Privacy Policy

1. Introduction

At DeFiMara ("we," "our," or "us"), we respect your privacy and are committed to protecting your personal information. This Privacy Policy explains how we collect, use, and safeguard your data when you use our decentralized finance application and AI assistant platform (the "Service").

Contact: [email protected] for privacy questions or data requests.

Your rights in the app: Privacy opens a short notice about the browser id and security logs (not for ads) and links to this policy. There is no self-serve download, erase, or other data action in the product. To access, correct, or erase personal data, email [email protected]. Dismissing the notice only hides it. The visitor id is stored when the preview starts, because the service needs it. Anonymous visitors have no email, so that notice shows again when this policy version changes. Wallet accounts may add an email for reports. After a verified support request we can remove the account, chat, and personal rows tied to that browser, except payment records kept for accounting. Security logs also expire after 90 days on their own. An anonymous profile with no wallet and no email is deleted after 90 days without a visit. Wallet login requires a signature. We do not treat a typed address as proof of ownership.

2. Information We Collect

2.1 Information You Provide

• Email address (optional): Only if you choose to add one for reports or transactional messages
• Wallet Address: Your public blockchain wallet address (EVM and/or Solana)
• Chat Messages: Messages you send to our AI assistant
• User Preferences: Settings and preferences you configure
• Consent Records: Your cookie and terms acceptance

2.2 Automatically Collected Information

• Session Data: Session IDs for maintaining your connection
• Browser Information: User agent and browser type
• Network Information: IP address in security logs for 90 days, for abuse checks and rate limiting
• Usage Data: Features you use and transactions you initiate
• Visitor id: A browser identifier so anonymous preview stays one person and so we can link abuse. We keep a short prefix and a one-way digest. The HttpOnly cookie dfm_visitor is refreshed while you use DeFiMara and lasts up to 180 days of inactivity in the browser. It is cleared when support completes an erasure request. Raw fingerprint components are checked when you connect and are not stored. This id is not used for advertising or sale.
• Campaign links (UTM / ref): If you open DeFiMara from a campaign URL (for example utm_source), we store those parameters in this browser and, when you connect, on your account so we can see which channels bring users. This stays on DeFiMara infrastructure. It is not shared with Google Analytics or ad networks, and it is not used for advertising profiles.

2.3 Blockchain Data

We may access publicly available blockchain data associated with your wallet address, including:

• Token balances and NFT holdings
• Transaction history
• DeFi protocol interactions
• Smart contract interactions

Note: This information is already public on the blockchain. We do not make it public; we only read it to provide our services.

3. What We DON'T Collect

4. How We Use Your Information

We use your information solely to:

• Provide and improve our AI-powered DeFi assistant
• Display your portfolio and wallet information
• Facilitate blockchain transactions you request
• Maintain your session and preferences
• Ensure security and prevent fraud
• Comply with legal obligations
• Respond to your support requests

4.1 Lawful basis

• Running the service you opened (contract, or steps before a contract): wallet addresses you sign, chat you send, session, preferences, and the visitor id that keeps an anonymous preview on one browser.
• Abuse checks (legitimate interest): security logs of path, status, IP, and client. The interest is keeping the service available. The fields are limited, they are not used for ads, they expire after 90 days, and earlier erasure is handled through [email protected].
• Accounting (legal obligation): payment records, which are not deleted on erasure requests.
• Email you choose to save for reports: only when you set it. Anonymous visitors have no email.

In demo mode a notice says we collect a browser id and security logs to prevent abuse, not for ads. Tapping OK only hides the notice. The id is stored when the preview starts. Data access or erasure requests go to [email protected].

5. Data Storage and Security

5.1 Where Your Data is Stored

5.2 Security Measures

• HTTPS/TLS for traffic to the app
• HttpOnly cookies for the session token and the visitor id
• XSS and CSRF protections on the app
• Secure cookie attributes where the deployment enables them (Secure, SameSite)
• Session token expires after 2 hours by default

6. Data Sharing and Third Parties

We may share limited data only in these circumstances:

• AI inference: OpenAI, in the United States — chat prompts and tool context. OpenAI's API data-processing terms include the EU standard contractual clauses. This page does not replace a countersigned pack kept by the operator.
• Hosting: the database and backend run on Hetzner in the EU. Cloudflare delivers the website and may see IP addresses on its network.
• Database: MongoDB on that EU server — user, chat, payment, and operational data
• Email: Resend — transactional email when you set an address
• Market/portfolio data: Zerion, CoinGecko, Binance, DefiLlama (via our servers; see dependency register)
• Blockchain execution: Public RPC nodes, ParaSwap, Jupiter, LI.FI, Hyperliquid (when you initiate actions)
• Legal compliance: When required by law or to protect rights and safety

Full processor list: docs/launch-readiness (S19-P0-011). We do not sell personal data for marketing.

7. Your Privacy Rights

Depending on your location, you may have the following rights:

To exercise these rights, email [email protected]. The in-app Privacy control only shows the notice and links here; it does not download or erase data automatically. We will respond within 30 calendar days of a request we can tie to this browser or wallet. Where the law allows, we may extend that by up to 30 days and tell you why. You can also complain to your supervisory authority.

8. Cookies and Similar Technologies

We use only essential cookies required for the Service to function:

• jwt_token: HttpOnly session cookie. Expires in 2 hours by default.
• dfm_visitor: HttpOnly visitor id. Refreshed when you connect. The browser keeps it for up to 180 days without a new connect, then drops it. Cleared when support completes an erasure request.
• userId: account id the app can read, so the signed-in browser can find its record. Same 180-day refresh. Not an advertising id.
• localStorage: session id, a flag that you saw this notice version (cookieConsent, cookieConsentDate, cookieConsentVersion), and first-touch campaign parameters when present (dfmAttributionFirstTouch).

We do not use advertising cookies, third-party analytics cookies such as Google Analytics, or social-media tracking cookies. Campaign UTM parameters are first-party only (this site and our servers).

9. Data Retention

We retain your data only as long as necessary:

• Session token: 2 hours by default (jwt_token).
• Visitor id and userId cookies: up to 180 days without a new connect, then the browser drops them. Each connect refreshes that clock.
• Security logs (path, status, IP, client): 90 days, or sooner after a verified support erasure request.
• Provider call logs (Zerion and similar): 14 days.
• Browser error reports: 30 days. They can include the page URL, a stack trace, and a wallet address if one was connected.
• Anonymous profile with no wallet and no email, including its chat: deleted after 90 days without a visit.
• Wallet account, chat, and preferences: kept until you ask [email protected] and we complete a verified erasure.
• Notice flag: stored on the user record until that record is deleted. We do not keep a separate multi-year consent archive.
• Payments: kept for accounting after erasure.

10. Children's Privacy

Our Service is not intended for individuals under 18 years of age. We do not knowingly collect personal information from children. If you believe we have collected data from a child, please contact us immediately at [email protected].

11. International Data Transfers

The application database stays on Hetzner in the EU. Chat prompts are sent to OpenAI in the United States under OpenAI's API data-processing terms, which include the EU standard contractual clauses. Cloudflare may process IP addresses on its network when it delivers the site. Portfolio lookups send the public wallet address to the data provider you asked us to call. Email, when you set one, is sent through Resend.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by updating the version at the top of this page. The bottom notice shows again when that version changes. Wallet accounts that saved an email may also be told by email.