We can't sell what we never receive

1. Who is responsible

The data controller for personal data described in this Privacy Policy is:

Controller: individual developer A. Shapialevich
Legal form: Sole proprietor operating within the limits of unregistered business activity (działalność nierejestrowana) as defined in Article 5(1) of the Polish Entrepreneurs’ Law Act of 6 March 2018 [1].
Operating location: Warsaw, Poland. A postal address is not currently provided.
Email: hello@getsmartable.app - for any question or request.
Website: https://getsmartable.app

If the publisher is operating as an individual before incorporation of a legal entity, the publisher’s legal and business details will be updated when applicable.

This email is used for privacy requests, including requests described in Section 11. We aim to respond within one month and within the time required by applicable law.

Smartable Wallet is self-custody software. In the ordinary wallet configuration, Smartable does not create a Smartable account, user profile, email account, phone-number record or Smartable user ID.

Some optional third-party features may require authentication, identity verification or information to be provided directly to a third-party provider. Those features are governed by the provider’s own terms and privacy policy.

2. What never leaves your device

The following are not transmitted to Smartable or third-party infrastructure in plaintext:

• your recovery phrase;
• your private keys;
• your wallet password;
• your PIN;
• signing keys derived from your password;
• hardware-wallet private keys.

The application is designed so that these credentials are not transmitted to Smartable servers.

A signed transaction is different. After you approve a transaction, your device sends the signed transaction to the relevant network through the connection you chose for that network — a node-provider account of your own, a node endpoint you entered or a public endpoint from the application's catalog (section 6). This applies to every transaction: a send, a transaction you approve in the in-app dApp browser or over WalletConnect, a swap, a bridge or cross-chain transfer, a token approval or its revocation, and a separate payment of Smartable's fee. It does not pass through Smartable's infrastructure.

Private transaction broadcast is not offered in this version. A signed transaction is sent once, and not sent again after an unclear answer. It is not submitted to a swap provider, protocol or relayer as an order.

A signed transaction does not contain your private key, recovery phrase or password. However, a signed transaction or authorisation may allow crypto-assets to be moved.

Important: Before signing, carefully check the network, recipient, asset, amount, permissions, provider, route, fees and expected result. A confirmed transaction, token approval or other blockchain authorisation may be irreversible and may result in permanent loss of crypto-assets.

Smartable may receive and hold its own software and interface fee revenue in cryptocurrency where a route provides for such payment. That revenue is Smartable’s own revenue and is not user wallet data held on behalf of the user.

This description applies to the supported application versions and configurations described in the documentation. Users remain responsible for reviewing the security of their device, operating system, hardware wallet and any third-party software or service they use.

3. Optional encrypted and split backup

If you enable an optional encrypted cloud backup feature, recovery material may be encrypted and split locally before any share is uploaded.

Depending on the selected configuration, the application may:

• encrypt recovery material locally;
• create multiple encrypted shares;
• upload selected encrypted shares to cloud providers chosen by you;
• retain one share on your device;
• require a threshold number of shares for recovery;
• require a backup password or passphrase.

For a 2‑of‑3 configuration, any two valid shares may satisfy the configured SLIP‑39 threshold. If the application imposes an additional requirement for a device-held share, that requirement will be explained in the backup and restore flow.

The plaintext recovery phrase, private keys and wallet password are not uploaded by Smartable as part of the intended backup design.

Encrypted shares are not intended to be usable by a cloud provider on their own. However, the security of your backup also depends on:

• the strength of your backup password or passphrase;
• the security of your devices;
• the security of your cloud accounts;
• the security of the selected cloud providers;
• the protection of your shares;
• the correctness of the recovery process.

Potential cloud providers may include:

• Google Drive;
• MEGA;
• Backblaze B2.

The selected cloud provider may process uploaded encrypted shares, filenames, technical metadata, account identifiers and access logs under its own privacy policy.

