Privacy Policy

1. Controller

The controller for personal data described in this policy is KYTGate (Nordera Works Teknoloji ve Danışmanlık A.Ş., registered at Esentepe Mahallesi, Büyükdere Caddesi, Metrocity No: 171 A, İç Kapı No: 172, Şişli, İstanbul, Türkiye (tax office Zincirlikuyu, tax no. 6312129403)). Contact: hello@kytgate.com. For data our customers submit through the API (section 5), the customer is the controller and we act as processor on its documented instructions.

2. What we deliberately do not collect

The public website sets no cookies, stores nothing on your device, runs no third-party analytics or advertising trackers, embeds no social-media pixels, and uses no browser fingerprinting. There is no account signup on the website. The only cookie we set anywhere is one strictly necessary, httpOnly session cookie for customer staff who log in to the console; it holds a session identifier and nothing else. We believe a compliance company should be able to say this plainly, so: if you only read our pages, we process no personal data about you beyond the standard server logs kept by our hosting provider for security and operations.

Anonymous visit counts. Each page you open sends us the page address, the site you came from (its host name only) and, if the link carried one, its campaign tag (utm_source). A click on a button sends the page and the button's destination. We add these to daily totals per page, per source and per button and keep nothing else: no IP address, no identifier and nothing that links one count to another or to you. To stop the totals being inflated, a short-lived counter keyed to a keyed hash of your IP address limits how many hits one network can add in a day; it is deleted after 7 days. The daily totals are kept for 400 days. Legal basis: our legitimate interest in knowing which pages are useful (GDPR art. 6(1)(f)).

3. Free tool queries

When you use the free wallet sanctions check, wallet profile or funds trace, the address or transaction you enter is processed to produce the result. We keep no permanent record of which addresses were queried and nothing links a query to you. One qualification, because it would otherwise be a half-truth: the answer about a public address may be held briefly in a cache of public blockchain data so that asking the same public question twice does not send a stranger's server two requests. That cache is keyed by chain and address and holds at most a wallet profile for 15 minutes and a public explorer label for 7 days, and nothing else: no IP, no identifier of yours, no link between an address and the person who asked about it. It is shared across everyone who uses the service and expires on its own schedule. Producing a result sends that identifier (and nothing about you) to the public read endpoints listed in clause 7 of the DPA, and to nothing else. To enforce fair rate limits, we store a short-lived counter keyed to a pseudonymised form of your IP address (a keyed HMAC-SHA-256 hash under a secret held only on our servers); the IP itself is not stored, the value cannot be turned back into an address without that secret, and the counter is purged after 7 days. Legal basis: our legitimate interest in operating and protecting a free service (GDPR art. 6(1)(f)).

Wallet watch. If you ask us to watch an address, we store that address, your e-mail address and the last observed status so that we can re-check it daily against sanctions lists (which we re-sync at least every 6 hours) and issuer contracts, and e-mail you when its status changes. Nothing is sent until you click the confirmation link (double opt-in); every e-mail carries a one-click stop link, after which we cease checking immediately and delete the record after 30 days. We never use the address for marketing or share it. Legal basis: your consent (GDPR art. 6(1)(a)), withdrawable at any time.

4. API sandbox

What we collect. To issue a sandbox tenant we ask for your work e-mail address and your company name, and optionally your name, role, approximate monthly crypto deposits and a phone number, with a box to tick if you want us to call you. We also record the page you sent the form from and the host name of the site that sent you there, so we know which pages lead to requests. We record the request together with a keyed, irreversible hash of your IP address (used only to enforce a limit of three requests per network address per day) and send a one-time claim link to your e-mail. The link is valid for 24 hours and can be used once; one sandbox is issued per e-mail address in any 30-day period. If you give a company name it becomes part of the sandbox tenant's name so you can recognise it in the API.

Purpose and legal basis. Sending you the link and the key, preventing abuse of a free service and, if you ask for production access later, reaching you about it. A copy of each request (the details you entered, without any IP information) is delivered to KYTGate's own inbox so we know who is evaluating the product. Legal basis: taking steps at your request before entering a contract (GDPR art. 6(1)(b)) and our legitimate interest in protecting the service (art. 6(1)(f)). We do not add sandbox users to any marketing list. We may send up to three kinds of service notice about the sandbox itself: how to make a first call if a key has not been used a day after it was issued, and when this month's screenings reach 80% and then the limit. Each carries a one-click link that stops them.

