By business type

Acceptable Use Policy Generator for crypto

Written for wallet addresses as personal data, on-chain permanence and the KYC that erasure cannot touch.

Generate your acceptable use policy Read the acceptable use policy guide

For a crypto product the acceptable use policy is where sanctions, illicit finance and market manipulation restrictions live - and it needs to be enforceable at speed, because the enforcement decisions are often automated.

The foundational problem in crypto privacy documentation is that a wallet address is usually personal data. Once an address is linked to an identity - through KYC, an exchange deposit, or on-chain analysis - every transaction that address ever made becomes attributable, permanently and publicly.

That collides directly with erasure. On-chain data cannot be deleted, and a privacy policy that promises deletion of everything on request is describing something the technology cannot do. The honest position explains what can be deleted off-chain and what cannot be touched on-chain, and why.

Regulated activity adds the opposite pressure. Where you perform KYC under anti-money-laundering rules, retention is mandatory, the Travel Rule requires transmitting originator and beneficiary information with transfers, and sanctions screening runs continuously against identity data you are obliged to keep.

What a acceptable use policy for a crypto or Web3 product has to cover

Prohibited jurisdictions and sanctioned parties
Money laundering, fraud and illicit finance restrictions
Market manipulation, wash trading and exploit activity
Automated enforcement, and what the user is told when an action is taken
The appeals route, within what disclosure rules permit

How a crypto or Web3 product actually moves personal data

Wallet connection

Connecting a wallet exposes the address and its full history to the application, which is a collection event most interfaces do not describe.

KYC and identity verification

Documents, selfies and liveness checks through a specialist vendor, retained under AML rules.

On-chain analytics

Chainalysis, TRM and similar services cluster addresses and attribute them, which is profiling of an identifiable person.

RPC providers and node infrastructure

Every read and write passes through an RPC endpoint that sees the address and the IP behind it.

Off-chain user accounts

Email, preferences and support history held conventionally alongside on-chain identity.

Airdrops and eligibility snapshots

Eligibility analysis links addresses to behaviour and often to identity, and the snapshot persists.

Third parties the draft will ask you about

Alchemy or Infura · Chainalysis or TRM Labs · Sumsub or Persona · Fireblocks · AWS · Intercom · Stripe for fiat on-ramps

The rules that apply

Wallet addresses as personal data

An address linked or linkable to an individual is personal data, which brings the whole transaction history it anchors into scope.

On-chain immutability versus erasure

Data written to a public chain cannot be deleted. The policy has to explain the boundary rather than promising deletion it cannot deliver.

AML and KYC retention

Where you are a regulated entity, identity and transaction records must be retained for statutory periods regardless of an erasure request.

Travel Rule obligations

Transfers above thresholds require originator and beneficiary information to travel with the transaction between providers.

Sanctions screening

Continuous screening against identity and address data, with restrictions on what may be disclosed to the customer.

What the generated acceptable use policy contains

Prohibited content and conduct
The categories you will not host, written specifically enough to enforce and narrowly enough to defend.
Technical restrictions
Rate limits, scraping, load testing, resource abuse and circumvention of quotas.
Security research boundaries
What testing is permitted, how to report a finding, and what will not be treated as an attack.
Reporting and moderation
How abuse is reported, what happens next, and the timescales you work to.
Enforcement ladder
Warning, throttle, suspension, termination - with the emergency route for genuinely urgent harm.
Appeals
How someone contests a decision, which several online-safety regimes now require rather than merely encourage.

Crypto compliance essentials

State plainly that wallet addresses are personal data
And explain what that means for the transaction history behind them.
Draw the on-chain and off-chain boundary
What you can delete, what you cannot, and why.
Disclose the infrastructure chain
RPC providers, analytics vendors, custody partners and KYC processors.
Document AML retention as a legal obligation
With the period, so erasure refusals can be explained.
Explain on-chain analytics and any Article 22 position
Where screening outcomes restrict or freeze accounts automatically.
Identify who the controller actually is
Even where the protocol is decentralised, the front end and the accounts are not.

Where this usually goes wrong

Claiming wallet addresses are anonymous

Pseudonymous is not anonymous, and once linked the whole history is attributable. Regulators have said so directly.

Promising erasure of on-chain data

It is technically impossible, and promising it is a misrepresentation as well as a compliance failure.

Not disclosing RPC providers

They see the address and the connecting IP on every interaction.

Silence on on-chain analytics

Clustering and attribution services are profiling, and users are entitled to know they are used.

KYC deletion promises that AML law forbids

Retention is mandatory for regulated entities, and the policy should explain why rather than promise otherwise.

Treating a DAO or protocol as having no controller

Someone determines the purposes of the front end, the analytics and the user accounts, and that party is the controller.

Frequently asked questions

Is a wallet address personal data?

Usually yes. It is pseudonymous rather than anonymous, and once linked to an identity - through KYC, an exchange, or chain analysis - it and the transaction history behind it are personal data.

How does the right to erasure work with a blockchain?

It does not reach the chain. You can delete off-chain records, close accounts and stop processing, but on-chain data is immutable. The policy should explain that boundary honestly rather than promise deletion it cannot deliver.

Can I delete KYC records on request?

Where you are a regulated entity, no - anti-money-laundering law requires retention for a statutory period. That is a legal obligation basis that overrides erasure, and the refusal needs explaining.

Does a decentralised protocol need a privacy policy?

The protocol may not, but the front end, the analytics, the RPC relationship and the user accounts have a controller - and that party does.

Do I need an acceptable use policy separate from my terms?

A separate AUP is easier to enforce and easier to update. It also gives moderation staff and automated systems a single reference to cite, which matters when a suspension is challenged.

Does an AUP help with platform liability?

It is part of the picture. Intermediary liability protections generally depend on acting on notice, and both the EU Digital Services Act and the UK Online Safety Act expect published rules, a reporting route and an appeals process.

How specific should prohibited-use lists be?

Specific enough that a moderator can apply it consistently, with a residual catch-all. Lists that are only catch-alls get challenged; lists that are only specific leave gaps.