Privacy Policy
What personal data Baro processes, why, how long it is kept, and the rights you have.
Effective: August 1, 2026
Notch Ventures Pte. Ltd. publishes this Privacy Policy (the "Policy") to protect the personal data of Baro users and to handle related inquiries. This Policy applies to www.baro.quest and to Baro's quest, campaign, profile, and reward services.
1. Processing Principles
The Company processes only the minimum information necessary for Telegram login, quest participation and verification, wallet address registration, reward claims, service security, and customer support. The Company does not use personal data beyond the purposes described in this Policy or permitted by applicable law, and does not sell users' personal data.
Wallet addresses, on-chain transaction records, and Telegram user information may identify an individual when combined with other information, so the Company manages them in accordance with data protection principles.
2. Information Processed and Purposes
| Purpose | Information processed | When |
|---|---|---|
| Telegram login and member identification | The user ID, username, display name, profile photo URL, authentication time, and login verification value provided by Telegram during login | When a user logs in with Telegram |
| Profile and wallet registration, reward claims | Public wallet address, connected network, wallet connection and disconnection times, signature verification results, transaction hashes, and claim or SBT issuance status | When a user connects a wallet or claims a reward |
| Quest participation and completion verification | Quests and campaigns joined, completion status, verification materials submitted by the user such as links, screenshots, and text, verification results, and appeal records | When a user joins a quest or submits proof of completion |
| Telegram channel intelligence | Public channel information such as the name, public handle, and description of public Telegram channels, public posts, post view and forward counts, subscriber counts, and post counts | When the Company collects and analyzes public channel data |
| Service security and abuse prevention | IP address, access time, browser and device information, session identifiers, error and security logs, and signals used to detect multiple accounts or automation | When generated automatically in the course of using the Service |
| Customer support and rights requests | The email address, Telegram username, wallet address, inquiry content, attachments, and handling records that a user provides in an inquiry or rights request | When a user contacts contact@notch.ventures |
The Company does not request or store your private keys, seed phrases, wallet passwords, exchange passwords, two-factor authentication codes, or Telegram password. Nor does it collect your private Telegram conversations, contact lists, or the message content of private channels. Processing of public channel data follows the table above and the retention periods in Section 3.
3. Retention Periods and Destruction
The Company destroys personal data without delay once the purpose of processing has been achieved. Where necessary to handle user requests, respond to disputes, prevent abuse, or meet legal obligations, it may store the data separately for the periods below.
| Information | Retention period |
|---|---|
| Telegram login information, registered wallet addresses, basic profile | Until account withdrawal or a deletion request, then destroyed within 30 days |
| Quest participation, completion verification, reward, and appeal records | Three years from the later of the campaign end date or the account deletion request date |
| Access, security, and abuse-response logs | 12 months from collection |
| Customer support and rights request records | Three years from completion of handling |
| Public Telegram channel data | 12 months from collection. Where a channel becomes private or is deleted, or a legitimate deletion or de-listing request is confirmed, the data is hidden or deleted promptly to a reasonable extent |
| Information subject to separate statutory retention | The period prescribed by the relevant law |
Electronic files are deleted in a manner that prevents recovery. On-chain information already recorded on a blockchain network cannot be deleted or modified by the Company; Section 6 applies to such records.
4. Disclosure to Third Parties and Campaign Organizers
As a rule, the Company does not provide users' personal data to third parties. It may do so to the extent necessary where the user consents, where there is a legal basis, where there is a lawful request from an investigative or supervisory authority, or where there is an urgent need to protect the life or property of the user or a third party.
Some campaigns may require the Company to pass a user's public wallet address, quest completion status, or reward receipt status to the campaign organizer in order to pay rewards or verify completion. In that case, the Company will separately state the recipient, purpose, items provided, retention period, and the effect of refusing consent on the relevant campaign screen, and will obtain separate consent where required. If you refuse consent, you can still use Baro's general services, but you may not be able to join campaigns for which that disclosure is essential.
The Company may provide campaign organizers with aggregate statistics that do not identify individuals for the purpose of measuring campaign performance.
5. Third-Party Services and Processors
Baro may integrate with Telegram login, third-party wallet connections, and blockchain networks. Where you use Telegram, MetaMask, WalletConnect, or another external service directly, that service's handling of personal data is governed by the provider's own terms and privacy policy.
