Effective Date: 9th July 2026
Hoop Capital Inc., registered at 300-1095 McKenzie Avenue, Victoria, BC V8P 2L5, Canada (“Vault”, “Company”, “we” or “us”), provides blockchain and web3 wallet-related services under the Vault brand.
This Privacy Notice explains how Vault processes personal information in connection with the Vault mobile and desktop applications, Telegram Mini App, websites, support channels, account functionality, wallet-related features, relayer and gas-abstraction functionality, referral program, on/off-ramp access points, blockchain-related features and any other products or services that link to this Privacy Notice (the “Services”).
This Privacy Notice applies to personal information processed by Vault in connection with the Services. It does not apply to information processed independently by public blockchain networks, blockchain explorers, RPC providers, on/off-ramp providers, payment providers, identity verification providers, analytics providers, application stores, Telegram, decentralized applications or other third-party platforms. Use of the Services is also subject to the Vault Terms of Use and any additional terms or notices applicable to specific features or jurisdictions.
Vault is a non-custodial wallet service. Vault does not collect, store or control private keys, seed phrases, mnemonic phrases or wallet recovery credentials, does not custody digital assets, and does not control or reverse transactions recorded on public blockchains.
Vault does not sell personal information. Vault also does not share personal information for cross-context behavioural advertising as that term is used under applicable California privacy laws, unless this Privacy Notice is updated and any legally required opt-out mechanism is provided.
Vault processes personal information only where it is reasonably necessary to provide, secure, support, maintain and improve the Services; to operate wallet-related, relayer, referral, analytics and third-party integration features; to prevent abuse and fraud; and to comply with applicable legal, accounting, tax, sanctions, security and regulatory obligations.
“Personal Information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or may reasonably be linked with an identified or identifiable natural person. “Wallet Address” means a public blockchain address created, imported, connected or used through the Services. “Blockchain Data” means information recorded on or obtained from a public blockchain, including wallet addresses, transaction hashes, balances, transfers, smart-contract interactions, timestamps, network fees and related on-chain activity.
Vault determines the purposes and means of processing personal information in connection with the Services, unless a different role is expressly described in this Privacy Notice, a separate notice or applicable third-party documentation. If the Services are used on behalf of an organization, that organization may have rights, controls or responsibilities in relation to the relevant account or use of the Services under the applicable agreement and law.
Third-party services are not controlled by Vault. When a user accesses a blockchain network, decentralized application, Telegram, an application store, an on/off-ramp provider, a payment provider, an identity verification provider or another external platform through or in connection with the Services, that third party processes information under its own privacy notice, terms and legal obligations.
Vault processes account and contact information, such as email address, account identifiers, login-related information, confirmation records, service communications and support identifiers. Vault also processes wallet and blockchain-related information, such as Wallet Addresses, wallet-account mappings, transaction hashes, transaction status, network identifiers, nonce, timestamps, signature metadata, token-related information and other transaction metadata. A Wallet Address may be personal information where it is linked, or reasonably capable of being linked, to an account, email address, device, IP address, support request, referral activity or other identifier.
Vault processes technical and usage information needed for the operation and protection of the Services. This may include IP address, approximate location derived from IP address, device type, operating system, application version, browser type, language, time zone, session identifiers, crash logs, diagnostics, error codes, request logs, security events and basic usage events.
When specific features are used, Vault processes the information required for those features. This may include Telegram user data made available through Telegram for the Telegram Mini App; address book entries, payee labels, payout templates, notes or similar optional saved data; referral codes, reward records and fraud-prevention signals for referral or bonus features; support communications, attachments, screenshots and issue details; and transaction requests, relayer metadata, request frequency, IP address at request time and anti-abuse signals for relayed, sponsored or gas-abstracted transactions.
Vault may use mobile attribution, analytics, diagnostics and similar technologies to measure application installs, attribution source, campaign performance, application stability and basic engagement events. Such data may include install source, application version, device information and limited event data. Vault does not use this information for cross-app behavioural advertising.
Where the Services provide access to on/off-ramp, payment, identity verification, compliance, blockchain infrastructure, DEX, bridge or similar third-party integrations, Vault may process limited technical, routing, referral, transaction or integration information needed to enable or support such access. KYC, AML, payment, banking, card or identity-verification information may be collected directly by the relevant third-party provider under its own privacy notice and terms, unless expressly stated otherwise.
Certain information is required to provide the Services, including account identifiers, wallet-related information, technical and security information, and relayer-related information where the relevant feature is used. Optional saved information, support content and participation in referral or reward features are voluntary, except where needed to provide the requested feature. If required information is not provided, Vault may be unable to create or maintain an account, provide wallet functionality, support related transactions, respond to support requests, maintain security or comply with legal obligations.
Users should not submit private keys, seed phrases, mnemonic phrases, wallet recovery credentials or unnecessary identity documents through support channels. Vault may delete or restrict processing of unnecessary sensitive information submitted to support.
