This Privacy Policy explains what personal data Envestir ("we", "us") collects, how we use it, and the choices you have. It applies to the Envestir application and website (the "Service").
1. Data we collect
- Account data — your email address or social login identifier and display name, provided through our authentication provider (Circle).
- Wallet data — your public Solana wallet address and on-chain activity. We never receive your private keys or PIN.
- Transaction data — trades, deposits, withdrawals, and credit activity you carry out through the Service.
- Identity data — where identity verification (KYC) is required, verification status and related metadata processed by our provider (Didit). We store your status, not your identity documents.
- Usage & device data — basic technical information (such as IP address, browser, and interactions) and local preferences stored on your device.
2. How we use it
- to provide, secure, and operate the Service;
- to execute and record the actions you take (trades, transfers, credits);
- to verify eligibility and comply with legal and regulatory obligations;
- to prevent fraud, abuse, and prohibited use;
- to improve features and provide support.
3. Third-party providers
We share data only as needed with service providers that help us operate, including:
- Circle — wallet creation and authentication;
- Didit — identity verification (when enabled);
- Ondo & Jupiter — tokenized-asset data and on-chain trade routing;
- AI providers — to generate research and analysis on request;
- Infrastructure & database providers — hosting and storage.
On-chain transactions are, by nature, public and permanent on the Solana blockchain and are not controlled by Envestir.
4. Cookies & local storage
We use strictly necessary cookies and browser local storage to keep you signed in and remember preferences. See our Cookies Policy for details.
5. Retention
We keep personal data for as long as your account is active and as needed to provide the Service and meet legal, accounting, and security obligations, after which it is deleted or anonymized.
6. Your rights
Subject to applicable law, you may request access to, correction of, or deletion of your personal data, and object to or restrict certain processing. Contact us to exercise these rights. Note that some records must be retained to meet legal obligations, and on-chain data cannot be deleted.
7. Security
We use technical and organizational measures to protect your data. No method of transmission or storage is completely secure, and you are responsible for protecting your login credentials and PIN.
8. Changes & contact
We may update this Policy from time to time; material changes take effect when posted. For privacy questions or requests, contact [privacy@envestir.example].
9. Language of this document
This document is provided in several languages for convenience. In case of any conflict or ambiguity between versions, the English version prevails and is the legally binding text.