Privacy Policy

Last Updated: October 2026

1. Introduction

MarketApp Limited (hereinafter “we”, “us”, “our”, “Company”, “BLASK” or the “Platform”) is strongly committed to protecting your privacy and complying with your choices. Both personal and non-personal data collected is safeguarded according to high privacy and data protection standards. We execute a robust data protection program designed to comply with applicable data protection laws, including the General Data Protection Regulation (Regulation (EU) 2016/679) (“GDPR”).

In accordance with Article 5 of the GDPR, personal data shall be:

a. Processed lawfully, fairly, and in a transparent manner in relation to individuals;
b. Collected for specified, explicit, and legitimate purposes and not further processed in a manner incompatible with those purposes;
c. Adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed;
d. Accurate and, where necessary, kept up to date, with every reasonable step taken to ensure inaccurate data is erased or rectified without delay;
e. Kept in a form that permits identification of data subjects for no longer than is necessary for the purposes for which the personal data is processed, subject to statutory storage and archiving obligations; and
f. Processed in a manner that ensures appropriate security, including protection against unauthorized or unlawful processing and accidental loss, destruction, or damage, using appropriate technical and organizational measures.

2. Data Collection

We collect personal data directly from you, automatically through your interaction with the Platform, through service providers and, where applicable, licensed third-party data suppliers:

Account and Contact Data: Name, email address, username, billing details, and any other communication details you provide directly to us.
Usage and Technical Data: IP address, browser type, operating system, device identifiers, log files, and data collected through cookies and similar tracking technologies.
AI Interaction Data: If you use Ask Blask, we may process your prompts, chat history, generated responses, relevant Platform information made available to answer your requests, and associated account or organization identifiers.
AI Usage and Billing Data: For chargeable AI functionality, we process request timestamps, token and tool usage, usage charges, balance checks, and credit or payment records necessary to administer the service.
Third-Party Analytics Data: Where licensed datasets used to produce market intelligence include personal data (including pseudonymized identifiers or browsing-event information), we process such data only subject to the applicable data-protection requirements. Aggregated data that cannot reasonably identify an individual is not personal data under the GDPR.
Payment and Crypto-Asset Data: When you pay for services using fiat or crypto-assets, we and our payment providers collect transaction-related metadata, including:
- Public blockchain wallet addresses (originating and receiving addresses);
- Transaction identifiers/hashes (TxID);
- Crypto-asset type, quantity, network details, and network (gas) fees;
- Fiat-denominated invoice reference and exchange rate quotation timestamps; and
- Payment status, confirmations, and verification timestamps.
- Note: The Platform does not access, collect, or store your private cryptographic keys, seed phrases, or credentials for personal unhosted wallets.

3. Data Use and Legal Bases for Processing

We process your personal data for the following specified purposes and legal grounds under Article 6 of the GDPR:

Performance of a Contract (GDPR Art. 6(1)(b)): To deliver, administer, and maintain the Platform and services; to process invoices, fiscal settlements, and crypto-asset payments; to activate licenses; and to provide technical support and transactional notices.
Legal and Regulatory Compliance (GDPR Art. 6(1)(c)): To fulfill statutory accounting, taxation, and corporate record-keeping requirements; to assist authorized payment providers with anti-money laundering (AML), counter-terrorist financing (CTF), and sanctions compliance (including the EU Transfer of Funds Regulation); and to respond to lawful regulatory requests.
Legitimate Interests (GDPR Art. 6(1)(f)): To detect, prevent, and mitigate fraud, security vulnerabilities, or technical issues; to verify blockchain payment finality; and to protect our legal rights, claims, and operational integrity.
Consent (GDPR Art. 6(1)(a)): To transmit direct marketing communications and run non-essential analytical or marketing cookies, where required by applicable law. Consent may be withdrawn at any time.
AI Services: Where necessary to provide Ask Blask to a contracting individual, we rely on Article 6(1)(b). For administration of business accounts, service security and reasonable prevention of misuse, we may rely on Article 6(1)(f), subject to the required balancing of interests. Where requests contain personal data about other individuals, the applicable legal basis and the roles of the parties depend on the particular processing context.
Licensed Analytics Data: Where externally sourced analytics datasets contain personal data, the relevant lawful basis and transparency obligations are assessed for the particular dataset and intended use before that data is incorporated into the Platform.

4. Blockchain and Distributed Ledger Technology

Payment processing via crypto-assets involves broadcasting transaction records to public, decentralized blockchains. You acknowledge and understand that:

Public Ledger Visibility: Public blockchain ledgers are transparent and accessible worldwide. Your public wallet address, transaction amount, and transaction hash (TxID) are published to the public network as an inherent technical component of distributed ledger technology.
Immutability of On-Chain Records: Data written to a public blockchain is permanent and immutable. Due to the decentralized and cryptographic nature of blockchain networks, transaction records permanently stored on-chain cannot technically be modified, rectified, restricted, or erased by the Company, our payment processors, or any central authority.
Application of Privacy Rights: Your statutory data protection rights (including erasure and rectification under Articles 16 and 17 of the GDPR) remain fully exercisable with respect to centralized databases controlled by the Company, but cannot technically be executed on public, decentralized blockchain ledgers.

