Privacy policy
The data CentraFIN processes, why, where, for how long and how to exercise your rights.
In short
- No advertising, no reselling of data, no trackers.
- No password. Your email address is used to sign you in and to confirm your requests, never for advertising.
- Your private wallets are encrypted in your browser: we can't read them.
Data controller
CentraFIN, a company whose registration is in progress (see the legal notice). Contact: contact@centrafin.xyz.
The data and how long we keep it
| Data | Why | How long |
|---|---|---|
| First and last name | To name your account | As long as the account exists |
| Email address | To sign you in, to confirm a change of address or the deletion of the account | As long as the account exists |
| Account number | To identify your account | As long as the account exists |
| Your passkeys' public keys and their counters | To verify your sign-ins | As long as the passkey stays on your account |
| Authenticator app secret, encrypted | To verify your codes | As long as the app stays enabled |
| Session cookie | To keep you signed in | 8 hours |
| IP address of a failed sign-in | To block repeated attempts | 15 minutes |
| Hash of a link sent by email | To check the link when you open it | 15 minutes, or until it is used |
| Hashes of the email address and the IP address of a sent email | To limit sending | 1 hour |
| Your platforms' API keys, encrypted, and their last 4 characters | To read your accounts | Until the connector is removed |
| Balances, positions, orders, fills and transfers read from your platforms | To show your figures, calculate your average cost and match your transfers | As long as the account exists, even after a connector is removed |
| Private wallets | To display them | Stored only in a form encrypted by your browser, unreadable to us |
| AI assistant authorisations | To give them read access | Until revoked; access token 1 hour, refresh token 30 days |
| Language cookie | To show the site in your language | 1 year |
During your session, your browser's storage also keeps your vault key in masked form, and your display preferences.
No cookie is used for advertising or analytics: the site's cookies are necessary for it to work, so they don't require consent.
Why we may process it
- Performance of the contract (Article 6(1)(b) GDPR): providing the service you request.
- Legitimate interest (Article 6(1)(f)): securing the service and preventing abuse.
Who processes it with us
- Cloudflare, Inc. (United States) hosts the site, the accounts and their data. These transfers are covered by the EU-US Data Privacy Framework and by the European Commission's Standard Contractual Clauses.
- Proton AG (Switzerland) sends our emails, from no-reply@centrafin.xyz: it receives your email address and the message, a sign-in or confirmation link. Switzerland is covered by an adequacy decision of the European Commission.
- Oracle Cloud Infrastructure (Marseille region, France) hosts our relay to Kraken, Coinbase, OKX and Hyperliquid. The platforms' responses pass through it without being stored there.
- Anthropic provides Claude, the AI that writes our market analyses from public data. No data from your account is sent to it.
Others receive data at your request:
- the platforms you connect receive our requests, signed with your keys, and handle that data under their own rules;
- public Bitcoin nodes see the addresses your browser requests, without your IP address;
- an AI assistant you authorise receives what it reads, under the responsibility of its provider.
What we don't do
- We don't sell or rent out any data.
- We don't do any advertising profiling.
- Sorting the analyses for your portfolio happens in your browser: your portfolio doesn't leave our service to do it.
Your rights
You have the right to access your data, to have it corrected or erased, to restrict its processing and to data portability, and you can object to its processing.
- In the settings, you rename your account, change your email address, manage your sign-in methods and authorised apps, export all your data to a JSON file (private wallets included, assembled by your browser) and delete your account: everything in it is erased immediately.
- For anything else, email contact@centrafin.xyz. We check that the request comes from the account holder, then reply within one month.
You can also lodge a complaint with the CNIL (cnil.fr), the French data protection authority, or with the data protection authority in your country.
Security
The measures that protect your data are described on the Security page.
Minors
The service is intended for adults.
Changes
The date of the last update is shown at the top of this page. Any significant change is announced in the service.