Last updated: July 5, 2026 · Pilot Program Edition
This Policy explains what personal data we process when you participate in the CanDoo pilot program, why we process it, and what rights you have. The pilot runs on public blockchain test networks; assets and balances are simulated.
The controller of your personal data is the operator of the CanDoo platform (“CanDoo”, “we”, “us”), reachable at support@candoo.app. This Policy applies to candoo.app and the related applications used in the pilot program (the “Platform”).
Account data. Email address, nickname and optional profile photo; if you sign in with Google or Telegram, the identifiers those providers share with us for authentication.
Identity verification data. Trading features require KYC performed by our verification provider (Sumsub). Depending on the flow this may include identity documents, a selfie/liveness check and derived verification results. During the pilot, verification runs in a test (sandbox) mode; we encourage participants to use the test documents provided for the pilot rather than real identity documents.
Wallet and transaction data. Blockchain addresses associated with your account and the transactions they perform. Note that blockchain data is public by design (see Section 5).
Usage and technical data. Log data such as IP address, browser type, pages viewed, and actions performed on the Platform; locally stored preferences (for example interface language and session state) kept in your browser’s storage.
Feedback. Anything you choose to share with us as a pilot participant (survey answers, bug reports, messages to support).
To provide the Platform — creating your account, authenticating you, executing listings and purchases, showing your portfolio and history (performance of a contract, Art. 6(1)(b) GDPR).
To verify identity — meeting the eligibility rules of the pilot and preparing compliance processes for a future production launch (legitimate interest / legal obligation, Art. 6(1)(f) and (c) GDPR).
To run and improve the pilot — analysing how participants use features, fixing defects, evaluating feedback (legitimate interest, Art. 6(1)(f) GDPR).
To secure the Platform — preventing abuse, fraud and unauthorized access (legitimate interest, Art. 6(1)(f) GDPR).
We do not use your data for third-party advertising and we do not sell personal data.
We share personal data only with service providers that help us operate the Platform, under data-processing agreements: Dynamic (authentication and embedded wallets), Sumsub (identity verification), and our hosting and infrastructure providers. We may also disclose data where required by law or to protect our rights.
Aggregated or anonymised pilot statistics that cannot identify you may be shared with the project’s stakeholders.
Wallet addresses and transactions are recorded on public blockchain networks. Such records are public, replicated worldwide and immutable: they cannot be modified or deleted by us or anyone else. Where erasure obligations apply, we fulfil them for the data under our control (our databases), and we minimise the personal data that ever reaches a public network.
Our service providers may process data outside the European Economic Area. Where that happens, transfers are protected by appropriate safeguards such as the European Commission’s Standard Contractual Clauses or an adequacy decision.
Account, usage and feedback data are kept for the duration of the pilot program and deleted or anonymised within 12 months after the pilot ends, unless a longer period is required by law. Verification data is retained according to the verification provider’s statutory obligations. Test-network blockchain records persist indefinitely by design.
Subject to applicable law, you have the right to access, rectify and erase your personal data, to restrict or object to its processing, to receive it in a portable format, and to withdraw consent where processing is based on consent. To exercise these rights, contact support@candoo.app.
You also have the right to lodge a complaint with your local data-protection supervisory authority.
We apply technical and organisational measures appropriate to the risk, including encryption in transit, encrypted storage of sensitive keys, access controls and audit logging. No system is perfectly secure; please protect your own credentials and wallet secrets.
The Platform is not directed at persons under 18, and we do not knowingly process their data. If you believe a minor has provided us data, contact us and we will delete it.
We may update this Policy from time to time; the “Last updated” date above reflects the latest revision. Material changes will be communicated through the Platform.