1. Scope of This Policy
This Privacy Policy explains how we collect, use, disclose, store, protect and delete personal information when you access or use the 24K website, web app, account, membership, support and related features.
This policy does not apply to third-party websites, exchanges, payment providers, wallets, browser extensions or external services we do not control. Please read their own privacy policies before using them.
2. Categories of Information We Process
2.1 Account and identity information
Includes username, email address, nickname, language, time zone, account status, membership level, registration time, login-credential information and account details you submit. We never store your password in plain text; passwords are stored using an appropriate cryptographic hash.
2.2 Transaction, subscription and billing information
Includes plan name, billing period, order number, payment status, refund status, currency, amount, invoice or billing details, and limited transaction identifiers returned by payment providers. Unless clearly notified and properly authorised, we do not store full card numbers, card security codes or payment-account passwords.
2.3 Usage and product preferences
Includes saved method groups, filters, display theme, language, time zone, history views, feature clicks, notice read status, use of membership benefits and support interactions.
2.4 Device, log and technical information
Includes IP address, device type, operating system, browser type, language settings, access time, page URL, referrer, session ID, error logs, performance data and security-event records.
2.5 Cookies, local storage and similar technologies
We may use essential cookies, local storage or similar technologies to keep you signed in, save language and theme, protect your account, remember privacy preferences, measure performance and improve the experience. Non-essential analytics, marketing or personalisation technologies require your consent where the law requires, with a way to withdraw or manage it.
2.6 Information you send us
Includes content you submit to support, feedback forms, appeal or security-report channels, and any screenshots, order details or other materials you attach. Never send private keys, seed phrases, full card numbers, passwords or other highly sensitive data in ordinary feedback.
2.7 Information we normally do not collect
24K's core service never needs your wallet private keys, seed phrases, exchange API keys or virtual assets controlled by us. If a future feature needs such information, we will explain the purpose, risks, storage and legal basis before collecting it.
3. Purposes and Legal Bases
We process personal information only with an appropriate legal basis and to the extent proportionate to the service, including:
| Purpose | Main information | Possible legal basis (varies by region) |
|---|---|---|
| Create, maintain and sign in to accounts | Account info, credentials, device info | Contract performance, legitimate interests |
| Provide live signals, history and membership benefits | Account, preferences, usage, subscription status | Contract performance, legitimate interests |
| Payments, invoicing, refunds and fraud prevention | Orders, billing, device and risk info | Contract, legal obligation, legitimate interests |
| Support and complaint handling | Contact details, communications, order info | Contract, legitimate interests, legal obligation |
| Protect accounts, systems and users | IP, device, logs, abnormal behaviour | Legitimate interests, legal obligation |
| Diagnose faults and improve the product | Logs, performance, usage preferences | Consent, legitimate interests |
| Send service notices | Email, account and subscription info | Contract, legal obligation, legitimate interests |
| Send marketing content | Contact details, subscription preferences | Consent or another basis permitted by law |
| Comply with legal, regulatory, court or law-enforcement requests | Related account, transaction and log info | Legal obligation, substantial public interest |
Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of earlier processing, but some features, notices or personalised services may no longer be available.
4. Sources of Information
We may obtain information from:
- information you provide directly when registering, paying, using features, contacting support or submitting forms;
- information generated automatically by your browser, device, network and use of the service;
- payment, authentication, anti-fraud, cloud, support, analytics and security providers;
- public sources, regulators or law-enforcement authorities as permitted by law.
5. Disclosure and Processors
We do not sell your personal information. We may disclose information, where necessary and appropriate, to these categories of recipients:
- cloud hosting, database, content delivery, backup and security providers;
- payment, billing, invoicing, refund and anti-fraud providers;
- email, support, ticketing, authentication and messaging providers;
- analytics, performance-monitoring and error-diagnosis providers;
- lawyers, accountants, auditors, insurers and professional advisers;
- parties involved in a merger, acquisition, financing, asset transfer or restructuring;
- courts, regulators, law-enforcement and government bodies legally entitled to request or receive information.
We require providers to process information only for agreed purposes, take appropriate security measures and bear confidentiality and data-protection obligations as permitted by law. The identity and scope of third parties are disclosed via [link to third-party provider list] or updates to this policy.
6. International and Cross-Border Transfers
To provide global access, cloud infrastructure, payments, support and security, personal information may be transferred, stored or processed in jurisdictions outside your country or region.
For information protected by the GDPR or other transfer rules, we use adequacy decisions, standard contractual clauses, equivalent contractual safeguards, binding corporate rules or other lawful mechanisms where applicable, plus supplementary measures based on risk. You can ask about the safeguards that apply to you via [privacy email].
