Privacy Policy

The controller is Kinthic, a founder-run project based in Valencia, Spain. Contact for anything privacy-related: [email protected]. See the legal notice.

• Account: email, name and profile picture URL from Google sign-in; when you accepted the Terms and confirmed you are 18+.
• Work data: vaults you watch, alert rules, decision log, role and organization if you give them.
• Alert channels: Telegram chat ID and username, browser push subscription, Slack or Discord webhook URL, if you set them up.
• Alert history: which alerts we sent you and when.
• Billing: Stripe customer and subscription IDs and plan. Card details stay with Stripe; we never see them.
• Technical: IP address and request logs kept by our hosting provider for security.

Kinthic is read-only and non-custodial. We never request wallet connections, signatures, seed phrases or private keys. The service is not for anyone under 18.

• Running your account, alerts and subscription: contract (GDPR art. 6(1)(b)).
• Invoices and tax records: legal obligation (art. 6(1)(c)).
• Security, abuse prevention, rate limiting, error tracking: legitimate interest (art. 6(1)(f)).
• Service emails about your account or a change to these terms: contract / legitimate interest.
• Occasional product emails to business contacts: legitimate interest, with an opt-out in every email.
• Anonymous page-view analytics: your consent (art. 6(1)(a)), which you can withdraw any time.

Severity scores and some summaries of public onchain changes are produced by AI models and are marked as such. These models receive public blockchain data only, never your personal data. No decision with legal or similar effect on you is made automatically.

• Supabase: Sign-in and database. Data hosted in the EU (Ireland). US company: SCCs + EU-US DPF.
• Vercel: Hosting, request logs, Web Analytics (only if you allow it). US: SCCs + EU-US DPF.
• PostHog: Error tracking (always on, no cookies, no profile) and page-view analytics (only if you allow it). EU cloud (Frankfurt, Germany).
• Cloudflare: DNS and network security. US: SCCs + EU-US DPF.
• Stripe: Payments, invoices, tax records. Stripe Payments Europe (Ireland); onward US transfers under SCCs + DPF.
• Google: Google sign-in; email we send or receive. Google Ireland / Google LLC (US): SCCs + DPF.
• Telegram: Alert delivery, only if you link a chat. Outside the EU (UAE). Transfer needed to deliver the alerts you ask for (GDPR art. 49(1)(b)).
• Browser push services (Google, Apple, Mozilla): Push delivery, only if you enable push. May be outside the EU.
• Slack / Discord: Alert delivery to a webhook you add. US: their own terms.
• TypeSafe (Jev): AI severity score of public onchain changes. Receives no personal data. Outside the EU.
• DeepSeek: AI text analysis of public governance text. Receives no personal data. China (no EU adequacy decision). We send it public data only.
• Alchemy, Morpho API: Reading public blockchain data. Receive no personal data. US.

Where a provider is outside the EU/EEA, transfers rely on the EU-US Data Privacy Framework, the European Commission's Standard Contractual Clauses, or, for Telegram, on being necessary to deliver the service you request. Ask us for a copy of the safeguards.

• Account and work data: until you delete your account, then removed within 30 days.
• Invoices and billing records: 6 years (Spanish Commercial Code art. 30) or as tax law requires.
• Hosting logs: short-term, under the hosting provider's retention.
• Analytics consent choice: in your browser until you change it.

You can access, correct, delete, export, restrict or object to the use of your data, and withdraw consent at any time. Email [email protected]; we answer within one month. You can unlink Telegram, remove vaults and turn off push yourself in Settings. To delete your account, email us from the address you sign in with. You can also complain to the Spanish Data Protection Agency (AEPD), aepd.es, C/ Jorge Juan 6, 28001 Madrid.

Essential only, set without asking:

• sb-*-auth-token (Supabase): keeps you signed in. Expires after up to 400 days; removed when you sign out.
• Browser storage (localStorage) for your own settings: read alerts, last visit, avatar colour, onboarding seen, and your analytics choice. Never sent to third parties.
• A service worker, only if you turn on push alerts.

Optional, off until you click Allow: Vercel Web Analytics and PostHog page views. They set no cookies, drop URL query strings and keep no lasting identifier on your device. When you are signed in, PostHog page views are linked to your account ID (never your email). No session replay, no ad trackers, no keystroke or form capture. Change your choice under Cookie settings in the site footer.

Fonts are served from kinthic.com; your browser does not contact Google Fonts.

Stripe Checkout runs on Stripe's own domain and sets its own cookies for fraud prevention.

We will email account holders before a material change takes effect.