Privacy Policy

Who we are

Invizi operates a market-information and decision-support service for crypto traders, accessible through the marketing site at invizi.co and the application at app.invizi.co. For privacy purposes, the data controller is Invizi Software Inc., contactable at privacy@invizi.co.

What data we collect

Account and authentication

• Email address (required for magic-link sign-in)
• Magic-link tokens and session cookies (short-lived; see Cookie Policy)

Content you create

• Trade theses, conversations with the AI, watchlists, alert configurations, notes
• Wallet addresses you choose to track (public on-chain identifiers; we do not link them to your real-world identity)
• Webhook URLs you configure for alerts

Automatically collected (operational)

• IP address (used for sign-in security, rate limiting, and abuse prevention)
• User-agent string (browser/OS — for compatibility and security)
• Request timestamps (security audit log)

Analytics (only with your consent)

• Page-view events on invizi.co via PostHog, gated behind the cookie consent banner. No analytics is loaded if you reject non-essential cookies.

We do not collect: real-name identifiers, government IDs, financial-account credentials, private-key material, your full trade history at exchanges, or any data not described above.

How we use your data

• Operate the Service: authenticate you, run your queries against public market data, store your content for retrieval across sessions and devices.
• Keep the Service safe: detect abuse, enforce rate limits, investigate security incidents (using IP, user-agent, and request logs).
• Communicate with you: send magic-link sign-in emails and (rarely) account-related notices. We do not send marketing email without your separate opt-in.
• Improve the Service: analyze aggregated, consent-gated usage data to understand which surfaces are useful. We do not use Your Content to train third-party models.

Legal basis (for users in the EU/UK)

Where the GDPR or UK GDPR applies, our legal bases are:

• Contract: account, authentication, content storage, and core Service operation.
• Legitimate interest: security, fraud prevention, and basic operational logs (kept narrow and proportionate).
• Consent: analytics cookies and any other non-essential processing. You can withdraw consent at any time using the Cookie preferences link.
• Legal obligation: responding to lawful requests from regulators or law enforcement.

Where your data lives

Account, authentication, and content data are stored in a PostgreSQL database hosted on Hetzner infrastructure in Germany. Encrypted, off-box backups are stored on a Hetzner Storage Box (separate physical system, EU region), encrypted with age (modern public-key encryption); the private decryption key is held by the founder off-machine.

Operational logs (auth events, request audit) are written to the same Hetzner host. Real-time alerts (when you opt in) are delivered via ntfy.sh; the founder operates a self-hosted ntfy instance on Hetzner for alert delivery.

Third parties that process your data

We use the following processors. Each is bound by either its public Data Processing Addendum or, where required, an executed DPA referencing EU Standard Contractual Clauses.

We do not sell your personal information. We do not share it with advertisers, data brokers, or other third parties beyond the processors listed above. If we ever add a new processor that handles your data, we will update this list before turning the integration on.

Cross-border transfers from the EU/UK to the United States (Resend, Anthropic, OpenAI, PostHog) rely on the EU Standard Contractual Clauses (Modules 2 and 3) and, where applicable, the UK International Data Transfer Addendum. Hetzner (compute and backups) is EU-based and does not require cross-border transfer mechanisms under the GDPR.

Your rights

Regardless of where you live, you can email privacy@invizi.co to:

• Request a copy of the data we hold about you
• Correct inaccurate data
• Delete your account and associated content
• Withdraw any consent you've given
• Receive a portable copy of your content (JSON export)

If you are in the EU, UK, or Switzerland (GDPR / UK GDPR / FADP)

You also have the right to:

• Restrict or object to certain processing
• Portability for data we process under contract or consent
• Lodge a complaint with your local data-protection authority

If you are a California resident (CCPA / CPRA)

You also have the right to:

• Know what categories of personal information we collect and the purposes
• Delete personal information (subject to limited exceptions, e.g. security audit logs)
• Correct inaccurate personal information
• Opt out of the "sale" or "sharing" of personal information — Invizi does not sell or share personal information for cross-context behavioral advertising
• Non-discrimination for exercising any of these rights (we will not change pricing or restrict service because you exercised a right)

We will respond to verifiable requests within thirty (30) days. We may need to verify your identity by sending a confirmation to the email address on your account.

Retention

The numbers below are the windows we currently apply.

We may retain limited records longer when required by law, to enforce our Terms, or to defend against legal claims. We may also issue a "litigation hold" that pauses normal deletion for affected records when a dispute is anticipated or served.

Cookies and tracking

We use a small number of strictly-necessary cookies to keep you signed in and to record your consent choice. We use analytics cookies only with your consent. See our Cookie Policy for the full list and how to change your choice.

Security research and disclosure

We welcome responsible disclosure of vulnerabilities. See our Security Policy (also at /.well-known/security.txt) for the channel and the safe-harbor commitment. Acting in good faith under that policy is not a violation of our Acceptable Use Policy.

Children

Invizi is not intended for anyone under 18, and we do not knowingly collect data from anyone under 18. If you become aware that a minor has provided us data, email privacy@invizi.co and we will delete it.

Changes to this policy

We may update this policy. The new version will be published at this URL with an updated effective date. Material changes will be communicated by email to active accounts at least thirty (30) days before they take effect. Substantive past versions are available on request.

Contact

Privacy questions or requests: privacy@invizi.co. We respond within thirty (30) days.