Smartable does not receive your plaintext recovery phrase or password and does not provide a decryption service.

You are responsible for retaining:

• the required shares;
• the required backup password or passphrase;
• any required recovery metadata;
• access to the selected cloud account.

Losing the required password, passphrase, shares or metadata may make recovery impossible.

4. No account, no identity

In the ordinary wallet configuration, there is no Smartable sign-up, Smartable email account, phone-number record or Smartable user ID.

If you use Smartable Wallet without contacting us or using an optional third-party feature that requires identity verification, we generally do not know who you are.

A blockchain address is not necessarily anonymous. It may be personal data where it can reasonably be linked to an individual.

Smartable treats wallet addresses as potentially personal data even though the ordinary wallet flow is not intended to create a persistent user identity.

Optional providers may collect identity information directly from you. Examples include:

• crypto purchase providers;
• cash-out providers;
• cloud storage providers;
• Google authentication;
• support services;
• other providers that require identity verification.

5. What is processed, why and on what legal basis

The legal basis stated below depends on the feature, the parties involved and the actual processing performed. Where a third-party provider processes data for its own purposes and determines how it is processed, that provider may act as an independent controller under its own privacy policy.

Where processing is based on consent, you may withdraw it at any time through the application where that option is available or by contacting us.

Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

6. Who else may see your data

Requests take one of two paths.

Requests about a blockchain — balances and token balances, account details, transaction history where the connection provides it, fees, previews and simulations of a transaction, names such as ENS names, and the signed transactions you send — go directly from your device to the connection you chose for that network: a node-provider account of your own, a node endpoint you entered, or a public endpoint you chose from the application's catalog. The application asks no node, explorer or indexer of its own accord, and a network you have not connected is asked nothing. These requests do not pass through Smartable's infrastructure; see Connections you choose below.

Smartable infrastructure is used for optional Smartable-operated services: swap, bridge and cross-chain quotes and routes, a route's status, the fee functions described in section 5, the CoinMarketCap prices, market figures and charts the application shows, the purchase and sale sessions of an on-ramp or off-ramp provider, updates of the sanctions, route-policy and phishing lists, and the address shown on Support the author (Settings → About), which the application is designed to request only when that screen is opened and whose request carries no wallet address, account or amount. It is not used to read a blockchain or to send a transaction.

The proxy is intended to reduce direct transmission of your IP address to the providers behind it. It does not do so for requests your device sends directly. The proxy may still process the information required to provide the requested feature.

Depending on the feature, Smartable infrastructure may process:

• public wallet addresses;
• source and destination addresses;
• asset identifiers;
• token contract addresses;
• amounts;
• route information;
• provider identifiers;
• fee information;
• transaction parameters;
• a message signed to confirm control of an address, where the fee functions described in section 5 require it;
• network and chain information;
• technical error information.

Smartable infrastructure does not receive private keys, recovery phrases, passwords or signing keys as part of the intended design.

Potential providers may include:

• blockchain connections you choose: the node providers whose account you connect (Alchemy, Infura, Ankr, dRPC and Dwellir), the operator of a node endpoint you enter, and the operator of a public endpoint you choose from the application's catalog, which the application names before you choose it — for example PublicNode (Allnodes), Nodely, Dwellir, Blockstream, mempool.space, TronGrid and DFINITY (icp-api.io, with the Internet Computer ledger's index); see Connections you choose below;
• THORChain's public node (gateway.liquify.com), which your device asks for THORChain's list of vaults before a THORChain route;
• prices and market data: CoinMarketCap, whose data Smartable's infrastructure obtains under Smartable's own account and passes to the application; exchange rates from ExchangeRate-API and the European Central Bank, asked by your device; and prices your device computes from exchange pools read through a node-provider account you connected — see Prices and market data below. To apply the USD 0.50 minimum fee, Smartable's infrastructure asks DefiLlama for the value of the asset you sell, naming the network and the asset, not you;
• swaps and bridges: 0x, LI.FI, THORChain, Jupiter and other providers;
• network-specific routes: STON.fi, Stellar network liquidity, xExchange, Vestige, Sirius and other providers;
• fiat on-ramps and off-ramps: Coinbase and other providers — when you start a purchase or sale, Smartable's proxy sends the provider the receiving addresses and asset you chose and your device's IP address, which the provider requires to bind the session to you, and later a random reference generated on your device, to show that purchase's or sale's status. The provider processes this data, and the identity and payment data it collects from you directly, as an independent controller under its own terms;
• phishing-domain list: the public polkadot-js/phishing list (Apache-2.0), fetched by Smartable infrastructure and delivered to the application as a signed update — the sites you open are checked on your device and are not sent to anyone;
• WalletConnect connections: Reown's WalletConnect relay network, which carries messages between the application and a dApp or agent session you choose to connect. The messages are encrypted end to end between those two, so the relay cannot read them; it can see your device's IP address, the connection's identifier and when messages pass; and Reown Verify, which the application asks about each connection proposal and each request it receives, so that it can tell you whether the site that made it is the one it names. Reown Verify may see your device's IP address and an identifier of that proposal or request — a hash of the message, not its content — and no address, amount or key of yours;
• crash reporting, only if you switch it on: Sentry (Functional Software, Inc.), in its EU data region;
• QR-code scanning on Android: Google ML Kit, which reads the camera image on your device. According to Google, ML Kit sends Google device information, app information, performance metrics and error codes for diagnostics and usage analytics; the contents of a scanned code are not among them. Google operates this under its own terms, and the application has no setting that turns it off;
• private transaction relays: none in this version. The relays the application carries — Flashbots Protect and MEV Blocker on Ethereum, 48 Club and PancakeSwap MEV Guard on BNB Smart Chain — are not sent anything;
• the country lookup at setup: BigDataCloud — see Country at setup below;
• hosting, delivery and security infrastructure: Cloudflare and other providers — for requests to Smartable-operated websites and APIs, Cloudflare may process IP addresses, approximate location derived from IP addresses, request metadata and security-event data to deliver those services and apply configured WAF, rate-limiting and geographic access rules;
• downloading the Android application from the website: GitLab (GitLab B.V. and GitLab Inc.) — the download button on getsmartable.app leads to the application file in Smartable's public project on GitLab (gitlab.com/getsmartable-app/android), so GitLab receives your device's IP address and the download request, under GitLab's own privacy statement;
• optional encrypted backup: Google Drive, MEGA and Backblaze B2;
• hardware-wallet or connection services: the relevant vendor or protocol.

Third-party providers operate under their own terms and privacy policies.

Smartable's own operational alerts are delivered to the publisher through Telegram. They describe the state of Smartable's infrastructure and of its fee collection, and contain no wallet address, amount, transaction or other information about a user.

AI tools. The application sends nothing to an AI provider and has no connection to any AI tool. If you use Analyze with AI, the text you choose to share — network names, public addresses and the task you selected — goes to the app you pick in your device's share sheet, or wherever you paste it, and what that app or its provider does with it is governed by their terms and privacy policy. A public address can be linked to its publicly visible on-chain activity.

Agent Wallet. An Agent Wallet is processed like any other wallet in the application: its recovery phrase and private keys stay on your device as described in section 2, and its public addresses are read through the same connections as any other wallet's. No AI provider receives anything about it unless you share its addresses yourself through Analyze with AI.

If you use a third-party feature, that provider may:

• process additional information;
• require identity verification;
• retain data under its own policy;
• use its own infrastructure;
• process information outside the EEA;
• provide additional privacy notices;
• use its own cookies or analytics.

The total amount you may pay or lose in connection with a route may include the source amount, the Smartable software and interface fee, third-party or protocol components, source-chain network fees, destination-chain network fees, approval or permit transaction fees, relayer costs, bridge costs and other route-specific deductions. The final amount received may therefore differ from the quoted amount.