The Company entrusts the following work to external specialists in order to operate the Service, and applies contractual and technical controls so that processors do not use personal data beyond the purpose of processing.
| Processor | Entrusted work | Information processed | Location and retention |
|---|---|---|---|
| Vercel Inc. | Website and application hosting, content delivery, security, and processing of service operation logs | IP address, access, device, and browser information, request and error logs, and data transmitted in the course of providing the Service | The United States and the countries and regions where Vercel's global infrastructure operates, for as long as necessary to provide the Service and respond to security and availability issues |
If the Company engages additional processors in future for data storage, customer support, error analysis, or other work, it will update this Policy with the processor's name, the work entrusted, the country or region of processing, and other necessary information before processing begins.
6. Cross-Border Processing and On-Chain Disclosure
6.1 Processing in Singapore
Baro is operated by a Singapore entity. When users in Korea or other countries and regions use the Service, the information described in Section 2 may be transmitted to and accessed by the Company in Singapore over secure networks for service operation, quest management, customer support, security, and dispute handling. The Company carries out such cross-border processing only where the lawful procedures and safeguards required by applicable law are in place.
You may direct inquiries or exercise your rights in relation to cross-border processing at contact@notch.ventures. If you do not agree to cross-border processing, you may refrain from using features that require it — such as wallet connection, quest participation, and reward claims — or request deletion of your account.
6.2 Processing via Vercel
The Baro website is served using Vercel Inc.'s global infrastructure. As a result, your IP address, access, device, and browser information, request and error logs, and data necessary to provide the Service may be processed in the United States or in other countries and regions where Vercel's global infrastructure is located. The purposes are service provision, security, incident response, and performance, and you may raise inquiries or exercise your rights using the methods in Section 7.
6.3 Blockchain Records
When you connect a wallet or claim a reward, your wallet address, transaction hashes, token or SBT holdings, and related transactions may be recorded on a public blockchain such as the GIWA testnet. Such records can be viewed publicly and, due to the nature of blockchains, may be preserved permanently or be impossible to delete or modify.
The Company operates so as not to write names, email addresses, Telegram user IDs, private keys, seed phrases, or sensitive personal data into on-chain metadata. You likewise must not enter personal or sensitive information into on-chain memos, transaction data, or submissions.
7. Your Rights and How to Exercise Them
To the extent recognized by applicable law, you may request access to, correction or deletion of, or suspension of the processing of your personal data, withdraw consent, or ask for an explanation of the processing. Send your request to contact@notch.ventures.
The Company will verify the requester's identity and handle the request without delay, and will explain the reason where the law restricts processing of the request or permits refusal. Account deletion and wallet disconnection apply to the off-chain profile and account information the Company holds, and cannot delete or reverse on-chain transactions, SBTs, or public blockchain records that have already been finalized.
8. Automated Verification and Appeals
The Company may use automated rules, public on-chain data, public information provided by external services, and security signals to assess quest completion, reward eligibility, multiple accounts, bot or macro use, and other possible abuse. The results may affect whether a quest is treated as complete, whether a reward is withheld or paid, and whether an account is restricted.
If you disagree with such a result, you may request a review at contact@notch.ventures. The Company will carry out further checks or human review to a reasonable extent.
9. Security Measures and Incident Response
To keep personal data secure, the Company operates appropriate safeguards including access rights management, least-privilege access, authentication and access controls, protection of data in transit and at rest, security updates, log management, management of internal handlers, and incident response procedures.
Where the Company becomes aware of a personal data breach or security incident, it takes measures to limit the impact and, where required by applicable law, notifies or reports to users and the relevant authorities. If you discover account takeover, phishing, wallet impersonation, or unusual activity, please notify the relevant third-party provider and the Company immediately.
10. Cookies and Similar Technologies
The Company may use cookies, local storage, or similar technologies to keep you logged in, secure the Service, and provide essential features. You can refuse or delete cookies in your browser settings, but some features — such as login, security, and saved settings — may then not work properly.
If the Company uses cookies or SDKs for advertising, personalization, or non-essential analytics in future, it will obtain separate consent to the extent required by applicable law and reflect the details in this Policy or in a separate cookie notice.
11. Minors
Baro is intended, as a rule, for users aged 19 and over. The Company does not knowingly collect personal data from users under 19, and where it learns that a minor is using the Service it may take the measures required by applicable law and the circumstances.
12. Changes to This Policy and Contact
The Company may amend this Policy in line with changes to the law, service features, processors, cross-border processing, or security policy. Where a change is material, the Company will announce the change and its effective date in the Service before it takes effect.
Questions about the processing of personal data, deletion requests, exercising your rights, or this Policy may be sent to the Baro operations team at contact@notch.ventures.