By business type

Terms & Conditions Generator for crypto

Written for wallet addresses as personal data, on-chain permanence and the KYC that erasure cannot touch.

Generate your terms and conditions Read the terms and conditions guide

Crypto terms carry risk disclosures that consumer regulators read closely, and a set of clauses about irreversibility that most software terms never need - because a mistaken transaction cannot be reversed by anyone.

The foundational problem in crypto privacy documentation is that a wallet address is usually personal data. Once an address is linked to an identity - through KYC, an exchange deposit, or on-chain analysis - every transaction that address ever made becomes attributable, permanently and publicly.

That collides directly with erasure. On-chain data cannot be deleted, and a privacy policy that promises deletion of everything on request is describing something the technology cannot do. The honest position explains what can be deleted off-chain and what cannot be touched on-chain, and why.

Regulated activity adds the opposite pressure. Where you perform KYC under anti-money-laundering rules, retention is mandatory, the Travel Rule requires transmitting originator and beneficiary information with transfers, and sanctions screening runs continuously against identity data you are obliged to keep.

What a terms and conditions for a crypto or Web3 product has to cover

Risk disclosure: volatility, total loss, smart contract risk and regulatory change
Irreversibility of transactions and the absence of a chargeback route
Custody model: who holds keys, and what happens if the user loses theirs
Eligibility, prohibited jurisdictions and sanctions screening
Account freezing and closure grounds, with the constraints disclosure rules impose

How a crypto or Web3 product actually moves personal data

Wallet connection

Connecting a wallet exposes the address and its full history to the application, which is a collection event most interfaces do not describe.

KYC and identity verification

Documents, selfies and liveness checks through a specialist vendor, retained under AML rules.

On-chain analytics

Chainalysis, TRM and similar services cluster addresses and attribute them, which is profiling of an identifiable person.

RPC providers and node infrastructure

Every read and write passes through an RPC endpoint that sees the address and the IP behind it.

Off-chain user accounts

Email, preferences and support history held conventionally alongside on-chain identity.

Airdrops and eligibility snapshots

Eligibility analysis links addresses to behaviour and often to identity, and the snapshot persists.

Third parties the draft will ask you about

Alchemy or Infura · Chainalysis or TRM Labs · Sumsub or Persona · Fireblocks · AWS · Intercom · Stripe for fiat on-ramps

The rules that apply

Wallet addresses as personal data

An address linked or linkable to an individual is personal data, which brings the whole transaction history it anchors into scope.

On-chain immutability versus erasure

Data written to a public chain cannot be deleted. The policy has to explain the boundary rather than promising deletion it cannot deliver.

AML and KYC retention

Where you are a regulated entity, identity and transaction records must be retained for statutory periods regardless of an erasure request.

Travel Rule obligations

Transfers above thresholds require originator and beneficiary information to travel with the transaction between providers.

Sanctions screening

Continuous screening against identity and address data, with restrictions on what may be disclosed to the customer.

What the generated terms and conditions contains

Who the contract is with and how it is formed
Your legal entity, and the exact moment acceptance happens - account creation, checkout, or continued use.
The service, the licence and its limits
What you are actually providing, what the user may do with it, and what they may not.
Price, payment, renewal and cancellation
Billing cycle, auto-renewal, price-change notice, and how either side ends the arrangement.
Acceptable use and enforcement
The behaviour that gets an account suspended, and the process you follow before you suspend it.
User content and intellectual property
Who owns what, the licence you need to run the service, and the takedown route for infringing material.
Warranties, liability and indemnity
Disclaimers that survive local consumer law, and caps that are actually enforceable rather than theatrically broad.
Governing law, jurisdiction and disputes
The law that applies, the courts that hear it, and any pre-litigation steps you require.

Crypto compliance essentials

State plainly that wallet addresses are personal data
And explain what that means for the transaction history behind them.
Draw the on-chain and off-chain boundary
What you can delete, what you cannot, and why.
Disclose the infrastructure chain
RPC providers, analytics vendors, custody partners and KYC processors.
Document AML retention as a legal obligation
With the period, so erasure refusals can be explained.
Explain on-chain analytics and any Article 22 position
Where screening outcomes restrict or freeze accounts automatically.
Identify who the controller actually is
Even where the protocol is decentralised, the front end and the accounts are not.

Where this usually goes wrong

Claiming wallet addresses are anonymous

Pseudonymous is not anonymous, and once linked the whole history is attributable. Regulators have said so directly.

Promising erasure of on-chain data

It is technically impossible, and promising it is a misrepresentation as well as a compliance failure.

Not disclosing RPC providers

They see the address and the connecting IP on every interaction.

Silence on on-chain analytics

Clustering and attribution services are profiling, and users are entitled to know they are used.

KYC deletion promises that AML law forbids

Retention is mandatory for regulated entities, and the policy should explain why rather than promise otherwise.

Treating a DAO or protocol as having no controller

Someone determines the purposes of the front end, the analytics and the user accounts, and that party is the controller.

Frequently asked questions

Is a wallet address personal data?

Usually yes. It is pseudonymous rather than anonymous, and once linked to an identity - through KYC, an exchange, or chain analysis - it and the transaction history behind it are personal data.

How does the right to erasure work with a blockchain?

It does not reach the chain. You can delete off-chain records, close accounts and stop processing, but on-chain data is immutable. The policy should explain that boundary honestly rather than promise deletion it cannot deliver.

Can I delete KYC records on request?

Where you are a regulated entity, no - anti-money-laundering law requires retention for a statutory period. That is a legal obligation basis that overrides erasure, and the refusal needs explaining.

Does a decentralised protocol need a privacy policy?

The protocol may not, but the front end, the analytics, the RPC relationship and the user accounts have a controller - and that party does.

Are terms and conditions legally binding?

They are when the user had a genuine opportunity to read them and took a positive step to accept. Clickwrap - a ticked box next to a visible link - holds up far more reliably than a "by using this site you agree" line in the footer.

What is the difference between terms of service and terms and conditions?

Nothing substantive. "Terms and conditions" is the more common phrasing in the UK and Commonwealth markets, "terms of service" in the US and in SaaS. The clauses do the same job.

Can I limit my liability to zero?

No. Most consumer regimes void attempts to exclude liability for death, personal injury or fraud, and unfair-terms rules strike out caps a court considers unreasonable. A cap that is drafted to survive review is worth more than one that is struck out entirely.

Do I need terms if I sell nothing?

If users can register, post, comment or upload, yes - the terms are what let you moderate, suspend and remove content without being in breach of contract yourself.