By business type

Disclaimer Generator for crypto

Written for wallet addresses as personal data, on-chain permanence and the KYC that erasure cannot touch.

Generate your disclaimer Read the disclaimer guide

Crypto disclaimers have to carry risk warnings that consumer regulators now prescribe in several markets, and they have to be honest about irreversibility - because unlike almost any other consumer product, a mistake cannot be undone by anyone.

The foundational problem in crypto privacy documentation is that a wallet address is usually personal data. Once an address is linked to an identity - through KYC, an exchange deposit, or on-chain analysis - every transaction that address ever made becomes attributable, permanently and publicly.

That collides directly with erasure. On-chain data cannot be deleted, and a privacy policy that promises deletion of everything on request is describing something the technology cannot do. The honest position explains what can be deleted off-chain and what cannot be touched on-chain, and why.

Regulated activity adds the opposite pressure. Where you perform KYC under anti-money-laundering rules, retention is mandatory, the Travel Rule requires transmitting originator and beneficiary information with transfers, and sanctions screening runs continuously against identity data you are obliged to keep.

What a disclaimer for a crypto or Web3 product has to cover

That content is not investment advice and no recommendation is being made
Capital-at-risk and volatility warnings in the form your markets require
Irreversibility of transactions and the absence of a chargeback or recovery route
Smart contract, custody and protocol risk, including third-party dependencies
Promotional relationships, token holdings and affiliate arrangements disclosed up front

How a crypto or Web3 product actually moves personal data

Wallet connection

Connecting a wallet exposes the address and its full history to the application, which is a collection event most interfaces do not describe.

KYC and identity verification

Documents, selfies and liveness checks through a specialist vendor, retained under AML rules.

On-chain analytics

Chainalysis, TRM and similar services cluster addresses and attribute them, which is profiling of an identifiable person.

RPC providers and node infrastructure

Every read and write passes through an RPC endpoint that sees the address and the IP behind it.

Off-chain user accounts

Email, preferences and support history held conventionally alongside on-chain identity.

Airdrops and eligibility snapshots

Eligibility analysis links addresses to behaviour and often to identity, and the snapshot persists.

Third parties the draft will ask you about

Alchemy or Infura · Chainalysis or TRM Labs · Sumsub or Persona · Fireblocks · AWS · Intercom · Stripe for fiat on-ramps

The rules that apply

Wallet addresses as personal data

An address linked or linkable to an individual is personal data, which brings the whole transaction history it anchors into scope.

On-chain immutability versus erasure

Data written to a public chain cannot be deleted. The policy has to explain the boundary rather than promising deletion it cannot deliver.

AML and KYC retention

Where you are a regulated entity, identity and transaction records must be retained for statutory periods regardless of an erasure request.

Travel Rule obligations

Transfers above thresholds require originator and beneficiary information to travel with the transaction between providers.

Sanctions screening

Continuous screening against identity and address data, with restrictions on what may be disclosed to the customer.

What the generated disclaimer contains

Scope of what is being disclaimed
The specific content, advice or outcome the disclaimer covers, named rather than gestured at.
No professional relationship
A clear statement that publishing information does not create a professional, advisory or fiduciary relationship.
Accuracy and currency
That content is provided as-is, may date, and should be verified before it is relied on.
External links and third-party content
That you do not control or endorse what sits behind an outbound link.
Affiliate and sponsorship disclosure
Paid relationships disclosed up front, which is a legal requirement in its own right in the US, UK and EU.
Limitation of liability
The consequences you are not responsible for, drafted to survive the consumer law of the markets you publish into.

Crypto compliance essentials

State plainly that wallet addresses are personal data
And explain what that means for the transaction history behind them.
Draw the on-chain and off-chain boundary
What you can delete, what you cannot, and why.
Disclose the infrastructure chain
RPC providers, analytics vendors, custody partners and KYC processors.
Document AML retention as a legal obligation
With the period, so erasure refusals can be explained.
Explain on-chain analytics and any Article 22 position
Where screening outcomes restrict or freeze accounts automatically.
Identify who the controller actually is
Even where the protocol is decentralised, the front end and the accounts are not.

Where this usually goes wrong

Claiming wallet addresses are anonymous

Pseudonymous is not anonymous, and once linked the whole history is attributable. Regulators have said so directly.

Promising erasure of on-chain data

It is technically impossible, and promising it is a misrepresentation as well as a compliance failure.

Not disclosing RPC providers

They see the address and the connecting IP on every interaction.

Silence on on-chain analytics

Clustering and attribution services are profiling, and users are entitled to know they are used.

KYC deletion promises that AML law forbids

Retention is mandatory for regulated entities, and the policy should explain why rather than promise otherwise.

Treating a DAO or protocol as having no controller

Someone determines the purposes of the front end, the analytics and the user accounts, and that party is the controller.

Frequently asked questions

Is a wallet address personal data?

Usually yes. It is pseudonymous rather than anonymous, and once linked to an identity - through KYC, an exchange, or chain analysis - it and the transaction history behind it are personal data.

How does the right to erasure work with a blockchain?

It does not reach the chain. You can delete off-chain records, close accounts and stop processing, but on-chain data is immutable. The policy should explain that boundary honestly rather than promise deletion it cannot deliver.

Can I delete KYC records on request?

Where you are a regulated entity, no - anti-money-laundering law requires retention for a statutory period. That is a legal obligation basis that overrides erasure, and the refusal needs explaining.

Does a decentralised protocol need a privacy policy?

The protocol may not, but the front end, the analytics, the RPC relationship and the user accounts have a controller - and that party does.

Does a disclaimer actually protect me?

It reduces exposure rather than removing it. A clear, prominent, specific disclaimer helps establish that a reader could not reasonably have treated your content as personalised advice; a vague one buried in a footer does very little.

Where should a disclaimer appear?

On its own page, and repeated at the point of risk - above the fold on the article, video description or calculator it applies to. Regulators care about proximity, not existence.

Do I need to disclose affiliate links?

Yes. The FTC endorsement guides, the UK CAP Code and the EU Unfair Commercial Practices Directive all require a clear, unavoidable disclosure before the link, not in a footer.