Privacy Policy (EEA)
1. This Privacy Policy explains how 365cash OÜ (“we”), as data controller, processes personal data in connection with the kytme.com Services.
Data we process
Identity and verification data (name, documents and verification results) — collected via our KYC/KYB provider iDenfy;
Contact and account data (email, company details, credentials);
Service data — wallet/blockchain addresses you submit and the screening results linked to your account;
Usage, billing and technical/log data (including IP address and cookies).
Purposes and legal bases
providing the Services and managing your account — performance of a contract;
identity verification, AML and sanctions screening, record-keeping — compliance with legal obligations and legitimate interests;
security, fraud prevention and service improvement — legitimate interests;
billing and tax — legal obligation.
Special category data
Biometric data used during identity verification is processed within iDenfy’s environment and is not stored on our platform.
Recipients and processors
We share personal data with service providers acting on our behalf, including:
Hetzner (EU) — hosting/infrastructure (data hosted in the EU);
iDenfy (Lithuania, EU) — identity verification;
Crystal Intelligence / BitOK / VALEGA Chain Analytics — upstream AML screening providers;
Google Ireland Limited — website analytics (Google Analytics 4), only if you consent to analytics cookies.
AI assistant connectors (MCP)
You may connect your Kytme account to a third-party AI assistant (such as Claude, ChatGPT, Grok or Gemini) through our MCP connector. When you do, we process the technical data of that connection (the assistant’s client identifier, the permissions you grant on the consent screen, and access tokens) and the requests you make through the assistant, in the same way as requests made in the dashboard.
The assistant is operated by its own provider under that provider’s terms and privacy policy: the results you request through it (risk scores, check summaries, balance figures) become part of your conversation with the assistant and are processed by that provider, not by us. We never share your credentials with the assistant, and notification recipients cannot be set through the connector.
You can revoke a connected assistant at any time on the connected apps page of your account; changing your password also revokes all connections.
International transfers
Your data is hosted in the EU/EEA. We do not transfer personal data to a country outside the EU/EEA except under appropriate safeguards (such as the EU Standard Contractual Clauses); a copy of the safeguards is available on request. Where you consent to analytics cookies, data collected by Google Analytics 4 may be processed by Google outside the EEA under such safeguards; you can prevent this by rejecting analytics cookies.
Retention
We retain personal data only as long as necessary for the purposes above and to meet legal/record-keeping obligations, after which it is deleted or anonymised.
Where you exercise your right to erasure, we retain a pseudonymised cryptographic hash of your email address, which cannot be reversed to reveal the address. We use it to prevent fraud and abuse (for example, repeated sign-up bonuses or evasion of account restrictions) and to continue honouring email suppression requests. The legal basis for this processing is our legitimate interests.
Your rights
Subject to applicable law, you may request access, rectification, erasure, restriction, portability, and object to processing. You may withdraw consent where processing is based on consent. To exercise your rights, contact us at [email protected].
You have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, AKI) or your local supervisory authority.
Cookies
We use cookies as described in our Cookie Policy at /legal/cookies. Strictly necessary cookies keep the Services working. Analytics cookies (Google Analytics 4: _ga, _ga_<container>, stored for up to 24 months) are set only after you accept them in the cookie banner; if you reject or ignore the banner, they are not set. Consent is the legal basis for analytics cookies and can be withdrawn at any time by clearing site data for kytme.com.
We do not send wallet addresses, transaction hashes or report identifiers to the analytics provider, and pages containing such identifiers are excluded from analytics. Analytics data is not used for advertising, remarketing or ad personalisation.
Contact
365cash OÜ (registry code 14397478) · Punane tn 56, Lasnamäe linnaosa, 13619 Tallinn, Harju maakond, Estonia · [email protected]