Privacy Policy

Ownership, Operation and Global Scope

Kapachain is owned by KAPACHAIN F.Z.E. Kapachain Pty Ltd, a partner of KAPACHAIN F.Z.E, handles operation of the Kapachain website and related operational support on its behalf. References to Kapachain describe the platform and these activities, not a separate legal entity.

This Policy applies to users worldwide across Kapachain websites, applications, APIs, demonstrations, support and enabled modules, whether accessed through a Free, Pro, Team, Compliance or Enterprise plan, another agreed subscription, a trial or a separately purchased add-on. Global scope does not mean every service, dataset, payment method or jurisdiction is supported. Local mandatory privacy rights remain applicable.

KAPACHAIN F.Z.E is responsible for the purposes and means of processing used to operate its own accounts, billing, security and service administration. For investigation records submitted on behalf of an organization, that organization remains responsible for its lawful purposes and instructions; Kapachain's role and obligations also depend on the applicable agreement and data-processing terms. Kapachain Pty Ltd's operational access is subject to this Policy and applicable law. Platform ownership does not transfer ownership of customer investigation records.

Information Across Features and Modules

Account and organization information may include names, business contact details, sign-in provider identifiers, memberships, seats, roles, permissions, authentication and device-session identifiers, and organization settings. Billing records may include the selected plan, billing interval, currency, payment-provider references, invoices, tax details, purchased credits, entitlements, usage and payment status. Payment processing is handled through the enabled payment provider; do not send payment-card details through investigation inputs or support messages.

Wallet screening, blockchain tracing, graph and ledger exploration, clustering, entity attribution, cross-chain fund flow and valuation features may process public wallet addresses, transaction hashes, network and asset identifiers, relationships, labels, risk indicators, price estimates, sources and investigation parameters. Public blockchain data can still be personal information when linked to an identifiable individual.

Cases and collaboration may process evidence, attachments, notes, saved graphs and traces, assignments, reviews, sharing permissions, activity history, attestations, report drafts, STR/SAR preparation materials and exported records. Alerts and monitoring may process watched addresses, rules, notification destinations, delivery events and resulting case activity. Evidence verification and provenance features process the identifiers and integrity metadata supplied for verification.

Enabled KYT/AML (Know Your Transaction / anti-money-laundering), sanctions, PEP, adverse-media, VASP, jurisdiction and online intelligence features may process the search identifiers and supporting information you supply, together with public, licensed or third-party results and source metadata. Kapachain analyzes blockchain transactions and wallets; it does not provide KYC or eKYC identity verification. Account authentication and verification of a privacy requester's authority are separate from customer identity-verification services. Travel Rule assessment and record workflows may process transfer details, counterparty or originator/beneficiary information and compliance-support records when supplied. Feature or dataset availability is conditional; this Policy does not represent that licensed datasets or external delivery are enabled.

AI assistants, assisted reports and investigation workflows may process prompts, conversation history, selected investigation context, retrieved source material and generated responses. APIs, integrations, administration, demonstrations and support may process request metadata, configuration, enquiries and correspondence. We also process IP addresses, browser and device information, timestamps, errors, usage telemetry and security/audit logs as needed to operate and protect the service.

Sources, Purposes and Legal Grounds

Information comes from you, authorized organization members, identity and payment providers, public blockchains, enabled data providers and your use of the service. We use it to provide requested features, authenticate users, manage organizations and subscriptions, meter entitlements, produce requested outputs, support customers, maintain provenance, prevent fraud and abuse, investigate incidents and meet applicable obligations.

Where law requires a legal basis, processing depends on the activity and our role: performing a contract or requested pre-contract steps, complying with legal obligations, legitimate interests such as securing and maintaining the service where permitted and appropriately balanced, or consent where required. Optional communications and any processing that requires consent must have the appropriate choice or authorization. Customers must establish their own lawful basis and necessary notices for information they submit, especially sensitive data or criminal-allegation information; an investigation purpose alone does not remove these requirements.

AI, Third Parties and Sharing

Requested AI operations may send the selected context to the configured AI service provider. Other enabled functions may send necessary identifiers or transfer details to blockchain, intelligence, identity, payment, communications or infrastructure providers. Do not submit secrets, seed phrases, private keys or unnecessary sensitive personal data. AI results require human verification; generated inferences are not established facts or a substitute for a decision-maker's review.

Organization administrators and authorized collaborators may access information according to permissions and organizational policies. Exporting or sharing records can place copies outside Kapachain's access controls; the recipient's handling may be governed by their own policies. We may disclose information to service providers supporting the platform, professional advisers or competent authorities where lawfully necessary, including to protect the service or enforce legal rights. We do not sell personal information.

