Privacy Policy
This policy says what personal data OmniOS OÜ holds about you, why we are allowed to hold it, who else sees it, how long we keep it, and how to make us stop. It describes what the system actually does, not what a template says it might.
- In force from
- Version
- 2.9
- Issued by
- OmniOS OÜ
Clarifies service records, aggregate request counts and optional analytics, with one saved choice and no automatic prompts.
1Who is responsible for your data
OmniOS OÜ (registry code 17591703) is the controller of the personal data described here, within the meaning of Regulation (EU) 2016/679 (GDPR).
- Controller
- OmniOS OÜ
- Registry code
- 17591703
- Address
- Padriku tee 3/3, 11912 Tallinn, Estonia
- Privacy contact
- [email protected]
- Data protection officer
- We are not required to appoint one: we do not carry out large-scale monitoring of individuals or process special-category data as a core activity. Privacy questions go to the address above and are handled by the management board.
- EU representative
- Not required — we are established in the EU.
This policy covers vultax.com, the app at app.vultax.com, the API, and alerts we send you. It does not cover exchanges, wallets or other sites you reach from ours; they have their own policies.
2The short version
- We do not sell, rent or trade personal data, and we never have.
- Optional analytics needs your choice on both sites. There is no automatic popup. Use Analytics choices in the website footer or Settings → Privacy & data in the app. Essential service records and aggregate request counts continue independently. See the cookie policy.
- We do not train models on your data. Your Vi AI conversations are not used to train anyone's model, ours or our provider's.
- Your data is hosted in the European Union, in Frankfurt, Germany.
- We collect what the Service needs to work, keep it for a stated period, and delete it after.
3What we collect, why, and on what legal basis
Each row states a purpose, the data used for it, the Article 6 GDPR basis, and how long we keep it. Where the basis is legitimate interests, the interest is named so you can weigh it.
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Run your account and give you the Service you paid for | Email address, display name, password hash, plan and entitlements, settings, watchlists, alert rules | Art. 6(1)(b) — performance of the contract | Life of the account, then 30 days |
| Sign you in with Google, if you choose to | Google account identifier, email address, display name, avatar URL | Art. 6(1)(b) — you asked to sign in this way | Life of the account, then 30 days |
| Take payment and manage the subscription | Billing email, country, plan, subscription status, Stripe customer and payment identifiers, invoice history. We never receive your full card number. | Art. 6(1)(b) contract; Art. 6(1)(c) legal obligation for the accounting record | Accounting records 7 years (Estonian Accounting Act § 12); other billing data, life of the account |
| Answer support requests and complaints | Your messages, attachments, and the account they concern | Art. 6(1)(b) contract; Art. 6(1)(f) legitimate interest in keeping a record of what was agreed | 3 years from last contact |
| Hold an alert configuration you have set up | Telegram chat identifier and alert rules, where you linked them, and a delivery log entry for each alert sent: the channel, the destination chat identifier, the delivery status and any error, the alert's title and category, and the time it was sent. | Art. 6(1)(b) — performance of the contract | Alert rules and the Telegram link: until you remove them; deleted with the account |
| Answer your questions in Vi AI | Your prompts, the assistant's replies, timestamps, token counts, the model used | Art. 6(1)(b) — performance of the contract | Conversation history until you delete it, or 12 months after the account closes |
| Let you practise on the paper desk | Your simulated positions, virtual balance and order history. Nothing here is money and no order reaches a market, but the ledger belongs to your account and is held by us, not by your browser. | Art. 6(1)(b) — performance of the contract | Life of the account, then 30 days |
| Keep the Service up, secure and free of abuse | IP address, user agent, request URL and status, timestamps, rate-limit counters, authentication events | Art. 6(1)(f) — legitimate interest in defending the Service against attack, credential stuffing and scraping | Access logs are rotated daily and normally kept for 14 days; records needed for a legal claim follow the legal-claims retention below |
| Understand how the app is used, so we know what to fix | With permission, Google Analytics measures pages, navigation, signups and checkout starts. Our own analytics measure public-page use, active time, scrolling and interaction counts, using a pseudonymous browser identifier and broad device, country and source categories. Typed content, account identifiers, email addresses, wallet addresses, payment details and session recordings are excluded. Advertising features are disabled. | Art. 6(1)(a) — consent, withdrawable in Settings → Privacy & data. Accepting the Terms is not analytics consent | Our detailed analytics: 90 days. Google event data: up to 14 months. Browser identifiers: up to 180 days |
