HOODSAFELegal
Privacy Policy
We collect only what we need to run HoodSafe, secure it, and meet our legal duties. We never sell your data and never use advertising trackers.
Analytics runs only if you allow it. Data written to public blockchains is public and permanent by design. You can contact us at any time to exercise your GDPR rights.
1. Who is responsible for your data
The controller of your personal data is Amilase Invest OÜ, registry code 16093311, Tornimäe tn 3, 10145 Tallinn, Estonia (“HoodSafe”, “we”). Contact for all privacy matters: [email protected] (subject “Privacy”).
This policy explains how we process personal data when you use the HoodSafe website, web terminal, Telegram bot, browser extension, wallet and related services (the “Services”), in accordance with the EU General Data Protection Regulation 2016/679 (“GDPR”) and the Estonian Personal Data Protection Act.
2. What data we process
- Account data: your Telegram user ID, username and display name; referral relationships; profile settings (for example a chosen NFT avatar); preferences.
- Wallet and transaction data: the address of your HoodSafe wallet; its private key (stored encrypted, see section 8); balances and transaction history read from public blockchains; the orders, swaps, locks, borrows, alerts, watched addresses and automation settings you create; fees.
- Content you post: social callouts, comments and similar content, which are public within the Services.
- Technical data: IP address, browser and device information, session cookies/tokens, timestamps, logs of requests and errors.
- Communications: messages you send to us or to our bots.
- Analytics data (only with your consent): see the Cookie Policy.
We do not ask for special categories of data (such as health data). We do not currently run identity verification. If the law requires us to verify your identity, we will tell you what we need and why before collecting it.
3. Why we use it and on what legal basis
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Provide your account and the Services (sign-in, wallet, trading, locker, borrowing, alerts, referrals, profile) | Telegram user ID, username and display name; wallet addresses; encrypted wallet keys; orders, transactions, bot and alert settings; referral links; profile and avatar choices | Performance of our contract with you (Art. 6(1)(b) GDPR) | While your account is open, then up to 3 years (limitation period for claims) |
| Execute blockchain transactions you request | Wallet address, transaction details (asset, amount, price limits), timestamps | Contract (Art. 6(1)(b)) | As above; on-chain data is public and permanent (see section 5) |
| Security, fraud and abuse prevention, debugging | IP address, user agent, session identifiers, request logs, error logs, rate-limit counters | Legitimate interests in keeping the Services and users safe (Art. 6(1)(f)) | Server logs normally up to 90 days; longer only if needed for a specific incident |
| Customer support and complaints | Messages you send us, contact details, related account data | Contract (Art. 6(1)(b)); legitimate interests (Art. 6(1)(f)) | Up to 3 years after the matter is closed |
| Accounting and legal compliance (including sanctions screening and responding to authorities) | Fee and transaction records, identification data where required, correspondence with authorities | Legal obligation (Art. 6(1)(c)) | As required by law; accounting records 7 years |
| Website analytics (only with your consent) | Pages viewed, referrer, device/browser type, approximate location (country/city), interactions; pseudonymous cookie IDs | Consent (Art. 6(1)(a)); withdraw at any time via “Cookie settings” | Google Analytics data retention set to 14 months |
| Product announcements and important service messages via Telegram | Telegram user ID | Contract for service messages; legitimate interests for product news, which you can mute or stop at any time | While your account is open |
Where we rely on legitimate interests, we have balanced them against your rights. You can ask us for that assessment and you can object (section 9). We do not sell personal data, and we do not use it for third-party advertising.
4. Automated decisions and profiling
We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects within the meaning of Art. 22 GDPR.
Automated trading features act on rules that you configure. Market scores, signals and labels describe tokens and on-chain activity, not you. Automated security checks (for example rate limits or sanctions screening) may temporarily block a request; you can ask for a human review.
5. Public blockchains
Transactions on public blockchains, including your wallet address, balances and transaction history, are recorded permanently and are visible to anyone. Neither we nor anyone else can delete or change them.
Your wallet address is not directly your name. However, it can become personal data if it is linked to you, for example through your Telegram account in our systems, your public profile, or your own posts. Please keep this in mind before linking public profiles or posting callouts. Your rights to erasure and rectification apply to the data in our own systems, not to data on public blockchains.
7. Transfers outside the EU/EEA
Some providers process data outside the EU/EEA, including in the United States. We transfer data on the basis of:
- an adequacy decision, including the EU-U.S. Data Privacy Framework for certified U.S. companies;
- the European Commission’s Standard Contractual Clauses, with additional safeguards where needed.
When you use Telegram or interact with third-party protocols yourself, those providers process data under their own terms. You can ask us for a copy of the relevant safeguards.
8. How we protect data
We use technical and organisational measures appropriate to the risk, including:
- encryption of wallet private keys at rest;
- encrypted connections (TLS);
- HttpOnly session cookies;
- restricted network access to databases and internal services;
- least-privilege access for staff;
- signing guards that check every transaction before it is sent;
- backups and logging.
No system is perfectly secure. If a personal-data breach is likely to result in a high risk to you, we will tell you without undue delay, as required by Art. 34 GDPR.
9. Your rights
Under the GDPR you have the right to:
- access your personal data and receive a copy;
- have inaccurate data corrected;
- have data erased, where the conditions of Art. 17 apply;
- restrict processing;
- data portability, for data you provided and that we process by contract or consent;
- object to processing based on legitimate interests, including at any time to direct marketing;
- withdraw consent at any time, without affecting earlier processing. For analytics, use “Cookie settings” in the site footer.
To exercise a right, email [email protected] from, or with proof of control of, the Telegram account linked to your HoodSafe account. We may ask for additional information to verify that the request comes from you. We answer within one month; this can be extended by up to two more months for complex requests, in which case we tell you why.
Some data must be kept despite an erasure request, for example accounting records or data needed for legal claims. In that case we restrict it to those purposes.
You also have the right to lodge a complaint with a supervisory authority, in particular in the EU country where you live or work or where the alleged infringement took place. In Estonia this is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, [email protected], www.aki.ee. We would appreciate the chance to address your concern first.
10. Children
The Services are only for adults (18+). We do not knowingly collect data from children. If you believe a child has created an account, contact us and we will delete it.
11. Changes to this policy
We will update this policy when our processing changes. We will announce material changes on the website or through the Telegram bot before they take effect. The effective date at the top shows the current version.