LEGAL

Privacy Policy

Beta draft. This policy reflects how mydefitax actually works today (public wallet addresses only, hosted SaaS, third-party data providers); it has not yet had a formal GDPR / DSGVO legal review (planned before paid plans go live). Last updated: 3 July 2026.

1. Controller

Vladimir Lobanov, Vasileos Georgiou I, 115, 4046 Limassol, Cyprus ([email protected]) is the controller responsible for the processing of your personal data described here.

2. What we process

Public wallet addresses you submit. We never ask for — and you must never give us — private keys, seed phrases or exchange API secrets.
On-chain data read from public blockchains for the addresses you provide (transactions, transfers, event logs, prices at the time of each event).
Waitlist data: the email address and, if you entered any, the wallet addresses you chose to link to your waitlist spot.
Account data: email and authentication details, once accounts are available.
Billing data: handled by our payment provider acting as merchant of record; we do not store full card numbers.
Technical data: IP address and browser user-agent in server logs, kept for security and abuse prevention. We run no product-analytics or advertising trackers.

3. Purposes and legal basis (Art. 6 GDPR)

Providing the service — reconstructing your transactions and generating reports: performance of a contract, Art. 6(1)(b).
Managing the waitlist and granting beta access: your request prior to entering a contract, Art. 6(1)(b), and legitimate interests, Art. 6(1)(f).
Security, abuse prevention and service improvement: legitimate interests, Art. 6(1)(f).
Billing and statutory record-keeping (once paid plans are live): legal obligation, Art. 6(1)(c).

4. Recipients / processors

We share data only with providers that help us operate the service:

Blockchain data / RPC providers (e.g. Envio HyperSync, dRPC, Alchemy, Etherscan, Infura, Blockscout, Moralis) — receive the public wallet addresses in order to fetch on-chain data. Wallet addresses are public blockchain data by nature.
Price-data providers (e.g. CoinGecko, Alchemy, Moralis) — receive token/date queries, not your addresses.
Hosting / infrastructure: DigitalOcean (EU region, Frankfurt).
Payment provider (once paid plans are live): Paddle, acting as merchant of record.

Some of these providers process data outside the EU/EEA; where they do, transfers rely on an EU adequacy decision or EU Standard Contractual Clauses.

5. Retention

Waitlist entries are kept until you receive access or ask us to remove you. Account and portfolio data are kept while your account is active and deleted within 90 days of account deletion, except where longer statutory (e.g. tax/bookkeeping) retention applies. Server logs are kept for a short rolling window.

6. Your rights

You have the right to access, rectification, erasure, restriction, data portability and objection, and the right to lodge a complaint with a supervisory authority — the Cyprus Commissioner for Personal Data Protection, or the data-protection authority of your own country of residence. To exercise any right, contact [email protected].

7. Cookies and analytics

We use no advertising or analytics cookies and no tracking pixels. The site uses only functional browser storage: the wallet addresses you paste into the analyzer are held in your browser's sessionStorage to carry them to the next page, and authenticated areas use a technically necessary session cookie. No consent banner is required for these.