| Understand how the public website is used | Our first-party page-use and interaction measurement on vultax.com, only after your explicit choice. Google Analytics is currently enabled in the app rather than on the public website. No optional analytics event is sent before permission. The saved choice applies on both sites. | Art. 6(1)(a) — consent, withdrawable at any time through Analytics choices in the site footer | Our detailed analytics: 90 days; browser identifier: up to 180 days |
| Count service requests without visitor profiles | Aggregate daily requests, public routes, broad sources and device categories, status codes and delivery performance derived from existing server requests. No visitor identifier, IP address or account is retained in these counts; no browser beacon is required. | Art. 6(1)(f) — legitimate interest in operating and improving the service with limited aggregate measurement | Aggregate counts: up to two years. They include automated requests and do not establish a number of people |
| Run the referral programme | The referral code of the member who sent you, the time your account was created, and — for the referring member — the payments received on accounts they referred and the balance owed to them. Not the referred account's email address, and not what they looked at. | Art. 6(1)(b) — performance of the contract with the referring member and with you, and Art. 6(1)(c) for the payment record | Accounting records 7 years; the attribution cookie 30 days |
| Tell which of our advertisements bring people here | One event, sent from our server when you subscribe to the research newsletter: a one-way hash of the address you just gave us — never the address itself — with the IP address and browser user-agent of that request and the page it came from. No ad-click reference or browser advertising identifier is included in that event. | Art. 6(1)(f) — legitimate interest in knowing whether our advertising works, weighed against a single event tied to an action you took deliberately. Object at [email protected] and we will exclude you | We keep no record of the event. OpenAI publishes no retention period for what it receives, so we do not state one for it. |
| Send service email you cannot opt out of | Email address (billing receipts, security notices, changes to these documents) | Art. 6(1)(b) contract; Art. 6(1)(c) legal obligation for change notices | Life of the account |
| Send product news, if you ask for it | Email address, and whether you opened it | Art. 6(1)(a) — consent, withdrawable in one click in every message | Until you withdraw consent, then a suppression record so we do not email you again |
| Establish, exercise or defend legal claims | Whatever is relevant to the claim | Art. 6(1)(f) — legitimate interest in defending ourselves; Art. 9(2)(f) where applicable | Until the claim and any appeal period ends |
You do not have to give us any of this. But without an email address and a payment method we cannot give you an account or a paid plan, and without the security logging we cannot safely run the Service at all.
4Blockchain and market data
This section matters, and most policies in our sector skip it.
The Service analyses public blockchain transactions and public exchange order flow. That data is about wallet addresses and trades, not about our customers. But a wallet address can sometimes be linked to a living person, and where it can, it is personal data under the GDPR. We treat it as personal data whenever that link is reasonably possible.
- What we process
- Publicly recorded blockchain addresses, transaction values, timestamps, counterparties, and derived flow and clustering metrics. Public exchange trade and order-book data. On prediction-market surfaces: public trades, positions and realised profit per participant, together with the public profile name the participant chose on the venue and an abbreviated form of their address.
- Where it comes from
- Public blockchains (including Polygon), public exchange APIs, and prediction-market operators' public data APIs (currently Polymarket). We do not buy identity data, and we do not attempt to attach a name, email or real-world identity to an address or a venue profile name.
- Legal basis
- Art. 6(1)(f) — our legitimate interest, and our customers' and the public's legitimate interest, in transparency about market integrity. We have carried out and documented the balancing test required by Art. 6(1)(f).
- Why we think it is balanced
- The data is already public and published by design; we analyse conduct on a market rather than a private life; we use only the name a participant chose to publish and abbreviate addresses; we do not deanonymise, profile individuals, or make automated decisions with legal effects; we offer no way to copy a participant's trades; and we publish our method so any figure can be challenged. Ranking participants by profit is the most intrusive thing we do with this data, and our documented balancing test treats it as such.
- Your rights over it
- If you can show an address is yours, you may object under Art. 21 and ask for restriction or erasure of our derived records. We cannot erase anything from a public blockchain, because nobody can. Write to [email protected].
A detection signal is not an accusation. Scores describe how closely observed behaviour resembles patterns associated with wash trading or spoofing. They are not a finding that anyone broke the law. If you are named and believe we are wrong, § 13 of the Terms sets out the right of reply.
