “our”) collects, uses, discloses, protects and retains personal information in connection with cwallet.com, our mobile and desktop applications, automated bot interfaces, customer support channels and related services (collectively, the “Services”).
The Company is incorporated in Samoa (registration number 95568) with its registered address at Intershore Suite, Le Sanalele Complex, Apia, Samoa, PO Box 608. This Policy covers personal information handled by the Company. Where another legal entity independently provides a service through the Platform, its identity and applicable privacy notice should be disclosed at the relevant point of service.
We serve users in permitted jurisdictions. Samoan law applies to our activities where applicable, and additional mandatory privacy laws in a user’s jurisdiction may also apply. Nothing in this Policy limits rights that cannot lawfully be waived.
## 2. Privacy Accountability and Contact
The Company is responsible for personal information under its control, including information processed by service providers on its behalf. Our designated Privacy Officer oversees privacy enquiries, complaints and requests.
Privacy contact: . Postal address: Intershore Suite, Le Sanalele Complex, Apia, Samoa, PO Box 608. Please include sufficient information to identify your account and describe your request; we may verify your identity before responding.
## 3. Information We Collect
Depending on the Services used, we may collect the following categories of personal information:
* *Identity and KYC: name, date of birth, nationality, government identification details and images, address, proof of address, identity verification results and, where genuinely used and necessary, facial images or biometric verification information.*
* *Business and beneficial ownership: entity registration, directors, authorised users, ownership and control, beneficial owners and business activities.*
* *Account and wallet: account identifiers, wallet addresses, balances, preferences, account history and related records.*
* *Transactions and financial information: deposits, withdrawals, blockchain transaction hashes, transaction counterparties, payment information, source of funds or wealth where required, and transaction screening results.*
* *Technical and usage: IP address, approximate location inferred from IP, device and browser identifiers, logs, crash reports, app version, security events, navigation and interactions.*
* *Communications and marketing: support correspondence, complaints, survey responses, communications preferences and marketing consents.*
We may receive information directly from you, from your use of the Services, from identity-verification providers, blockchain analytics providers, payment partners, public registers, sanctions and screening sources, and other lawful third-party sources. Public blockchain data may be visible to others independently of our processing.
We collect information reasonably necessary for identified purposes and use more sensitive information, including biometric information, only with appropriate notice and consent or another legally permitted basis. We do not assume that biometric collection is necessary for every user.
## 4. Purposes of Collection, Use and Disclosure
We collect, use and disclose personal information for purposes that include:
* *Creating, verifying, administering and securing accounts;*
* *Providing wallet, exchange, transfer and other Services actually offered by the Company;*
* *Processing and reconciling transactions and responding to support enquiries;*
* *Meeting identity verification, anti-money laundering, terrorist financing, sanctions, recordkeeping and reporting obligations;*
* *Detecting and investigating fraud, misuse, security incidents and suspicious activity;*
* *Maintaining platform infrastructure, reliability, backups, analytics and product improvements;*
* *Responding to lawful requests, enforcing terms and establishing or defending legal claims;*
* *Sending service messages and, where permitted, marketing communications.*
We identify purposes at or before collection, obtain meaningful consent where required, and rely on statutory exceptions only where legally available. Where a new materially different purpose requires consent, we will seek it before proceeding.
## 5. Consent and Choices
Consent may be expressed or implied where applicable law permits, taking into account sensitivity and reasonable expectations. You may withdraw consent for optional processing by contacting us or using available controls, subject to legal or contractual restrictions and reasonable notice. Withdrawal may limit our ability to provide some Services. We may retain or process information without consent where applicable law permits or requires it, including certain AML/ATF, fraud prevention and legal compliance circumstances.
Marketing messages are sent only where permitted under applicable anti-spam and privacy laws. Commercial electronic messages include required identification and unsubscribe functionality, subject to applicable exceptions.
## 6. Identity Verification and Financial Crime Compliance
We may verify your identity and assess transactions using KYC vendors, sanctions screening and blockchain analytics. We may request additional documents or information about the source or destination of funds. Where required, we may retain records and disclose prescribed information to the Financial Intelligence Unit of the Central Bank of Samoa or other authorities. We may be prohibited from notifying you about certain reports or investigations. Specific retention and reporting rules depend on the transaction and record type.
