Last modified on 15 October 2026.
This is the privacy policy (the Policy) of WR Solutions BV, a private limited liability company (besloten vennootschap) incorporated under Belgian law, with registered office at Ruisbroekstraat 34a, 3360 Bierbeek, Belgium, registered with the Crossroads Bank for Enterprises under number BE0792211569, trading as BlueHouse and as BlueHouse Projects (WallClaimer, we, us or our).
WallClaimer operates the mobile and desktop application WallClaimer and the website www.wallclaimer.com, together with the related online services (the Platform, as defined in our Terms and Conditions of Use, the Terms): an application that lets Users send images to one another, and share them in a Group, so that they are displayed directly on the recipient's phone wallpaper or in a home-screen widget. We think it is important that you know which personal data we process, why we process it, and what rights you have.
We process your personal data in a safe and lawful manner, in accordance with Regulation (EU) 2016/679 (the GDPR) and applicable Belgian data protection law. Capitalized terms not defined in this Policy have the meaning given to them in the GDPR. Terms defined in the Terms have the same meaning in this Policy.
Please read this Policy carefully. It describes not only your rights, but also how you can exercise them.
We may amend this Policy. The date at the top of this Policy indicates when it was last changed. We will notify you of substantial changes in advance, via the Platform or by e-mail.
The most recent version is always available via https://wallclaimer.com/PrivacyPolicy.html and in the App.
WallClaimer is the data controller for the personal data that we collect through the Platform, through your Account, through your contact with us, and through reports made under Article 9 of the Terms.
You can reach us via:
General enquiries: support@wallclaimer.com
Privacy queries and requests: privacy@wallclaimer.com
Postal address: WR Solutions BV, Ruisbroekstraat 34a, 3360 Bierbeek, Belgium
WallClaimer has not appointed a data protection officer.
Below, per category of data subject, you find which personal data we process, for what purpose, and on which legal basis. Where we process on the basis of a legitimate interest, we have weighed that interest against your rights and freedoms.
3.1. Website visitors
Personal data: Technical and log data (IP address, device and browser type, pages visited), cookies (see Article 12).
Purpose: Operating and securing the Website, analytics.
Legal basis: Legitimate interest in operating a functional and secure Website; consent for non-essential cookies.
Retention: 30 days
3.2. Users of the Platform: registration and Account
Personal data: E-mail address, username, device identifier, any other registration data requested at sign-up, and, where you request one, the information you provide in support of a verification marker (Verified Profile) as referred to in Article 4 of the Terms.
Purpose: Creating and managing your Account, authentication, the age confirmation referred to in Article 4 of the Terms, and assessing a request for a verification marker.
Legal basis: Performance of the contract constituted by the Terms.
Retention: For the duration of your Account, and thereafter in accordance with Article 9 of this Policy.
3.3. Users of the Platform: profile, searchability and Connections
Personal data: Your username, the name you display, your profile image, the friend requests you send and receive, your Connections, the Users you have blocked, and the Groups of which you are a member.
Purpose: Letting Users find one another and connect, and managing friend requests, Connections, blocks and Groups.
Legal basis: Performance of the contract constituted by the Terms.
Retention: For the duration of your Account, and thereafter in accordance with Article 9 of this Policy.
3.4. Users of the Platform: Claims and Content
Personal data: The images and any accompanying text that you send as a Claim, share in a Group or otherwise upload to the Platform, the Comments you place on a Claim, together with metadata (sender, recipient, Group, timestamp).
Purpose: Providing the Claims, Group and Comment functionality described in Article 5 of the Terms; automated child-safety scanning described in Article 5 of this Policy.
Legal basis: Performance of the contract, for the Claims functionality; legitimate interest in preventing the sexual exploitation and abuse of minors, for the child-safety scanning, as further described in Article 5 of this Policy.
Retention: The image in a Claim: 30 days from the moment the Claim is sent, or the longer period provided for by a Pro Feature, up to a maximum of 365 days, as set out in Article 9 of this Policy. Other data in this category: for the duration of your Account, and thereafter in accordance with Article 9 of this Policy.
3.5. Reports, moderation and safety
Personal data: The content of a report, the identity of the reporting person (unless made anonymously), the Account and Content reported, the outcome of the review, any measure taken and the statement of reasons for it, and any contestation of that decision.
