Scope and who we are

The data controller is Elabify (elabify.com). For European Economic Area and United Kingdom users, Elabify acts as controller for the personal data described here, except where it acts as a processor on behalf of an institutional customer (notably for self-hosted or customer-operated deployments of Musnad and Mizan, where the customer is the controller). This policy covers:

• Maknoon, the mobile identity and wallet app (a local-first holder application).
• Musnad, the protocol services that issue and verify credentials (issuer and verifier servers and the on-chain registries at musnad.elabify.com and related endpoints).
• Mizan, the institutional digital-asset risk-governance platform (mizan.elabify.com, and self-hosted deployments).
• elabify.com, the marketing and support website.

Where a service is deployed in a specific jurisdiction (for example mainland China, see section 9), regional data-handling and localization rules apply in addition to this policy.

The Maknoon app: local-first by design

Maknoon is architected so the sensitive material never leaves your device. Elabify operates no account system for the app, requires no sign-up, and receives no copy of your identity, keys, or credentials.

Passport, ID documents, and biometrics

Passport or ID-document chip data is processed on your device to display it and to build a credential you requested; the passive-authentication check runs locally as a trust badge. The app does not transmit your raw document data to Elabify. Face ID, fingerprint, or device passcode are used locally to authorize signing; Maknoon receives only a yes/no result from the operating system, never your biometric data.

Musnad: issuing and verifying credentials

Issuing a credential or running a higher-assurance check requires processing real data on a server. Musnad is designed for data minimization, and what it commits to a blockchain is never personal data.

Issuer services

When you request a credential (for example, a passport-based identity credential), the issuer may process the document fields needed for that credential (such as name, date of birth, document number, nationality), a reference to any identity check performed, and, where enabled, the result of a sanctions / politically-exposed-person screening run against a third-party dataset. The lawful bases are performance of the service you requested, compliance with legal obligations (for example anti-money-laundering checks), and, where applicable, your consent.

• Minimization: only the fields that back the credential are processed; the credential is built so you can later disclose them selectively.
• Third parties: sanctions/PEP screening, when enabled, queries a specialized dataset provider for that purpose only.

Verifier services

When someone verifies a credential you present, the verifier sees only the fields you chose to disclose plus a one-time challenge. The default verifier is stateless: it checks the cryptographic proofs and the on-chain status and does not retain your credential or build a profile of you.

What goes on-chain

The on-chain registries hold cryptographic commitments only: issuer public keys, per-credential Merkle roots, revocation flags, and certificate-authority hashes. They contain no names, document data, or attributes. Because a blockchain is public and effectively permanent, this boundary is deliberate: nothing personal is published, so nothing personal can be exposed or has to be erased there.

Mizan: institutional risk governance

Mizan is a multi-tenant platform for stablecoin issuers, family offices, and institutional treasury teams to score protocols, track positions, and produce evidence packs. Unlike Maknoon, Mizan is an account-based service that stores the data you put into your workspace.

• Account data: the email address used for magic-link sign-in, and basic account and workspace settings. Lawful basis: performance of the contract for the service.
• Workspace data you enter: vault and protocol assessments, governance checklists, positions you track, alert rules, and scheduled reports. This is your institutional data; Elabify processes it to provide the platform.
• Market and on-chain data: Mizan pulls protocol performance and position data from third-party data sources (for example Alchemy and DeFiLlama) to populate your workspace. Public wallet addresses you choose to track are sent to those providers to read on-chain state.
• Audit logs: every change in a workspace is logged with before/after values for accountability (section 7).
• Tenant isolation: each workspace is isolated by Postgres row-level security from creation; no tenant can see another tenant’s data.
• Self-hosted option: when you run Mizan on your own infrastructure (Helm/Docker), your data stays in your environment and you are the controller; Elabify does not receive it.

Backups (Maknoon)

If you create a backup of your Maknoon identity, the app encrypts it on your device (authenticated AES-GCM, with the key derived from your chosen password) before writing it anywhere. You choose where it goes (for example iCloud Drive, the Files app, or a local file). Elabify cannot read your backup and does not hold the password. A “verify backup” tool lets you confirm a backup opens and shows its contents, entirely on-device. If you lose the password, the backup cannot be recovered, by you or by anyone.

The elabify.com website

The marketing and support website behaves like a typical website and is separate from the apps and services above.

Logs and retention

We keep data only as long as needed for the purpose it was collected, plus any period required by law (for example anti-money-laundering or tax rules), after which it is deleted or anonymized. Backups are rotated, so deleted data may persist in encrypted backups for a short window before expiring. Indicative periods:

Where a longer period is required by a legal hold or a regulator, that period applies and overrides the above.

Your rights (GDPR / UK GDPR)

If you are in the European Economic Area or the United Kingdom, you have the rights below over personal data Elabify holds about you as controller. For self-hosted or customer-operated deployments where an institution is the controller, address requests to that institution; we will assist them as processor.

• Access a copy of your data, and information about how it is processed.
• Rectification of inaccurate or incomplete data.
• Erasure (“right to be forgotten”), subject to data we must keep by law.
• Restriction of processing, and the right to object to processing based on legitimate interests.
• Portability: receive your data in a portable format, where processing is based on consent or contract.
• Withdraw consent at any time, where processing is based on consent.
• Not be subject to solely automated decisions with legal or similarly significant effects. We do not carry out such decision-making (any payment-fraud screening by a payment processor on the website is that processor’s function).
• Complain to your local supervisory authority (for example your national data protection authority, or the UK ICO).

Lawful bases. We rely on: performance of a contract (providing Maknoon services, Musnad issuance you request, and Mizan); compliance with legal obligations (AML/KYC and sanctions checks); legitimate interests (security, abuse prevention, and operating our services); and consent (cookies and optional features), which you can withdraw.

A note specific to Maknoon. Because your keys, credentials, and identity data live on your device and not on our servers, for the app there is generally nothing for Elabify to access, export, or delete; you control that data directly and can erase it by removing it from your device. We do not sell personal data.

To exercise any right, contact us using section 11. We respond within the timeframes required by applicable law (one month under the GDPR, extendable for complex requests). An EU/UK Article 27 representative can be identified on request.

International transfers and regional deployments

Where personal data is transferred outside the EEA or the UK, we rely on an adequacy decision where one exists, or on appropriate safeguards such as the Standard Contractual Clauses together with supplementary measures, and we transfer the minimum necessary.

Mainland China (managed ICP deployments)

For deployments operated in mainland China, Elabify provides a local team and managed services, including ICP BeiAn registration and in-country cloud operation. In that setting, infrastructure and personal data sit inside mainland China, and personal information is handled in accordance with applicable Chinese law (including the Personal Information Protection Law), with data localization and any cross-border transfer subject to the requirements of that law. The institution operating the deployment is typically the controller for that data; Elabify acts as a managed-service provider. Specific localization, consent, and cross-border arrangements are agreed per deployment.

Security, children, and changes

• Identity and credential signatures use post-quantum cryptography (ML-DSA-65); key transport uses a hybrid post-quantum scheme.
• On the device, secrets live in the platform secure store and signing is biometric-gated.
• Backups and stored customer product data are encrypted at rest (AES-256); Mizan workspaces are isolated by row-level security.
• Public releases of the on-device code are cryptographically signed, and the source is published so a build can be independently audited.

Breach notification: if we become aware of a suspected breach affecting customer data we hold, we aim to notify affected customers by email within 24 hours, and to notify supervisory authorities and individuals where the law requires.

Children: the apps and services are not directed to children and are intended for adults. Changes: we may update this policy; material changes will be reflected by the effective date above and communicated through the apps or website.