Vault receives personal information from users directly, from use of the Services, from devices, applications, browsers and technical systems, from Telegram when the Telegram Mini App is used, from public blockchain networks and blockchain infrastructure, from relayer, attribution, analytics, support, hosting, security and infrastructure providers, and from on/off-ramp, payment, identity verification, compliance or other third-party services where applicable.
Vault uses personal information to provide, operate, maintain and secure the Services; create, authenticate and manage accounts; enable wallet functionality; display balances and transactions; link account identifiers with Wallet Addresses for account, support, security and abuse-prevention purposes; facilitate relayed, sponsored or gas-abstracted transactions; operate referral, reward or bonus features; provide support; diagnose issues; monitor performance; prevent fraud, spam, unauthorized access, relayer abuse, technical misuse and other harmful activity; enforce the Terms of Use; comply with applicable laws, sanctions, court orders and regulatory requests; maintain business, accounting, tax, security and compliance records; establish, exercise or defend legal claims; measure attribution and campaign performance; and send service, security, operational or legal notices.
Where GDPR, UK GDPR or similar laws apply, Vault relies on the following legal bases: performance of a contract where processing is needed to provide the Services; legitimate interests in security, fraud prevention, diagnostics, service improvement, abuse prevention, relayer protection, legal rights and business operations; consent where required for optional analytics, cookies, direct marketing or similar processing; legal obligation where processing is needed to comply with law; and the establishment, exercise or defence of legal claims where applicable.
Where Canadian, Hong Kong or similar privacy laws apply, Vault processes personal information for identified, reasonable and appropriate purposes, on the basis of notice, consent or another lawful basis available under applicable law.
Public blockchains are transparent by design. Wallet Addresses, transaction hashes, token balances, transfers, smart-contract interactions, timestamps, network fees and other on-chain activity may be publicly visible, copied, indexed, analyzed and retained by blockchain networks, explorers, analytics providers and other third parties. Vault does not control these public records.
Deleting an account or personal information controlled by Vault does not delete or alter Blockchain Data recorded on a public blockchain. Vault cannot restore wallet access, recover private keys or seed phrases, reverse blockchain transactions, or delete, modify or anonymize records maintained by public blockchain networks.
Vault websites may use strictly necessary cookies and similar technologies for security, session management, load balancing, fraud prevention and basic functionality. Mobile applications may use software development kits and similar technologies for attribution, analytics, diagnostics, stability, security and basic engagement measurement. Where required by applicable law, Vault provides notice and obtains consent for non-essential technologies through the applicable website or in-app consent mechanism.
Browser or device settings may allow cookies, identifiers or similar technologies to be blocked or limited. Some Services may not function properly if strictly necessary technologies are disabled. Vault does not use personal information for direct marketing without prior consent where such consent is required by law. Service, security, legal and transactional communications are not treated as marketing communications.
Vault may share personal information where reasonably necessary for the purposes described in this Privacy Notice. Recipients may include affiliated entities; hosting, cloud, database, infrastructure and security providers; blockchain infrastructure, RPC, explorer, relayer and energy providers; attribution, analytics and diagnostics providers; support, communication and ticketing providers; fraud-prevention, monitoring and incident-response providers; on/off-ramp, payment, identity verification, compliance, DEX, bridge and other integration providers; professional advisers, auditors, insurers, legal counsel and accounting providers; regulators, courts, law-enforcement authorities or public authorities; and third parties involved in a merger, acquisition, financing, restructuring, sale of assets, reorganization, bankruptcy or similar corporate transaction.
Service providers may access or process personal information only to the extent necessary to provide services to Vault and must implement appropriate confidentiality, security and data-protection measures. Vault may maintain a separate Service Provider and Subprocessor Register identifying material providers used in connection with the Services. That register may be updated without amending this Privacy Notice, unless the update materially changes the categories of personal information processed, the purposes of processing, the categories of recipients, or user rights and choices.
Vault may use automated or semi-automated technical signals to detect fraud, spam, unauthorized access, relayer abuse, suspicious activity, sanctions or compliance risks, technical misuse and other harmful activity. This may result in limitation, rejection, suspension or additional review of certain requests, transactions or access attempts where necessary to protect the Services, users, Vault or third parties. Vault does not use automated processing to make decisions producing legal or similarly significant effects on users, except where permitted by applicable law and subject to any required safeguards.
Personal information may be stored and processed in Canada, Hong Kong, the United States, the European Economic Area, the United Kingdom, Singapore, the United Arab Emirates and other jurisdictions where Vault or its service providers operate. Laws in those jurisdictions may differ from the laws of the user’s location.
Where required by applicable law, Vault uses appropriate safeguards for international transfers, which may include data-processing agreements, contractual safeguards, Standard Contractual Clauses, transfer assessments, encryption, access controls, vendor due diligence and other technical or organizational measures. Information about applicable transfer safeguards may be requested by contacting Vault at privacy@stablevault.app.