Purpose: Handling reports and taking moderation measures under Article 9 of the Terms; child-safety measures under Article 8 of the Terms.
Legal basis: Legitimate interest in maintaining a safe Platform; legal obligation, where we notify the competent authorities of a suspected criminal offence, including CSAM (Article 18 of the Digital Services Act).
Retention: 12 months after the report or moderation file is closed, as set out in Article 9 of this Policy.
3.6. Communication and support
Personal data: Your contact details and the content of your correspondence with us.
Purpose: Responding to your questions and complaints.
Legal basis: Legitimate interest in providing support; performance of the contract, where the query relates to the Platform.
Retention: 1 year
We do not ask you to provide special categories of personal data, such as data concerning your health, your sexual orientation, your religious or philosophical beliefs, your political opinions, or your racial or ethnic origin.
The Platform does, however, let you share images and messages with other Users. Where you choose to include special categories of personal data, whether your own or a third party's, in a Claim or other Content, you do so on your own initiative and you thereby make that data known to the User to whom you send it. We then process that data because you have manifestly made it public to that recipient, within the meaning of Article 9(2)(e) GDPR. We recommend that you exercise restraint in sharing such data, and that you obtain the consent of any third party depicted before doing so. Sexually explicit Content is in any event prohibited under Article 6.3 of the Terms, which limits the extent to which data concerning your sex life or sexual orientation can reach the Platform through Content.
In the context of reports and moderation, we may unavoidably become aware of special categories of personal data, for example where a report or the reported Content itself reveals such data. We process this only to the extent necessary to handle the report and for the establishment, exercise or defense of a legal claim.
The Platform is not intended for persons below the minimum age set out in Article 4 of the Terms. We do not knowingly collect personal data from persons below that age. We establish your age on the basis of the confirmation described in Article 4 of the Terms and do not currently carry out any further age verification. Where we establish that an Account was created by a person below that age, we delete that Account and the associated personal data, except for the data we must retain under Article 9 of this Policy or under a legal obligation.
Every image sent as a Claim or shared in a Group through the App is automatically checked before it is delivered, using Shield by Project Arachnid. To that end, the image is transmitted to the Canadian Centre for Child Protection Inc. (C3P), which calculates a digital fingerprint (hash value) of the image and compares it with hash values of material that C3P has already classified as child sexual abuse material (CSAM) or as harmful-abusive material of children. C3P returns the result of that comparison to us. This check is carried out for every image, regardless of its content. It does not otherwise analyze the content of your images, and it does not identify material that C3P has not already classified.
Where the check returns a match, the Claim is not delivered, we do not store the image, and the sending Account is automatically blocked. We keep a record of the detection, consisting of the identifiers of the sending Account, the intended recipient or Group, the hash value and the result returned by C3P, and the date and time of the detection, and we proceed as set out in Article 8 of the Terms, including notification to the competent authorities. You can contest the blocking as set out in Article 9.6 of the Terms.
C3P acts as an independent controller in respect of the images and hash values it receives through Shield. C3P is established in Canada and stores data on its servers in Canada. Where an image results in an exact match, C3P does not retain the data we submit. Where an image results in a near match or in no match, C3P may retain it for as long as necessary to classify material and to combat child sexual abuse material online, and may give partner organizations that classify material on its behalf, some of which are located outside the European Economic Area, access to it. Article 8 of this Policy sets out the safeguards that apply to those transfers. More information is available in the privacy policy of Project Arachnid at https://projectarachnid.ca.
We process personal data for this purpose on the basis of our legitimate interest in preventing the sexual exploitation and abuse of minors through the Platform (Article 6(1)(f) GDPR), in reliance on Regulation (EU) 2021/1232, which permits providers of interpersonal communications services to use such technologies on a voluntary basis and subject to safeguards. Where we notify the competent authorities, we do so to comply with our legal obligations, including Article 18 of the Digital Services Act.
WR Solutions BV accesses Shield by Project Arachnid (https://projectarachnid.ca), a program of the Canadian Centre for Child Protection Inc., to facilitate the detection and removal of child sexual abuse material and harmful-abusive material of children and survivors of child sexual abuse on its services.