6Transfers outside the EEA
Core service data is hosted in the European Economic Area. Some providers process limited data outside the EEA, as described in the processor inventory and below:
- Cloudflare — as our CDN and security layer it processes request metadata, including your IP address, at edge locations worldwide. Covered by Cloudflare's data processing addendum incorporating the European Commission's Standard Contractual Clauses.
- OpenAI — Vi AI prompts and news text are sent to its API for processing. Covered by its data processing addendum incorporating the Standard Contractual Clauses. Under its API terms, content sent through the API is not used to train its models. Advertising measurement is a separate arrangement: OpenAI publishes a distinct set of Ad Tools terms for it rather than that addendum, § 3c of the sub-processors page sets out what it receives and on what footing, and it is now one server-side event with nothing running in your browser.
- Telegram — only if you connect it, and only the chat identifier and the alert text you asked for. This transfer happens because you asked us to send you messages on a platform of your choosing (Art. 49(1)(b) GDPR).
We minimise what leaves the EEA: no billing data, no password material and no full account record goes to any of them. A copy of the relevant clauses is available on request at [email protected].
8Automated decisions and profiling
We do not make decisions about you by automated means that produce legal effects or similarly significantly affect you, within the meaning of Art. 22 GDPR.
Two automated processes touch you, and neither reaches that threshold: rate limiting and abuse detection may temporarily throttle a request pattern, and Stripe applies its own fraud screening to card payments. In both cases you can reach a human at [email protected] and have the outcome reviewed.
Vi IQ scores, detection signals and wallet analytics score markets and addresses, not our customers. They are not used to make decisions about you.
9How we protect it
- TLS 1.2 or better for everything in transit, with HSTS and a preload entry.
- Passwords stored only as salted hashes with a modern key-derivation function. We cannot read your password.
- Session cookies are signed, HTTP-only and same-site; OAuth uses PKCE with a single-use state nonce.
- A restrictive content security policy, and no third-party script we have not chosen deliberately.
- Encrypted, tested backups, with restore drills rather than assumed recoverability.
- Access to production data limited to those who need it, over authenticated channels, with an append-only audit log.
- Dependency and vulnerability scanning, with security fixes prioritised over feature work.
No system is perfectly secure. If a breach is likely to risk your rights and freedoms, we will notify the Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate) within 72 hours of becoming aware of it, and tell you without undue delay where the risk to you is high, as Arts. 33 and 34 GDPR require. Our vulnerability reporting process is in the security policy.
10Your rights, and how to use them
Under the GDPR you can ask us to do each of the following. Exercising them is free, and we do not treat you differently for it.
- Access (Art. 15)
- Get a copy of the personal data we hold about you, and be told what we do with it.
- Rectification (Art. 16)
- Have inaccurate data corrected and incomplete data completed.
- Erasure (Art. 17)
- Have data deleted where we no longer need it, subject to records we must keep by law — principally the 7-year accounting record.
- Restriction (Art. 18)
- Have us hold data without using it while a dispute about it is resolved.
- Portability (Art. 20)
- Receive the data you gave us in a structured, machine-readable format, or have it sent to another provider.
- Objection (Art. 21)
- Object to processing based on legitimate interests, including our analysis of a blockchain address you can show is yours. Objection to direct marketing is absolute — we stop, no balancing.
- Withdraw consent (Art. 7(3))
- Withdraw consent at any time, without affecting what we did lawfully before you withdrew it.
- Complain (Art. 77)
- Complain to a supervisory authority — see § 11.
Write to [email protected] from the address on your account. We respond within one month. If a request is unusually complex we may extend by two further months, and we will tell you why within the first month. We may ask you to confirm your identity, but only where we have real doubt, and we will not use the request as a reason to collect more data about you.
11Complaining to a regulator
Please raise it with us first — we would rather fix it. But you have the right to go straight to a supervisory authority. Ours is:
- Authority
- Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate)
- Address
- Tatari 39, 10134 Tallinn, Estonia
- [email protected]
- Phone
- +372 627 4135
If you live or work in another EEA country, you may also complain to your own national authority.
12Children
The Service is for adults. We do not knowingly collect data from anyone under 18, and we do not direct any part of the Service at children. If you believe a child has given us data, write to [email protected] and we will delete it.
13Changes to this policy
When we change how we use personal data we update this page, change the version and date at the top, and record it in the changelog. We notify affected users of material changes as required. Where a change requires your consent, we ask for it rather than assuming it from your continued use.