Privacy Policy

1. Introduction and Scope

This Privacy Policy (the “Policy”) describes how Defi-Vision Analytics (“Defi-Vision”, “we”, “us”) collects, uses, discloses, and protects information when you access or use the Defi-Vision platform, including the website, web application, AI features, dashboards, trading interfaces, and any related services (collectively, the “Service”).

This Policy applies to all visitors and users of the Service. It is incorporated by reference into our Terms of Service. By using the Service, you acknowledge that you have read and understood this Policy.

2. Information We Collect

2.1 Information You Provide Directly

• Wallet address required for Premium — when you connect a Solana or EVM wallet for Premium activation. We do not collect your private key, seed phrase, or any signed data beyond what the signature itself requires.
• Payment data — on-chain transaction hashes and originating addresses when you purchase Premium. This data is already publicly visible on the blockchain.
• Contact data optional — your email address only if you voluntarily contact us, subscribe to a newsletter, or use a feature that explicitly requires it.
• User-generated content — alert rule definitions, watchlist entries, bundled wallet addresses, saved SQL queries, AI prompts, and webhook URLs that you create within the Service.

2.2 Information Collected Automatically

• Technical data — IP address (used for rate limiting and abuse prevention), user agent string, referrer, requested URL, response time, error logs. Stored ephemerally and aggregated where possible.
• Usage data — anonymized counts of API calls per endpoint and per IP for capacity planning and abuse detection.
• Session and event analytics — a randomly generated session identifier persisted in your browser’s localStorage (no name, no email, no profile data) plus a record of which Defi-Vision pages you visited and which Defi-Vision UI actions you took (e.g. clicked Pro CTA, opened the upgrade page). When you connect a wallet, the wallet public key may be associated with the session id so we can measure conversion at a wallet level — the public key is already publicly visible on-chain and we do not associate it with any off-chain identity. These rows live in our user_events table and the aggregate counters in daily_activity. We additionally use Google Analytics 4 (measurement ID G-4F59M4EEW2) for audience measurement: it records the pages you view, an approximate location derived from your IP address, your device and browser, and it sets its own identifiers in your browser. Its script loads only after you consent to the "usage measurement" category in the cookie notice — decline it, or make no choice at all, and the script is never downloaded. We never send your wallet address, email or any other identifier of yours to Google.
• AI query metadata — model used, tools invoked, response provider, token consumption (for budget enforcement). Query content is processed transiently except where retained for caching as described in Section 13.

3. Information We Do NOT Collect

For clarity, we do not collect or process:

• private keys, seed phrases, mnemonic recovery phrases, or any wallet credentials of any kind;
• government-issued identifiers (SSN, CPF, RG, passport, etc.) — Defi-Vision does not perform KYC;
• banking, credit card, or fiat payment data — Premium payments are processed on-chain;
• biometric data;
• precise geolocation (only coarse country-level data may be inferred from IP);
• contact lists, photos, or device sensor data.

4. Local Storage and IndexedDB

To deliver an instant, low-latency experience and to respect user privacy, we persist many features locally on your device rather than on our servers. This includes:

• watchlist entries and tracked assets (localStorage);
• bundled wallet addresses for portfolio aggregation (localStorage);
• alert rules, channel preferences, and trigger history (localStorage);
• saved SQL queries from the Studio workbench (localStorage);
• AI chat sessions, messages, and history (IndexedDB with localStorage fallback);
• UI preferences (theme, locale, layout state).

This data does not leave your device unless required by a specific feature you activate (e.g., a webhook URL is invoked when an alert fires; an AI prompt is sent to an LLM provider when you submit a query). Clearing your browser data will permanently remove all local-storage content. We cannot recover it.

5. How We Use Information

We process the categories of data above to:

• operate, maintain, and provide the Service and its features;
• verify Premium eligibility and authenticate wallet-based identity through cryptographic signatures;
• enforce rate limits, prevent abuse, and detect fraudulent or malicious activity;
• respond to your support inquiries and provide customer service;
• send service-related communications (e.g., security notices, terms updates);
• comply with legal obligations, court orders, and lawful requests from authorities with jurisdiction;
• analyze and improve the Service in aggregate (e.g., which features are used, error patterns);
• aggregate, anonymize, or de-identify data for statistical or research purposes.