We do not take decisions based solely on automated processing, including profiling, that produce legal effects concerning you or that similarly significantly affect you, within the meaning of Article 22 GDPR, except for the automatic blocking described in Article 5 of this Policy upon a confirmed CSAM hash match, which is authorized by Regulation (EU) 2021/1232 within the meaning of Article 22(2)(b) GDPR. You can contest such a blocking, in which case the decision is reviewed by a person, as set out in Article 9.6 of the Terms. Any other decision to suspend or terminate an Account is taken or reviewed by or on behalf of WallClaimer, as described in Article 9 of the Terms.
Other Users have access to the Content that you send them, and to any profile information you make visible to them.
Any other User can find you in the App by searching for your username or for the name you display. There is currently no setting that limits this to Users with whom you have a Connection. Your profile is not indexed by external search engines, and a Claim you send is visible only to the recipient or, where you share it in a Group, to the members of that Group.
We use the following categories of service providers, who act as processors on our behalf:
Cloudflare, for object storage of images (R2), hosted in Western Europe;
Hetzner Online GmbH, for hosting of the application database, in Germany;
Google (Google Play Services and Firebase Analytics), for app distribution services and analytics;
RevenueCat, for the management of in-app purchases and subscriptions, if and once Pro Features are offered.
We enter into a data processing agreement that meets the requirements of Article 28 GDPR with each service provider before it processes personal data on our behalf.
The following recipients process personal data as independent controllers, under their own privacy policies: the Canadian Centre for Child Protection Inc., for the child-safety check described in Article 5 of this Policy; and Apple and Google, as operators of the App Store and the Google Play Store, for the distribution of the App and, if and once Pro Features are offered, for the processing of payments.
We may also disclose your personal data to:
our accountant, insurer, lawyers or other professional advisers, where we request their assistance;
the judicial, police or administrative authorities, where we are legally required to do so, in order to comply with a binding decision, or where necessary to prevent or address a serious risk to the safety of persons. We disclose personal data to an authority outside the European Economic Area only on the basis of a procedure recognized under Belgian or European Union law, such as a request for mutual legal assistance, or where this is strictly necessary to protect the life or physical integrity of a person;
the competent Belgian police services or public prosecutor, and Child Focus, where we notify confirmed CSAM or conduct falling within CSAE in accordance with Article 8 of the Terms; and
a transferee or successor, in the context of a reorganization, merger or transfer of our business, in which case we ensure your data continues to be protected in accordance with this Policy.
We do not sell your personal data and do not make it available to third parties for their own marketing purposes.
We are a Belgian company and store your images and database records with providers located in the European Economic Area (Cloudflare's Western Europe region, and Hetzner's German data centres). The child-safety check described in Article 5 of this Policy involves a transfer of images to C3P in Canada.
Certain of our other service providers, in particular Google (Firebase Analytics and Google Play Services), may process personal data outside the European Economic Area, including in the United States. Where such a provider is certified under the EU-U.S. Data Privacy Framework, the transfer is based on the adequacy decision of the European Commission of 10 July 2023.
Images that we transfer to C3P for the check described in Article 5 are transferred on the basis of the European Commission's standard contractual clauses (controller to controller) concluded between us and C3P. C3P may give partner organizations located in countries that do not offer an adequate level of protection, currently in Cambodia, Colombia, Australia, Albania and Mexico, access to images that it retains. Those onward transfers are made on the basis of the European Commission's standard contractual clauses (controller to processor).
Where we transfer personal data to a country that, according to the European Commission, does not offer an adequate level of protection, we take the necessary measures to ensure an equivalent level of protection, including reliance on the European Commission's standard contractual clauses, where relevant supplemented by additional technical and organizational measures. You can request a copy of those safeguards via the contact details in Article 2.
We do not retain your personal data for longer than necessary for the purposes for which it was collected, unless a longer retention period is required or permitted by law.
We apply the following retention periods:
Account data: for the duration of the Account plus 30 days after deletion. Where an Account has not been used for two consecutive years, we notify the User by e-mail and, unless the User logs in within 30 days of that notification, we delete the Account and the associated personal data in accordance with this Article. This does not apply to an Account through which a Pro Feature is active or has been purchased against a one-time payment for lifetime access.
