CHATTERPAY PRIVACY POLICY

Version 2.0 | Effective: 10th August 2026

ChatterPay, a Cayman Islands exempted company (Registration No. CR-426282), registered office at 68 Fort Street, George Town, PO Box 31726, Grand Cayman KY1-1207, Cayman Islands, is the data controller for the processing described here.

This Policy forms part of the ChatterPay Terms of Service. Capitalised terms not defined here have the meaning given in the Terms.

AT A GLANCE

We identify you by your phone number, not by your identity documents.
We do not ask you for identity documents to use the non-custodial Service.
We read the messages you send our bot, because that is how the Service works.
Blockchain data is public and permanent. We cannot delete it, and neither can anyone else.
We do not sell your personal data.

1. WHAT WE COLLECT

1.1 Information you give us

Your Registered Number and your WhatsApp profile name.
The content of messages, commands, and files you send our bot, including transaction instructions and free-text messages.
Preferences you set, such as language, display currency, and security settings.
Support requests and any information you include in them.
Any information you volunteer in surveys, waitlists, or beta programmes.

1.2 Information generated by your use of the Service

Your smart account address and, where applicable, associated addresses.
Transaction records: amounts, assets, counterparty addresses, networks, timestamps, fees, and status.
Session and technical data: timestamps, coarse locale and language, message identifiers, error and diagnostic logs, and rate-limiting signals.
Security signals: authentication events, failed PIN attempts, and fraud or abuse indicators.

1.3 Information from third parties

Meta / WhatsApp Business Platform: message delivery metadata, your phone number, and your WhatsApp profile name.
Public blockchains: balances, transaction history, and token holdings associated with your address. This data is public and we do not create it.
Blockchain analytics and sanctions screening providers: risk scores and list matches associated with addresses.
Website analytics: aggregate usage data from chatterpay.net, subject to your cookie choices.

1.4 What we do not collect

We do not require or request government identity documents, selfies, proof of address, or bank details in order to use the non-custodial Service. We do not knowingly collect special categories of personal data (health, biometrics, political or religious views, sexual orientation), and you should not send them to our bot.

If we introduce a fiat on-ramp or off-ramp, the third-party provider of that feature will require identity verification. See Section 6.

2. WHY WE PROCESS IT, AND ON WHAT BASIS

| Purpose | Data used | Legal basis | |---|---|---| | Create your account, interpret your instructions, build and relay transactions | 1.1, 1.2 | Performance of a contract | | Display balances, prices, and history | 1.2, 1.3 | Performance of a contract | | Sponsor gas and route to third-party protocols | 1.2 | Performance of a contract | | Provide support and resolve disputes | 1.1, 1.2 | Performance of a contract; legitimate interests | | Detect and prevent fraud, abuse, and security incidents | 1.2, 1.3 | Legitimate interests; legal obligation | | Sanctions screening and compliance | 1.2, 1.3 | Legal obligation; legitimate interests | | Improve, debug, and measure the Service | 1.2, 1.3 | Legitimate interests | | Send operational and transactional messages | 1.1 | Performance of a contract | | Send marketing messages | 1.1 | Consent | | Analytics cookies on our website | 1.3 | Consent | | Comply with law, court orders, and regulatory requests | Any | Legal obligation |

Where we rely on legitimate interests, we have assessed that our interest in operating a secure and functional service does not override your rights.

3. AUTOMATED PROCESSING AND AI

3.1 The Service uses automated systems, including third-party language models, to interpret your messages and generate responses. Message content may be sent to those providers for that purpose. We instruct our providers not to use your content to train their models, and we contractually restrict their use of it to providing the service to us.

3.2 We use automated screening to flag transactions and addresses for fraud and sanctions risk. A flag may result in a transaction being declined or an account being restricted under Section 12 of the Terms. You may contest an automated decision by contacting us at privacy@chatterpay.com.ar, and a human will review it.

3.3 We do not use your data for automated credit scoring, profiling for advertising, or any decision producing legal effects other than as described in 3.2.

4. WHO WE SHARE IT WITH

We do not sell personal data and we do not share it for cross-context behavioural advertising. We share it with:

Infrastructure providers: cloud hosting, databases, RPC nodes, bundlers, paymasters, logging, and error monitoring.
Meta Platforms: necessarily, because the Service runs on WhatsApp. Meta processes your data under its own terms and policies, which we do not control.
AI and language model providers: as described in Section 3.1.
Compliance providers: blockchain analytics and sanctions screening.
Third-Party Protocols: when you instruct a swap, bridge, or prediction-market transaction, the necessary transaction data is transmitted to the relevant protocol or aggregator. That data becomes public on-chain.
Fiat providers: only if you choose to use a fiat feature, and only after you are told who the provider is. See Section 6.
Professional advisers: lawyers, auditors, and accountants under duties of confidentiality.
Authorities: law enforcement, regulators, tax authorities, and courts, where we are legally required to disclose or where disclosure is necessary to prevent or investigate crime or to protect our rights or those of others.
Acquirers: in connection with a merger, financing, reorganisation, or sale of assets, subject to equivalent protection.

