1. Data controller

The controller of your personal data is the Alphabitx team ("we", "Alphabitx"), based in Portimão, Portugal. You can contact us about any privacy matter at [email protected].

2. What data we collect

We never have access to the recovery phrase (seed phrase) or private key of an internal wallet generated on your device - that data never leaves your device.

3. Purposes and legal basis

4. Data on the blockchain

Wallet and DEX operations and some marketplace confirmations are recorded on a public blockchain. By nature, these records are public, decentralised and immutable - neither Alphabitx nor anyone else can change or delete a transaction once it is confirmed. For this reason, the right to erasure (section 8) does not apply to data already recorded on a public blockchain, only to the data we keep on our own systems (e.g. your account, your marketplace delivery address).

5. Who we share data with

• Matrix federation: if you take part in a room with users from another Matrix server, that room's messages (including metadata) are also replicated to that server, outside our direct control;
• Technical service providers that help us run the Platform (hosting, connection protection and delivery - Cloudflare -, transactional email), under contract and only to the extent strictly necessary;
• The blockchain network for wallet and DEX operations (see section 4);
• Competent authorities, when required by law or court order.
• Meta Platforms (WhatsApp, Messenger and Instagram), only if you contact us on those channels - see section 12;

We never sell your personal data and never share it for targeted advertising.

6. Where your data is kept

We store and process your data on our own servers in the European Union. Your messages, files, account and session data do not leave Europe and stay protected by the GDPR.

There are only a few limited cases where some information passes outside Europe:

• the pages of the web.alphabitx.xyz website are delivered through Cloudflare's network, which sees your IP address and the page requested - never your messages;
• push notifications go through your browser's or phone's notification service (for example Google, Apple or Mozilla), with encrypted content;
• if you choose to chat in a room with users from another Matrix server, that room's messages are also kept on that server (section 5);
• blockchain transactions are public and global (section 4).
• if you write to us on WhatsApp, Messenger or Instagram, the message goes through Meta's systems before it reaches our servers (section 12);

In these cases the GDPR safeguards apply - an adequacy decision of the European Commission (such as the EU-US Data Privacy Framework) or Standard Contractual Clauses.

7. Retention period

We keep your account data for as long as your account is active. After an account is closed, we delete or anonymise the associated personal data within a reasonable period, except where we are legally required to keep it longer (e.g. tax records, anti-money laundering) or where the data is immutably recorded on a public blockchain (section 4).

8. Your rights

Under the GDPR, you have the right to:

• Access - know what personal data we hold about you;
• Rectification - correct inaccurate or incomplete data;
• Erasure - ask for your data to be deleted, subject to the limits in section 4;
• Restriction of processing, in certain circumstances;
• Portability - receive your data in a structured, commonly used format;
• Object to processing based on legitimate interest;
• Withdraw the consent given for analytics at any time, without affecting processing carried out before then;
• Lodge a complaint with the competent supervisory authority.

You can exercise these rights by writing to [email protected]. You can also delete your account yourself, in Settings › Account security. We will reply within one month at the latest, under Article 12 GDPR.

9. Security and privacy of your conversations

The privacy of your conversations is not an extra - it is how Alphabitx was built from the ground up:

• End-to-end encryption by default. Private and group rooms use the Olm (1-to-1 conversations) and Megolm (groups) protocols, based on the Double Ratchet algorithm - the same cryptographic family behind the most scrutinised and respected encrypted messaging protocols in the world. Encryption keys are created and kept on the participants' devices - they never reach our servers in readable form;
• Forward secrecy and post-compromise security. The keys for each message change continuously: if a device is compromised in the future, messages exchanged before then stay protected, and the conversation regains its security as soon as the compromised device is removed;
• Two-step verification (2FA). You can protect your account with an authenticator app or an email code on top of your password - mandatory for administrators;
• Device verification. You can verify the cryptographic identity of the person on the other side of a conversation (and of your own devices), detecting interception attempts that a plain phone number or username could never reveal;
• Open, auditable protocol. Alphabitx is built on the Matrix protocol, an open and public specification, and on code that can be independently inspected - security does not depend on blindly trusting our word, because it is not a closed black box;
• No mandatory phone number. You can create and use your account without ever linking a phone number to your identity - email is optional, only for account recovery;
• Backups without encryption shortcuts. When you turn on the backup of your encryption keys, that backup always stays protected by a security phrase or recovery key only you know - it is never readable by a third-party cloud storage service, a common weakness of other messaging apps;
• Encryption in transit and at rest. All connections use HTTPS/TLS, passwords are always stored in hashed form (never in plain text), and the recovery phrase or private key of an internal wallet is created and stays only on your device - we never see it, never store it, never transmit it.

10. Cookies and local storage

The Platform uses the browser's local storage (localStorage/IndexedDB) to keep your session, preferences and, where applicable, encryption data - not for cross-site advertising tracking. If product analytics (PostHog) is active on this server, it is only used after you explicitly accept the corresponding notice, and you can withdraw your consent at any time in Settings. We honour your browser's Global Privacy Control (GPC) signal.

11. Minors

The Platform is not intended for minors under 16 without the consent of the holder of parental responsibility, under Article 8 GDPR (or a lower age where the law of the minor's country of residence provides for it, never below 13). We do not knowingly collect data from children under 13; if we learn that this has happened, we delete that data. The wallet, DEX and marketplace features are also subject to the age limits described in our Terms and Conditions.

12. Contacting us on WhatsApp, Messenger and Instagram

If you write to us on WhatsApp, to the Alphabitx Page on Facebook (Messenger) or to the @alphabitx_xyz account on Instagram, the message is delivered to us by Meta Platforms. We then process:

• the conversation identifier Meta gives us and, on WhatsApp, your phone number;
• the public name or username of your profile;
• the text of the messages you send us (for attachments we only keep a note that there was one), with date and time.

We use this data only to answer you: an automatic assistant sends a welcome message or answers to keywords (such as "help" or "download"), and the message is copied into a private support room, on our servers in the European Union, that only the support team can access. Legal basis: steps prior to a contract and our legitimate interest in answering your request (GDPR art. 6(1)(b) and (f)). We never start conversations, we do not send advertising on these channels and we do not use this data for anything else.

How to delete this data: write "delete my data" in the same conversation. The assistant immediately deletes the copies of your messages in our support room and the conversation identifier, and confirms it to you right away. You can also ask at [email protected]. Copies kept by Meta itself are governed by Meta's privacy policy; you can delete the conversation in your app.

13. Changes to this Policy

We may update this Policy to reflect changes to the Platform or to applicable law. Material changes will be announced through the Platform or by email, with reasonable advance notice. The date of the last update is shown at the top of this page.

14. Contact and complaints

For any question about this Policy or your personal data, write to [email protected]. You also have the right to lodge a complaint with the data protection authority of your country of residence.