Privacy Policy
This policy says what personal data OmniOS OÜ holds about you, why we are allowed to hold it, who else sees it, how long we keep it, and how to make us stop. It describes what the system actually does, not what a template says it might.
- In force from
- Version
- 2.8
- Issued by
- OmniOS OÜ
Version 2.8 adds the delivery log kept for each alert sent to a linked Telegram chat. Version 2.7 set out product analytics on app.vultax.com under Art. 6(1)(f) with a Settings opt-out, website analytics on vultax.com under Art. 6(1)(a) consent, and the referral programme under Art. 6(1)(b), and recorded that the paper desk ledger belongs to your account rather than to your browser. Version 2.6 had removed Google Analytics from both sites.
1Who is responsible for your data
OmniOS OÜ (registry code 17591703) is the controller of the personal data described here, within the meaning of Regulation (EU) 2016/679 (GDPR).
- Controller
- OmniOS OÜ
- Registry code
- 17591703
- Address
- Padriku tee 3/3, 11912 Tallinn, Estonia
- Privacy contact
- [email protected]
- Data protection officer
- We are not required to appoint one: we do not carry out large-scale monitoring of individuals or process special-category data as a core activity. Privacy questions go to the address above and are handled by the management board.
- EU representative
- Not required — we are established in the EU.
This policy covers vultax.com, the app at app.vultax.com, the API, and alerts we send you. It does not cover exchanges, wallets or other sites you reach from ours; they have their own policies.
2The short version
- We do not sell, rent or trade personal data, and we never have.
- The website asks before it measures; the app measures by default and lets you stop it. vultax.com runs no analytics until you allow it. app.vultax.com runs product analytics on signed-in usage under our legitimate interest, with an opt-out in Settings → Privacy & data. Neither sends account identifiers, searches, wallet addresses or payment details. See the cookie policy.
- We do not train models on your data. Your Vi AI conversations are not used to train anyone's model, ours or our provider's.
- Your data is hosted in the European Union, in Frankfurt, Germany.
- We collect what the Service needs to work, keep it for a stated period, and delete it after.
3What we collect, why, and on what legal basis
Each row states a purpose, the data used for it, the Article 6 GDPR basis, and how long we keep it. Where the basis is legitimate interests, the interest is named so you can weigh it.
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Run your account and give you the Service you paid for | Email address, display name, password hash, plan and entitlements, settings, watchlists, alert rules | Art. 6(1)(b) — performance of the contract | Life of the account, then 30 days |
| Sign you in with Google, if you choose to | Google account identifier, email address, display name, avatar URL | Art. 6(1)(b) — you asked to sign in this way | Life of the account, then 30 days |
| Take payment and manage the subscription | Billing email, country, plan, subscription status, Stripe customer and payment identifiers, invoice history. We never receive your full card number. | Art. 6(1)(b) contract; Art. 6(1)(c) legal obligation for the accounting record | Accounting records 7 years (Estonian Accounting Act § 12); other billing data, life of the account |
| Answer support requests and complaints | Your messages, attachments, and the account they concern | Art. 6(1)(b) contract; Art. 6(1)(f) legitimate interest in keeping a record of what was agreed | 3 years from last contact |
| Hold an alert configuration you have set up | Telegram chat identifier and alert rules, where you linked them, and a delivery log entry for each alert sent: the channel, the destination chat identifier, the delivery status and any error, the alert's title and category, and the time it was sent. | Art. 6(1)(b) — performance of the contract | Alert rules and the Telegram link: until you remove them; deleted with the account |
| Answer your questions in Vi AI | Your prompts, the assistant's replies, timestamps, token counts, the model used | Art. 6(1)(b) — performance of the contract | Conversation history until you delete it, or 12 months after the account closes |
| Let you practise on the paper desk | Your simulated positions, virtual balance and order history. Nothing here is money and no order reaches a market, but the ledger belongs to your account and is held by us, not by your browser. | Art. 6(1)(b) — performance of the contract | Life of the account, then 30 days |
| Keep the Service up, secure and free of abuse | IP address, user agent, request URL and status, timestamps, rate-limit counters, authentication events | Art. 6(1)(f) — legitimate interest in defending the Service against attack, credential stuffing and scraping | Security and access logs 12 months, then deleted |
| Understand how the app is used, so we know what to fix | Google Analytics 4 on app.vultax.com: a pseudonymous client identifier, the pages you open, and two product events — a completed signup and the start of a checkout. No account identifier, no email address, no search terms, no wallet addresses, no payment details. Advertising features, Google Signals and ad personalisation are switched off. | Art. 6(1)(f) — legitimate interest in knowing whether the product we charge for actually works, weighed against pseudonymous measurement of a signed-in session you opened deliberately. Turn it off at any time in Settings → Privacy & data; it is not tied to your plan | Analytics event data 14 months, then deleted by Google; the cookie 180 days |
