Contents
This Privacy Policy explains how Ryntra handles personal data in Ryntra on Arc — the website at arc.ryntra.io, the app on Arc Mainnet, payment request pages, the receipt verifier and the related APIs (the “Service”). It covers the people who use the Service and the people whose data a team keeps in it, such as its recipients and payers. Ryntra’s investing product at ryntra.io has its own privacy policy.
In short
- You sign in with your wallet. We never ask for your name, email, phone number or bank details.
- Payments on Arc are public: amounts, addresses and transaction hashes can be seen by anyone, for good.
- A team decides about the records it keeps — requests, recipients, payouts — and we process them on its behalf.
- We don’t sell personal data, show ads or track you across other sites.
- Ask us for a copy of your data, or to correct or delete it, at hello@ryntra.io.
This summary helps you read the policy. It is not part of it and does not change it.
1.Who is responsible
Ryntra is responsible for the personal data described in this policy — its “controller” — except for the records a team keeps in the Service, for which the team is responsible (section 3). Write to us at hello@ryntra.io.
2.Public by design: the Arc network and shared links
Payments made with the Service are recorded on the Arc network, a public blockchain. The amount, the asset, the sending and receiving addresses, the time and the transaction hash of each payment can be seen by anyone, for as long as the network exists, and nobody — Ryntra included — can change or delete them. A wallet address is not a name, but it can be linked to a person: for example, when they share it, or when an exchange knows whose it is.
Some pages of the Service are open to anyone who has their link:
- A payment request’s page shows the amount, the receiving address, the purpose and reference the team wrote, the network and the expiry. Once the request is paid, it shows the date and the transaction — and the transaction shows the payer’s address on the network.
- A receipt can be checked by anyone who has one of its references — including the hash of its transaction, which is public on the network. The check shows what the receipt records about the operation: the network and the transaction, amounts and fees, statuses, the policy decision and times. It never shows the team, the wallet that approved the operation, the addresses of a payout, the sender or recipient of a transfer between networks, or the payer, payee, purpose or reference of a payment request.
3.Our role, and a team’s
A team decides why and how the records it keeps in the Service are used — its payment requests, recipients, payouts, policies and notes. For those records the team is the controller, and Ryntra processes them on the team’s behalf, as its processor, under the Data Processing Agreement. If you are a team’s recipient or payer and have a question about your data, ask the team first; we pass on any request we receive about a team’s records.
Ryntra is the controller for what it does for its own purposes: signing people in, keeping the Service secure, screening addresses, reading the network, keeping receipts verifiable, answering messages and counting visits to the site.
4.What we collect, and why
| What | Details | Why | Legal basis (GDPR) |
|---|---|---|---|
| Wallet addresses | The address of the wallet you connect or sign in with; the addresses you pay or are paid by through the Service; the addresses of a team’s members and recipients. | To prepare, check and reconcile operations, read balances and show your records. | Contract (Art. 6(1)(b)); for a team’s records, the team’s instructions. |
| Sign-in records | The sign-in message your wallet signs — with its address, network, times and single-use code — and the time it was used; your session, kept only as a hash of its token, with when it starts and ends. The signature itself is not kept. | To sign you in for up to 7 days, and to record that you accepted the Terms of Service. | Contract; legitimate interests in security and in evidence of acceptance (Art. 6(1)(f)). |
| Team | The team’s name, if it has one; its members’ addresses and roles; who added whom, and when. | To let a team work together. | Contract. |
| Payment requests | Amount, asset, the receiving address, the purpose (up to 80 characters) and reference (up to 32), expiry and status; once paid, the payer’s address, the transaction and the receipts. | To show the payer what is asked and to mark the request paid. | The team’s instructions (Ryntra as processor). |
| Recipients | The label (up to 40 characters), address, network and note (up to 120 characters) a team saves for each recipient, and who saved it. | To fill in payments and payouts. | The team’s instructions. |
| Payouts | Recipients’ labels and addresses; amounts; the purpose code — for example, invoice or refund; a business reference; the team’s policy — the limits the team sets — and its approvals. | To prepare, approve and reconcile payouts. | The team’s instructions. |
| Transfers between networks | For a top-up of Arc from another network, or a withdrawal to Base: the sending wallet and the recipient’s address, the amount and asset, both networks, Circle’s fee, the transactions on both networks, Circle’s attested message, and the sealed receipt. | To prepare the transfer, record its burn, follow Circle’s delivery, finish a stalled one and prove what arrived. | Contract; legitimate interests in keeping verifiable records. |