## 7. Sharing Personal Information
We may share personal information, only as appropriate for the stated purposes, with:
* *Cloud hosting, cybersecurity, analytics, communications and customer support providers;*
* *Identity verification, sanctions screening and blockchain transaction monitoring providers;*
* *Payment processors, banks, liquidity or transaction execution partners and other counterparties necessary to provide requested Services;*
* *Professional advisers, auditors and insurers;*
* *Affiliated or separate service-provider entities where necessary and disclosed, subject to appropriate safeguards;*
* The Financial Intelligence Unit of the Central Bank of Samoa, law enforcement, courts, regulators and other public bodies where legally required or permitted;
* *A purchaser or successor in a proposed or completed business transaction, subject to applicable legal safeguards.*
Service providers are required by contract or other appropriate measures to protect personal information and use it only for authorised purposes. We do not sell personal information for unrelated third-party marketing.
## 8. International Processing and Transfers
Personal information may be stored, accessed or processed in Samoa or other countries where our affiliates, service providers or partners operate. Privacy laws in those countries may differ from those in your country of residence, and information may be accessible to courts, law enforcement or public authorities under applicable local laws.
We remain accountable for personal information transferred to service providers for processing and use contractual, organisational and technical measures appropriate to the sensitivity of the information. Where a jurisdiction imposes additional cross-border transfer notices, assessments, contractual safeguards or consent requirements, we will comply to the extent applicable. We do not represent that Samoan law replaces mandatory laws in every country where users reside.
## 9. Cookies, Analytics and Similar Technologies
Our website and applications may use cookies, software development kits, local storage and similar technologies for authentication, security, preferences, analytics and, where enabled, marketing. Necessary technologies support the operation and protection of the Services. Optional analytics or advertising technologies are subject to appropriate notice, choices and consent where required.
You may manage cookies through available cookie settings, your browser or device controls. Blocking necessary technologies may affect functionality. The Company should publish an accurate cookie inventory identifying actual providers, purposes and retention periods; references in the former policy to Google Analytics, Cloudflare and Amplitude must be verified before naming them publicly.
## 10. Information Security
We use administrative, technical and physical safeguards appropriate to the sensitivity of personal information, which may include access controls, encryption, monitoring, backups, personnel confidentiality obligations and vendor due diligence. No system is completely secure. Please safeguard your credentials and contact us promptly if you suspect unauthorised access.
We assess breaches of security safeguards and, where required by applicable law, report them to the competent authorities and notify affected individuals as soon as feasible when a breach creates a real risk of significant harm. We keep breach records as required by law. Additional notification rules may apply in particular jurisdictions.
## 11. Retention and Deletion
We retain personal information only for as long as necessary for identified purposes or as required or permitted by applicable law. Samoan AML/ATF rules require certain identification and transaction records to be retained for at least five years, but the applicable starting date and period depend on the record category. Other information is retained according to documented retention schedules, business needs, disputes and legal holds.
When retention is no longer required, we securely delete, destroy or anonymise information as appropriate. Closing an account or withdrawing consent does not automatically erase records we must retain for legal or regulatory reasons.
## 12. Access, Correction and Privacy Requests
Subject to applicable exceptions, you may request access to personal information held about you, information about its use and disclosure, and correction of inaccurate or incomplete information. We aim to respond to access requests within 30 days, subject to legally permitted extensions and exceptions. We will explain applicable limitations and available complaint options.
You may also request withdrawal of consent for optional uses, deletion where legally appropriate, or changes to marketing preferences. Other rights, such as portability or objection, may apply under mandatory laws of particular jurisdictions; they are not represented as universal rights.
To exercise your rights, email . We may ask for identity verification and sufficient details to locate the information.
## 13. Complaints and Regulatory Contacts
Please first contact our Privacy Officer at . We will investigate complaints and explain our findings and any appropriate remedial steps. If you are dissatisfied, you may contact the data protection authority in your jurisdiction where its law applies.
## 14. Automated Screening and Decisions
We may use automated tools to assist with fraud detection, identity verification, sanctions screening, blockchain analysis and risk alerts. Depending on our actual processes, these tools may influence whether an account or transaction is reviewed, delayed or restricted. Where applicable law requires additional transparency, human review or a means of contesting a decision, we will provide it. We do not claim that no profiling or automated assessment occurs if risk-scoring tools are in use.
## 15. Local Storage, External Links and Third Parties
The Services may use local storage to remember sessions, authentication state and preferences. You can manage some local storage through device or browser settings. The Services may also link to independent third-party websites or decentralised protocols; those parties may process information under their own privacy policies. We encourage you to review their notices before using their services.
## 16. Children
The Services are not intended for persons under 18, or any higher minimum age required by applicable law. We do not knowingly solicit personal information from minors for account services. If we discover that a minor has provided information contrary to this restriction, we will take appropriate steps consistent with legal retention requirements.
## 17. Changes to This Policy
We may update this Policy to reflect changes to our Services, data practices or applicable law. We will post the revised version and update the effective date. Where a material change requires additional notice or renewed consent, we will provide it before the change takes effect. Continued use alone will not substitute for legally required consent.