Privacy Policy

1. Scope and contact

This policy applies to cryptovista.ai, its application and docs.cryptovista.ai. Questions, access requests and deletion requests can be sent to bilalalam58@gmail.com. Please identify the account concerned, but do not email passwords, recovery codes, API secrets or full payment-card details.

Third-party exchanges, Google and other services you visit have their own policies. This policy describes CryptoVista’s processing; it does not replace their policies.

• Contact the CryptoVista team
• Terms of Service

2. Information you provide

Account information includes your email address, account identifier and profile information such as your name, username, photo and bio, when supplied. Password-based authentication is handled through Supabase Auth. Information you submit to support, feedback or security channels is also processed to respond to the request.

• Saved preferences: watchlists, pinned pages, workspaces, notes, alerts and notification choices.
• Research content: messages, uploaded files or images, selected evidence and reports you ask VistaAnalyst or a Workspace to process.
• Community content: profile details, posts, comments, reactions and other interactions you choose to make in Discover. Visibility follows the feature and audience you select; public content is visible to others.
• Optional account connections: provider and connection identifiers, permitted balances, positions, transaction or product records, valuation snapshots and connection-consent records, according to the access you authorize.
• Billing information: customer and subscription identifiers, plan, invoice, payment status and related transaction records when paid services are available. Payment-card entry is handled by the payment processor.

3. Google Sign-In: access, use and storage

When you choose Continue with Google, Google and Supabase Auth provide the identity information needed to sign you in. This can include a Google account identifier, email address and email-verification status, name and profile picture, when Google supplies them. Basic sign-in uses the openid, email and profile permissions.

We use that information to create or link your CryptoVista account, authenticate you, display your account identity, maintain your session, and provide the account features you request. The account and authentication records are stored through Supabase; relevant profile information can be stored with your CryptoVista profile. Signing in does not provide CryptoVista with your Google password, Gmail messages, Google Drive files, calendar or contacts.

We do not sell Google user data or use it for personalized advertising, creditworthiness decisions or training our own general-purpose AI models. We share Google identity information only as needed for the disclosed account features, service processing, security or applicable legal obligations. If you make profile information public, that information is visible through the account features you choose.

Our use of information received from Google is subject to the Google API Services User Data Policy, including Limited Use requirements where they apply. Any future feature requiring additional Google permissions must request those permissions and explain the additional use before access.

• Google API Services User Data Policy
• Review Google third-party connections

4. Technical, usage and security information

Our hosting, authentication and application services process technical information such as IP address, request time, browser or device information, page or feature requested, session identifiers, errors and security events. We use this information to deliver pages, protect accounts, prevent abuse, troubleshoot faults and understand use of available features.

The documentation includes Vercel Web Analytics for page-view and visitor statistics. The application also records feature, performance, operational and security events. Essential security processing continues where necessary to protect the service.

• Vercel Web Analytics privacy information
• Cookie and browser-storage details

5. Why we process information

We process information to provide and maintain requested services, save your work and preferences, authenticate and protect accounts, process authorized connections and billing, respond to support, deliver requested alerts, moderate reported misuse, and diagnose reliability problems. We may also use service usage information to improve the product.

Where applicable data-protection law requires a legal basis, processing is based on providing the service you request, your consent for optional uses, legitimate interests such as security and reliability where permitted, or a legal obligation. Optional feature consent can be withdrawn as described in that feature. Withdrawing consent does not retroactively undo processing already lawfully performed.

6. Optional portfolio and exchange connections

You decide whether to connect an available provider and which supported read permissions and products to authorize. Connection data can include balances, holdings, positions, history and recorded valuations. Some history or background recording requires separate consent. The connection screen describes its scope, security and retention terms.

Read-only connections are for analysis. CryptoVista does not execute trades, withdrawals, transfers, subscriptions or redemptions through the portfolio connection. The service stores an encrypted credential envelope to make authorized read requests. Use a dedicated read-only key and never grant permissions the connection does not require.

