Privacy policy

[Legal entity name], of [Registered address], is the data controller for personal data processed through OpenKol. You can reach us about anything on this page at [email protected].

If you have an account

Your email address, a hashed password or the identifier from whichever sign-in provider you used, your plan and its expiry, and the results you have generated.

If you pay us

The wallet address you paid from, the transaction hash, the amount, and the period it bought. These are recorded on a public blockchain by their nature, not by us. We never see or hold a private key.

However you use the service

The posts you submit for analysis, your IP address, and basic technical characteristics of your browser and device.

The free tier works without an account, which means the only way to stop one person consuming it through hundreds of sessions is to recognise that the sessions are related. We do that with your IP address and a derived identifier based on technical characteristics of your browser.

That identifier is a hash. We do not use it to build a profile of you, do not attempt to identify you personally with it, do not combine it with data from other sites, and do not share or sell it. It exists to count requests and nothing else, and it is discarded after 30 days.

It is still personal data, and you still have every right in clause 7 over it. We would rather say this in a heading than in a footnote.

• To provide the service — running analyses, storing your results, showing your history. Basis: performance of our contract with you.
• To take payment and give access — matching a transaction to an account and a period. Basis: performance of our contract, and our legal obligation to keep financial records.
• To prevent abuse — the rate limiting described above. Basis: our legitimate interest in keeping a free tier that is not consumed by a handful of scripts.
• To improve the product — aggregate, non-identifying analysis of how the service is used. Basis: legitimate interest.

A result is derived from public posts and public market data. We retain results and reuse them: a post already analysed is served from storage rather than recomputed, and results contribute to the aggregate distributions that paid comparisons are measured against.

Those aggregates are statistical. They do not identify you, and deleting your account does not remove a public post from having existed — but it does remove the link between any result and you.

We use a small number of processors, each under contract and each for one job:

• hosting and infrastructure;
• a payment processor, to generate addresses and confirm transactions;
• an email provider, for account and renewal notices;
• privacy-respecting, cookie-free analytics.

We do not sell personal data, and we do not share it for advertising. We will disclose data where legally compelled, and will tell you unless prohibited from doing so.

• Account data: while your account exists, then 30 days.
• Payment records: as long as tax and accounting law requires.
• Abuse-prevention identifiers and IP logs: 30 days.
• Analyses: indefinitely, unlinked from you once your account is deleted.

If you are in the UK or EEA you have the right to access your data, correct it, have it erased, restrict or object to processing, and receive it in a portable form. Where we rely on legitimate interest you can object, and we will stop unless we have compelling grounds not to.

Email [email protected] and we will respond within 30 days. If you are unhappy with our response you can complain to your local supervisory authority.

Our infrastructure and processors may operate outside the UK and EEA. Where data is transferred, it is done under UK/EU standard contractual clauses or an equivalent adequacy mechanism.

Data is encrypted in transit and at rest, access is limited to those who need it, and passwords are stored hashed. No system is perfectly secure; if a breach affects your personal data we will notify you and the relevant authority as the law requires.

The service is not intended for anyone under 18 and we do not knowingly collect their data. If you believe we have, contact us and we will delete it.

We may update this policy. The date at the top always reflects the current version, and we will notify account holders by email before any material change takes effect.