Privacy Policy
Last updated: 13 October 2026
Who we are
VerifiedWallet (verifiedwallet.io) is run by Karl Finance Technologies Ltd, a company registered in England and Wales with company number 17308197, whose registered office is 128 City Road, London, EC1V 2NX, United Kingdom. We are the controller of the personal data described here. For anything about your data, email [email protected] or see our contact page.
The short version
- A certificate is public on purpose: it shows your wallet address, which checks were done and when, so that anyone you share it with can verify it. That's the service you ask us for.
- We never publish your name, email, documents, selfie or payment details.
- If you choose identity verification, your documents and face scan go to our identity provider, not to us. We receive only the result.
- We don't use advertising or analytics cookies, and we never sell your data.
What we collect and why
| Data | Why | Lawful basis (UK GDPR) |
|---|---|---|
| Your wallet address, the message your wallet signed and its signature | To issue the certificate and let anyone check it | Contract (Art. 6(1)(b)) |
| Certificate details: tier, dates, and the outcome of any identity or AML check (for example "verified", or a wallet risk score) | To show on the certificate what was checked | Contract |
| Email address and payment record from Stripe (we never see your card number) | To process payment, send your certificate link and handle support | Contract; legal obligation for accounting records (Art. 6(1)(c)) |
| Identity documents, selfie and liveness video, face match, device and IP checks (Tier 2 and 3, collected by our identity provider) | To verify your identity for the certificate | Contract; for biometric data, your explicit consent (Art. 9(2)(a)), which you give before starting the check |
| Your name and date of birth checked against sanctions and politically-exposed-person lists (Tier 3, by our identity provider) | The AML screening included in Tier 3 | Contract |
| Wallet address sent for on-chain screening (Tier 3); no other personal data is sent with it | The wallet AML screening included in Tier 3 | Contract |
| What you send through the contact form: name, email, mobile number, company and certificate ID if given, and your message | To answer you | Legitimate interests (Art. 6(1)(f)), or contract where it is about your certificate |
| Technical data such as IP address and request logs, handled by our hosting provider | Keeping the service secure and preventing fraud and abuse | Legitimate interests (Art. 6(1)(f)) |
You must be 18 or over to use VerifiedWallet.
What is public
Your certificate page and its data (at /cert?id=… and /api/cert/…) show: your wallet
address and network, the signed request message and signature, the tier, issue date, whether the certificate
is valid or revoked, and the outcome of any checks (for example "Identity: Verified", or "AML: no risk found"
with a risk score per network). This is public so that people you share the link with can verify it, and the
public register at Verify a wallet lists certificates by wallet address.
Because a wallet address can be linked to you, this is personal data, and publishing it is part of the service you ask for. Your name, email, documents, biometric data and payment details are never published. Certificate pages ask search engines not to index them, but anyone with the link can see and share them, and copies made by others are outside our control. Wallet activity on a blockchain is public regardless of us.
Identity verification
Identity checks are carried out by Didit (Didit Identity, Inc., based in the United States) and, where enabled, Sumsub, acting as our processors. They collect your document and face scan directly in their own secure flow, and return to us only the outcome (verified, rejected or in review) and a reference. Didit may also process some data as an independent controller for its own security and fraud-prevention purposes, as described in its privacy notice. The check is largely automated; if you think a result is wrong, contact us and we will have it reviewed by a person.
We have set our identity provider to keep verification data for 30 days, after which it is deleted. The certificate keeps only the outcome and its date.
Reusing a result. If you verified your identity for a wallet within the last 12 months and later need another certificate for the same wallet, we offer to reuse that outcome instead of a new document and selfie check. We only do this if you tick the box agreeing to it, after you have signed with the wallet again. We reuse only the outcome and its date, never documents or images (which we don't hold). If the new certificate is for a company that asked you to verify, that company sees the reused outcome. AML screening of the wallet is always done again.
