Privacy Policy

How Blockchain Intelligence LLC (Wyoming limited liability company), operating DEO Finance, collects, uses, and protects your personal information, and the rights available to you under GDPR, CCPA/CPRA, and Korea PIPA.

Version 1.0 · Effective September 26, 2026

1. Data Controller

Blockchain Intelligence LLC (Wyoming limited liability company), doing business as DEO Finance, is the data controller responsible for your personal information. Registered address: 30 N Gould St, Sheridan, WY 82801, USA. You can reach us, including our privacy contact and data-protection officer, at deo@deo.finance.

2. Privacy by Design

Privacy is built into the architecture. We never store your wallet private keys or PIN — they are generated and held solely by you through your self-custodial wallet, never by us. Sensitive identity fields are encrypted at rest using AES-256-GCM. Web Push notifications carry only generic, privacy-preserving content and never include balances, amounts, counterparties, card numbers, or identity data.

3. Information We Collect

We collect: (a) identity and profile data (your name, email address, and, for verification, government-issued ID and address details); (b) authentication data, including WebAuthn passkey credentials and TOTP two-factor authentication seeds; (c) KYC verification metadata returned by Stripe Identity (verification status and outcome — not the raw document images, which Stripe processes as described in its own policy); (d) public blockchain transaction hashes and wallet addresses; and (e) technical metadata such as IP address and rate-limiting signals.

4. Legal Bases for Processing (GDPR Article 6)

Where the GDPR applies, we process personal data on the following lawful bases: performance of a contract (to provide the service you request); compliance with a legal obligation (anti-money-laundering and sanctions screening, and financial recordkeeping); and our legitimate interests (preventing fraud and abuse, rate-limiting, securing the service, and treasury solvency reconciliation), balanced against your rights and freedoms. Where we rely on consent, you may withdraw it at any time.

5. Third-Party Data Processors

We share personal information only with service providers that process it on our behalf under contractual data-protection terms: Circle (wallet infrastructure and USDC), Stripe (fiat on-ramp and off-ramp, payment processing, and identity verification), Supabase (authentication and database), Vercel (application hosting), Amazon Web Services (cloud infrastructure), and Upstash (rate-limiting). We do NOT sell or share your personal information.

6. Cross-Border Transfers & International Safeguards

Our infrastructure is operated in the United States, so your personal information is transferred to and processed on U.S. servers. Where personal data is transferred from the EU/EEA, the United Kingdom, or the Republic of Korea, we rely on appropriate safeguards, including Standard Contractual Clauses (SCCs) and encryption in transit and at rest.

7. Your Rights Under GDPR (European Union / EEA)

If you are located in the EU or EEA, you have the right to access, rectify, erase, and port your personal data, and to restrict or object to processing. You can exercise access, rectification, erasure, and portability yourself through our self-service endpoints — /api/privacy/export, /api/privacy/rectify, and /api/privacy/erase — or from your account settings. You also have the right to lodge a complaint with your local supervisory authority.

8. Your Rights Under the CCPA / CPRA (California, USA)

If you are a California resident, you have the right to know what personal information we collect and how it is used, the right to delete personal information, and the right to correct inaccurate information. We do NOT sell or share personal information, as those terms are defined under the CCPA/CPRA, and we do not use or disclose sensitive personal information for purposes that would trigger a right to limit. You will not receive discriminatory treatment for exercising any of these rights.

9. Your Rights Under Korea PIPA (Republic of Korea)

If you are located in the Republic of Korea, the Personal Information Protection Act (PIPA) applies, and this section is our notice under Article 30. Purpose of processing: account provision, identity verification, legal and anti-money-laundering compliance, and security. Retention period: for the duration of your account and thereafter only as required by applicable financial-recordkeeping law, after which the information is destroyed. Destruction method: electronic files are irreversibly deleted and any physical records are shredded or incinerated. International transfer: personal information is transferred to and processed on servers in the United States (see Cross-Border Transfers above), protected by SCCs and encryption. Chief Privacy Officer (CPO): reachable at deo@deo.finance.

10. How to Exercise Your Rights

You can exercise your data rights yourself, without waiting on a manual request: use the privacy controls in your account Settings, or call the authenticated endpoints directly — data access and portability via /api/privacy/export, correction via /api/privacy/rectify, and erasure via /api/privacy/erase. We may verify your identity before acting on a request and will respond within the timeframe required by applicable law.

11. Data Retention

We retain personal information for as long as needed to provide the service and to meet legal, tax, and regulatory obligations. Financial and transaction records may be retained for a longer statutory period, after which identifying data is deleted or anonymized where feasible.

12. Contact

Questions about this Privacy Policy or your personal information may be directed to Blockchain Intelligence LLC, 30 N Gould St, Sheridan, WY 82801, USA, or by email to deo@deo.finance. This policy is effective September 26, 2026.