Dolix Privacy Policy

The data operator is the Dolix Administration (hereinafter "we", "the service"). For data-processing matters, contact us via the Dolix Telegram bot and in-app support.

The Policy applies to all parts of the Dolix ecosystem: the Telegram bot with verification tools (AMLSCAN, PDFSCAN, counterparty check), the Dolix Wallet mini app (wallet, exchange, P2P), the public API and the dolix.io website, including public checks on the website without registration.

We process data: to perform the contract with you (provision of the service); to comply with applicable requirements (KYC/AML procedures aligned with FATF standards; sanctions screening against international sanctions lists, including those of the UN, the US (OFAC), the EU and the UK, in the composition of sources current at the time of the check); in the legitimate interests of the service and its users (security, anti-fraud, prevention of abuse, and the establishment, exercise and defence of legal claims); with your consent — where it is required. Refusal to provide data required for KYC/AML and for the operation of the service, or withdrawal of consent, may make use of the service wholly or partly impossible.

4.1 Account — Telegram id, username, name, interface language, mini app sessions.

4.2 Contacts — email (if linked); when the link is confirmed, the IP address and device are recorded.

4.3 Operations — deposits, withdrawals, transfers, exchanges and P2P deals: addresses, amounts, TXIDs, statuses.

4.4 Checks — addresses and TXIDs submitted for checking, uploaded PDF files, results and risk scores.

4.5 KYC — full name, date of birth, country, residential address, document type and number, photo of the document.

4.6 Payment details — payment details for exchange and P2P (for example, a card or phone number).

4.7 Correspondence — messages and attachments in P2P deal chats, appeals and dispute materials.

4.8 Security — the PIN, the account password and API keys are stored in protected form (cryptographic hashes).

4.9 Activity — usage events of the bot, the app and the API; referral-program data.

4.10 Geodata — the coordinates and address of the meeting place that you publish in a cash P2P ad.

Notes. On request, the service may additionally collect a selfie and source-of-funds information (Section 5 of the Terms of Use); for the merchant or trader role, a selfie, a bank statement and proof of source of funds are collected. The activity log may include the action type and a short fragment of the text of a command or message sent to the bot (up to 120 characters), as well as records of views of other users' P2P profiles with the viewer's identifier. When you sign in to the account through a browser, the time and IP address of the last sign-in are stored. The coordinates and address of the meeting place in a cash ad are, by the nature of the feature, available to other users — do not specify an address you are not prepared to disclose (for example, your home address).

During a public check on the website we process the entered addresses and uploaded files — to perform the check. The IP address is used to account for the free-check limit and to ensure security. The technical logs of the service and of its infrastructure providers (web server, attack protection) may contain IP addresses; such logs are kept for a limited time and are not used to profile visitors. Registration is not required for a public check.

We obtain data: from you — when you use the service; from public blockchains — on-chain data is by its nature publicly available; from public sources — open profiles and channels of P2P platforms, public sanctions lists; from other users — complaints, reviews and dispute materials, which may contain information about you as a counterparty.

By uploading or transmitting to the service materials containing information about third parties (documents, correspondence, complaints, payment details), you confirm that you have a lawful basis for their transfer and undertake to indemnify the service against losses, costs and third-party claims caused by a breach of this representation.

Operation of the service and maintenance of balances; performance of AMLSCAN, PDFSCAN and counterparty checks, including matching uploaded documents against previously checked ones to detect forgeries; verification (KYC) and AML controls; security, anti-fraud and prevention of abuse; user support and dispute resolution; the establishment, exercise and defence of the service's legal claims; administration of subscriptions, plans and API access; internal usage statistics. No advertising profiling is carried out.

Photographs of basic-KYC documents are stored encrypted using strong encryption; decryption is possible only on the server, and access is restricted to authorised operators whose actions are logged. Materials of merchant or trader role applications are stored with server-level access restrictions. Verification is currently performed by the service's own operators; if an external provider is engaged, the Policy will be updated. Application materials are delivered for review through the Telegram infrastructure (Section 17). KYC data is used for verification and AML controls, for compliance with applicable requirements, for responding to lawful requests from competent authorities, and for the establishment, exercise and defence of the service's legal claims.

The counterparty check feature relies on complaint databases and blacklists, which may contain data of persons who are not users of the service: contacts, payment details, nicknames and incident descriptions. Such data is processed in the legitimate interest of protecting users from fraud. Records are based on user complaints, public sources and moderation; complaints submitted via the API generally undergo moderation before publication; moderation does not guarantee the reliability, completeness or legal accuracy of records. The provisions of Section 3 of the Terms of Use on the informational nature of results apply to records and check results. If information about you is included in the database, you may contact support with an objection or a request for correction: we will consider the request within a reasonable time and, if the inaccuracy is confirmed, correct or delete the record. The service may request proof of the applicant's identity and substantiation, and may retain the record (in whole or in part, including in masked form) where its retention is justified by the legitimate interest of protecting users from fraud. In the bot and app interface, sensitive payment details are partially masked; to API clients with access to the counterparty check feature, data is transmitted to the extent necessary for the check.

