Privacy Policy

1. Overview

Balenafi is a subscription analytics product. Beyond the account information needed to run it and the billing information needed to charge you, we deliberately collect very little personal data: the whale-tracking data at the core of the product is public, on-chain Polymarket activity, not data about you.

2. Data we collect

Account data

• Email address and a hashed password, managed for us by Firebase Authentication.
• A unique account identifier and account creation date.
• Your current subscription tier (Free, Signals, or Pro).

Content you provide

• Trades you manually log (market, side, entry price, size, and timestamps) and any positions you mark as closed.
• Watchlist entries (traders, markets, or categories you choose to follow).
• Notification preferences and read/unread state.
• Feedback, bug reports, or feature requests you submit, together with the page you submitted them from and, if you were signed in, your email and account identifier.

Billing data

• Which subscription tier you have, your billing status, and identifiers Stripe uses to associate your account with a Stripe customer and subscription. Your card number and full billing details are collected and stored by Stripe directly — Balenafi never receives or stores your full card number.

Usage & technical data

• Log data such as IP address, browser and device type, pages requested, and timestamps, generated automatically by our hosting infrastructure for operating and securing the Service.
• A single authentication session cookie (described in Section 8).

3. What we don't collect

We do not collect your Polymarket account credentials, wallet private keys, or seed phrases, and we never ask for them. We do not have access to your real Polymarket account or funds, and trades you log in Balenafi are self-reported records for your own tracking — logging a trade does not give us any access to, or information about, your actual holdings on Polymarket or any wallet. We do not collect government ID, biometric data, or precise geolocation.

4. How we use your data

We use the data described above to:

• create and secure your account, and authenticate you on each visit;
• provide the features of your subscription tier, including your personalized watchlists, portfolio and trade tracking, and notifications;
• process payments, manage your subscription, and communicate about billing (through Stripe);
• generate portfolio valuations by combining your logged trades with live Polymarket market prices;
• respond to feedback, bug reports, and support requests;
• maintain, secure, debug, and improve the Service, including monitoring for abuse of our systems; and
• comply with legal obligations, such as tax and accounting requirements tied to subscription revenue.

We do not sell your personal data, and we do not use your account or trade data to train third-party AI models on data about you personally.

5. Our legal basis for processing

If you are in the European Economic Area, the United Kingdom, or another jurisdiction with similar requirements, we rely on the following legal bases: performance of a contract (to provide the Service you signed up for and process your subscription), legitimate interests (to secure and improve the Service, and to respond to feedback), and legal obligation (for billing records and tax compliance). Where we rely on legitimate interests, we have considered and balanced any impact on you before processing your data.

6. AI features & your data

AI Recommendations and Poseidon Deep Research are generated by sending the relevant market's public whale-positioning data, price and volume history, and (for Poseidon) live web-search context to a third-party AI model provider for processing. When you request Poseidon research on a specific market, that request is associated with your account so we can cache and rate-limit it appropriately, but the underlying content processed by the AI provider is market data, not your personal profile, trades, or watchlist. Our AI model provider processes this data under its own data-processing terms and does not use it to train models for other customers.

7. Who we share data with

We share personal data only with service providers who process it on our behalf to operate the Service (our "subprocessors"), and only to the extent necessary for the purpose described:

We may also disclose personal data if required by law, subpoena, or other legal process; to protect the rights, property, or safety of Balenafi, our users, or the public; or in connection with a merger, acquisition, financing, or sale of assets, subject to appropriate confidentiality protections. We do not share your personal data with third parties for their own independent marketing purposes.

8. Cookies & similar technologies

We use a single strictly-necessary, HTTP-only session cookie to keep you signed in and to verify your identity on every request. This cookie is required for the Service to function and cannot be disabled without signing out. Your theme preference (light/dark) is stored locally in your browser. We do not currently use third-party advertising or analytics cookies or trackers. If that changes, we will update this Policy and, where required by law, request your consent first.

9. International data transfers

Our service providers may process and store data in countries other than your own, including the United States. Where we transfer personal data out of the European Economic Area, the United Kingdom, or Switzerland, we rely on appropriate safeguards recognized under applicable law, such as Standard Contractual Clauses with our subprocessors, to protect your data.

10. Data retention

We retain account, trade, and watchlist data for as long as your account is active, so the Service can keep working the way you've set it up. If you delete your account, we delete or anonymize your personal data within a reasonable period, except where we are required to retain certain records (for example, billing records for tax or accounting purposes) for longer under applicable law. Aggregated or anonymized data that can no longer identify you — for example, statistics used to build our public track record — may be retained indefinitely.

11. Security

We use industry-standard safeguards to protect personal data, including encryption of data in transit, hashed passwords managed by our authentication provider, HTTP-only session cookies, and access controls limiting who can reach production data. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

12. Your rights

Depending on where you live, you may have the right to: access the personal data we hold about you; correct inaccurate data; request deletion of your data; object to or restrict certain processing; request a portable copy of your data; and withdraw consent where processing is based on consent. Residents of the European Economic Area and United Kingdom have these rights under the General Data Protection Regulation and UK GDPR; residents of California and certain other U.S. states have similar rights under applicable state privacy laws, including the right to opt out of the sale or "sharing" of personal data — noting again that we do not sell your personal data.

To exercise any of these rights, email privacy@balenafi.com. We will respond within the time required by applicable law. You can access and update most of your account data, watchlists, and logged trades directly within the Service at any time. If you are in the European Economic Area or United Kingdom, you also have the right to lodge a complaint with your local data protection authority.

13. Children's privacy

The Service is not directed at, and must not be used by, anyone under 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us at privacy@balenafi.com and we will delete it.

14. Breach notification

If a security incident occurs that compromises your personal data, we will notify affected users and, where required, the relevant regulator, without undue delay and in accordance with applicable law.

15. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will post the updated policy here with a new "Last updated" date and, where required by law or practical, provide additional notice such as an in-app notice or email.

16. Contact us

Questions about this Privacy Policy, or requests relating to your personal data, can be sent to privacy@balenafi.com.

[Balenafi legal entity name and registered address]