Privacy Policy – Auras Wallet

Effective Date: 7 July 2026

1. Introduction

AurasPay EU OÜ (“AurasPay”, “we”, “us”, or “our”) respects your privacy and is committed to protecting your personal data.

This Privacy Policy explains how we collect, use, disclose, store, and protect personal data when you access or use the Auras Wallet mobile application, website, software, and related services collectively referred to as the “Wallet”.

AurasPay EU OÜ is a private limited company incorporated in the Republic of Estonia under registry code 17537945, with its registered office at Tornimäe tn 5, Tallinn 10145, Estonia.

For the personal data processed for the purposes described in this Privacy Policy, AurasPay EU OÜ acts as the data controller.

We process personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”), the Estonian Personal Data Protection Act, and other applicable data-protection laws.

2. Nature of Auras Wallet

Auras Wallet is a self-custodial and non-custodial software wallet.

AurasPay does not:

• hold or control users’ digital assets;
• store or have access to users’ private keys or recovery phrases;
• maintain custodial accounts or balances for users;
• authorise blockchain transactions on behalf of users; or
• have the ability to recover, reverse, freeze, or modify blockchain transactions.

Private keys and recovery information are generated and stored on the user’s device or otherwise remain under the user’s exclusive control.

Public wallet addresses, token balances, and transaction records may be publicly visible through the relevant blockchain network. Public blockchain information is not created or controlled by AurasPay and may remain permanently available on the blockchain.

3. Personal Data We May Collect

Depending on how you use the Wallet, we may collect or process the following categories of personal data:

3.1 Information You Provide

• Email address or contact information when you contact support;
• Information contained in support requests, complaints, or correspondence;
• Feedback or information voluntarily submitted through the Wallet;
• Communication preferences, where available; and
• Any other information you choose to provide to us.

3.2 Technical and Device Information

• Device type and device model;
• Operating-system type and version;
• Application version;
• Language and regional settings;
• IP address;
• Log files and timestamps;
• Crash reports and diagnostic information;
• Security and fraud-prevention information; and
• Information concerning how Wallet features are accessed and used.

3.3 Wallet and Blockchain Information

To provide Wallet functionality, we may process:

• Public wallet addresses;
• Blockchain network information;
• Token identifiers;
• Public token balances;
• Public blockchain transaction information;
• Transaction hashes; and
• Network and gas-fee information.

We do not collect or store your private keys or complete recovery phrase.

Information recorded on a public blockchain may be viewed, copied, or processed by third parties independently of AurasPay.

4. How We Use Personal Data

We may use personal data to:

• provide and maintain the Wallet;
• display public wallet balances and blockchain transactions;
• process and respond to support requests;
• diagnose errors, crashes, and technical problems;
• improve Wallet functionality and user experience;
• protect the security and integrity of the Wallet;
• detect misuse, fraud, cyberattacks, or prohibited activity;
• communicate material service or policy updates;
• comply with applicable legal obligations;
• establish, exercise, or defend legal claims; and
• integrate optional third-party services requested by users.

We do not sell personal data.

5. Legal Bases for Processing

We process personal data under one or more of the following legal bases:

5.1 Performance of a Contract

Processing that is necessary to provide Wallet functionality or respond to a service request initiated by you.

5.2 Legitimate Interests

Processing that is necessary for our legitimate interests, including:

• maintaining and improving the Wallet;
• protecting the Wallet and our infrastructure;
• preventing fraud and misuse;
• troubleshooting technical issues;
• responding to support requests; and
• establishing or defending legal claims.

We rely on legitimate interests only where those interests are not overridden by your fundamental rights and freedoms.

5.3 Consent

Where required, we request your consent before using optional analytics, tracking technologies, notifications, or similar features.

You may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing performed before consent was withdrawn.

5.4 Legal Obligations

We may process personal data where necessary to comply with a legal, regulatory, judicial, or governmental requirement applicable to AurasPay.

6. Analytics, Diagnostics, and Tracking Technologies

We may use third-party analytics, performance, and crash-reporting tools, including services provided by Google such as Firebase, Google Analytics for Firebase, and Crashlytics.