Disconnecting removes the active credential envelope and current imported balances. Existing snapshots, connection metadata, consent and activity records can remain until account deletion or the applicable retention process. Independent encrypted recovery snapshots can retain earlier encrypted records until their recorded expiry. Disconnecting CryptoVista does not revoke the key at your exchange; revoke it separately in the provider’s account controls.

7. AI research, files and external requests

When you use VistaAnalyst, the content needed for the task—including your message, relevant conversation context, selected evidence and file or image content—can be sent to configured AI processing services. Processing can pass through Vercel AI Gateway or other configured gateways and model providers. Public research and URL-reading tools can send the search terms or URL necessary for your request to external research services.

Only submit material you are permitted to process. Avoid uploading credentials, identity documents or sensitive account information that the analysis does not need. If a tool retrieves an external URL, that external service can receive the request and associated technical data. AI and research providers process requests under their own service terms and data-handling rules; do not assume every provider has the same retention or training settings.

Research messages, attachments, notes and reports can be retained with your account so you can return to your work. Sharing or publishing an excerpt, report or community post is a separate action. Review the audience and content before sharing.

8. Who receives information

Service providers receive the information necessary for their role. These include Supabase for authentication and databases; Vercel for hosting, storage, analytics and configured AI gateway processing; Stripe where payment processing is enabled; and configured AI, research, email, monitoring and notification providers when those functions are used.

Authorized team members can access information needed for support, security, moderation, operations or legal requests. We use role and ownership checks to restrict access; this does not mean that all data is end-to-end encrypted or invisible to service operators.

We may disclose information when required by applicable law, to investigate fraud or security incidents, or to protect legal rights. A transfer associated with a business transaction must follow applicable law and any consent obligations, including restrictions applying to Google user data. We do not sell personal information.

9. Storage, security and international processing

Information is stored in the databases, storage and operational systems used to run CryptoVista and its service providers. Processing can occur outside your country; the countries involved depend on the provider and the service configuration. Contact us to ask about a particular processing operation.

We use HTTPS, authenticated access, database ownership policies and server-side controls. Exchange connection credentials have a separately protected encrypted server-side envelope. No service is risk-free, and these measures do not guarantee protection against every incident.

10. Retention and deletion

We retain account and profile information while the account remains active and as needed to provide account functions. Saved work and research content remain until removed through an available feature or processed as part of an account-deletion request, subject to the exceptions below. Optional portfolio history follows the connection-specific consent and retention disclosure.

Billing, consent, security, moderation and legal records can need to remain after ordinary account content is removed, for example to reconcile a transaction, investigate abuse or meet a legal obligation. Provider logs, recovery copies and backups can remain until their applicable expiry or deletion process completes. We do not promise immediate removal from every backup or a single deletion period for every data category.

Use the account-deletion option in settings when available or email the contact above. The application can schedule deletion and display a grace period or execution date; that displayed schedule governs the request. We may verify account ownership and clarify the request before releasing or deleting information. Removing a Google connection is separate from deleting your CryptoVista account. Revoking Google access stops future authorized Google access but does not by itself erase CryptoVista’s stored account records.

11. Your choices and rights

You can review available account and privacy controls, edit your profile, manage saved content, disconnect optional providers, change notification permissions and contact us about your data. Browser controls can remove local storage and cookies, but doing so can sign you out or remove locally retained drafts.

Depending on the law that applies to you, you may have rights to access, correct, obtain a copy of, delete, restrict or object to certain processing, withdraw consent, or complain to a competent data-protection authority. These rights can have legal exceptions. Contact us with the account and request type; we will assess the request under applicable requirements.

Available account controls and export options depend on the feature and release. If an in-product control is unavailable or fails, contact us rather than assuming the request has completed.

12. Children and policy updates

CryptoVista is intended for adults aged 18 or older. It is not directed to children. Contact us if you believe a child has supplied personal information so we can assess and address it.

We update this policy when the service or its data practices change. The date on this page identifies the current version. Material changes that require notice or renewed consent will be handled before the new optional use where required. This policy does not authorize new Google permissions without a separate consent request.