Single facts for a company. A company that asks you to verify can ask for specific facts instead of your documents: whether you're over 18 or 21, the country that issued your ID, your nationality, and whether the identity provider's sanctions and PEP screening found you. We tell you which facts it will see before you start. We read them from the identity provider's result, share only those with that company, and keep the facts (never your date of birth) on our register record so they can be reused with your consent as above.
Proof of funds. If a company asks for it, and you're told before you sign, we record the balances your wallet holds at that moment (read from the public blockchain) and share that snapshot with that company.
Business certificates
For a Business certificate, our identity provider Didit checks the company against its official registry (name, number, status, officers and owners) and screens the company against sanctions lists. The person ordering the certificate names the directors and owners the check asks for; each of them is sent their own identity check (document, selfie and liveness, as above) and gives their own consent before it starts. We receive the company's registry details and the outcome of each check, not the people's documents. The certificate shows the company's registered name, number and country and how many key people were verified, never their names. For a multisig wallet, the signing room holds only public data (the wallet address, the request text, signatures and public keys) and is deleted after 7 days; a Bitcoin wallet descriptor is used in your browser to make the signing file and is never sent to us.
Wallets and sign-in options
If you choose "Create a wallet with email", your email is sent to Privy to create a non-custodial wallet; Privy never gives us or anyone else your private key. If you connect a wallet on your phone, WalletConnect (Reown) relays the connection. These tools store connection details in your browser while you use them. We never ask for, or receive, your recovery phrase or private keys.
Website statistics
To understand how people find and use the site, we count page views without cookies and without storing IP addresses. When a page loads, it tells us the page, the site that sent you there (if your browser shares it), any campaign tags in the link, your browser's language, and the type of device and browser. Cloudflare, which hosts the site, tells us your country. To count each visitor once a day, we combine your IP address and browser details with a secret value and keep only the resulting code, which changes every day and can't be turned back into your IP address. We keep these statistics for 13 months, use them only to improve the site and our marketing, and never sell them or use them to build profiles of individuals. Our legal basis is our legitimate interest in running and improving the site.
Who we share data with
- Stripe: payments.
- Didit and, where enabled, Sumsub: identity verification, sanctions/PEP screening, and (Didit) wallet screening.
- Privy: email wallets, if you choose one. WalletConnect (Reown): phone wallet connections, if you use one.
- Resend: sending your certificate email, where enabled.
- Cloudflare: hosting, security and the data store.
- TON Connect: if you connect a TON wallet, the connection is relayed through your wallet's TON Connect bridge; it carries your wallet address and the signed proof.
- Public blockchain nodes (PublicNode, or another node provider we choose) and Safe's public message service: for smart-contract wallets only, we send the wallet address and the signed message to check the signature on its network. No other personal data is sent.
Each acts on our instructions under a data processing agreement, except where stated above. We share data with authorities only where the law requires it.
International transfers
Some of these providers process data outside the UK (for example in the EU or the United States). Where they do, we rely on UK adequacy regulations or the UK International Data Transfer Agreement / Addendum to protect your data.
How long we keep it
- Certificates: for as long as the certificate exists, because it's meant to be lasting proof. You can ask us to revoke or remove it at any time.
- Unpaid checkout requests: deleted automatically after 24 hours.
- Contact-form messages: one year, then deleted automatically.
- Payment and accounting records (including your email): 6 years, as required for tax and accounting.
- Identity verification data at our provider: 30 days.
- Security logs: as set by our hosting provider, typically a short period.
Your rights
You can ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, or to have it in a portable format. Where we rely on consent (the biometric part of identity checks), you can withdraw it at any time; this doesn't affect checks already done. Email [email protected] and we'll reply within one month.
If you ask us to delete a certificate, we remove its page and data from our register. Anyone who already saved a copy of the signatures could still check them, because that's how independent verification works.
You can also complain to the Information Commissioner's Office (ico.org.uk), though we'd appreciate the chance to put things right first.
Changes
We'll update this page if anything changes, and change the date at the top.