Depending on the configuration and your device settings, these tools may process:

• device and application identifiers;
• IP address;
• device and operating-system information;
• usage events;
• application performance information;
• crash logs; and
• diagnostic data.

Optional analytics technologies will be used on the basis of consent where consent is required by applicable law.

Technical processing strictly necessary for security, application functionality, or error diagnosis may be based on our legitimate interests.

You may be able to control certain analytics and device permissions through the Wallet settings or your mobile-device settings.

7. Third-Party Integrations

The Wallet may allow users to access independent third-party services, including:

• fiat-to-crypto service providers;
• decentralised exchanges and liquidity aggregators;
• blockchain infrastructure providers;
• gift card and digital voucher providers;
• virtual-card or payment-card providers; and
• decentralised applications and blockchain protocols.

Third-party services are optional and are initiated by the user.

Each third-party provider is responsible for the personal data it collects and processes under its own terms and privacy policy.

AurasPay is not responsible for the privacy practices, security, availability, or regulatory compliance of an independent third-party provider.

8. Transak Integration

Auras Wallet may provide users with optional access to fiat-to-crypto services supplied by Transak.

When you choose to use Transak, the Wallet may provide Transak with limited information necessary to initiate the requested service, such as:

• your public destination wallet address;
• the selected blockchain network;
• the selected digital asset;
• the transaction amount or currency;
• your country or region, where applicable; and
• technical integration information.

Transak independently collects and processes information required to provide its services, which may include:

• identity-verification and KYC information;
• identification documents;
• facial-verification or biometric information;
• payment information;
• bank or payment-card details;
• transaction and compliance information; and
• sanctions, fraud, and anti-money-laundering screening information.

Transak acts as an independent data controller for the personal data it processes for identity verification, regulatory compliance, payment processing, and delivery of its services.

AurasPay does not receive or store your complete identification documents, payment-card credentials, bank-account credentials, or biometric verification information collected directly by Transak.

AurasPay may receive limited information from Transak, such as:

• a transaction reference;
• transaction status;
• selected asset and amount;
• destination wallet address; and
• completion, cancellation, or failure information.

Your use of Transak is governed by Transak’s own terms of service and privacy policy.

9. Other Third-Party Services

The Wallet may also integrate with or provide access to services such as:

• Jupiter or other decentralised liquidity aggregators;
• blockchain RPC and infrastructure providers;
• gift card and digital voucher providers; and
• independent card issuers or programme managers.

When you connect to or use a decentralised protocol, your public wallet address and transaction data may be visible to that protocol, its infrastructure providers, blockchain validators, analytics providers, and the public.

AurasPay does not control decentralised protocols or public blockchain networks.

Services that are not currently active or available in the Wallet should not be considered part of the service solely because they are mentioned in this Privacy Policy.

10. Customer Support

When you submit a support request, we may collect:

• your name or email address;
• the contents of your request;
• public wallet addresses voluntarily supplied by you;
• screenshots or attachments;
• device and application information; and
• previous correspondence concerning the issue.

We use this information to investigate and respond to your request, maintain service records, improve our support process, and protect against misuse.

You must not send us your private key, complete recovery phrase, payment-card password, or other secret authentication information.

AurasPay personnel will never request your complete recovery phrase or private key.

11. Sharing of Personal Data

We may share personal data with:

• cloud-hosting and infrastructure providers;
• analytics and diagnostic service providers;
• customer-support providers;
• cybersecurity and fraud-prevention providers;
• legal, accounting, and professional advisers;
• competent courts, regulators, or public authorities where legally required;
• third-party services expressly selected by you; and
• a purchaser, successor, or corporate affiliate in connection with a merger, financing, restructuring, or sale of all or part of our business.

We require service providers processing personal data on our behalf to protect the data and process it only in accordance with our documented instructions and applicable law.

Independent third-party controllers, including Transak, process personal data under their own policies and responsibilities.

12. International Data Transfers

Some service providers may process personal data outside Estonia or the European Economic Area.

Where personal data is transferred outside the European Economic Area, we use an applicable lawful transfer mechanism where required, which may include:

• an adequacy decision adopted by the European Commission;
• European Commission Standard Contractual Clauses;
• supplementary technical and organisational safeguards; or
• another transfer mechanism permitted under the GDPR.

