Privacy Policy

Requesting deletion

When account deletion is enabled in your wallet, open Delete account, review balances and payment restrictions, confirm with a fresh code sent to the email already linked to your account, and press Delete account permanently. If the action is unavailable, contact support@lendao.com to request deletion and learn which applicable obligations affect your request.

Deletion starts after final confirmation. There is no cancellation period. Leaving the page does not cancel it. A pending, retrying or paused operation is not a completed deletion. We report completion only after all required steps finish. Technical failures trigger retries; operations unfinished after 24 hours are escalated to responsible staff, without a guaranteed completion deadline.

Funds and wallet access

USDT is checked across all your embedded wallets on supported networks. A combined nonzero remainder of no more than 0.01 USDT requires your express agreement to lose access to that exact displayed amount through this app. The tokens remain on the blockchain. Above this threshold, follow the support instructions before deleting.

Native SOL must be withdrawn before wallet access is removed. The withdrawal flow transfers the available native SOL to a validated recipient, with network fees paid by our treasury. Recipient and network restrictions can still prevent a transfer. Payments must have a confirmed payout, a blockchain-confirmed refund, or verified completion without money movement or a remaining refund obligation.

Do not send funds to your former wallet addresses after deletion. Blockchain addresses can still receive transfers after app access ends. We check balances again immediately before removing Privy access; new funds before that step can pause deletion for withdrawal or fresh confirmation. Later deposits do not guarantee that we can restore access. Before deletion you may export your wallet key through Privy for your own independent use. We never need your private key or seed phrase.

What is erased and what is retained

Deletion removes your active profile and access through the app, along with managed personal copies that are unnecessary for a documented obligation. This includes unnecessary contact/profile fields, provider payload duplicates, cached data and subject-linked support or log content. Necessary records are detached from login and kept in a restricted archive; registering again with the same email does not recover the old account or give access to that archive.

The selected archive contains the necessary identity facts and verification evidence relied upon, such as name, date of birth, nationality, residence, relevant identity-document details, material document evidence and verification decision/provenance. Each payment has one logical record of the money movement, amounts, assets, times, counterparties, transaction/provider references and confirmed payout or refund, together with necessary reconciliation evidence. A whole profile, entire Didit response or unrelated information is not archived automatically.

The default is five calendar years from the applicable event. For relationship-based identity and payment records this is actual termination of the customer relationship; a separately regulated one-off transaction or reporting record can have a different applicable start event. A documented additional obligation or investigation hold retains only the necessary scope. Retries, copies and release of a hold do not restart the original clock. Expired unheld records are erased.

This five-year minimum applies where the operator is subject to the relevant BVI record-keeping duties. Financial-record duties alone do not require every identity document or selfie. Biometric templates, selfies, video and raw provider responses are excluded by default; an exception requires a specific documented necessity and lawful basis, limited access and its own retention decision.

Status, support and security

Save your operation number. Status credentials and automated recovery through the original email have an absolute 30-day validity window from initial issuance. Recovery and retries do not extend it; expiry does not stop deletion. After that window, or if automated recovery cannot be used, contact support with the operation number for a separate secure identity-verification procedure.

An operation number, supplied email, knowledge of a past record or a new account using the same email is not sufficient proof of ownership. Independently verified support may communicate the status of the original operation; it does not restore signing, account access, an expired status credential or access to archived documents. Archive access is restricted to authorized staff for assigned lawful purposes and is audited.

Deletion notification and support-access audit records contain only selected operation/case/staff references and fixed outcomes and are erased after 30 days from creation. Confirmation-mail drafts are removed from our store on provider acceptance or expiry, within ten minutes; minimal delivery receipts expire within 24 hours. Independent mail/support recipients have their own reviewed retention and transfer conditions. A genuine complaint, dispute or investigation may need separately justified records; this does not retain the entire active profile or renew temporary credentials.

Never send support a private key, seed phrase, email code or deletion-status secret. Ordinary email should contain only the operation reference and a short description; necessary ownership checks use a verified secure case channel. Privacy-rights and records-access requests are assessed separately under applicable law.

New identity documents and contact/channel material supplied solely for manual status verification must stay in the private verification workspace, outside backups, and be erased within 24 hours of receipt. Minimal case/proof/decision and status-delivery references expire 30 days from original creation. A separately justified legal dispute or investigation has its own limited evidence and deadline; it does not turn every support submission into a five-year record.

Backups, devices and independent records

The deletion retention policy requires restricted snapshots to rotate at a 30-day target, residual recoverable copies to be removed within a hard maximum of 35 days from original erasure or expiry, and point-in-time recovery logs to be limited to seven days. Backups are not used as active profiles. Restored data stays in quarantine until current erasure, expiry, hold and credential-revocation rules have been reapplied and verified. These controls are required before enabling account deletion.

The current client clears managed profile/session data after confirmed completion. Other devices clear on their next access after server revocation; inaccessible or offline browser data cannot be erased remotely. Your downloads and exported keys remain under your control. Public blockchain addresses and transaction histories cannot be removed from the blockchain.

Privy, Didit, the fiat payout provider Qdree and other applicable recipients can have independent legal, security or backup obligations. We request the agreed scoped deletion, but cannot promise removal of every independently required record. An app server located in Europe does not establish where every recipient stores data; recipient and transfer conditions must match the deployed service.