Privacy Policy

Last updated 3 November 2026

1. About this policy

This Privacy Policy explains how Manultas ("we", "us") collects, uses and shares personal data when you visit manultas.com and its subdomains, use our web application, API, alerts and reports (together, the "Services"), or contact us. Manultas is the controller of that personal data. We process it in line with the Data Protection Act, 2021 of the British Virgin Islands and, where they apply to you, the EU and UK General Data Protection Regulations and US state privacy laws. This policy forms part of our Terms of Service; our Cookie Policy explains the cookies and similar technologies we use.

2. Our approach

Manultas analyses public blockchains: it follows funds across addresses, chains, bridges and swaps, and maps the organisations around a token. A few principles guide how we handle data:

• The addresses you search, and the maps, labels and notes you create, are private to your account. We do not add them to the public dataset or show them to other users.
• We do not sell personal data, and we do not share it for cross-context behavioural advertising.
• We use no advertising or marketing cookies. Analytics cookies are on unless you turn them off.

3. Data we collect

Data you give us

• Account data: name, email address, password (stored only as a hash), organisation and role, or the wallet address you sign in with.
• Billing data: billing name and address, VAT number and payment history. Card and bank details are processed by our payment provider; we do not store full card numbers.
• Workspace content: addresses you search or import, panoramas and traces you save, labels, notes, watchlists, alert rules and exports.
• Communications: messages to support, access requests, survey answers and feedback.
• Marketing preferences: whether you want to hear from us, and your choices about cookies.

Data collected automatically

• Device and log data: IP address, approximate location derived from it, browser and operating system, referring page, and the time of each request.
• Usage data: pages and features used, searches run, errors, and API calls (key, endpoint, volume).
• Cookies and similar technologies: see section 7 and our Cookie Policy.

Data from other sources

• Public blockchains: transactions, balances and smart-contract activity recorded on public ledgers.
• Public sources: exchange and protocol disclosures, court and regulatory filings, sanctions lists, company registers, news, and official social media accounts. We use these to label addresses that belong to organisations.
• Service providers: payment confirmations and fraud signals.

4. How we use it, and our legal bases

We do not use your workspace content to train machine learning models made available to others.

5. How we share it

• Service providers that host, run and support the Services for us (cloud hosting, content delivery, blockchain node access, payments, email, customer support and analytics by Google Analytics). They act on our instructions and under contract.
• Professional advisers, such as lawyers, auditors and insurers.
• Authorities, when the law requires it, or to protect the rights, property or safety of Manultas, our users or the public. Where we can, we tell the user concerned first.
• A buyer or successor, in a merger, acquisition, financing or sale of assets, under confidentiality and this policy.
• Others you choose: for example, when you share a map link or send an export to a colleague.

We do not sell personal data and do not "share" it, as those terms are used in California law.

6. Blockchain data and people on our maps

Public blockchain records can relate to people who do not use Manultas. We process them under our legitimate interests, and the interests of our users and the public, in tracing stolen funds, preventing fraud and financial crime, and understanding public markets. We limit this as follows:

• We label addresses that belong to organisations (exchanges, protocols, funds, issuers and public bodies) from public evidence, and we show the evidence or its type.
• We do not name the person behind a private wallet unless that link has already been made public by the person themselves, a court or a regulator, and it is relevant.
• Links between addresses and amounts on a map are analytical estimates and can be wrong.

If you believe a label or link relates to you and is inaccurate, or you object to it, write to support@manultas.com. We will review it and correct, restrict or remove it where appropriate.

7. Cookies

We use strictly necessary cookies and local storage to sign you in, keep the Services secure, and remember settings you choose and your cookie choices. We also use Google Analytics 4, with Google signals and advertising features turned off. We do not use advertising or marketing cookies. You can turn analytics off at any time through Cookie settings in the footer. We honour Global Privacy Control signals as an opt-out of analytics cookies; we do not respond to Do Not Track signals, as there is no common standard for them. Details are in our Cookie Policy.

8. International transfers

We and our service providers process data in several countries, including the United States and the European Union. When we transfer personal data out of the EEA, the UK or Switzerland, we rely on an adequacy decision or on the European Commission's Standard Contractual Clauses (with the UK addendum where needed), together with additional safeguards where appropriate. Google, which provides our analytics, is certified under the EU-US Data Privacy Framework. You can ask us for a copy of the relevant safeguards.

9. Retention

• Account data and workspace content: while your account is open, and deleted within 90 days after it is closed.
• Billing records: as long as tax and accounting law requires, usually 7 years.
• Server and security logs: up to 90 days, longer only while investigating an incident.
• Analytics data (Google Analytics): 14 months.
• Support messages: up to 3 years after the conversation ends.
• Marketing data: until you opt out or withdraw consent.

We may keep data longer where the law requires it or to resolve disputes, and we may keep aggregated or de-identified data that no longer identifies you.

10. Security

We protect personal data with encryption in transit and at rest, access controls, logging and regular review of our systems and providers. No system is perfectly secure; if a breach affects your personal data, we will notify you and the relevant authorities as the law requires.

11. Your rights

Depending on where you live, you may have the right to:

• access the personal data we hold about you and receive a copy;
• correct inaccurate data;
• delete your data;
• restrict or object to our processing, including processing based on legitimate interests and direct marketing;
• receive your data in a portable format;
• withdraw consent at any time, without affecting earlier processing;
• complain to your data protection authority.

California residents also have the right to know what personal information we collect, use and disclose; to delete and correct it; to opt out of its sale or sharing (we do neither); to limit the use of sensitive personal information (we do not use it for inferring characteristics); and not to be treated differently for exercising these rights. You may use an authorised agent.

To exercise a right, write to support@manultas.com. We will verify your request and reply within one month (45 days for California requests), and tell you if we need more time as the law allows. Account holders can also edit or delete most data in their account settings.

12. Children

The Services are not intended for anyone under 18, and we do not knowingly collect their personal data. If you believe a child has given us personal data, contact us and we will delete it.

13. Changes

We may update this policy from time to time. We will change the date at the top, and for material changes we will notify account holders by email or in the Services before the changes take effect.

14. Contact

Privacy questions and requests: support@manultas.com
Manultas, British Virgin Islands