Images sent as a Claim or shared in a Group: 30 days from the moment the Claim is sent, after which the image is deleted automatically and can no longer be retrieved, in accordance with Article 5 of the Terms. Where a Pro Feature provides for a longer availability period, that longer period applies, up to a maximum of 365 days from the moment the Claim is sent.
Images a recipient has saved to their own device: outside our control and no longer covered by this Policy.
Metadata of a Claim, including the record that a Claim was made: for the duration of the Account plus 30 days after deletion.
Moderation and report files: 12 months after the file is closed. A file is closed once the decision on the report has become final, that is to say once the period for contesting it under Article 9.6 of the Terms has expired or a contestation has been decided.
Data retained further to a confirmed CSAM match: the identifiers of the Account concerned, the hash value and the result returned by C3P, the date and time of the detection, and the notification made to the competent authorities, for no longer than 12 months from the date of the detection, unless a competent authority requires a longer period. We do not retain an image that results in a match under the check described in Article 5.
Images and other Content subject to a retention hold: notwithstanding the periods above, we may place a specific image, Claim or Account on hold, so that it is not deleted automatically, where this is necessary: (a) to handle a report or a moderation file, including a confirmed case of CSAM or CSAE, in which case the hold ends once the file is closed and the period for contesting the decision has expired, or once the competent authorities have confirmed that they hold the material, and in any event no later than 12 months after the report or detection; or (b) to comply with a request of a competent authority or in connection with a specific legal claim, in which case the hold ends once the request lapses or the claim has been finally resolved. We review each hold at least every 30 days in case (a) and at least every 90 days in case (b). Content on hold is no longer available in the App and is accessible only to the persons who need it for that purpose.
In addition to the periods above, we may retain personal data for a longer period where necessary: (i) to comply with a legal or regulatory obligation; (ii) to establish, exercise or defend a legal claim; (iii) to enforce our agreements; or (iv) to retain an image that forms part of a report or a moderation file, as set out in Article 5 of the Terms.
We take appropriate technical and organizational measures to protect your personal data against loss, misuse, unauthorized access and unauthorized modification. These measures include encryption of the connection and, where appropriate, of storage, access controls limited to what is necessary for the relevant function, logging, back-ups and internal confidentiality undertakings.
Where a personal data breach occurs that poses a risk to your rights and freedoms, we notify the Belgian Data Protection Authority no later than 72 hours after becoming aware of it. Where the breach poses a high risk, we also inform you without undue delay. We maintain an internal procedure and breach register for this purpose.
Within the limits of applicable law, you have the right:
to find out whether we process your personal data and, if so, to obtain access to that personal data;
to have inaccurate or incomplete personal data corrected without delay;
to have your personal data erased;
to obtain restriction of the processing;
to receive your personal data in a structured, commonly used and machine-readable format and to have it transmitted to another controller;
to object to the processing of your personal data based on our legitimate interest, and to object at any time and without giving reasons to direct marketing; and
to withdraw your consent at any time, without affecting the lawfulness of processing before the withdrawal.
You can exercise these rights via the contact details in Article 2. We respond within one month of receiving your request. That period may be extended by two further months where your request is complex; we will inform you of any such extension. We may ask you to prove your identity where we have reasonable doubt about it.
You can also delete your Account yourself using the functionality provided in the App, via the in-app delete button, or via deleteme@wallclaimer.com. We then delete the associated personal data, except for what we must retain under Article 9 of this Policy or under a legal obligation.
We may refuse a request, in whole or in part, where the law requires or permits this, for example where the data is necessary for the defense of a legal claim, where the rights of other Users would be affected, or where a legal retention obligation applies. We give reasons for our decision.
You have the right to lodge a complaint with the Belgian Data Protection Authority (Autoriteit Persoonsgegevens / Gegevensbeschermingsautoriteit), Drukpersstraat 35, 1000 Brussels, contact@apd-gba.be, www.gegevensbeschermingsautoriteit.be, or with the supervisory authority of your habitual residence. You may also always bring a claim before the competent court.
Our Website and App use cookies and similar technologies. Which cookies we use, for what purpose, and how you can manage your preferences, is set out in our cookie policy, available via [cookie policy URL].
For questions about this Policy or about the processing of your personal data, you can reach us via the contact details in Article 2.