Provider roles

Where a third-party provider processes data on documented instructions from Smartable and for the purposes described in this Privacy Policy, it acts as a processor. Where a provider determines its own purposes and means (for example fiat on-ramps that collect identity data directly from you), it acts as an independent controller under its own privacy policy.

The following table summarises typical provider types, the data they may process and their role under data-protection law. The actual role depends on the specific provider, feature and processing activity.

For each active provider, Smartable maintains an internal record of processing that identifies the provider's role, the categories of data, purposes of processing, transfer safeguards and retention periods.

Connections you choose

The application connects to a network only after you have chosen and saved a connection for it on the Connect to Network screen, in one of three ways:

• a node-provider account of your own — Alchemy, Infura, Ankr, dRPC or Dwellir. You create the account and its key on the provider's own website, which the application opens in your device's browser and reads nothing from. The key is stored encrypted on your device and sent only to that provider's own hosts, never to Smartable;
• a node endpoint you enter yourself, with a key in a request header where the endpoint needs one. The key is sent only to that endpoint;
• a public endpoint from the application's catalog, offered for testing. Nothing is sent while you look through the catalog; the endpoint you choose is asked only when you check it and, after you use it, for that network's requests. Where Smartable has read an operator's usage terms, the application lets you open them.

Before a connection is saved, the application asks it one or two questions that only that network's main network can answer — its chain ID, its genesis or a known block — and keeps it only if it answers as that network. A network you have not connected is asked nothing.

The operator of the connection you chose may see:

• the IP address of your device;
• the public wallet addresses being read, and the network and kind of each request;
• the time of each request;
• the details of a transaction you are asked to approve — sender, recipient, amount and data — before you approve it, where the application asks the connection to estimate its fee, to preview what it would do or to simulate it: on Ethereum-compatible networks, including for a dApp or WalletConnect request and an ENS name you look up, and on Solana, Filecoin, TRON, Starknet, Aptos, Movement and the Cosmos-based networks — on Solana, every swap or bridge is simulated before it is signed;
• the signed transaction, once you approve it.

It does not receive your recovery phrase, private keys, wallet password or PIN. The operators are independent third parties under their own terms and privacy policies; a node-provider account of your own is governed by your agreement with that provider. The IP-address-based restrictions described in section 8 of the Terms of Use are not applied to these requests by Smartable infrastructure; that section applies to your use of these features all the same.

Addresses that reach one operator together. After you unlock the wallet, and once for each network you have connected, the application also asks that network's connection for the balance of a few further addresses derived from the same recovery phrase by paths other wallets use, so that it can tell you if a balance sits on a path this wallet does not. You can also ask it to look on every connected network at once (Settings, Networks); it first tells you what that involves and asks nothing until you confirm. Because these addresses reach the operator together, from one IP address and within moments of each other, the operator may be able to link them to one another, and to the address you use, as coming from one device. Nothing is signed, adopted or stored because of the answer, and a network that does not answer is reported as not having answered, never as having nothing. When you import a Bitcoin private key, the application looks up the addresses that key controls — up to four — on your Bitcoin connection together, so that operator may link them to one another as belonging to one key. On Starknet, once for each account of your wallet, the application also asks which of the addresses your key could have under different account contracts already exist. On Sei's original (sei1) addresses it asks, before every send, whether the recipient is the old spelling of an EVM address that Sei has linked to another account, so that operator may see the recipient written as an EVM address before you confirm; and if you use the button that moves coins to your own Sei (0x) address, it sees that address too.

Networks with particular requirements. A Bitcoin connection is an Esplora endpoint; the application asks no Electrum server. Dogecoin and Bitcoin Cash need an endpoint of your own. The Internet Computer is connected either through DFINITY's pair in the catalog — the icp-api.io boundary node with the ledger's index at ledger-api.internetcomputer.org — or through a boundary node of your own, through which balances, history and the confirmation of a transfer are read as anonymous queries of the ledger and its index; either way an answer is that node's alone.

