La version anglaise de ce document fait foi ; les autres langues sont des traductions fournies pour votre commodité. Révision du 2026-10-26.

X PrimeFlow Privacy Policy

Revision: 2026-10-26 · Version: 1.2

1. Who processes the data

The data controller is a private individual who runs the X PrimeFlow project (a company has not been registered yet, so there is no company name, registration number or registered address to state here — they will be published in this section as soon as registration is complete).

Questions about processing: [email protected].

2. What we process

Account data:

the crypto wallet address you sign in with (a public blockchain identifier);
e-mail — only if you provided it for account recovery and invoices;
plan, period start and end dates, invoice history.

Technical data: IP address, browser and device type, request times, API endpoints called, usage

volume. Needed for abuse protection, limit accounting and troubleshooting.

Swap and bridge request log (from 24 October 2026): when you ask our server for a swap or bridge quote, a transaction or a

transfer status — the requests that reach the route providers 1inch and LI.FI (bridge requests are

logged whichever bridge you pick) — the web server writes one line to a separate log: your IP address,

the time, the request path, the response code, the network and — if the request carries it in its

address — your wallet address. Amounts, tokens and request bodies are not written there. Other pages

and requests do not get into this log. The log is used only for security (protection against abuse and

fraud), to answer lawful requests of public authorities and to meet the providers' conditions — and for

nothing else.

Signed read-only requests to exchanges: exchanges do not answer balance, open-order and fill requests

from a browser directly, so these requests, already signed on your device, are delivered through our server

(/api/cex/relay). In transit the server sees the request — including your API key identifier and, for OKX

and Bitget, the passphrase these exchanges require in every request — and the exchange's answer. It cannot

change a signed request and stores neither its contents, nor the key identifier, nor the answer; to respect

the exchanges' rate limits it keeps only a short hash of the key identifier in memory.

Interface settings: language, selected exchanges, watchlist, alert settings.

What we do NOT receive:

wallet private keys — the server never receives them: your wallet signs the transaction;
exchange API secrets — they are encrypted in your browser, the master password is stored nowhere, and

every request is signed on your device. Functions that would need an exchange API secret on our servers are

switched off (Terms of Use, §2);

card details — handled by the payment provider; we only see that a payment occurred and its amount;
identity documents — we do not run identity verification.

3. Why we process it

| Purpose | Basis |

|---|---|

| providing access, accounting for plan and limits | performance of the contract |

| invoicing and bookkeeping | contract, legal obligation |

| protection against abuse, attacks and unauthorised access | legitimate interest |

| troubleshooting and improving the service | legitimate interest |

| swap and bridge request log: protection against abuse and fraud, answering lawful requests of public authorities and meeting the conditions of the providers (1inch, LI.FI) without which swaps and bridges through them are unavailable | legitimate interest |

| service messages (changes to terms, outages, invoices) | performance of the contract |

We do not send marketing mail. If we ever do, it will be by separate consent with one-click opt-out.

Only those without whom the service does not work:

hosting provider — servers and data storage;
payment provider — accepting payments (card details are handled by them, not us);
e-mail delivery service — invoices and service messages;
swap and bridge route providers (for example 1inch, LI.FI and NEAR Intents) — when you request a quote or a

transaction through our server, the provider receives your wallet address (for a bridge — the addresses on both networks: the recipient and the refund address) and the trade parameters

needed to build the route. The request comes from our server, and we do not forward your IP address

in it.

We do not sell personal data and do not pass it to third parties for marketing. Data may be disclosed to

public authorities only on a written request made in accordance with the law. Lines of the swap and

bridge request log are disclosed only on such a request: to the authority directly, or to 1inch, LI.FI

or NEAR Intents when the provider presents such a request of an authority — and only the lines it concerns.

Some processors may be located outside Ukraine; in that case transfers are made to countries with an

adequate level of protection or under standard contractual clauses.

5. Retention

account data — while the account exists and 3 years after deletion (limitation period);
invoices and payment records — 3 years, or longer where tax law requires;
technical logs — up to 12 months;
swap and bridge request log — at least 30 and no more than 32 days, then deleted automatically

(30 days is the minimum the providers require);

alert trigger history — 30 days.

6. Your rights

You may:

know what data we process about you and receive a copy;
have inaccurate data corrected;
have data deleted where there is no lawful basis to keep it;
restrict or object to processing;
withdraw consent where processing is based on consent;
lodge a complaint with the Ukrainian Parliament Commissioner for Human Rights, and — if you are in the

EU — with your local supervisory authority.

Write to [email protected]. We respond within 30 days.

If you are in the European Union, the rights under the General Data Protection Regulation (GDPR) also

apply to you.

7. How we protect data

Transport is encrypted (HTTPS). Database access is restricted. Exchange keys are encrypted on your device

and are not stored on the server: it only ever sees an already-signed request, and the API secret never

reaches it. We will notify you and the supervisory authority of incidents that threaten

your rights. The swap and bridge request log is a separate file that only the server administrator and

the web server writing it can open.

8. Cookies

Cookie use is described in a separate document.

9. Changes

We announce material changes at least 14 days in advance, in the service or by e-mail. The effective date

is always shown at the top of this document.