| Understand how the public website is used | The same measurement on vultax.com, but only if you allow it. Nothing runs and no analytics cookie is written until you answer the question, and declining is remembered for longer than accepting. | Art. 6(1)(a) — consent, withdrawable at any time through Analytics choices in the site footer | Analytics event data 14 months; the cookie 180 days |
| Count traffic at the network edge | Cloudflare Web Analytics. Aggregate page views, referrer, country, device class and page performance. No cookies, no identifier stored on your device, no profile. | Art. 6(1)(f) — legitimate interest in knowing what to build and fix, with no identification of anyone | Aggregates only; no personal-level record retained |
| Run the referral programme | The referral code of the member who sent you, the time your account was created, and — for the referring member — the payments received on accounts they referred and the balance owed to them. Not the referred account's email address, and not what they looked at. | Art. 6(1)(b) — performance of the contract with the referring member and with you, and Art. 6(1)(c) for the payment record | Accounting records 7 years; the attribution cookie 30 days |
| Tell which of our advertisements bring people here | One event, sent from our server when you subscribe to the research newsletter: a one-way hash of the address you just gave us — never the address itself — with the IP address and browser user-agent of that request and the page it came from. The browser pixel that also passed an ad-click reference has been removed, so no reference to your browser or to an advertisement is collected or stored anywhere. | Art. 6(1)(f) — legitimate interest in knowing whether our advertising works, weighed against a single event tied to an action you took deliberately. Object at [email protected] and we will exclude you | We keep no record of the event. OpenAI publishes no retention period for what it receives, so we do not state one for it. |
| Send service email you cannot opt out of | Email address (billing receipts, security notices, changes to these documents) | Art. 6(1)(b) contract; Art. 6(1)(c) legal obligation for change notices | Life of the account |
| Send product news, if you ask for it | Email address, and whether you opened it | Art. 6(1)(a) — consent, withdrawable in one click in every message | Until you withdraw consent, then a suppression record so we do not email you again |
| Establish, exercise or defend legal claims | Whatever is relevant to the claim | Art. 6(1)(f) — legitimate interest in defending ourselves; Art. 9(2)(f) where applicable | Until the claim and any appeal period ends |
You do not have to give us any of this. But without an email address and a payment method we cannot give you an account or a paid plan, and without the security logging we cannot safely run the Service at all.
4Blockchain and market data
This section matters, and most policies in our sector skip it.
The Service analyses public blockchain transactions and public exchange order flow. That data is about wallet addresses and trades, not about our customers. But a wallet address can sometimes be linked to a living person, and where it can, it is personal data under the GDPR. We treat it as personal data whenever that link is reasonably possible.
- What we process
- Publicly recorded blockchain addresses, transaction values, timestamps, counterparties, and derived flow and clustering metrics. Public exchange trade and order-book data. On prediction-market surfaces: public trades, positions and realised profit per participant, together with the public profile name the participant chose on the venue and an abbreviated form of their address.
- Where it comes from
- Public blockchains (including Polygon), public exchange APIs, and prediction-market operators' public data APIs (currently Polymarket). We do not buy identity data, and we do not attempt to attach a name, email or real-world identity to an address or a venue profile name.
- Legal basis
- Art. 6(1)(f) — our legitimate interest, and our customers' and the public's legitimate interest, in transparency about market integrity. We have carried out and documented the balancing test required by Art. 6(1)(f).
- Why we think it is balanced
- The data is already public and published by design; we analyse conduct on a market rather than a private life; we use only the name a participant chose to publish and abbreviate addresses; we do not deanonymise, profile individuals, or make automated decisions with legal effects; we offer no way to copy a participant's trades; and we publish our method so any figure can be challenged. Ranking participants by profit is the most intrusive thing we do with this data, and our documented balancing test treats it as such.
- Your rights over it
- If you can show an address is yours, you may object under Art. 21 and ask for restriction or erasure of our derived records. We cannot erase anything from a public blockchain, because nobody can. Write to [email protected].
A detection signal is not an accusation. Scores describe how closely observed behaviour resembles patterns associated with wash trading or spoofing. They are not a finding that anyone broke the law. If you are named and believe we are wrong, § 13 of the Terms sets out the right of reply.
