Optivo — Privacy Policy
Version: 0.2 (DRAFT) · Effective date: 21 October 2026
DRAFT FOR THE PRODUCT OWNER AND A LAWYER. Version 0.1 is written from the spec (§0.5, §15.6) and docs/legal/legal-analysis.md. It is not legal advice and is not ready for publication until a qualified lawyer reviews it. Version 0.2 (21 Oct 2026) names the controller, the providers and the retention periods approved by the product owner. Optivo is operated by Rapid R Ltd until a dedicated company is formed.
This Privacy Policy explains what personal data Rapid R Ltd ("Optivo", "we", "us") collects when you use the Optivo website, web application and APIs (the "Service"), why we collect it, how long we keep it, who receives it, and your rights. It is part of the Terms and Conditions, and you accept it with them when you sign the acceptance message with your wallet.
1. Who is responsible for your data
Rapid R Ltd, a company incorporated in Bulgaria with company number (UIC) 208687089, registered address bl. 109, Knyaz Boris I Blvd., Varna, Bulgaria, is the controller of your personal data. Contact: support@optivo.app.
2. What we collect
We collect only the data below. We do not ask for your name, email address, identity documents or bank details.
Wallet addresses. The address of the wallet you sign in with, and the addresses of the exchange accounts and subaccounts linked to it. A wallet address can identify you, so we treat it as personal data. Your trades, deposits and withdrawals on a public blockchain are linked to your wallet address and are public.
IP data. Your IP address, the country your requests come from, and your browser's identification string (user agent). We record them when you sign in, when you use the Service, and when you accept the Terms.
Location checks. The results of our eligibility checks: the country of residence you declare when you accept the Terms, the country your requests come from, and whether you connect through Tor. If you connect from a restricted country, through Tor, or from a country other than the one you declared, the Service asks you to confirm a statement; we store your confirmation with the statement, the country, your IP address, your user agent and the time.
Screening results. The result of the sanctions screening of your wallet address and the time of the check.
Telegram alerts (only if you connect Telegram). Your Telegram chat ID and username, and the alerts we send you there. You can disconnect at any time in Settings or by sending /stop to the bot.
Acceptance records. Each time you accept the Terms and this Privacy Policy, we store the versions you accepted, their document hashes, your declared country, your wallet signature, the time, your IP address and your user agent.
3. Why we use it
| Purpose | Data | Legal basis |
|---|---|---|
| Eligibility: check that you may use the Service (country, not a US person, Derive's own restrictions) | IP data, location checks, declared country | Legal obligation; our legitimate interest in serving only eligible users |
| Sanctions: check that you are not a sanctioned person and that your wallet is not linked to one | Wallet addresses, screening results | Legal obligation |
| Security: protect your account and the Service against abuse, fraud and attacks | Wallet addresses, IP data | Legitimate interest |
| Operating the Service: sign you in, run your account, keep records of what you confirmed and accepted | Wallet addresses, acceptance records | Performance of our contract with you (the Terms) |
| Alerts: send you alerts about your account on Telegram, if you connect it | Telegram chat ID and username | Your consent (you connect it and can disconnect at any time) |
We do not sell your data. We do not use it for advertising, and we do not build marketing profiles.
4. How long we keep it
- IP data in server logs: 30 days.
- Location checks and screening results: for as long as your account exists, and then 5 years, to show that we applied our eligibility and sanctions controls.
- Acceptance records and location confirmations: for as long as your account exists, and then 6 years, as evidence of what you agreed to and confirmed.
- Telegram chat ID and username: until you disconnect Telegram or close your account.
- Data on a public blockchain is public and permanent. We cannot delete it.
When the retention period ends, we delete the data or make it anonymous.
5. Who receives it
We share your data only with these recipients, and only as far as each needs it:
- The exchange we route orders to, named in the Terms. It receives your wallet address and the orders the Service places on your account. Its own privacy policy applies to the data it holds.
- The Ethereum node provider we use for sanctions screening (PublicNode). We check your wallet address against the Chainalysis sanctions list, which is published on the Ethereum blockchain; to read it, we send your wallet address to the node provider. Chainalysis itself does not receive your data.
- Telegram, if you connect Telegram alerts. It delivers our alerts to your chat. Telegram's own privacy policy applies to the data it holds.
- Hosting and infrastructure providers that run our servers, store our secrets and keys, and pass the request country to us: Contabo GmbH (servers in the European Union), Google Cloud (secret and key management), and Cloudflare (edge network, which tells us the country you connect from). They process data only on our instructions.
- Authorities, when the law requires us to share data, for example in response to a lawful order.
Some of these recipients can be outside your country. Where the law requires it, we use safeguards such as standard contractual clauses for these transfers.
6. Cookies
We use two cookies, both needed for the Service: a session cookie that keeps you signed in, and a cookie that stores your time zone so that dates show in your local time. We use no advertising or tracking cookies.
7. Your rights
Depending on where you live, you can ask us to:
- give you a copy of your personal data;
- correct data that is wrong;
- delete your data, unless we must keep it by law or to defend legal claims (Section 4);
- restrict or object to how we use your data;
- send your data to you or to another provider in a common format.
To use these rights, write to support@optivo.app from the Service or sign a message with your wallet so we can check that the request comes from you. We answer within one month. You can also complain to the data protection authority in your country.
8. Security
We protect your data with access controls, encryption and audit logs. No system is completely secure. If a breach puts your rights at risk, we will tell you and the authorities as the law requires.
9. Children
The Service is only for people aged 18 or older. We do not knowingly collect data from children.
10. Changes to this Privacy Policy
Each version has a number, an effective date and a published hash. Previous versions stay available at https://optivo.app/privacy. If a change is material, the Service asks you to accept the new version before you continue.
11. Contact
Questions about this Privacy Policy or your data: support@optivo.app.