When a route completes. Where Smartable's fee for a route is a separate transaction, the application first checks that the route completed: on a THORChain route it asks Smartable's infrastructure for THORChain's status of your deposit, by that transaction's hash; on other networks it asks the connection you chose, by the swap's transaction hash. Where a separate fee for a completed route from an Ethereum-compatible address is awaiting confirmation, and after you have confirmed control of that address, the application sends Smartable's infrastructure the route's transaction hash and the fee's amount and asset, and later the payment's transaction hash, so that Smartable can keep the record described in section 5.

THORChain's list of vaults. Before a THORChain route is approved or signed, your device asks a public THORChain node (gateway.liquify.com) for THORChain's published list of vaults, to check that the deposit goes to one of them. The request carries your device's IP address and nothing else: no address, amount, asset or route. It is not sent through Smartable.

Bridges whose delivery is read from the chains. Before a route through StargateV2 or Circle's CCTP is offered, and again before it is signed, the application reads, through the connections of both networks you chose, which asset the bridge's contracts deliver on the destination network. These requests name the bridge's contracts, the destination network and the asset; they carry no wallet address or amount.

Password for large sends. If you have set one, the application values the transaction before asking for it, using the prices described under Prices and market data below; where it holds no price for an asset, it asks for the password.

Direct asset-logo requests

The application loads asset logos it does not carry from raw.githubusercontent.com, which may see your device's IP address and the logos requested. The requested logos may reveal which assets the application is displaying, although they do not include a wallet address or transaction amount. CoinGecko's image hosts are not asked in this version.

Prices and market data

The prices, market figures and charts the application shows come from three places:

• CoinMarketCap, through Smartable's infrastructure. Your device asks Smartable's proxy for a snapshot of current prices and market figures — the same answer for everybody. The request names no wallet address, holding, balance or amount, only which snapshot your device already holds. When you open the chart of a network's own coin over a period the device cannot draw itself, the request also names that network and the period. Smartable's infrastructure obtains the data from CoinMarketCap under Smartable's own account; CoinMarketCap does not receive your request or your IP address. The Markets list and its order are CoinMarketCap's. These prices are for display: the application's checks before signing do not use them.
• Prices computed on your device from exchange pools, read through a node-provider account you connected for that network. The requests name pools and token contracts — never your wallet address, a balance or an amount; the provider sees your device's IP address and which assets are being valued, as it already sees what your wallet holds on that network. These are the prices the application's checks before signing use — the password for large sends, the market-value comparison and the limits on additional cross-chain route costs — and where none is available, the application treats the price as unknown and says so.
• Exchange rates. Where your display currency is not the US dollar, your device asks ExchangeRate-API (open.er-api.com) and the European Central Bank (www.ecb.europa.eu) for their tables of rates, at most every six hours. The request carries nothing but the request itself.

The list of tokens the application checks your wallet for is carried in the application; nothing about the tokens you hold is sent to Smartable for it. Prices used by Smartable's infrastructure for swaps and cross-chain routes, including the USD 0.50 minimum fee, are obtained by that infrastructure.

These providers are independent third parties under their own terms and privacy policies.

Country at setup

When the application first asks which country you are using the wallet in, it asks BigDataCloud (api.bigdatacloud.net), once, which country your internet connection appears to be in, and offers the answer for you to check and confirm or change. Your device makes the request directly, not through Smartable infrastructure, and it is made after you have accepted these documents. BigDataCloud may see your device's IP address and the technical information any web request carries; the request contains no wallet address, balance, amount or identifier. The answer includes an approximate location, of which the application keeps only the two-letter country code. The request is repeated if you ask the application to check again from Settings, or when you confirm a change to a country with fewer restrictions than the one the application holds, because the application then confirms the change from your connection. If the first check could not be made — for example because your device had no connection, or the provider did not answer — the application repeats it by itself, at increasing intervals and when you return to the application, until it has succeeded once; it then stops. Until then the application tells you that your country is not yet confirmed by your connection.

