Privacy Policy

This policy applies to the DeFi Orbit website, the Portfolio app, Portfolio Enterprise, the API Platform, DeFi Orbit AI (our MCP server) and our partner programs. It explains what we collect, why, who we share it with, how long we keep it and the choices you have.

1.1When we act for a client

If you use DeFi Orbit through an organisation, such as an asset manager that tracks your wallets in Portfolio Enterprise, that organisation decides what data is added and who can see it. We process that data on their behalf and under our agreement with them. Questions about it are best sent to them first, and we will help them answer.

1.2Related pages

Our Terms & Conditions govern your use of the services. Our Security & Privacy page describes how we protect data in more detail.

2.1Information you give us

When you create an account, subscribe, contact us or join a program, we may collect:

• Name, email address and company name
• Account settings and preferences
• Billing details, handled by our payment processor; we do not store full card numbers
• Messages you send through our forms, email or support channels
• Telegram handle or chat ID, if you turn on Telegram alerts
• For referral partners: payout wallet address and the details needed to pay commissions

2.2Wallet addresses and on-chain data

You or your organisation add public wallet addresses to your account. For those addresses we read public blockchain data, including:

• Token balances and transaction history
• Liquidity and lending positions, fees, rewards and related events
• Values, profit and loss and other figures we calculate from that data

2.3Wallet signatures

To prove you own a wallet, you may be asked to sign a short text message. A message signature is not a transaction: it cannot move funds, approve a token or change anything on-chain. We store the result of the check, not anything that could be used to sign on your behalf.

We never collect, store or have access to:

• Private keys or seed phrases
• The ability to sign transactions for you
• Funds or assets in your wallet

2.4API Platform and DeFi Orbit AI

When you use an API key, directly or through an AI assistant, we record:

• The key used, the endpoint or tool called and the time
• The wallet addresses and parameters in the request
• Response status, credits used and response time
• The IP address the request came from

2.5Usage and device information

When you visit the website or use the app, we collect standard technical information such as IP address, browser type, pages viewed and the time of each visit. See section 09 for cookies.

2.6Information from other sources

We obtain public blockchain data and market prices through blockchain nodes, data providers and price feeds. This data is public and is not specific to you until it is linked to an address in your account.

We use the information above to:

• Provide the app, API and AI tools, including positions, performance figures, snapshots and reports
• Send the alerts you set up, by email or Telegram
• Create share links and white-label views that you choose to publish
• Process subscriptions, credit purchases and referral payouts
• Provide support and respond to demo and data requests
• Show you your own usage, logs and credit balance
• Keep the services secure, prevent abuse and enforce rate limits
• Improve the services, using aggregated or de-identified data where possible
• Send product updates and, where required with your consent, marketing emails
• Meet legal, tax and accounting obligations

3.1Aggregated protocol analytics

We produce aggregated statistics from public on-chain data, such as how many LPs use a protocol, how long positions stay open and how pools perform. When we share these with protocol partners, they describe the protocol as a whole. We do not give partners the account details, names or contact information of our users.

3.2Legal bases

Where data protection laws such as the GDPR apply, we rely on: performing our contract with you; our legitimate interests in running, securing and improving the services; your consent, for optional marketing and non-essential cookies; and compliance with legal obligations.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We share it only as follows:

4.1Service providers

We use providers that process data on our behalf under contract, for:

• Payment processing
• Cloud hosting, storage and databases
• Blockchain data and price data
• Email delivery and notifications
• Customer support and analytics

4.2People you choose to share with

Share links and white-label reports can be opened by anyone who has the link, without an account. You decide what each link shows and can turn it off at any time. In Portfolio Enterprise, members of your team see the data your account settings allow.

4.3AI assistants you connect

DeFi Orbit AI returns data only to the client that made the request. What happens next is governed by the assistant you use and its model provider, so choose one whose data terms you are comfortable with.

4.4Legal requirements and protection

We may disclose information when required by law, to respond to valid legal process, or to protect the rights, property or safety of DeFi Orbit, our users or others, including to prevent fraud or abuse.

4.5Business transfers

If DeFi Orbit is involved in a merger, acquisition or sale of assets, information may be transferred as part of that transaction, subject to this policy.

We keep information only as long as we need it for the purposes above:

• Account and wallet data: until you or your organisation delete the account, after which it is deleted or de-identified unless the law requires us to keep it
• Daily snapshots and audit trail: for the life of the account, because their purpose is long-term reporting
• API request logs: two years
• Billing and payout records: as long as tax and accounting law requires, typically seven years
• Support and form messages: up to two years after the conversation ends

Public blockchain data is not deleted by us, because it remains on the blockchain itself.

We use technical and organisational measures appropriate to the data we hold, including encryption in transit (TLS) and at rest, access controls with least privilege, and monitoring. DeFi Orbit is read-only: we cannot move funds or execute transactions on your behalf. Our Security & Privacy page describes these measures in more detail.

6.1If something goes wrong

If a security incident affects your personal information, we will notify you and any regulator as required by law, and tell you what happened and what we are doing about it.

Depending on where you live, you may have the right to:

• Access the personal information we hold about you
• Correct inaccurate information
• Delete your information, subject to legal requirements
• Receive your data in a portable format, such as CSV export
• Object to or restrict certain processing
• Withdraw consent at any time, where we rely on it
• Opt out of marketing emails using the link in each email

7.1How to make a request

Email privacy@defiorbit.xyz from the address on your account. We may ask you to confirm your identity, for example by signing a message with a wallet on the account. We respond within 30 days, or sooner where the law requires. We will not treat you differently for exercising your rights.

7.2California residents

California residents have the rights to know, delete and correct personal information, and to opt out of its sale or sharing. We do not sell or share personal information as those terms are defined under California law.

7.3Complaints

If you are in the EU, the UK or another region with a data protection authority, you may lodge a complaint with it. We would appreciate the chance to resolve your concern first.

DeFi Orbit Inc. is based in the United States, and we and our providers may process information in the US and other countries. Where we transfer personal information from the EU, the UK or Switzerland, we use safeguards such as the European Commission’s Standard Contractual Clauses.

9.1What we use

We use:

• Essential cookies, which keep you signed in and the services working
• Analytics through PostHog, to understand how the website and app are used
• Analytics through Google Analytics, to measure website traffic; it sets cookies to distinguish visitors
• Support chat through Intercom, so you can message us from the site; it sets cookies to keep your conversation history

9.2Your choices

You can block or delete cookies in your browser settings. Blocking essential cookies may stop parts of the app from working. Where the law requires consent for non-essential cookies, we ask for it first.

10.1Public and permanent

Transactions, balances and contract interactions on public blockchains are visible to anyone and cannot be changed or deleted, by us or anyone else. Deleting your DeFi Orbit account removes the link between your account and your addresses, not the on-chain history.

10.2Third-party protocols

The protocols, wallets and networks you use have their own privacy practices, which this policy does not cover.

Our services are not intended for anyone under 18. We do not knowingly collect personal information from children, and if we learn we have, we will delete it.

We may update this policy as our services change. We will post the new version here with a new date, and for material changes we will notify registered users by email or in the app before they take effect.

Questions or requests about this policy or our data practices can be sent to:

DeFi Orbit Inc. · Draper, UT · Privacy: privacy@defiorbit.xyz · Support: support@defiorbit.xyz