Wirnora Privacy Policy
Last updated: 17 October 2026
This policy explains what personal data Wirnora collects, why, and what you can do about it. In this policy "Wirnora" and "we" mean the operator of the Service. Contact: [email protected].
1. Who is responsible
- For your own account (merchants and their staff), Wirnora is the controller.
- For data about your customers that passes through the Service, you are the controller and Wirnora processes it on your behalf.
- This data is mainly the customer identifier you send us and their deposit transactions.
- You are responsible for informing your customers.
2. What we collect
From you, when you create and use an account:
- Business name and email address.
- Password. We store only a one-way Argon2id hash, never the password itself.
- Two-factor authentication secret and recovery codes. The secret is encrypted; the recovery codes are stored only as hashes.
- API keys. Stored as hashes; we cannot see a key after it is shown to you once.
- Webhook URLs, registered payout addresses, and settings.
- Security events. Sign-ins, failed attempts, password and 2FA changes, and new keys, with time and IP address.
About your customers, from you and from the blockchain:
- The customer identifier you choose (for example
user_60). We ask you not to use names, emails or other directly identifying data as identifiers. - Deposit addresses, transaction hashes, amounts and timestamps. Transactions on public blockchains are visible to anyone and cannot be erased by us or anyone else.
Technical data:
- Server logs. These contain IP addresses, requested paths, status codes and user agents. Secrets and sign-in tokens are removed from logs before they are written.
- One strictly necessary session cookie on app.wirnora.com. It is encrypted, HttpOnly and Secure, and keeps you signed in.
- No cookies, analytics or trackers on wirnora.com. Our network provider, Cloudflare, may set strictly necessary security cookies.
We do not collect identity documents at sign-up. If we later need to verify you or a transaction, we will tell you what we need and why.
3. Why we use it
| Purpose | Legal basis |
|---|---|
| Providing the Service: crediting deposits, paying withdrawals, sending webhooks | Performance of our contract with you |
| Security: authentication, rate limiting, detecting fraud and account takeover | Legitimate interests; contract |
| Service emails: verification, password reset, security notices, changes to terms | Contract; legitimate interests |
| Keeping financial records; responding to lawful requests from authorities | Legal obligation |
| Internal operational alerts (see Section 4) | Legitimate interests |
We do not sell personal data. We do not use it for advertising, and we do not build marketing profiles.
4. Who we share it with
We use these providers to run the Service. Each receives only what it needs:
- Our cloud hosting provider runs the servers that host the dashboard, API and database.
- Cloudflare provides DNS and hosts the public website wirnora.com. It does not handle dashboard or API traffic.
- Namecheap (Private Email) sends and receives our email.
- Telegram delivers internal alerts to our operators. Some alerts contain a merchant name and the domain of a merchant's email address, for example when a new account is created.
- Blockchain node providers see the addresses and transactions we query. That information is public on the blockchain anyway.
We may also disclose data:
- when the law requires it;
- to protect our rights or the safety of others;
- to a successor if the business is sold. In that case we will notify you.
Some of these providers process data outside your country. Where required, we rely on appropriate safeguards for such transfers.
5. How long we keep it
- Account and transaction records are kept while your account is open and afterwards for as long as financial-record laws require. Our ledger is append-only: entries are never edited or deleted, by design, so that balances can always be audited.
- Security events are kept for the life of the account plus the same period.
- Server logs are rotated automatically and kept only as long as needed for security and troubleshooting.
- Encrypted database backups follow the same retention as the data they contain.
6. Security
Measures we take include:
- TLS on every connection;
- password hashing with Argon2id;
- encrypted 2FA secrets;
- hashed API keys and recovery codes;
- separate database roles with least privilege for each service;
- a dashboard process with no direct database access;
- encrypted backups;
- treasury keys that are never stored on our servers.
No system is perfectly secure. If a breach affects your data, we will notify you and the relevant authorities as the law requires.
7. Your rights
Depending on where you live, you may have the right to:
- access the personal data we hold about you;
- correct it;
- delete it;
- restrict or object to its use;
- receive a copy in a portable format;
- complain to your data-protection authority.
To exercise these rights, email [email protected] from your account's email address.
Some data cannot be deleted while the law requires us to keep it, or because it forms part of the audit trail of balances we owe. Data on public blockchains cannot be deleted by anyone. In those cases we will restrict its use instead and explain why.
8. Children
The Service is not intended for anyone under 18. We do not knowingly collect their data.
9. Changes
We will post any change on this page and, if it is material, email account holders at least 14 days before it takes effect.
10. Contact
Email: [email protected]