7. Retention Period
We keep personal information for the shortest period needed to fulfil the purpose of collection, depending on the type of information, account status, service needs, legal obligations, dispute resolution, audits, security and fraud prevention.
In general:
- Account information: kept while the account exists, then deleted, anonymised or access-restricted within a reasonable period after closure;
- Order, payment and tax records: kept for the applicable financial, tax, anti-fraud and dispute-resolution periods;
- Security, audit and access logs: kept only as long as needed for security, troubleshooting, legal or investigative purposes;
- Support and complaint records: kept as long as needed to handle the matter, for quality management and legal periods.
If the law requires longer retention, or it is necessary to handle disputes, investigate security incidents or enforce agreements, we may keep information for that period. After it ends, we delete, anonymise or securely destroy the information.
8. Security Measures
We take reasonable technical and organisational measures based on the nature and risk of the information, including access control, password hashing, encryption in transit, log audits, backup protection, vulnerability fixes, staff confidentiality and vendor management.
No internet transmission or electronic storage is completely secure. Do not send passwords, private keys, seed phrases, full card details or other unnecessary sensitive data through ordinary support channels.
If a data-security incident may put individuals at risk, we will assess and record it under applicable law and notify regulators and affected individuals where required.
9. Your Privacy Rights
Depending on your region and applicable law, you may have the following rights:
- to know what personal information we collect, use, disclose and keep;
- to access or obtain a copy of your personal information;
- to correct inaccurate or incomplete information;
- to request deletion, except where the law allows retention;
- to restrict or object to certain processing;
- to withdraw consent-based authorisation;
- to receive or transfer information in a structured, common, machine-readable format (where applicable);
- to object to automated decisions or profiling (where applicable);
- to opt out of marketing communications;
- where California law applies, to know, delete, correct and limit use of sensitive personal information, and to opt out of the sale or "sharing" of personal information;
- not to face unlawful discrimination or unfair treatment for exercising applicable privacy rights.
We do not sell personal information or share it for cross-context behavioural advertising. If a defined sale or sharing occurs in future, we will provide the legally required opt-out and a "Do Not Sell or Share My Personal Information" link (where applicable).
10. How to Exercise Your Rights
Submit privacy requests via:
To protect accounts and personal information, we may require reasonable identity verification. We only use the information needed for verification and never for unrelated purposes. You may also authorise an agent, but we may require proof of authorisation as permitted by law.
We will respond within the period required by law. If we need to extend, refuse or partially refuse, we will explain why and the appeal or regulatory complaint options. Requests are normally free, but where the law allows we may charge a reasonable fee or refuse manifestly unfounded, repetitive or excessive requests.
If you believe our processing breaches data-protection law, you may contact your local data-protection authority. Users in the EU, EEA or UK may contact the authority in their country or region.
11. Children and Minors
The service is in principle not available to anyone under 18. We do not knowingly collect personal information from minors. If you believe a minor has provided us information, contact us via [privacy email] and we will take appropriate action after verification.
Where applicable law sets a different age, parental-consent requirement or rules on minors' data, we will follow it.
12. Direct Marketing and Communication Preferences
We may send essential service notices about your account, security, payments, service changes, membership status and system operation. Unsubscribing from marketing does not stop essential service notices.
For marketing emails, product news or promotions, we obtain consent first where the law requires and provide a clear, free way to unsubscribe. You can manage marketing preferences anytime via the link at the bottom of emails, account settings or [service email].
13. Cookies and Privacy Preferences
Essential technologies support sign-in, security and core features and usually cannot be turned off. Analytics, personalisation and marketing technologies are disclosed, consented to and managed according to applicable law.
We provide a cookie settings center on the website that includes at least:
- view cookie categories, vendors, purposes and retention periods;
- accept or reject non-essential cookies;
- withdraw or change your choices at any time;
- recognise Global Privacy Control (GPC) or equivalent browser signals where applicable.
14. Changes to This Policy
We may update this policy due to changes in the service, law, regulation, technology or organisation. We will update the "effective date" or "last updated" date; material changes will be notified via site notices, account notifications or email as required by law. Where the law requires consent, we will obtain it again before the change takes effect.
15. Contact and Complaints
For privacy, access, correction, deletion, cross-border transfer, data security or complaints, contact:
Operator: [24K] ("we" or "the Operator")
Place of registration / principal place of business: [Malaysia]
Contact email: [email protected]
Governing law and venue: [Malaysia]