6. Legal Bases for Processing (GDPR / LGPD)

Where applicable law requires a legal basis for processing, we rely on the following:

• Performance of a contract — to deliver the Service you requested (Art. 6(1)(b) GDPR / Art. 7, V LGPD);
• Legitimate interest — to operate, secure, and improve the Service, prevent abuse, and exercise legal rights (Art. 6(1)(f) GDPR / Art. 7, IX LGPD);
• Consent — for optional features such as marketing emails or non-essential analytics (Art. 6(1)(a) GDPR / Art. 7, I LGPD);
• Compliance with legal obligation — to respond to lawful requests (Art. 6(1)(c) GDPR / Art. 7, II LGPD).

7. Sharing and Disclosure

We do not sell, rent, or trade your personal data. We disclose data only in the following narrow circumstances:

• Service providers — infrastructure and AI inference providers acting as data processors on our behalf, bound by contractual confidentiality and data-protection obligations (e.g., Cloudflare for hosting and edge delivery, Supabase for database storage, LLM providers for AI inference, Solana RPC providers for transaction broadcasting);
• Third-party services you initiate — when you broadcast a transaction, the data leaves our system and is published on the relevant public blockchain. When you trigger a webhook, payload is sent to the URL you configured (Discord, Slack, custom);
• Legal requirements — to comply with applicable law, regulation, legal process, or governmental request, or to enforce our Terms;
• Vital interests — to protect the safety, rights, or property of Defi-Vision, users, or the public;
• Business transfer — in connection with a merger, acquisition, or sale of assets, in which case the acquirer will be bound by this Policy or a successor with equivalent protections.

8. Third-Party Data Sources

The Service aggregates data from public third-party APIs and feeds. We act as a read-only client: we fetch data from these sources to display to you, but we do not transmit your identity, wallet, or activity to them (with the exceptions noted below). Because any individual provider may be added, replaced, or removed without notice, the recipients are described here by category:

• Protocol analytics providers (protocols, TVL, fees, revenue, emissions, stablecoins) — read-only;
• Market data providers (prices, market caps, historical charts) — read-only;
• Public exchange endpoints (candles, funding rate, long/short ratio) — read-only, no authenticated calls;
• Governance data providers (DAO proposals and voting) — read-only;
• News publishers and RSS feeds — read-only;
• Sentiment index providers (Fear & Greed Index) — read-only;
• Block explorers (contract name tags, when an API key is configured) — your queried address may be sent;
• Public RPCs (Ethereum, Solana, BSC, Polygon, Arbitrum, Avalanche, Optimism, Base) — your queried wallet addresses are sent to the RPC; these are public addresses with on-chain data;
• Swap-routing providers (Solana swap quotes and routing) — your wallet address and intended trade parameters are sent when you request a quote;
• Limit-order providers (non-custodial Solana limit orders) — your wallet address and order parameters are sent when you place, list or cancel a limit order;
• Solana concentrated-liquidity programs (audited on-chain automated market makers reached through routing) — your wallet address and transaction parameters are sent when you sign and broadcast a swap or pool-related transaction. These are on-chain interactions and the data they receive is the same data that will land on-chain.

Each provider has its own privacy practices, which we do not control. You should review their policies before relying on the Service in sensitive contexts.

9. AI Processing and Inference Providers

When you use AI features (“DV Neural”, AI Vision, AI chat tool calls), your prompt and any contextual data we attach (page context, fetched tool data) is sent to one or more third-party large language model (LLM) providers for inference. These providers process your query transiently to generate a response.

By default, we configure these providers in “no-training” mode wherever supported, meaning your prompts are not used to train their models. We do not control the providers’ broader infrastructure logging policies. We rate-limit and budget AI calls to mitigate abuse.

Some AI responses may be cached by us for a short period to reduce duplicate inference costs. Cached responses are keyed by a content hash and are not associated with your wallet or IP except transiently for rate limiting.

10. Cookies and Tracking Technologies

We use a minimal set of cookies and similar technologies:

• Strictly necessary — session cookies and security tokens required for Premium gating, wallet sessions, and basic Service operation;
• Preferences — local storage entries for UI choices (theme, locale, layout);
• Analytics opt-in — our own aggregated usage metrics plus Google Analytics 4, which sets its own cookies and receives your IP address. Nothing is loaded until you accept the "usage measurement" category, and withdrawing consent stops the collection.
• Advertising opt-in — we display ads from the Bitmedia network on the free plan only. Subscribers see neither the ad nor the space reserved for it. The network script is loaded only after you tick the "Advertising" category in the cookie notice: without that explicit consent it is not even downloaded. Once loaded, the network may store an identifier in your browser to cap how often the same ad repeats and to measure clicks. No ads are shown on payment, trading, or sign-up screens.