The application stores, encrypted on your device or not at all, two values, each a two-letter country code: the country you confirmed or chose and the country code the connection last reported. It does not store your IP address, any coordinates or other location detail, the provider's answer, the date of a check or a history of checks. These values are deleted when you remove the wallet. They are used to decide whether the wallet signs transactions on your device; they are not sent to Smartable, and the application does not decide your location or eligibility by this, which a VPN or a mistaken answer can defeat. If the lookup fails, you choose your country yourself and nothing else is withheld. BigDataCloud is an independent third party under its own terms and privacy policy.

7. Transfers outside the EEA

Some Smartable infrastructure and third-party providers may be located outside the European Economic Area, including in the United States.

Where required, transfers may rely on:

• an adequacy decision;
• the EU–US Data Privacy Framework where the provider participates [3];
• Standard Contractual Clauses;
• another lawful transfer mechanism;
• another lawful basis permitted by applicable data-protection law.

A blockchain transaction is broadcast to a public network of nodes worldwide. This international distribution is inherent to blockchain technology and is outside Smartable’s control. This description of blockchain broadcasting is separate from transfers of personal data by Smartable. Depending on the network, transaction data may be distributed globally by the network itself. Smartable does not control the recipients, locations or retention practices of independent network participants.

You may contact us using the details in section 16 to request information about the specific transfer safeguards applicable to a particular provider or processing activity.

8. What is public regardless of Smartable

Blockchain addresses, balances, token holdings and confirmed transactions may be public or publicly derivable depending on the network.

Anyone may read the relevant blockchain data.

Blockchain data may be linked to an individual by third parties.

Confirmed blockchain transactions cannot be erased by Smartable or by any other wallet provider.

For privacy-sensitive use, consider:

• using separate addresses for separate purposes;
• using your own RPC node where supported;
• avoiding unnecessary public address reuse;
• reviewing the privacy policy of every provider you use.

9. Analytics and crash reporting

The application is intended to contain no advertising analytics or user-behaviour profiling.

This website does not intentionally use advertising trackers or analytics.

If third-party content, analytics, advertising, cookies or hosted resources are introduced, this section will be updated.

Crash reporting is optional and off by default. It is activated only after you enable it in the application, except where a separate technical diagnostic process is strictly necessary for security or service operation and applicable law permits it.

If crash reporting is enabled, it is limited to diagnosing software failures. Reports are sent to Sentry (Functional Software, Inc.), which receives them in its EU data region and acts as Smartable's processor.

The crash-reporting configuration is intended to exclude the following data and is tested against the supported application versions. Technical metadata may still reveal information indirectly in exceptional cases.

Crash reporting is configured not to send:

• private keys;
• recovery phrases;
• passwords;
• wallet addresses, and names that resolve to one, such as ENS or NEAR account names;
• transaction paths;
• transaction amounts;
• screenshots;
• breadcrumb trails containing wallet activity.

Crash reporting may still include technical information such as:

• exception type;
• the exception's message, with anything shaped like an address, a key, a transaction identifier or an amount removed before it is sent;
• stack trace;
• application version;
• operating-system version;
• device model;
• device configuration;
• crash timestamp;
• technical diagnostics.

Because crash reporting is off until you switch it on, crash reports are processed on the basis of your consent under Article 6(1)(a) GDPR, as stated in the table in section 5. You may withdraw that consent at any time by disabling crash reporting in the application; withdrawal does not affect reports already sent.

Crash reports are retained only for as long as necessary to diagnose and fix the relevant issue, and are deleted thereafter unless a longer retention period is required by law.

