Legal

Privacy Policy

Privacy information for talao.io visitors, project contacts and Talao Wallet users.

Web3 Digital Wallet — Talao

Effective date: November 23, 2023
Last updated: August 29, 2026

Purpose and scope

This Privacy Policy explains how WEB3 DIGITAL WALLET processes personal data in connection with the corporate website talao.io, enquiries submitted to Talao, and the Talao Wallet mobile application. These are separate contexts: visiting the Website does not cause the same processing as using Talao Wallet or interacting with an issuer or verifier.

This Policy does not automatically govern:

  • Altme Wallet, which is a separate product with its own privacy policy on altme.io;
  • a wallet deployed for a customer under a separate notice or agreement;
  • an issuer, verifier or other third-party service that determines its own purposes and means of processing.

Who we are

WEB3 DIGITAL WALLET is a French simplified joint-stock company (SAS), SIREN 910 399 435, RCS Chartres, with its registered office at 112 rue des Tuileries, 28260 Saint-Ouen-Marchefroy, France. “Talao”, “we”, “us” and “our” refer to WEB3 DIGITAL WALLET in this Policy.

Processing contexts and GDPR roles

Visitors to talao.io

WEB3 DIGITAL WALLET operates the corporate Website and determines the purposes of the personal data processing that it carries out directly for that Website.

People contacting Talao

When you send a demo or project enquiry, or contact support, WEB3 DIGITAL WALLET processes the information you choose to provide in order to receive, review and respond to the communication.

Talao Wallet users

Talao Wallet is a mobile application for receiving, storing and presenting Verifiable Credentials. It follows self-sovereign identity principles: Credentials and private cryptographic keys held in the Wallet are stored on the user’s device and remain under the user’s control. WEB3 DIGITAL WALLET does not hold a server-side copy of those private keys or locally stored Credentials and cannot retrieve or reconstruct them if they are lost and the user has no usable backup or recovery method. The data involved in an issuance or presentation depends on the Credential selected by the user and on the relevant issuer or verifier.

WEB3 DIGITAL WALLET currently provides the following credential issuance services for Talao Wallet:

  • identity attestations through La Poste / Docaposte ID360;
  • proofs of control of an email address issued by WEB3 DIGITAL WALLET’s own server;
  • proofs of control of a telephone number issued by WEB3 DIGITAL WALLET’s own server.

For the email and telephone proofs, the relevant email address or telephone number and the information needed to complete the requested issuance are processed for the issuance flow. WEB3 DIGITAL WALLET does not retain that information or a server-side copy of the attestation after issuance.

An issuer or verifier may process personal data under its own privacy notice. The fact that Talao Wallet supports an interaction does not, by itself, make WEB3 DIGITAL WALLET the controller of processing performed independently by that issuer or verifier.

Customer and enterprise services

For customer-specific wallet, backend, issuance, verification or integration services, WEB3 DIGITAL WALLET may act as a controller for its own purposes or as a processor acting on a customer’s documented instructions. The applicable agreement and service-specific privacy information determine the respective roles.

The talao.io website

talao.io is a static website hosted on an AWS EC2 instance and served by Nginx. WEB3 DIGITAL WALLET’s servers are hosted by Amazon Web Services (AWS) in a European region.

As of the Last updated date, the code served directly by talao.io does not:

  • set first-party cookies;
  • include website analytics or advertising trackers.

The Website uses browser localStorage only to remember the language selected by the visitor. This preference is stored under the key talao-language; it is not used for analytics, advertising or cross-site tracking. The Website does not use sessionStorage.

The hosting and web-server infrastructure receives the technical information necessary to answer an internet request. Such information may include an IP address, the requested resource, browser or user-agent information and the time of the request.

Demo and contact requests through Typeform

Links marked “Contact”, “Request a demo” or similar wording open a form hosted on Typeform’s own domain. Typeform is not embedded in, and its scripts are not loaded by, talao.io before you follow the external link.

The current form asks for information about the proposed project and its stage, the organization and industry, the contact’s name, job title and email address, and an optional indication of budget. WEB3 DIGITAL WALLET receives the submitted information to review and respond to the request.