Vault retains personal information only for as long as reasonably necessary for the purposes described in this Privacy Notice, unless a longer period is required or permitted by law. Retention depends on the nature of the information, the feature used and the relevant legal, security, accounting, tax, compliance, fraud-prevention, backup, dispute-resolution and operational requirements.
Account information and wallet-account mappings are generally retained for the duration of the account and for a reasonable period thereafter where needed for security, legal, accounting, compliance or dispute-resolution purposes. IP addresses, request logs and security logs are generally retained for 30 to 90 days, unless longer retention is required for security incidents, fraud prevention, abuse investigation, legal claims or regulatory requests. Support, relayer, referral, reward, attribution, analytics and backup records are retained for periods appropriate to their purposes and applicable legal requirements. Public Blockchain Data is retained on public blockchain networks and is not controlled by Vault.
Upon account deletion or a valid deletion request, Vault will delete or anonymize personal information controlled by Vault, subject to legal, security, fraud-prevention, accounting, backup, dispute-resolution and compliance limitations.
Vault implements administrative, technical and organizational measures designed to protect personal information against unauthorized access, loss, misuse, alteration and disclosure. These measures may include encryption in transit, encryption at rest where applicable, access controls, least-privilege permissions, audit logging, monitoring, rate-limiting, abuse detection, segregation of secrets and vendor security review.
No method of transmission or storage is completely secure. Users are responsible for securing their devices, passwords, wallet credentials, private keys, seed phrases, backups and access methods. Vault does not recover private keys, seed phrases, mnemonic phrases or wallet recovery credentials.
Depending on location and applicable law, users may have rights to request access to personal information, correction of inaccurate or incomplete information, deletion of information controlled by Vault, restriction of or objection to certain processing, withdrawal of consent, data portability, opt-out of direct marketing, opt-out of sale or sharing where applicable, and complaint to a competent privacy or data protection authority.
Requests may be sent to privacy@stablevault.app. Vault may verify identity before responding and may refuse, limit or charge a reasonable fee for requests where permitted by law, including where a request is manifestly unfounded, excessive, repetitive, legally restricted or affects the rights and freedoms of others. Rights requests do not apply to public blockchain records not controlled by Vault.
The Services are not directed to persons under 18 years of age. Vault does not knowingly collect personal information from persons under 18. If Vault becomes aware that such information has been collected, Vault may delete it and restrict access to the Services, subject to applicable law.
In connection with a merger, acquisition, financing, restructuring, reorganization, sale of assets, bankruptcy or similar corporate transaction, personal information may be disclosed or transferred to relevant third parties, subject to applicable law and appropriate confidentiality or data-protection safeguards.
Vault may update this Privacy Notice from time to time. The updated version will be posted with a new date of last revision or effective date. Where required by law or where changes are material, Vault may provide additional notice by email, in-app notice, website notice or other appropriate means.
This Privacy Notice is designed to address applicable privacy and data protection laws, including, where applicable, the EU General Data Protection Regulation, the UK General Data Protection Regulation, Swiss data protection law, Canadian privacy laws, the British Columbia Personal Information Protection Act, the Hong Kong Personal Data (Privacy) Ordinance, the California Consumer Privacy Act and other applicable privacy or data protection laws.
If GDPR, UK GDPR or similar laws apply, users may have rights of access, rectification, erasure, restriction, objection, portability, withdrawal of consent and complaint to a supervisory authority. Where Vault is required to appoint a representative in the European Economic Area or the United Kingdom, the relevant contact details will be made available in this Privacy Notice or through a separate notice.
If Canadian privacy laws apply, Vault collects, uses and discloses personal information only for purposes that a reasonable person would consider appropriate in the circumstances, subject to applicable notice, consent, access, correction, safeguard, retention and complaint-handling requirements. If the Hong Kong Personal Data (Privacy) Ordinance applies, personal data is processed in accordance with the applicable Data Protection Principles, including purpose specification, collection limitation, accuracy, retention limitation, use limitation, security, transparency, and access and correction rights. Vault will not use personal data for direct marketing without providing any required notice and obtaining consent where required by law.
If the California Consumer Privacy Act or other United States state privacy laws apply, eligible users may have rights to know, access, correct, delete and obtain a copy of personal information, to opt out of sale or sharing where applicable, and not to be discriminated against for exercising privacy rights. Authorized agents may submit requests where permitted by law, subject to verification of authority and identity. Nothing in this Privacy Notice limits any mandatory rights or protections available under applicable privacy or data protection laws.
Privacy-related questions, requests and complaints may be addressed to:
Hoop Capital Inc.
Attn: Privacy Officer
300-1095 McKenzie Avenue
Victoria, BC V8P 2L5
Canada
Email: privacy@stablevault.app
Vault will acknowledge and respond to privacy requests and complaints within the timeframe required by applicable law, including, for GDPR/UK GDPR requests, without undue delay and in any event within one month, subject to permitted extensions.
