Privacy Policy

Effective Date: April 29, 2026

01. Overview

Walleto ("the App"), operated by Montages Media Labs ("we," "us," or "our"), is designed with a "Privacy First" philosophy. We believe that your digital identity should remain under your control. Our architecture is based on zero-knowledge principles, ensuring that your data remains local and encrypted.

02. Information We Collect

In accordance with the Google Play Data Safety policy, we disclose the following data collection practices. Most data collection is optional and depends on your use of specific app features.

Personal Information

  • Name & Email: Collected if you use Google Authentication for licensing or profile display. Used for App Functionality and Account Management.
  • Phone Number: Collected only if you choose to include it in a Lead Generation form.
  • User & Device IDs: We use an anonymous 16-character Device ID to track referral milestones and a hashed email (User ID) for licensing.

App Content & Media

  • Contacts (Leads): Leads you collect are stored locally. If synced to the cloud, they are encrypted and purged from our servers within 24 hours.
  • Photos: The app fetches your Google Profile photo (if authenticated) and stores custom icons for your cards locally.
  • App Activity: We store the content of your cards (URLs, text, links) to facilitate sharing via NFC and QR.

03. Data Retention & Deletion

We do not retain your data indefinitely. Our systems are designed for minimal persistence:

  • 24-Hour Cloud Purge: Any lead data transmitted through our cloud relay for syncing is RSA-encrypted and automatically deleted from our servers within 24 hours of receipt.
  • User-Initiated Purge: You can request the permanent removal of your account, license history, and referral data at any time via our Data Deletion Portal.
  • Local Wipe: The "Factory Reset" feature within the app settings allows you to instantly wipe all local data, cards, and leads from your device.

04. Google Drive & Sheets Sync

If you enable Cloud Sync or Lead Export, Walleto interacts with your personal Google Drive in two ways:

  • Private Backup: The app uses a restricted "AppData" folder to sync your card designs. This folder is invisible to you and third parties.
  • Visible Lead Export: If you choose to export leads to Google Sheets, Walleto creates a folder named "Walleto_leads" and a spreadsheet named "collected_leads" in your main Drive. You are the sole controller of this data; we do not have access to these files once they are transferred to your Drive.

05. Data Security

We implement a variety of security measures to maintain the safety of your personal information:

  • Asymmetric Encryption: We use RSA-2048 encryption for account data and lead transit.
  • Data Sovereignty: Your collected leads never touch our central servers; they reside either on your device or your personal Google account.
  • Identity Anonymization: We identify your referral progress via an anonymous 16-character Device ID.

06. Infrastructure & Jurisdiction

To ensure the highest standards of data protection and compliance with GDPR and UK GDPR, Walleto utilizes European-based infrastructure. Our website and PostgreSQL databases are hosted on Scaleway servers located within the European Union.

This ensures that any data we process—even in its encrypted form—remains within jurisdictions that provide the strongest legal protections for individual privacy.

07. Marketing & Analytics

To monitor the performance of our website and the effectiveness of our advertising campaigns, we utilize the following third-party tracking tools:

  • Google Analytics: We use this to understand how users interact with our site, allowing us to optimize the user journey and performance.
  • Meta Pixel: We use the Meta Pixel to track conversions from social media ads and to optimize our advertising reach within the Meta ecosystem.

08. Beta Program Data

If you voluntarily sign up for the Walleto Closed Beta Program, we collect and process your email address under the following terms:

  • Collection & Purpose: We collect your Gmail address solely for the purpose of communicating beta updates and provisioning perks, such as the Free Year subscription and early Affiliate Program access.
  • Encryption at Rest: To maintain our strict security standards, your email address is encrypted using RSA-2048 before it is stored in our database. It is never stored in plaintext.
  • Right to Erasure: You may request the deletion of your beta tester status and email from our servers at any time via the Data Deletion Portal.

09. Contact Us

If you have any questions regarding this Privacy Policy, you may contact us using the information below:

Montages Media Labs
[email protected]