Once you open Typeform, Typeform’s own privacy and cookie practices apply. Please consult Typeform’s privacy policy before submitting information.

Categories of personal data

Depending on the context, WEB3 DIGITAL WALLET may process:

  • Contact and professional information: name, job title, organization, industry and email address submitted through the demo form;
  • Project information: needs, project stage, budget indication and other information entered in the form;
  • Correspondence: information contained in support or other communications;
  • Website request information: technical information needed to deliver and secure the Website;
  • Wallet content: credentials and related data stored on the device and presented following a user action;
  • Credential issuance data: identity information handled in the La Poste / Docaposte ID360 issuance flow, and an email address or telephone number processed to issue the corresponding proof;
  • Service data: data processed for a customer-specific service as described in the relevant notice or agreement.

WEB3 DIGITAL WALLET will never ask you to disclose a private key, wallet PIN or other secret by email or through the corporate Website.

Purposes

Personal data may be processed, depending on the applicable context, to:

  • deliver and protect the Website;
  • receive, assess and respond to demo, project and support requests;
  • provide the Talao Wallet functions initiated by the user;
  • issue an identity attestation, proof of control of an email address or proof of control of a telephone number requested by the user;
  • provide customer-specific services under the relevant agreement;
  • comply with applicable legal obligations and respond to lawful requests.

Storage and retention

Credentials and private cryptographic keys held in Talao Wallet remain on the user’s device until they are removed through the Application or the wallet data is deleted. WEB3 DIGITAL WALLET does not hold a server-side copy and cannot recover locally stored Credentials or private keys that the user loses without a usable backup or recovery method. This does not determine how an independent issuer or verifier retains data that it processes.

WEB3 DIGITAL WALLET does not retain the information processed by its email and telephone proof issuance server after the requested issuance is completed, and it does not retain a server-side copy of the issued attestation. WEB3 DIGITAL WALLET also does not retain a server-side copy of an identity attestation issued through the La Poste / Docaposte ID360 flow. Any processing or retention performed independently by La Poste / Docaposte is governed by the applicable provider information.

Retention applicable to Website request information, demo submissions, support correspondence and customer services is managed according to the relevant processing context and applicable obligations.

Recipients and third-party services

Personal data may be received by authorized personnel and service providers where required to operate the relevant service. Amazon Web Services (AWS) hosts WEB3 DIGITAL WALLET’s servers in a European region. The corporate Website currently directs demo and contact requests to Typeform. La Poste / Docaposte ID360 is used for the identity-attestation issuance flow. Issuers, verifiers and customer organizations may receive data when a user chooses to interact with them.

External services may process data in countries outside the European Economic Area under their own arrangements and notices. The existence and safeguards of any transfer must be assessed for the specific service concerned.

Security

WEB3 DIGITAL WALLET uses technical and organizational measures intended to protect personal data against unauthorized access, alteration, loss or disclosure, taking account of the processing context. No internet or mobile service can be guaranteed to be completely secure.

Disclosure required by law

WEB3 DIGITAL WALLET may disclose personal data where required by applicable law, a binding legal process or a competent authority.

Your data protection rights

Subject to the conditions of applicable law, you may have the right to:

  • obtain access to your personal data;
  • request rectification of inaccurate or incomplete data;
  • request erasure;
  • request restriction of processing;
  • object to processing;
  • receive data in a portable format where the right to portability applies;
  • withdraw consent at any time where processing relies on consent, without affecting processing carried out before withdrawal.

These rights do not apply identically in every context. To exercise a right concerning processing carried out by WEB3 DIGITAL WALLET, contact contact@talao.io. Where another organization is the controller, requests should be sent to that organization.

You also have the right to lodge a complaint with the Commission Nationale de l’Informatique et des Libertés (CNIL) or another competent supervisory authority.

Privacy contact

The current Privacy Officer contact is thierry.theveet@talao.io. The description “Privacy Officer” does not state that this contact has been designated as a statutory Data Protection Officer (DPO).

Changes to this Privacy Policy

WEB3 DIGITAL WALLET may update this Policy to reflect changes in the services, processing or applicable requirements. The Last updated date at the beginning of the Policy identifies the published version.