| Swaps | For a swap prepared through the Service: your wallet, the two tokens, the amount, the provider that carries it and the fees, the transaction your wallet signs, what settled and the sealed receipt. | To prepare the swap, check it before you sign, follow it on the network and prove what you received. | Contract; legitimate interests in keeping verifiable records. |
| Operations and receipts | For each payment prepared through the Service: the wallet, the recipient, the amount, the checks and their results, the approval — its signature kept only as a hash — the transaction and the sealed receipt. | To prove what was prepared, approved and settled. | Contract; legitimate interests in keeping verifiable records. |
| Futures: the country confirmation | Before your first trading key, your confirmation that you are not from the United States, Ontario or a sanctioned country: your wallet address, the date, and the approval of the trading key your wallet signed with it — the key’s public address, its end and the signature. | To keep a record that you confirmed the limits Hyperliquid’s terms set by country; the Service blocks no one by location. | Legitimate interests in evidence of the confirmation (Art. 6(1)(f)). |
| Screening | The addresses in an operation, checked against the OFAC list’s digital currency addresses held in the Service and against the USDC blocklist on the Arc network — for a transfer between networks, against the asset’s blocklist on both networks. We keep only that the check was made; a refused operation is not stored. | To refuse operations with sanctioned or blocked addresses. | Legitimate interests, and compliance with sanctions law (Art. 6(1)(c) and (f)). |
| Location | The country and region our hosting provider estimates from your IP address, passed with each request and never stored. | Not used to refuse anyone or to limit a feature: the Service blocks no one by location. | Legitimate interests. |
| Technical data | Your IP address, browser and the addresses you request, recorded in our hosting provider’s logs — some addresses in the app contain a wallet address. The Service’s own code keeps IP addresses in memory only, to limit abuse. | To run and secure the Service. | Legitimate interests. |
| Site statistics | Page views, referring sites, device type and country, counted on arc.ryntra.io by Vercel Web Analytics, which sets no cookies. | To understand how the site is used. | Legitimate interests. |
| Messages | What you send us by email or through the app’s feedback form, and any contact details you include. | To answer you and to improve the Service. | Legitimate interests. |
We never ask for your name, email address, phone number, bank details or identity documents to use the Service. Please don’t put them — or anyone else’s — in the free-text fields: purposes, references, labels and notes.
5.What we do not do
- We do not sell or rent personal data, and we do not share it for advertising.
- We do not track you across other sites, and we use no advertising cookies.
- We do not build profiles of you. The only automated decision the Service makes is to refuse an operation that fails a check — a sanctions or blocklist match or a rule — and you can ask us to review it.
6.Who receives personal data
We use these providers to run the Service. Each processes personal data to provide its service to us, under its own terms:
| Provider | What it does | What it receives | Where |
|---|---|---|---|
| Vercel Inc. | Hosts the site, the app and its APIs; keeps request logs; counts page views on arc.ryntra.io with Vercel Web Analytics, which sets no cookies. | Everything the Service processes, and technical request data — IP address, browser and the address requested. | United States |
| Neon | Runs the Service’s database. | The records the Service keeps: sign-in, teams, payment requests, recipients, payouts, transfers between networks, swaps and receipts. | United States; the records of the closed Arc Testnet app stay in the European Union until they are deleted |
| dRPC, Blockdaemon and QuickNode | Give access to the Arc network: the Service reads balances, transactions, contract wallets’ signatures and the USDC blocklist through them. | Wallet addresses and transaction data in the read requests the Service sends — never a user’s cookie or IP address. | Their networks of servers, including the United States |
| Public endpoints of the other networks — PublicNode, the networks’ own endpoints, dRPC and Alchemy | Give access to the network a transfer between networks leaves or reaches — Ethereum, Base, Arbitrum and the others the Service lists: the Service reads the burn, the delivery, the balance, the approval and the stablecoin’s blocklist there. | Wallet addresses and transaction data in the read requests the Service sends — never a user’s cookie or IP address. | Their networks of servers, including the United States |
| Circle Internet Financial | Runs the Arc network’s own public endpoint, which the Service may read through when the others do not answer; for a transfer between networks, gives the fee, the attested message and the state of its delivery (Circle’s cross-chain transfer protocol and its Forwarding Service). | Wallet addresses and transaction data in read requests; for a transfer between networks, the transaction hash of the burn and the networks it connects. | United States |
| Email at hello@ryntra.io. | The messages you send us and the address you send them from. | United States |
Personal data also reaches:
- The people you deal with. A team’s members see the team’s records; a payer sees the request they pay; anyone who has a link sees what that page shows (section 2).
