# Privacy Policy (EN) Last updated: 2026‑06‑18 This Policy is an integral part of the IMBA Wallet Terms of Use. It governs the relationship between **Asha Wallet LLC** (OGRN: 124PA000984, TIN (INN): 11031596, address: 58 R. Barcic St., Gagra, Republic of Abkhazia) ("we"), the owner of the IMBA Wallet application (the "Service"), and you ("User" or "you"), and describes what personal data we process when you use the Service and for what purposes. "Client", "User" and "you" mean the individual using the Service. "Operator" means **Asha Wallet LLC** (Republic of Abkhazia), the owner of the IMBA Wallet brand. ## 1. Data Controller The data controller is **Asha Wallet LLC (ООО «Аша Воллет»)** — a legal entity registered and operating in the **Republic of Abkhazia**. **IMBA Wallet** is the commercial designation (brand) of the Service; personal data processing within the Service is carried out by Asha Wallet LLC, not by the IMBA Wallet brand as a separate entity. **Operator details:** - **Legal name:** Asha Wallet LLC (Общество с ограниченной ответственностью «Аша Воллет») - **Address:** 58 R. Barcic St., Gagra, Republic of Abkhazia - **TIN (INN):** 11031596 · **KPP:** 211001521 · **OKPO:** 51469661 · **OGRN:** 124PA000984 - **E-mail:** support@imbawallet.com The Operator processes personal data **to the extent necessary for the Service interface**, the Client's account, storage of digital assets on the internal balance and forwarding instructions to partners. Certain operations (RUB ↔ USDT exchange, card issuance, bank accounts) are performed by partners and contractors; their data processing is also governed by their policies. ## 2. Data We Process ### 2.1. Authentication Data - Telegram Mini App (`initData`): user_id, username, first/last name (if provided by Telegram), language, timestamp and signature — used for authenticity, identity verification and login. - Access/refresh tokens generated after login. ### 2.2. Profile Data - username (Telegram or provided manually when using other login methods), first name, last name, middle name (if any), phone, email, notification settings, app language, if provided by the user or obtained from Telegram, stored in encrypted form. ### 2.3. Financial and Operational Data (within Service functionality) - **Digital asset balances** (e.g., USDT) accounted by the Operator on the Client's internal balance in the Service. - **Transaction history** in the Service, statuses of instructions forwarded to partners and contractors. - **Virtual card data**: identifiers, types, masked numbers, statuses, aliases — to the extent received from card issuance partners for display in the interface. - **Saved payout details and addresses** (bank details, blockchain addresses) provided by the Client for operations. - **Data required to initiate exchange and conversion** (amounts, operation directions, partner transaction identifiers) — for forwarding to contractor (Achyumchara LLC) and/or partner bank (Altyn Bank). **The Operator does not store Clients' rubles** on its own balances. Information about ruble operations, bank accounts and cards opened with partner banks may be **displayed in the interface** based on data received from partners but **does not mean** that the Operator stores the Client's ruble funds. ### 2.4. Technical Data - Server/client logs (anonymized to the extent reasonably possible), device/browser info, IP, language, time zone, basic error diagnostics. ### 2.5. Cookies/Analytics/Telemetry (anonymized) - Session and functional cookies for the web app. - Usage analytics (aggregated, without attempting identification), performance and stability telemetry, A/B metrics. Providers may change; their policies apply. ## 3. Sources - Directly from the Client when using the Service. - From Telegram (within Telegram Mini App). - From partners and contractors when executing operations — to the extent necessary to display statuses, history and execute the Client's instructions (including from Achyumchara LLC, Altyn Bank, card issuance partners, partner banks). ## 4. Purposes - Authentication, authorization, security. - Providing Service features (profile, notifications, digital asset accounting, cards, payout details, transactions, forwarding instructions to partners). - Support, quality improvement, error diagnostics. - Fulfilling legal obligations and compliance requirements. - Contacting the Client regarding technical, financial or legal matters. ## 5. Storage and Retention - Data is stored indefinitely unless otherwise required by law or operational obligations. - Tokens and sessions are time-limited. - Personal and financial data may be deleted no earlier than five years after the Client's request — subject to the law of the Republic of Abkhazia and retention requirements for operation records. ## 6. Sharing with Third Parties - **Partners and contractors** (including Achyumchara LLC, Altyn Bank, card issuance partners, partner banks) — to the extent necessary to perform operations initiated by the Client through the Service. - Payment and infrastructure providers — to the extent necessary for Service operation. - Analytics/telemetry providers — in anonymized/aggregated form, without attempting identification. - As required by law — to competent authorities. ## 7. Your Rights Subject to applicable law of the Republic of Abkhazia, you may: - access information about your data and obtain copies; - correct inaccuracies (profile can be edited except fields obtained from Telegram for that login method); - request deletion/restriction (where not conflicting with law/obligations and operation-record retention requirements); - object to processing and exercise portability where applicable. ## 8. Security The Operator employs reasonable safeguards. No system is absolutely secure. The Client must keep PIN and tokens secret and use secure devices. If the Client does not enable two-factor authentication, the Operator bears no liability for the safety of the Client's funds to the extent set out in the Terms of Use. ## 9. International Transfers Data may be processed on servers in various countries. Appropriate safeguards and contractual mechanisms are used for transfers. ## 10. Governing Law This Policy is governed by the **law of the Republic of Abkhazia**. Personal data is processed by the Operator registered and operating in the **Republic of Abkhazia**. ## 11. Changes The Operator may update this Policy. Material changes will be communicated in the app or on the website. Continued use of the Service constitutes acceptance of the updates. ## 12. Contact and Operator Details **Asha Wallet LLC (ООО «Аша Воллет»)** 58 R. Barcic St., Gagra, Republic of Abkhazia TIN 11031596 · KPP 211001521 · OKPO 51469661 · OGRN 124PA000984 E-mail: support@imbawallet.com --- ## Appendix A. Login metadata (login history) The Operator collects and stores the following metadata for login attempts and authorizations: - Event date and time - IP address - Geo by IP (country, city) — approximate, from external sources, may be inaccurate - Client/device: app/browser and platform (e.g., Telegram Android app, iOS app, Chrome on Windows, Not defined) - Technical session identifier (hash) - Result (success/failure) Purposes: security, audit, anti-fraud, incident investigation, Client notifications about logins, UX improvements (e.g., suspicious-session hints). Retention: as per general retention terms in "Storage and Retention". The Client may request export/deletion subject to applicable law.