Waiqo — Privacy Policy
Effective date: 4 October 2026 Controller: BLACK FLAG INTERNATIONAL LIMITED ("Waiqo", "we", "us", "our"), a private company limited by shares incorporated in Hong Kong (company no. 3117200). Contact: privacy@wayqo.app; registered office: Room 1911A, Unit F, 19/F, Golden Bear Centre, 66 Chai Wan Kok Street, Tsuen Wan, Hong Kong.
This Policy explains what personal data we process when you use the Waiqo application and website (the "App"), why, and your rights. Waiqo is a non-custodial wallet and software provider; we design for data minimisation.
1. Data we do NOT collect
We never receive, store, or have access to your private keys, recovery phrase/seed, or wallet passphrase. These are generated and held only on your device. We cannot access, move, or recover your assets.
2. Data we process
- Wallet and account data: your wallet's public address, a wallet name you choose, session tokens, and app/device security metadata (not your keys).
- Residency attestation: the country of residence you declare at onboarding, used to determine eligibility.
- Personal identity verification (KYC) data: to unlock full functionality, identity checks (e.g. an identity document, a selfie/liveness check, name, and date of birth) are performed by a third-party identity-verification provider. For this in-app flow, that provider collects and processes the verification media under its own privacy policy; Waiqo receives a verification status and limited attributes (such as pass/fail, and where required, nationality or country), not the underlying document images. Business KYB requests follow a separate process.
- Transaction and activity data: records needed to show your payment history and receipts — for example wallet address, amount, asset, quote and order identifiers, timestamps, and provider settlement status. We do not store raw merchant QR account identifiers, signed transactions, card or bank credentials.
- Technical and usage data: IP address, device and app version, language, and security/diagnostic logs, used for security and to operate the App.
- Communications: information you provide if you contact support.
- Business access requests: if you choose to email us from the business page, we receive the company, activity, representative contact, ownership summary and KYB-document checklist you enter. The website itself does not store the form. We use the email to assess and respond to your request. Do not include identity-document images or wallet secrets in the first email.
3. On-chain (blockchain) data
Payments settle on a public blockchain. Wallet addresses, amounts, and transactions recorded there are public and immutable by design, are not controlled by Waiqo, and cannot be edited or erased by us or anyone. Do not treat on-chain data as private. To display balances and broadcast transactions the App uses a third-party blockchain node/RPC provider, which may receive your wallet address and transaction data.
4. Why we process it (purposes) and legal bases
| Purpose | Legal basis (GDPR, where it applies) |
|---|---|
| Provide the wallet, quotes, and payment features you request | Performance of a contract |
| Identity verification, sanctions/eligibility checks, record-keeping | Compliance with legal obligations; legitimate interests |
| Security, fraud/abuse prevention, and diagnostics | Legitimate interests |
| Responding to lawful requests from authorities | Legal obligation |
| Optional analytics or communications, if any | Consent (which you may withdraw) |
For users in Hong Kong, we process personal data in accordance with the Personal Data (Privacy) Ordinance (PDPO). For users in the EEA/UK, we process it in accordance with the GDPR/UK GDPR.
5. Who we share it with (recipients)
We share personal data only as needed, with:
- the third-party identity-verification provider (for KYC);
- the payment/off-ramp provider(s) and their licensed financial partners, so a conversion/payout you instruct can be processed (they act as independent controllers for that activity under their own policies);
- the blockchain node/RPC provider (wallet address, transaction data);
- hosting, content-delivery, and infrastructure providers that operate the App on our behalf (processors);
- authorities, regulators, or advisers where required by law or to protect rights.
We do not sell your personal data. A current list of processors/subprocessors is available on request at privacy@wayqo.app.
6. International transfers
Waiqo and some providers are located outside your country (including Hong Kong and other jurisdictions). Where we transfer personal data internationally and the GDPR/UK GDPR applies, we rely on an appropriate transfer mechanism (such as Standard Contractual Clauses) and apply supplementary measures where needed. Details are available on request.
7. Retention
We keep personal data only as long as necessary for the purposes above. Identity-verification and transaction records may be retained for a legally required period (for example, up to five years after the relevant activity) to meet anti-money-laundering and record-keeping obligations, whether held by us or by the relevant provider. On-chain data cannot be deleted (Section 3).
8. Your rights
Subject to applicable law (PDPO / GDPR / UK GDPR), you may request to access, correct, update, erase, restrict, or port your personal data, and to object to certain processing or withdraw consent. To exercise a right, contact privacy@wayqo.app. You may also complain to your data-protection authority (in Hong Kong, the Office of the Privacy Commissioner for Personal Data (PCPD); in the EEA/UK, your local authority). Note we cannot alter or erase on-chain data, and we may need to retain some data to meet legal obligations.
9. Account and data deletion
To delete your Waiqo account data, submit a request at https://www.wayqo.app/delete or email privacy@wayqo.app. On a verified request we delete the personal data we hold about you (your residency attestation, profile, verification status, and session and activity records) — we delete it, we do not merely deactivate it — and we instruct our processors to do the same. Two limits apply: (1) records we must keep by law — for example identity-verification and transaction records retained for anti-money-laundering purposes (see Section 7) — are kept for the required period and then deleted; and (2) on-chain data (Section 3) is public and immutable and cannot be deleted by us or anyone. Your self-custody wallet and keys exist only on your device and are removed when you delete them there or uninstall the App.
10. Security
We use technical and organisational measures appropriate to the risk, including on-device encryption of sensitive material (your keys are protected by your device's hardware-backed keystore and never leave your device), transport encryption (TLS), access controls, and minimisation. No system is perfectly secure; you are responsible for securing your device and recovery material.
11. Children
The App is not directed to, and may not be used by, anyone under 18.
12. Changes
We may update this Policy. Material changes will be notified in the App or on our site, and the effective date above will be updated.
13. Contact
BLACK FLAG INTERNATIONAL LIMITED — privacy@wayqo.app; registered office: Room 1911A, Unit F, 19/F, Golden Bear Centre, 66 Chai Wan Kok Street, Tsuen Wan, Hong Kong.