Retention. Unclaimed links expire after 24 hours. Everything a sandbox tenant stores (screenings, wallets, cases, receipts) is deleted after 7 days. The request record and the tenant's own contact e-mail are kept for the 30-day one-sandbox-per-e-mail window and for as long as our business correspondence with you is relevant (section 6).

5. Customer screening data (we act as processor)

Customers submit wallet addresses, transaction identifiers and related funding metadata to the API. Blockchain identifiers can constitute personal data where they relate to an identifiable person; for this data the customer is the controller, since it determines why an address is screened, and KYTGate processes it solely to deliver the screening, decisioning and record-keeping the customer configured. Processor-supplied screening results are held strictly per-tenant and are never shared across customers, aggregated into common intelligence, or sold. A data processing addendum reflecting GDPR art. 28 is available at /dpa.

Information requests (GateRemediate). When a customer's compliance team asks one of its clients for information from a case, KYTGate stores the client's answers (for example source-of-funds explanations and a wallet ownership signature) and any documents the client uploads (up to three files of at most 2 MB each, stored base64-encoded). If the customer chooses to have KYTGate send the request rather than delivering the link itself, the client's e-mail address is used for that one message, sent through our e-mail provider, and is not stored. This data belongs to the case and is deleted with it under the customer's retention setting; the customer remains the controller.

Console access. Console logins are tenant-scoped: a customer's admin and reviewer accounts see and act on that customer's tenant only. KYTGate staff accounts are global and are used solely on a customer's documented instruction. Every console action is written to an append-only audit log together with the acting user, the network it came from and a keyed hash of the IP address; the address itself is not stored.

Screening records, case events and decision receipts are retained append-only for the retention period configured per tenant (default seven years, reflecting typical financial-sector record-keeping obligations), then deleted unless law requires otherwise.

6. Contact and business correspondence

If you email us, we process your name, email address and message content to respond and to maintain our business relationship (art. 6(1)(b) and (f)). We keep correspondence as long as relevant to the relationship and applicable limitation periods. The contact, order and sandbox forms on this site are delivered to our inbox by e-mail and are also recorded in our own system (what you entered, the page you sent it from and the host name of the site that sent you there) so that our team can follow up and keep track of who has been answered. You receive one automatic confirmation that we received your message. These records are deleted 24 months after they were last updated, or earlier on request to hello@kytgate.com.

7. Subprocessors and recipients

We use a small number of infrastructure providers to run the Service, each under data processing terms: Vercel Inc. (application hosting and server logs, USA / EEA); Neon Inc. (managed postgres database, USA (AWS us-east-1)); Resend Inc. (transactional e-mail, USA); Functional Software, Inc. (Sentry) (error reporting, EEA (Germany)).

Blockchain reads go to TRON DAO (TronGrid) (tron network reads, Public network endpoint); Blockscout public explorer API instances (wallet profile and funds trace reads on evm networks, Public endpoints (eth, base, arbitrum, polygon, optimism.blockscout.com)); Public blockchain JSON-RPC providers (on-chain reads per network, Public endpoints, per network, configurable per deployment); each read carries only the address or transaction being checked and nothing about you. Sanctions matching compares that identifier against published list data held on our own database. The full list, with what each provider receives and the date it began processing, is in clause 7 of the DPA; we give at least 30 days’ notice before a new one starts. We disclose personal data to authorities only where legally required, and will notify the affected customer where lawful.

8. International transfers

Our infrastructure providers may process data in the United States and the EEA. Where personal data subject to the GDPR is transferred to a third country, we rely on adequacy decisions or the European Commission's Standard Contractual Clauses as implemented in our providers' data processing terms.

9. Your rights

Where the GDPR or similar law applies to you, you have the rights of access, rectification, erasure, restriction, portability and objection and, where processing is based on consent, withdrawal at any time. Write to hello@kytgate.com; we respond within one month. Two honest caveats: requests concerning data a customer submitted should be addressed to that customer as controller (we will assist them), and records retained under financial record-keeping obligations may be exempt from erasure (art. 17(3)(b)). You may lodge a complaint with your supervisory authority.

10. Security

All traffic is encrypted in transit. API keys are stored only as cryptographic hashes. Screening records are append-only, and decision receipts are digitally signed so that subsequent alteration is detectable by anyone holding our published verification key. Access to production systems is restricted and credentialed. See /security for the full description.

11. Changes

We will update this policy as the Service evolves, for example when payment processing or account signup is introduced, and material changes will be flagged on this page with a new date. We will not weaken the commitments in section 2 silently.