Bisotun Wallet — Privacy Policy
Effective date: [EFFECTIVE_DATE] Published at: https://wallet.bisotun.app/en/privacy
1. Who we are
Bisotun Wallet ("Bisotun", "we") is a privacy-preserving digital identity wallet. The Bisotun services are operated and hosted by [OPERATOR_NAME], [OPERATOR_ADDRESS] (the "operator"), which is responsible for the processing of personal data described in this policy.
Contact: support@bisotun.app
2. Our principles
- Your data stays on your phone. The cards and data in your wallet are stored on your own device. We cannot see which cards you have or what they contain.
- We do not see what you share. When you share data with a requestor (an organisation that asks for your data), it goes directly from your phone to that requestor. We do not learn what you shared or with whom.
- No tracking. The app and our websites contain no advertising, no analytics or tracking tools and no third-party trackers. We do not sell or rent personal data.
- Data minimisation. Our servers store only what is strictly necessary to protect your wallet, as described below.
3. Data stored on your phone
The following data is stored only on your device and is never sent to us:
- the cards (credentials) you have received from issuers, and the data they contain;
- the secret keys of your wallet, protected by your PIN;
- your local activity history (which cards you received, and which data you shared with whom and when);
- your app settings, such as language.
Your PIN itself is never stored in readable form, neither on your phone nor on our servers. If you uninstall the app or reset your wallet, this data is deleted from your phone. We cannot recover it.
4. Data stored on our server
To protect your wallet against misuse if your phone is lost or stolen, part of the cryptographic protection of your wallet runs on our server (the "keyshare server"). For this purpose we store:
| Data | Purpose | Retention |
|---|---|---|
| Your wallet ID (a random identifier, not linked to your name) | Recognising your wallet | Until your account is deleted |
| A share of your wallet's secret key, and data derived from your PIN that allows us to check it (never the PIN itself) | Ensuring your wallet can only be used together with your PIN, and blocking it after too many wrong attempts | Until your account is deleted |
| Your e-mail address(es), if you choose to provide them | Logging in to My Bisotun, blocking your wallet remotely, and sending you security notifications (e.g. about deletion) | Until you remove the address or your account is deleted |
| Activity log: the time of PIN checks, blocked attempts and wallet sessions | Showing you your wallet's usage in My Bisotun, and detecting misuse | [LOG_RETENTION_PERIOD] |
| Date your wallet was last used, and your preferred language | Deleting unused accounts; sending e-mails in your language | Until your account is deleted |
The activity log does not contain which data you shared, with which requestor, or where you were.
Technical data such as IP addresses may be processed briefly in server logs for security and to keep the service running. These logs are retained for no longer than [SERVER_LOG_RETENTION_PERIOD].
5. E-mail verification
If you add an e-mail address to your wallet, our e-mail issuer sends a verification message to that address. The address is processed only to send this message and to issue the e-mail card to your wallet. Verification links and codes expire automatically. E-mails are sent from noreply@bisotun.app.
6. My Bisotun
In the My Bisotun portal (https://mycer.bisotun.app/) you can view your activity log, manage your e-mail addresses, block your wallet and delete your account. My Bisotun uses only what is necessary to keep you logged in during your visit; it uses no tracking cookies.
7. Issuers and requestors
Issuers (organisations that give you cards) and requestors (organisations that ask for your data) are independent parties. When you receive a card or share data, their own privacy policies apply to the data they process. The app always shows you who is asking and what is being asked before you decide.
8. Deletion of your data
- You can delete your account at any time in My Bisotun or in the app. Server data is then deleted within [DELETION_PERIOD_DAYS] days.
- If your wallet has not been used for [INACTIVITY_PERIOD], we will notify you by e-mail (if provided) and then delete your account.
- Data on your phone is deleted when you reset the wallet or uninstall the app.
9. Security
We protect our servers and your data with appropriate technical and organisational measures, including encryption in transit, access restrictions and a design in which the server never receives the contents of your cards.
10. Legal basis and your rights
[LEGAL_BASIS_AND_APPLICABLE_LAW — to be completed by the lawyer.]
Depending on applicable law, you may have the right to access, correct or delete your personal data, to object to or restrict its processing, and to lodge a complaint with a supervisory authority. To exercise your rights, contact support@bisotun.app.
11. Changes
We may update this policy. Material changes will be announced in the app or on https://wallet.bisotun.app/en/privacy before they take effect.
12. Contact
Questions about privacy: support@bisotun.app Security issues: security@bisotun.app