Privacy Policy (EEA)
1. This Privacy Policy explains how 365cash OÜ (“we”), as data controller, processes personal data in connection with the kytme.com Services.
Data we process
Identity and verification data (name, documents and verification results) — collected via our KYC/KYB provider iDenfy;
Contact and account data (email, company details, credentials);
Service data — wallet/blockchain addresses you submit and the screening results linked to your account;
Telegram data - if you use our Telegram bot: your Telegram user ID, username and the messages you send to the bot (the bot creates a temporary account for you until you register);
Marketing attribution data - where you came from before signing up (UTM tags, Google Ads click ID, referring website and landing page), saved to your account at registration;
Usage, billing and technical/log data (including IP address and cookies).
Purposes and legal bases
providing the Services and managing your account — performance of a contract;
identity verification, AML and sanctions screening, record-keeping — compliance with legal obligations and legitimate interests;
security, fraud prevention and service improvement — legitimate interests;
service emails (account, security and billing notices) - performance of a contract; marketing emails - your consent, which you can withdraw at any time via the unsubscribe link;
measuring which channels and advertising campaigns bring sign-ups - your consent to cookies, or our legitimate interests where the source is passed in the sign-up link during the same visit;
billing and tax — legal obligation.
Special category data
Biometric data used during identity verification is processed within iDenfy’s environment and is not stored on our platform.
Recipients and processors
We share personal data with service providers acting on our behalf, including:
Hetzner (EU) — hosting/infrastructure (data hosted in the EU);
iDenfy (Lithuania, EU) — identity verification;
Crystal Intelligence / BitOK / VALEGA Chain Analytics — upstream AML screening providers;
Postmark (ActiveCampaign, LLC, USA) - delivery of service and marketing emails;
Telegram (Telegram Messenger Inc.) - operation of our Telegram bot;
Anthropic, PBC (USA) - the AI model that writes replies in our Telegram bot; it receives the messages you send to the bot;
Cloudflare, Inc. (USA) - website security and content delivery (IP address and technical request data);
Functional Software, Inc. (Sentry, data stored in the EU) - error monitoring;
Google Ireland Limited — website analytics (Google Analytics 4), only if you consent to analytics cookies.
AI assistant connectors (MCP)
You may connect your KYTme account to a third-party AI assistant (such as Claude, ChatGPT, Grok or Gemini) through our MCP connector. When you do, we process the technical data of that connection (the assistant’s client identifier, the permissions you grant on the consent screen, and access tokens) and the requests you make through the assistant, in the same way as requests made in the dashboard.
The assistant is operated by its own provider under that provider’s terms and privacy policy: the results you request through it (risk scores, check summaries, balance figures) become part of your conversation with the assistant and are processed by that provider, not by us. We never share your credentials with the assistant, and notification recipients cannot be set through the connector.
You can revoke a connected assistant at any time on the connected apps page of your account; changing your password also revokes all connections.
International transfers
Your data is hosted in the EU/EEA. Some of our service providers are established outside the EU/EEA (Postmark, Anthropic and Cloudflare in the USA, and Telegram). Where their processing involves a transfer of personal data, it takes place only under appropriate safeguards: an adequacy decision (such as the EU-US Data Privacy Framework for certified recipients) or the EU Standard Contractual Clauses; a copy of the safeguards is available on request. Where you consent to analytics cookies, data collected by Google Analytics 4 may be processed by Google outside the EEA under such safeguards; you can prevent this by rejecting analytics cookies.
Automated decision-making
Risk scores are produced automatically by our AML providers and describe crypto addresses and transactions, not you. We do not make decisions that produce legal or similarly significant effects on you based solely on automated processing. If you disagree with a decision about your account, you can contact us and ask for it to be reviewed by a person.
Retention
We retain personal data only as long as necessary for the purposes above and to meet legal/record-keeping obligations, after which it is deleted or anonymised.
Where you exercise your right to erasure, we retain a pseudonymised cryptographic hash of your email address, which cannot be reversed to reveal the address. We use it to prevent fraud and abuse (for example, repeated sign-up bonuses or evasion of account restrictions) and to continue honouring email suppression requests. The legal basis for this processing is our legitimate interests.
Your rights
Subject to applicable law, you may request access, rectification, erasure, restriction, portability, and object to processing. You may withdraw consent where processing is based on consent. To exercise your rights, contact us at [email protected].
You have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, AKI) or your local supervisory authority.
Cookies
We use cookies as described in our Cookie Policy at /legal/cookies. Strictly necessary cookies keep the Services working. Analytics cookies (Google Analytics 4: _ga, _ga_<container>, stored for up to 24 months) are set only after you accept them in the cookie banner; if you reject or ignore the banner, they are not set. The same applies to our first-party attribution cookie gb_attr (up to 90 days), which records where you came from before signing up. Consent is the legal basis for these cookies and can be withdrawn at any time by clearing site data for kytme.com.
We do not send wallet addresses, transaction hashes or report identifiers to the analytics provider, and pages containing such identifiers are excluded from analytics. Analytics data is used to measure the results of our advertising campaigns, but not for remarketing or ad personalisation.
Contact
365cash OÜ (registry code 14397478) · Punane tn 56, Lasnamäe linnaosa, 13619 Tallinn, Harju maakond, Estonia · [email protected]