We do not sell your personal data. We share personal data only in the following limited circumstances:

Third-Party Payment Providers: Payments (including crypto-asset settlements) are processed through independent, regulated third-party payment gateways. These payment providers operate as independent data controllers in respect of transaction processing, identity verification, wallet screening, and compliance with anti-money laundering, sanctions, and Travel Rule regulations. Their collection and processing of your data are governed strictly by their respective privacy notices and regulatory licenses.
Service Providers (Processors): We engage third-party service providers who assist us in hosting, database management, security monitoring, and customer support. These providers process data on our documented instructions, subject to confidentiality agreements and data processing terms that meet GDPR Article 28 requirements.
AI Model, Routing and Search Providers: To provide Ask Blask, we may transmit prompts and the limited context necessary to answer them to AI-routing, language-model and web-search providers, including OpenRouter and Exa where used. The actual model provider may depend on the selected configuration and availability. These providers may receive personal data included in the request or contextual data. Their data-protection roles and applicable contractual safeguards are determined by the relevant services and processing arrangements.
Licensed Data Suppliers: We may obtain market intelligence datasets from external suppliers, including Datos where integrated. We assess whether such datasets contain personal data and apply the corresponding contractual, legal-basis and transparency requirements before processing them for our analytics purposes.
Legal and Regulatory Authorities: We may disclose data where required to do so by applicable statutory law, court orders, or enforceable requests from supervisory authorities.

6. International Data Transfers

Where personal data is transferred to, stored at, or processed in countries outside the European Economic Area (EEA), we ensure an adequate level of protection is maintained in accordance with Chapter V of the GDPR by implementing one of the following mechanisms:

Transferring data to countries recognized by the European Commission as providing an adequate level of data protection;
Executing Standard Contractual Clauses (SCCs) approved by the European Commission, accompanied by supplementary technical, organizational, and contractual risk assessments where appropriate; or
Other legally recognized transfer mechanisms and statutory derogations under Article 49 of the GDPR where strictly necessary for the performance of our contract with you.

7. Data Security

We implement technical and organizational security measures designed to protect your personal data against accidental loss, unauthorized access, alteration, destruction, or disclosure. These measures include transport layer encryption (TLS), role-based access controls, administrative safeguards, and periodic vulnerability reviews. However, while we employ security safeguards, no method of transmission over the internet or electronic storage is completely secure, and we cannot guarantee absolute security.

Ask Blask Processing: We apply access controls and other technical and organizational measures intended to limit the account context disclosed to AI service providers to what is needed for the requested functionality.

8. Data Retention and Deletion

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, as specified in this Policy, or as required to comply with our statutory obligations:

Operational Account Data: Maintained for the duration of your active account plus a reasonable period thereafter to resolve disputes or enforce agreements.
AI Chat History and Request Logs: Chat content, generated responses and related technical logs are kept only for as long as needed to provide the requested features, support user account functionality, investigate abuse or security incidents, resolve billing disputes and satisfy applicable legal obligations. The applicable period may depend on account settings, the category of data and the relevant provider configuration.
Third-Party Analytics Data: Retention of licensed datasets and derived data is determined by the applicable license terms, the character of the data and any statutory retention or deletion obligations. If the data is personal data, GDPR storage-limitation requirements apply.
Financial and Transaction Records: In accordance with Cyprus tax, corporate, and accounting regulations, records of payments, invoices, and transaction settlements are retained for up to seven (7) years following the close of the relevant financial year.
On-Chain Data: Data broadcast to public blockchain ledgers persists indefinitely due to the immutable design of distributed ledger networks.
Deletion Requests: You may request the deletion of your account data at any time. We will erase or anonymize eligible personal data, excluding data we are legally required or authorized to retain under statutory retention frameworks, legitimate interest defenses, or records embedded in public blockchains. Requests concerning eligible AI chat data may also be submitted using the contact details in Section 12.

9. Data Subject Rights

Under the GDPR and applicable data protection legislation, you are entitled to the following rights:

Right of Access (Art. 15): Request confirmation of and access to the personal data we hold about you.
Right to Rectification (Art. 16): Request correction of inaccurate or incomplete personal data (subject to blockchain technical immutability).
Right to Erasure (Art. 17): Request deletion of your personal data where lawful grounds apply.
Right to Restriction of Processing (Art. 18): Request restriction of processing under certain statutory circumstances.
Right to Data Portability (Art. 20): Request transmission of your personal data to you or a third party in a structured, machine-readable format.
Right to Object (Art. 21): Object to data processing based on legitimate interests or direct marketing.
Right to Withdraw Consent: Withdraw previously granted consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.
Right to Lodge a Complaint: Lodge a complaint with the competent supervisory authority (in Cyprus, the Office of the Commissioner for Personal Data Protection, accessible at dataprotection.gov.cy).

To exercise any of these rights, contact our Data Protection Officer at: legal@marketapp.cy.

10. Cookies and Tracking Technologies

Non-essential cookies, analytics tags, and tracking technologies are managed separately via our cookie interface, which allows you to grant, manage, or withdraw cookie consent at any time. Further details regarding specific cookie categories and durations are provided in our dedicated Cookie Notice.

11. Amendments

We reserve the right to amend this Privacy Policy from time to time to reflect operational, technological, or legal developments. When changes occur, we will update the “Last Updated” date at the top of this Policy and notify you through the Platform interface or via your registered email address. We encourage you to review this Policy periodically to remain informed of our data practices.

12. Contact Us

If you have questions, feedback, or requests concerning this Privacy Policy, our data processing practices, or your statutory data subject rights, please direct your correspondence to our Data Protection Officer:

Company: MarketApp Limited
Designation: Data Protection Officer
Email: legal@marketapp.cy