Legal · Privacy Policy

Privacy Policy

What data we collect, how we store it, and how you can request deletion.

Effective: 2026-05-05 · Version 1.0 · GDPR-compliant draft

Pending legal review

Short version: we don't track you, we don't sell data, we don't have ad partners. We store the minimum required to keep you signed in and to operate the bot. You can request deletion at any time.

1. Data We Collect

Data	Purpose	Retention
Wallet address	Authentication, allocation tracking	While account is active
2FA secret (hashed)	Authenticator-app verification	Until 2FA is disabled
IP address	Security audit, geolocation, abuse prevention	30 days, rolling
Trading history	Performance reporting, risk gauges	While account is active
Session token	Keep you signed in (HTTP-only cookie + localStorage)	24 hours, rolling
User-agent string	Browser-fingerprinting for SOC anomaly detection	30 days

2. What We Do NOT Collect

No private keys or seed phrases (we never see them — wallet signatures only).
No KYC documents (passport, ID, bills) — we are non-custodial.
No third-party analytics (no Google Analytics, no Facebook Pixel, no Hotjar).
No advertising IDs.
No email or phone (unless you opt in to Telegram alerts).

3. Cookies & Local Storage

We use only essential cookies for authentication and CSRF protection. localStorage holds your session token, UI preferences (workspace layout, theme), and your 2FA acknowledgement flag. No tracking cookies are used. See Cookies Notice for the full list.

4. Legal Basis (GDPR)

For EU residents:

Contract performance (Article 6.1.b GDPR): wallet address, trading history, session token — required to provide the service.
Legitimate interest (Article 6.1.f): IP address, user-agent for fraud and abuse prevention.
Consent (Article 6.1.a): Telegram alert subscription, optional analytics if ever enabled.

5. Data Sharing

We do not sell, rent, or share your data with advertisers, brokers, or analytics providers. We share data only:

With Hyperliquid (via the wallet you connect) — required to execute trades.
With our infrastructure providers (server hosting) under data-processing agreements.
If legally compelled by a court order or subpoena from a competent authority.

6. Your Rights

Under GDPR, CCPA, and similar regimes, you have the right to:

Access the data we hold about you.
Rectify inaccurate data.
Erase your data (right to be forgotten).
Restrict or object to processing.
Portability: receive your data in a machine-readable format.
Lodge a complaint with your local data-protection authority.

To exercise any right, email privacy@evolvingbot.tech from the email tied to your account, or signed by your wallet. We respond within 30 days.

7. Security

We protect data with: 2FA-mandatory authentication, IP whitelisting per user, GeoIP filtering of restricted jurisdictions, encrypted secrets (AES-256-GCM), threat-intelligence IP blocking, and continuous SOC monitoring (HIDS, FIM, anomaly detection). API keys for Hyperliquid are encrypted at rest with a master key stored separately from the data.

8. International Transfers

Data may be processed in the country where our servers are hosted. For EU residents, transfers outside the EEA are made under Standard Contractual Clauses (SCCs).

9. Children

The service is not intended for children under 18. We do not knowingly collect data from minors.

10. Changes

Material changes to this policy will be announced via the platform interface and via email if you have provided one.

11. Contact

Privacy questions: privacy@evolvingbot.tech · Data Protection Officer: TBD on entity formation.