Privacy Policy

The data controller responsible for your personal data is Cryptofluencer (the “Platform Operator”), an independent service operating from Switzerland.

The Platform Operator is the “controller” within the meaning of both Article 4(7) GDPR and Article 5(j) of the Swiss revised Federal Act on Data Protection (nFADP, in force 1 September 2023).

For privacy enquiries please contact us at privacy@cryptofluencer.io or via Telegram: @cryptofluencer_verify_bot.

We collect the following categories of personal data:

• Account data: username, password (stored as a salted hash via Supabase Auth — we never see your plaintext password), Telegram ID and username if you link your Telegram account, login timestamps.
• Behaviour data: ratings, endorsements, distrusts, reports, watchlist entries, project views. These are subscriber-only actions; counts may be displayed publicly in aggregated form.
• Payment data: payment intent identifiers, status, amount, and the wallet/transaction metadata returned by NOWPayments. We do not see or store your private keys or wallet seeds. We see the payer address only as reported by NOWPayments.
• Technical data: we store your IP address only as a one-way SHA-256 hash for abuse-prevention and view-counting; the raw IP is never persisted. We process standard request metadata (browser, OS, language) via our hosting providers.

• Contract performance (Art. 6(1)(b)) — providing the account, subscription, and listing services you request.
• Legitimate interest (Art. 6(1)(f)) — security, fraud prevention, abuse-detection, and rate-limiting (e.g. hashed IP, Turnstile bot protection).
• Consent (Art. 6(1)(a)) — where you actively opt in, such as accepting these Terms when creating an account. We do not currently process personal data for marketing purposes.
• Legal obligation (Art. 6(1)(c)) — where applicable record-keeping laws apply.

For data subjects in Switzerland, the equivalent lawful-basis framework under Article 31 nFADP applies: (a) consent; (b) contract performance; (c) overriding legitimate interest; (d) legal obligation.

• To operate your account and deliver the service you signed up for.
• To process payments and activate subscription or listing access.
• To send transactional messages via Telegram (subscription confirmations, expiry reminders, watchlist alerts, password reset codes).
• To display community signals (ratings, endorsements, distrusts, reports) and operate the Platform.
• To detect and prevent abuse, spam, manipulation, and security incidents.
• To comply with applicable laws and lawful requests.

We share personal data only with the sub-processors required to operate the Platform:

• Supabase — database, authentication, and row-level-security infrastructure (hosted in EU, Zurich region).
• Vercel — application hosting and edge runtime (United States).
• Cloudflare — Workers, Queues, KV, and Turnstile bot protection (United States with global edge).
• Upstash — Redis-based rate limiting (United States).
• NOWPayments — crypto payment processing (operates internationally).
• Telegram — bot interactions and the private subscriber group.
• DexScreener, Moralis, CoinGecko, GoPlus — read-only public on-chain and market data; we do not share your personal data with these providers.
• Sentry (if configured) — error monitoring.

We do not sell your personal data. We do not use third-party advertising or marketing analytics.

• Account data: kept for as long as your account is active and for a reasonable period thereafter (typically up to 12 months) for fraud prevention and legal compliance.
• Payment records: kept for the period required by applicable accounting and tax law (typically up to 10 years).
• Hashed IP addresses: retained for a maximum of 90 days for abuse-detection.
• Community signals (ratings, endorsements, distrusts, reports): retained as long as the project remains listed or as required for moderation history.

Our primary database (Supabase) is hosted in the EU/Zurich region. The Platform Operator is based in Switzerland, which the European Commission has recognized as providing an adequate level of data protection (adequacy decision under GDPR Chapter V). Transfers of personal data from the EEA to Switzerland are therefore not third-country transfers under the GDPR.

Some sub-processors (Vercel, Cloudflare, Upstash, Sentry, NOWPayments) operate from or via the United States or other non-EEA jurisdictions. Where personal data is transferred to such providers, the transfer relies on EU Standard Contractual Clauses (SCCs), an adequacy decision, or another lawful transfer mechanism recognized under the GDPR.

The Platform uses only essential cookies and local storage:

• Authentication session cookies set by Supabase Auth.
• A maintenance-bypass cookie (valid 30 days) when a soft-launch gate is active.
• CSRF tokens for protected API endpoints.

We do not use marketing, advertising, or third-party analytics cookies. Essential cookies do not require prior consent under GDPR.

If you are in Switzerland, you have equivalent rights under Articles 25–28 nFADP: right to information, access, rectification, deletion, objection, and restriction of processing.

You have the right to:

• Access the personal data we hold about you (Art. 15).
• Rectify inaccurate personal data (Art. 16).
• Erasure(“right to be forgotten”) of your personal data (Art. 17), subject to legal retention requirements.
• Restriction of processing (Art. 18).
• Data portability (Art. 20) — receive your data in a structured, machine-readable format.
• Object to processing based on legitimate interest (Art. 21).
• Withdraw consent where processing is based on consent (Art. 7(3)).
• Lodge a complaint with your local supervisory authority.

To exercise any of these rights contact us at privacy@cryptofluencer.io or via Telegram: @cryptofluencer_verify_bot.

Response time. We will respond to any exercise of these rights within 30 days (Article 12(3) GDPR / Article 19 nFADP). If a request is complex or numerous, we may extend this period by up to two further months and will explain the delay within the initial 30-day window.

Account deletion and User Content. When you exercise your right to erasure, your account record and authentication credentials are deleted. However, User Content you have published — ratings, endorsements, distrusts, reports, and comments — is anonymised rather than deleted: the link to your user identifier is severed and replaced with a placeholder (“deleted user”). This preserves the integrity of community signals that other users have relied upon and is justified under our legitimate interest (Article 6(1)(f) GDPR / Article 31(2)(d) nFADP) in maintaining the historical record of platform activity. If you require complete deletion of your User Content, indicate this in your request; we will assess on a case-by-case basis whether it can be honoured without disproportionate impact on third parties' rights.

Complaint to a supervisory authority. In addition to your home Member State DPA, Swiss data subjects may file a complaint with the Federal Data Protection and Information Commissioner (FDPIC, https://www.edoeb.admin.ch).

The Platform is not directed at, and we do not knowingly collect personal data from, individuals under 18. If you believe a minor has provided us with personal data, please contact us at privacy@cryptofluencer.io so we can delete it.

We protect your data with industry-standard measures, including:

• Row-Level Security on every database table.
• SHA-256 hashing of IP addresses before storage.
• HMAC-SHA-512 verification of payment webhook payloads.
• Encryption at rest (Supabase, Vercel, Cloudflare defaults).
• TLS for all data in transit.
• Durable rate-limiting and bot protection (Upstash Redis, Cloudflare Turnstile).

No system is perfectly secure. If you become aware of a security issue, please report it to support@cryptofluencer.io or via Telegram.

We may update this Privacy Policy as the Platform evolves. The “Effective date” at the top of this page will be updated when material changes take effect.

For privacy questions or to exercise your rights, email us at privacy@cryptofluencer.io or contact us via Telegram: @cryptofluencer_verify_bot.