Your choice is stored in your browser and can be changed or withdrawn at any time through the cookie notice. Withdrawing the "Advertising" category stops the network from loading immediately, without a page reload.

You can manage cookies through your browser settings. Disabling strictly necessary cookies may break parts of the Service.

11. Webhooks and Outbound Notifications

If you configure an alert rule with a webhook URL (e.g., Discord, Slack, or custom endpoint), our server-side proxy will deliver alert payloads to that URL when triggered. To protect your security and prevent abuse:

• only HTTPS URLs are accepted;
• private, internal, or loopback IPs are blocked (RFC1918, link-local, IPv6 unique-local);
• payload size is capped at 8 KB;
• each request has a 7-second timeout.

You are solely responsible for the security and lawful operation of any URL you configure.

12. Public Blockchain Data

Information broadcast to a public blockchain — including wallet addresses, transaction amounts, timestamps, and metadata — is public, immutable, and pseudonymous by design. We display and analyze such data, but we did not create it; it is published by the user and replicated globally across blockchain nodes. The right to be forgotten cannot be applied to on-chain data, as we have no ability to alter the underlying ledger.

13. Data Retention

We retain data only for as long as necessary for the purposes described in this Policy:

• IP addresses — retained for up to 30 days for rate-limit and abuse-prevention purposes, then deleted or anonymized;
• AI query cache — content-keyed cache entries are retained for up to 24 hours;
• Premium activation records — wallet address + transaction hash retained while subscription is active, plus reasonable post-termination period for tax and accounting purposes (typically 5 years per Brazilian fiscal law);
• Support correspondence — retained for up to 24 months after the resolution of the inquiry;
• Local-storage / IndexedDB content — controlled entirely by you on your device; we have no copy.

14. International Transfers

Defi-Vision operates globally. Your data may be processed in jurisdictions other than the one in which you reside, including the United States, the European Union, and Brazil. When we transfer personal data internationally, we rely on appropriate safeguards permitted by applicable law (e.g., Standard Contractual Clauses, adequacy decisions, or your explicit consent).

15. Security

We implement reasonable administrative, technical, and physical safeguards designed to protect data against unauthorized access, loss, misuse, or alteration. These include:

• HTTPS/TLS encryption for all traffic;
• server-side input validation and SSRF protection on outbound calls (e.g., webhook proxy);
• rate limiting and abuse detection;
• principle of least privilege for any service accounts;
• regular dependency updates and security review of changes.

However, no method of transmission or storage is 100% secure. You bear responsibility for the security of your devices, wallets, and credentials. If you suspect a security issue, please report it to defivisionanalytics@gmail.com or follow our Security Policy.

16. Your Rights (GDPR · LGPD · CCPA)

Subject to applicable law, you may have the following rights:

• Access — request a copy of personal data we hold about you;
• Rectification — request correction of inaccurate or incomplete data;
• Erasure / “right to be forgotten” — request deletion of your data, subject to exceptions (e.g., legal retention, on-chain data we cannot alter);
• Restriction — request that we restrict processing in certain cases;
• Portability — receive your data in a structured, commonly used, machine-readable format;
• Objection — object to processing based on legitimate interest;
• Withdraw consent — where processing relies on consent, you may withdraw it at any time;
• Lodge a complaint — with the data protection authority of your country (e.g., ANPD in Brazil, your national EU DPA, your state’s attorney general in the US).

To exercise your rights, contact us at defivisionanalytics@gmail.com. We will respond within thirty (30) days, or such shorter period as required by law. We may need to verify your identity (e.g., by requiring a signed message from the relevant wallet).

17. Children

The Service is not directed at children under the age of 18 (or the age of majority in your jurisdiction). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

18. Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices, legal requirements, or the Service. The “Last updated” date at the top reflects the latest revision. If a change is material, we will use reasonable efforts to provide additional notice (e.g., banner, email to Premium subscribers). Your continued use of the Service after the effective date constitutes acceptance of the updated Policy.

19. Contact and Data Protection Officer

For privacy questions, data-subject requests, or to contact our Data Protection Officer:

For users in Brazil: complaints may be filed with the Autoridade Nacional de Proteção de Dados (ANPD). For users in the EU/EEA: with your local supervisory authority. For California residents: see additional CCPA disclosures available upon request.