- Anyone, through the Arc network, for everything recorded on it.
- Your wallet. When you add Arc to your wallet from the Service, the wallet is given the addresses of dRPC and Blockdaemon and reads the network through them itself, under its own terms.
- Circle and KyberSwap, when you swap. A price is asked without your wallet address — for a stand-in address, whether or not you are signed in. When you press Swap, the Service sends your wallet address, the addresses of the two tokens and the amount to Circle’s Stablecoin Service (api.circle.com) or to KyberSwap, to build the transaction. Each receives them under its own privacy terms.
- GeckoTerminal and KyberSwap, for the token check. A token check sends them only the token’s address — nothing about you.
- Hyperliquid, when you use futures. Your browser reads your Hyperliquid account from Hyperliquid by your wallet address, and sends Hyperliquid the orders and approvals you sign — directly, not through Ryntra. Hyperliquid receives them under its own privacy terms. The trading key stays in your browser’s storage; Ryntra never receives it.
- Circle, when you top up for futures. To follow a top-up, the Service asks Circle’s attestation service about its transaction on Arc, which is public on the network.
- Authorities, when the law requires it, and professional advisers bound by confidentiality.
- A successor, if the Service moves to a company formed to operate it, which would continue to apply this policy.
7.International transfers
Ryntra and the providers above process personal data outside the European Economic Area and the United Kingdom, including in the United States. Where the law requires it, we rely on the European Commission’s Standard Contractual Clauses, or on a provider’s certification under the EU–US Data Privacy Framework.
8.How long we keep data
| Data | How long |
|---|---|
| Sign-in message | Kept after use, as the record of your sign-in and of your acceptance of the Terms of Service. A message that is never signed stops working after 5 minutes. |
| Session | Deleted when you sign out, or when you sign in again in the same browser; otherwise it stops working after 7 days. |
| A team’s records — requests, recipients, payouts, transfers between networks, swaps, policies | For as long as the team uses the Service, or until the team asks us to delete them. |
| Receipts, and the operations behind them | For as long as the Service runs, so that they can be checked — unless the team asks us to withdraw them. |
| The futures country confirmation | For as long as the Service offers futures, as the record of what you confirmed. |
| Location | Never stored. |
| Hosting logs | For the short period our hosting provider keeps them. |
| Messages | For as long as we need them to answer you and to keep a record of the exchange. |
| What is on the Arc network, and on the other network of a transfer | Permanently. Nobody can delete it. |
The Service does not yet delete old records automatically. We delete them by hand when you ask (section 11).
10.Security
We protect personal data with the measures listed in the Data Processing Agreement — among them: no keys and no funds held, encryption in transit, sign-in without passwords with sessions kept only as hashes, a separate database for Arc Mainnet, and screening before signing. No system is perfectly secure. If a breach puts your data at risk, we will tell you and the authorities as the law requires.
11.Your rights
Depending on where you live, you can ask us for a copy of your personal data, to correct it, to delete it, to restrict or object to its use, or to receive it in a portable form. Write to hello@ryntra.io. Because the Service knows you by your wallet, we will ask you to prove that you control it — for example, by signing a message — before we act. We answer within one month.
Some requests have limits: nobody can change or delete what is recorded on the Arc network, and for a team’s records we act on the team’s instructions. You can also complain to the data protection authority where you live or work.
12.Children
The Service is not for anyone under 18, and we do not knowingly process their personal data.
13.Changes to this policy
We may update this policy. The version and the date it takes effect are shown at the top, and we will announce a material change on this page and in the app before it takes effect.
14.Contact
Questions about this policy or your data: hello@ryntra.io.