6Transfers outside the EEA
Your account, billing and market data are stored on servers in Frankfurt, Germany. Three services involve a transfer outside the EEA, and each is covered:
- Cloudflare — as our CDN and security layer it processes request metadata, including your IP address, at edge locations worldwide. Covered by Cloudflare's data processing addendum incorporating the European Commission's Standard Contractual Clauses.
- OpenAI — Vi AI prompts and news text are sent to its API for processing. Covered by its data processing addendum incorporating the Standard Contractual Clauses. Under its API terms, content sent through the API is not used to train its models. Advertising measurement is a separate arrangement: OpenAI publishes a distinct set of Ad Tools terms for it rather than that addendum, § 3c of the sub-processors page sets out what it receives and on what footing, and it is now one server-side event with nothing running in your browser.
- Telegram — only if you connect it, and only the chat identifier and the alert text you asked for. This transfer happens because you asked us to send you messages on a platform of your choosing (Art. 49(1)(b) GDPR).
We have assessed each transfer for the risk that foreign law could compel disclosure, and we minimise what leaves the EEA: no billing data, no password material and no full account record goes to any of them. A copy of the relevant clauses is available on request at [email protected].
8Automated decisions and profiling
We do not make decisions about you by automated means that produce legal effects or similarly significantly affect you, within the meaning of Art. 22 GDPR.
Two automated processes touch you, and neither reaches that threshold: rate limiting and abuse detection may temporarily throttle a request pattern, and Stripe applies its own fraud screening to card payments. In both cases you can reach a human at [email protected] and have the outcome reviewed.
Vi IQ scores, detection signals and wallet analytics score markets and addresses, not our customers. They are not used to make decisions about you.
9How we protect it
- TLS 1.2 or better for everything in transit, with HSTS and a preload entry.
- Passwords stored only as salted hashes with a modern key-derivation function. We cannot read your password.
- Session cookies are signed, HTTP-only and same-site; OAuth uses PKCE with a single-use state nonce.
- A restrictive content security policy, and no third-party script we have not chosen deliberately.
- Encrypted, tested backups, with restore drills rather than assumed recoverability.
- Access to production data limited to those who need it, over authenticated channels, with an append-only audit log.
- Dependency and vulnerability scanning, with security fixes prioritised over feature work.
No system is perfectly secure. If a breach is likely to risk your rights and freedoms, we will notify the Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate) within 72 hours of becoming aware of it, and tell you without undue delay where the risk to you is high, as Arts. 33 and 34 GDPR require. Our vulnerability reporting process is in the security policy.
10Your rights, and how to use them
Under the GDPR you can ask us to do each of the following. Exercising them is free, and we do not treat you differently for it.
- Access (Art. 15)
- Get a copy of the personal data we hold about you, and be told what we do with it.
- Rectification (Art. 16)
- Have inaccurate data corrected and incomplete data completed.
- Erasure (Art. 17)
- Have data deleted where we no longer need it, subject to records we must keep by law — principally the 7-year accounting record.
- Restriction (Art. 18)
- Have us hold data without using it while a dispute about it is resolved.
- Portability (Art. 20)
- Receive the data you gave us in a structured, machine-readable format, or have it sent to another provider.
- Objection (Art. 21)
- Object to processing based on legitimate interests, including our analysis of a blockchain address you can show is yours. Objection to direct marketing is absolute — we stop, no balancing.
- Withdraw consent (Art. 7(3))
- Withdraw consent at any time, without affecting what we did lawfully before you withdrew it.
- Complain (Art. 77)
- Complain to a supervisory authority — see § 11.
Write to [email protected] from the address on your account. We respond within one month. If a request is unusually complex we may extend by two further months, and we will tell you why within the first month. We may ask you to confirm your identity, but only where we have real doubt, and we will not use the request as a reason to collect more data about you.
11Complaining to a regulator
Please raise it with us first — we would rather fix it. But you have the right to go straight to a supervisory authority. Ours is:
- Authority
- Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate)
- Address
- Tatari 39, 10134 Tallinn, Estonia
- [email protected]
- Phone
- +372 627 4135
If you live or work in another EEA country, you may also complain to your own national authority.
12Children
The Service is for adults. We do not knowingly collect data from anyone under 18, and we do not direct any part of the Service at children. If you believe a child has given us data, write to [email protected] and we will delete it.
13Changes to this policy
When we change how we use personal data we update this page, change the version and date at the top, and record it in the changelog. For a change that materially affects you we email account holders at least 30 days beforehand. Where a change requires your consent, we ask for it rather than assuming it from your continued use.