5. BLOCKCHAIN DATA

5.1 Transactions you instruct are published to public blockchains. They are permanent, worldwide, and readable by anyone.

5.2 We cannot amend, delete, or restrict on-chain data. No right of erasure, rectification, or restriction can be exercised against a public blockchain, by us or by anyone else.

5.3 Blockchain addresses are pseudonymous, not anonymous. Third parties may be able to link your address to your identity using their own data. Assume that anything you transact is public.

6. FIAT SERVICES AND KYC

If we integrate a fiat on-ramp, off-ramp, card, or bank-transfer provider:

Using it will be optional.
We will name the provider before you begin onboarding.
That provider will collect and process your identity data directly, as an independent controller, under its own privacy policy, and will apply its own KYC, source-of-funds, sanctions screening, and monitoring requirements.
We may receive from the provider only the status of your onboarding and the minimum data needed to display and reconcile the transaction.

7. INTERNATIONAL TRANSFERS

We are established in the Cayman Islands and our providers operate in multiple countries, including the United States and the European Union. Where personal data is transferred out of a jurisdiction that restricts transfers, we rely on an applicable adequacy decision, on standard contractual clauses, or on another lawful transfer mechanism. You can request details of the mechanism used by writing to privacy@chatterpay.com.ar.

8. RETENTION

| Category | Retention | |---|---| | Account record and Registered Number | While your account is active, then up to 24 months | | Message content with the bot | Up to 12 months, then deleted or aggregated | | Transaction and security logs | Up to 5 years, for fraud, dispute, and legal-defence purposes | | Support correspondence | Up to 3 years | | Compliance and sanctions-screening records | As required by applicable law, typically 5 years | | On-chain data | Permanent and outside our control |

We may retain data longer where required by law, by a regulator, or to establish, exercise, or defend legal claims.

9. SECURITY

9.1 We apply technical and organisational measures including encryption in transit, encryption at rest for stored data, access controls on a need-to-know basis, logging, and regular review of our dependencies.

9.2 The Service offers security features you should enable, including a PIN configured through WhatsApp Flows, which is entered outside the chat thread and is not stored in your message history.

9.3 No system is perfectly secure. Access to your account depends on control of your Registered Number and WhatsApp account, which are outside our control. See Section 5 of the Terms for the risks you accept.

9.4 If a personal data breach is likely to result in significant risk to you, we will notify you and the relevant authority as required by applicable law.

10. YOUR RIGHTS

Subject to the limits in Section 5, you may:

Access the personal data we hold about you and receive a copy.
Rectify inaccurate or incomplete data.
Erase data where we no longer have a lawful basis to keep it.
Restrict or object to processing based on legitimate interests.
Port data you provided to us, in a machine-readable format.
Withdraw consent at any time, without affecting processing already carried out.
Not be subject to a solely automated decision with legal or similarly significant effect, as described in Section 3.2.
Complain to a supervisory authority.

To exercise any right, write to privacy@chatterpay.com.ar. We will respond within thirty (30) days, or the shorter period required by your local law, and may ask you to confirm control of your Registered Number before acting.

Supervisory authorities. Cayman Islands: the Office of the Ombudsman. EEA and UK: your national data protection authority. Argentina: the Agencia de Acceso a la Información Pública. Brazil: the Autoridade Nacional de Proteção de Dados.

Applicable regimes. We process personal data under the Data Protection Act (2021 Revision) of the Cayman Islands. Where the GDPR, the UK GDPR, Argentina's Ley 25.326, or Brazil's LGPD apply to our processing of your data, we comply with them and you hold the rights they confer.

11. CHILDREN

The Service is not directed at persons under 18. We do not knowingly process the personal data of a child. If you believe a child has used the Service, write to privacy@chatterpay.com.ar and we will delete the data we can delete, noting that we cannot delete on-chain records.

12. COOKIES

chatterpay.net uses strictly necessary cookies to operate, and analytics cookies only with your consent. You can change or withdraw your choice at any time through the cookie banner or your browser settings. We do not use advertising cookies.

13. CHANGES TO THIS POLICY

We may update this Policy. We will publish the new version with a version number and effective date and, for material changes, give notice through the Service or on WhatsApp before it takes effect.

14. CONTACT

ChatterPay 68 Fort Street, George Town, PO Box 31726 Grand Cayman KY1-1207, Cayman Islands Registration No. CR-426282

Privacy matters: privacy@chatterpay.com.ar General: contacto@chatterpay.com.ar

Version 2.0. Effective 10th August 2026.