10. Security and privacy limitations

Smartable may provide:

• phishing-domain checks;
• address validation;
• address-poisoning detection;
• token approval monitoring;
• transaction simulation;
• typed-data review;
• device-integrity checks;
• screen-capture protection on supported platforms;
• biometric or PIN protection.

These features reduce certain risks but do not guarantee that:

• a site is safe;
• a contract is safe;
• a token is legitimate;
• a provider is reliable;
• a transaction will succeed;
• a simulation is complete;
• a device is uncompromised;
• a private key will never be exposed by a compromised device;
• a blockchain transaction will produce the expected result.

A successful security check or simulation is not a guarantee of safety.

An unavailable check or simulation is not evidence that a transaction is safe or unsafe.

A rooted, jailbroken or compromised device may alter what is displayed before signing or interfere with the application.

11. Your rights

Under the GDPR, you may have rights including:

• access;
• rectification;
• erasure;
• restriction of processing;
• data portability;
• objection to processing based on legitimate interests;
• withdrawal of consent where processing is based on consent.

Send privacy requests to:

hello@getsmartable.appCopy

Please use “Privacy” in the subject line.

We aim to respond within one month and within the time required by applicable law.

These rights do not allow Smartable to erase:

• data permanently recorded on a public blockchain;
• data held by an independent third-party provider where Smartable has no control over it;
• data that must be retained under applicable law;
• data required to establish, exercise or defend legal claims.

You may also complain to the supervisory authority in your country of residence, workplace or the place of the alleged infringement.

We may ask for information reasonably necessary to verify your identity and protect personal data before responding to a request. We will not ask you to provide a recovery phrase, private key, password, PIN or signing credential.

12. Automated processing and route selection

Smartable does not use profiling or automated decision-making that produces legal or similarly significant effects on you.

The application may automatically:

• select technical fallbacks;
• reject malformed requests;
• apply rate limits;
• hide unavailable data;
• display security warnings;
• block known phishing domains;
• restrict unsupported networks or providers.

These are operational, technical and security controls. They are not decisions about your eligibility, creditworthiness, insurance, employment or personal profile.

The application does not rank or select a swap or bridge provider for you. Which provider is used is your explicit choice — see section 6.11 of the Terms of Use.

13. Children

Smartable Wallet is not directed at children under 18.

We do not knowingly collect personal data from children.

Where Article 8 GDPR applies to an information-society service based on consent, applicable age and parental-consent requirements will apply. [2]

14. Data security

Smartable uses technical and organisational measures intended to protect data processed through its infrastructure.

These measures may include:

• encrypted transport;
• access controls;
• secret separation;
• rate limiting;
• logging restrictions;
• sensitive-data redaction;
• secure storage practices;
• provider access controls;
• security monitoring;
• restricted production access.

No method of transmission or storage is completely secure.

You are responsible for protecting:

• your device;
• your wallet password;
• your PIN;
• your recovery phrase;
• your backup shares;
• your backup passphrase;
• your cloud accounts;
• your hardware wallet;
• your email and support accounts.

15. Changes to this Privacy Policy

Material changes to this Privacy Policy will be announced in the application or on the website before they take effect where practicable.

Each version will carry its own effective date.

If required by law, Smartable will request renewed consent before applying a material change to consent-based processing.

16. Contact for privacy matters

For privacy questions or requests, contact:

hello@getsmartable.appCopy

Please use “Privacy” in the subject line.

Support will never ask for your:

• recovery phrase;
• private key;
• wallet password;
• PIN;
• backup passphrase;
• full split-backup shares.

Any message requesting these credentials is not authorised by Smartable, regardless of the sender address.

Legal references

[1] Article 5(1) of the Polish Entrepreneurs’ Law Act of 6 March 2018 (ustawa Prawo przedsiębiorców).

[2] Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, General Data Protection Regulation, including Article 8:
EUR-Lex

[3] European Commission Implementing Decision (EU) 2023/1795 on the EU–US Data Privacy Framework:
EUR-Lex