Provider selection, processing locations and any additional safeguards for your organization depend on the enabled service and contractual terms. Contact support@kapachain.com for applicable processing information or data-processing arrangements before submitting data subject to special restrictions. This Policy does not promise provider model-training exclusions, a fixed data-residency region or an unverified certification.

International Processing

Users, collaborators, KAPACHAIN F.Z.E, Kapachain Pty Ltd and service providers may be located in different countries. Information may therefore be accessed or processed outside your country, including in connection with UAE ownership and Australian operations. Different countries may provide different levels of privacy protection.

Where applicable law restricts an international transfer, the required transfer basis and safeguards must be established for that processing, such as a recognized adequacy decision, valid contractual safeguards and supplementary measures, or another lawful exception. Contact us for information about the arrangements applicable to your service. Using the platform is not blanket consent to otherwise unlawful transfers. No global data-residency or transfer-compliance guarantee is made.

Cookies, Local Storage and Communications

Authentication cookies, session controls and browser storage support sign-in, security and preferences such as language and currency. Operational telemetry supports reliability and abuse prevention. Browser controls can restrict or clear storage but may prevent sign-in or remove preferences; clearing browser storage does not delete server-side records. Non-essential tracking, where introduced, requires the choices or consent mandated by applicable law. A general statement in this Policy does not replace a required consent mechanism.

We may send service, billing and security notices. You can contact us about optional communications and withdraw consent where that is their legal basis; necessary service notices may still be sent.

Retention, Deletion and Security

Retention depends on the record type, service purpose, contract, security needs, disputes, legal holds and applicable obligations. Account closure, subscription cancellation or credit expiry does not by itself erase investigation records, audit history or payment records. This does not extend access or retention: the Free plan does not include saved investigation history, and after a paid term ends we provide only the limited read-only export period set out in the Terms of Use (30 days for Pro and Team plans, 90 days for Compliance and Enterprise plans, unless your order or agreement states otherwise) and cannot guarantee that records remain retained or accessible after it. Public blockchain entries cannot be deleted by Kapachain, and independently shared or exported copies may remain with their recipients.

Kapachain does not currently provide automated case-retention or case-deletion compliance. Destructive case disposal is disabled. Retention and deletion requests are reviewed and handled manually, subject to identity verification, contractual requirements, legal holds, security needs and applicable law. We provide a written outcome after review; submitting a request does not mean that data has been automatically deleted.

Administrative, technical and organizational controls are intended to protect information against unauthorized access, disclosure, alteration and loss. No system is completely secure. Where legally required, incidents will be assessed and communicated to affected parties or authorities under the applicable requirements, rather than a universal notice deadline.

Rights and Regional Protections

Depending on your location and the applicable law, rights may include information about processing, access, correction, deletion, restriction, portability, objection, withdrawal of consent, and safeguards concerning certain automated decisions. Some jurisdictions also provide rights concerning sale/sharing, targeted advertising, sensitive information, authorized agents or appeals. Rights are subject to applicable conditions, exemptions and verification; withdrawal does not invalidate prior lawful processing. We do not discriminate for exercising rights where prohibited by law.

Where applicable, regional protections include the Australian Privacy Act and Australian Privacy Principles; EU/EEA GDPR and UK data-protection law; UAE federal or applicable free-zone data-protection law; US federal and state privacy and consumer protections; Canada's PIPEDA and applicable provincial law; Japan's Act on the Protection of Personal Information (APPI); and South Korea's Personal Information Protection Act (PIPA). Local regulator, complaint and remedy rights are not displaced by UAE governing law. Other supported jurisdictions retain their applicable mandatory rights. This list does not assert that every law applies to every service or that Kapachain is licensed or certified under those regimes.

Send requests to support@kapachain.com, identifying the account, organization, records and jurisdiction involved without unnecessary sensitive data. We verify authority, assess applicable rights and restrictions, and respond within applicable legal time limits. For organization-controlled records, we may refer you to or assist the relevant organization. You may complain to a competent privacy or data-protection authority without first contacting us where law permits.

Children and Updates

Kapachain is a professional service, not directed to children. Do not create an account if you are below the age legally required to enter the applicable agreement. Contact us if you believe a child has provided personal information without required authorization. Customers must not submit information about minors unless lawful and necessary for their authorized purpose.

We may update this Policy as services or legal requirements change. The current version and last-updated date are available at this URL and in the legal popup. Material changes will be notified where required; additional consent will be sought when legally necessary.

Governing Law and Contact

This Policy and disputes arising out of or relating to it are governed by the laws of the United Arab Emirates (UAE), subject to mandatory laws and statutory rights that cannot lawfully be excluded. This provision does not limit your right to raise a concern with a competent privacy or data-protection authority. For privacy questions, requests or a concern you want us to investigate, contact KAPACHAIN F.Z.E through support@kapachain.com; Kapachain Pty Ltd may handle operational correspondence on its behalf.