Draft template. Must be reviewed by the client's lawyer — this is not a legally reviewed text.
Privacy policy
1. Data we process
Email (sign-in and emails), Telegram id and username (if you use Telegram), language, watchlist, price alerts, portfolios (manual positions and public blockchain addresses you add), portfolio value history, subscription and payment data (no card numbers — Stripe processes them), session data (IP address and browser at sign-in).
2. Purposes
Providing the service and your account, sign-in emails, alerts and the report (if you opt in), payments and bookkeeping, abuse prevention (rate limits). Legal bases: contract, legitimate interest, your consent to the report.
3. Recipients
Payment providers: Stripe (cards), NOWPayments — only what a payment needs. Public blockchain addresses are queried from public APIs (mempool.space, public RPC nodes) without your identity.
We do not sell personal data.
4. Retention
While your account exists. Sessions — 30 days, sign-in links — 15 minutes (request records up to 24 hours for rate limits).
5. Your rights
In your account you can download all your data (JSON) and delete your account with all its data.
6. Cookies
One strictly necessary session cookie (httpOnly).