AML scoring and anti-fraud mechanisms operate automatically and may automatically restrict operations: suspend crediting, freeze withdrawals, require additional verification. Initial restrictions may be applied automatically and are preliminary in nature; decisions on prolonged restriction are, as a rule, additionally reviewed by an operator. You may request human review of an automated decision by contacting support; specific review timeframes are not guaranteed.

The dolix.io website does not use its own cookies for tracking; infrastructure providers (hosting, attack protection) may set strictly technically necessary cookies. localStorage is used for technically necessary functions: on the website — language selection and the documentation cache; in the mini app — interface state (theme, language). There are currently no advertising trackers or third-party analytics (counters, pixels); usage statistics are collected by the service's internal means.

Data is disclosed only to the categories of recipients, and to the extent, necessary for the operation of the service and the purposes described in this Policy: Telegram — as the channel for delivering messages and files; blockchain-data and market-price providers — receive the addresses and TXIDs being checked in order to perform the checks; the virtual card issuer — the data required to issue and service the card under the rules of the relevant card program (for example, the cardholder's name; for certain programs — contact details and date of birth); mapping and geocoding services — receive the address text for geocoding via our server, without transmission of your IP address, while when the map is opened your device loads map data directly from OpenStreetMap servers, which then see your IP address; infrastructure providers; professional advisers (lawyers, auditors) — under confidentiality obligations; courts, arbitrators and parties to proceedings — to the extent necessary for the establishment, exercise and defence of the service's legal claims; successors — in the event of reorganisation, sale or transfer of the business or a part of it, with preservation of the level of protection provided for by this Policy; state and law-enforcement authorities — upon lawful requests. We do not sell personal data to advertisers or data brokers. Complaint-database data about third parties is disclosed to users and paid API clients solely within the counterparty check feature (Section 9); recipients of such data process it independently and bear their own responsibility for the lawfulness of further processing; use of the data for harassment, blackmail, defamation or public accusations is prohibited by the Terms of Use. On-chain data is public by its nature.

The service's infrastructure and its providers may be located in different jurisdictions. When transferring data, we strive to ensure a level of protection comparable to that described in this Policy, including through contractual and technical measures.

Mini app sessions are time-limited and, as a rule, are terminated when the account password is changed; email confirmation codes are valid for a limited time. KYC/AML records are retained, as a rule, for at least 5 years in line with international practice. Check logs, the archive of uploaded documents and complaint-database records are retained for as long as necessary for security and fraud-detection purposes, including matching new checks against historical ones. Upon a request to support, we assess the need for further retention and delete or anonymise data that is not required for KYC/AML, security and the defence of legal claims.

You have the right to: obtain information about the processing and a copy of your data; request correction of inaccurate data; request deletion or restriction of processing — subject to mandatory KYC/AML retention periods and legitimate security interests; object to processing based on legitimate interests; withdraw consent (which may make the service unavailable); lodge a complaint with the data-protection supervisory authority of your jurisdiction. The rights of persons included in the complaint databases are described in Section 9. Requests are accepted via the Telegram bot and support and are considered within a reasonable time. Before fulfilling a request, the service may request proof of the applicant's identity and clarification of the scope of the request; the service may refuse manifestly unfounded or excessively repetitive requests, or charge a reasonable fee for processing them. A copy of the data is provided within a reasonable time, taking into account the complexity and number of requests.

We apply strong encryption (in particular, for photographs of basic-KYC documents and backups), hashing of secrets (the PIN, the account password, API keys), and granular administrator access with action logging; internal services are isolated from direct network access. The set of technical measures may change while the level of protection is maintained. Absolute security cannot be guaranteed; the user's responsibility for the safety of their device and means of access is defined in Section 4 of the Terms of Use.

The service operates inside Telegram: messages, files, notifications and service materials of checks pass through Telegram's servers, to which Telegram's own privacy policy applies. The service does not control data processing on Telegram's side and is not responsible for the actions, failures or incidents of the Telegram infrastructure; by using the service, you accept that data delivery through Telegram is an integral part of its operation. The mini app loads the official Telegram WebApp script; there are no other external scripts, except for the loading of map data when the map is opened (Section 12).

The service is intended for persons aged 18 or older; children's data is not knowingly collected. We announce changes to the Policy in the app or bot with the version date; continued use means agreement with the updated version. If you do not agree with the changes, stop using the service. Where applicable law requires separate explicit consent, we will request it additionally. This version supersedes all previous versions of the Privacy Policy.

This Policy describes the actual practices of the service and does not provide warranties beyond the requirements of applicable law. The provisions of the Terms of Use on the disclaimer of warranties, limitation of liability, force majeure and the informational nature of check results (Sections 3, 14 and 15 of the Terms) apply in full to data processing under this Policy. The invalidity of an individual provision of the Policy does not affect its remaining provisions.