You may contact us for further information about the safeguards applicable to international transfers of your personal data.

13. Data Retention

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, including providing the Wallet, resolving support requests, maintaining security, and complying with legal obligations.

Retention periods depend on the type of data, the purpose of processing, legal requirements, security needs, and whether the information is required for a legal claim.

Generally:

• support correspondence is retained for the period necessary to resolve the request and address related disputes;
• diagnostic and security logs are retained only for the period reasonably necessary for troubleshooting and security;
• analytics information is retained according to the retention settings of the relevant analytics provider; and
• information required by law may be retained for the period specified by applicable law.

When personal data is no longer required, we delete, anonymise, or securely restrict access to it.

AurasPay cannot delete or modify information permanently recorded on a public blockchain.

14. Data Security

We use reasonable technical and organisational measures designed to protect personal data against:

• unauthorised access;
• accidental loss;
• unlawful disclosure;
• destruction;
• misuse; and
• alteration.

These measures may include encryption, access restrictions, authentication controls, secure development practices, monitoring, and internal access procedures.

No system, application, blockchain, device, or internet transmission method can be guaranteed to be completely secure.

You are responsible for protecting your device, passwords, private keys, recovery phrase, and authentication credentials.

15. Your GDPR Rights

Subject to the conditions and limitations of applicable law, you may have the right to:

• request access to your personal data;
• request correction of inaccurate or incomplete personal data;
• request deletion of your personal data;
• request restriction of processing;
• object to processing based on legitimate interests;
• receive certain personal data in a structured, commonly used, and machine-readable format;
• request transmission of eligible data to another controller;
• withdraw consent at any time;
• object to direct marketing; and
• lodge a complaint with a competent data-protection supervisory authority.

These rights are not absolute and may be limited where processing is required by law, necessary for security or legal claims, or relates to information permanently recorded on a public blockchain.

To exercise your rights, contact us at: support@auraspay.com

We may request reasonable information to verify your identity before responding.

16. Supervisory Authority

You have the right to lodge a complaint with the Estonian Data Protection Inspectorate, known in Estonian as Andmekaitse Inspektsioon.

You may also contact the data-protection authority in the European Union or European Economic Area country in which you habitually reside, work, or believe an infringement occurred.

We encourage you to contact us first so that we have an opportunity to address your concern.

17. Children’s Privacy

The Wallet is not intended for individuals under the age of 18.

We do not knowingly collect personal data from children under 18.

If we become aware that personal data has been collected from a child in circumstances where such processing is not permitted, we will take reasonable steps to delete the information.

18. Automated Decision-Making

AurasPay does not currently make decisions producing legal or similarly significant effects solely through automated processing.

Independent third-party providers, including identity-verification, fraud-prevention, or payment providers, may use automated systems under their own policies and legal obligations.

Questions regarding automated decisions made by a third-party provider must be directed to that provider.

19. Marketing Communications

We will send marketing communications only where we have an appropriate legal basis.

Where marketing is based on consent, you may withdraw your consent or unsubscribe at any time.

Service, security, legal, and transactional communications are not considered marketing and may be sent where necessary to provide or protect the Wallet.

20. No Sale of Personal Data

AurasPay does not sell or rent personal data to advertisers or data brokers.

We do not permit independent third-party service providers to use personal data received from us for their own direct marketing unless the user has independently provided valid consent.

21. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes to:

• our services;
• third-party integrations;
• legal or regulatory requirements;
• data-processing activities; or
• security and technical practices.

The updated Privacy Policy will be published with a revised effective date.

Where required by law, we will provide additional notice or request consent before applying a material change.

22. Contact Information

For privacy questions, requests, or complaints, contact:

23. Final Notice

Auras Wallet is self-custodial software.

AurasPay EU OÜ does not store, access, or control users’ private keys or recovery phrases and cannot reverse or recover blockchain transactions.

Independent third-party services accessible through the Wallet, including Transak, process personal data under their own terms, privacy policies, and regulatory responsibilities.

© 2026 AurasPay EU OÜ. All rights reserved.