Privacy Policy

Controller

Hearing Software SL is the data controller for personal data processed through FundsOrigin.

What we process

Wallet addresses, analysis parameters, optional email addresses for completion notifications, consent timestamps, and technical logs (IP, user agent) for abuse prevention.

We do not require an account for the public analysis flow.

Purposes and legal bases

Providing the analysis you request (contract / legitimate interest).

Optional email notifications when you opt in (consent).

Optional product updates when you separately consent (consent).

Security and rate limiting (legitimate interest).

Retention and rights

Data is retained as needed to provide the service and meet legal obligations, then deleted or anonymised.

Under the GDPR you may request access, rectification, erasure, restriction, portability, or object to processing. Contact the controller to exercise these rights.

Processors

Infrastructure and email providers may process data on our instructions under appropriate agreements.

Google Ireland Limited may process analytics data when you consent to Google Analytics 4 cookies (see the Cookie Policy).

Website analytics and server logs

With your consent, we use Google Analytics 4 (GA4) to understand aggregate site usage. GA4 sets first-party cookies (_ga, _ga_*) and may receive a truncated, anonymised IP address. We send page views with redacted paths and referrers (no wallet addresses, report links, or query strings). Enhanced Measurement must stay off in the GA4 property. Advertising features and ad personalisation are disabled. Legal basis: consent (GDPR Art. 6(1)(a)). Retention: as configured in GA4 (typically up to 14 months for user-level data) or until you withdraw consent (we also delete `_ga` cookies in the browser).

We also run cookieless, self-hosted analytics (Umami) on our infrastructure. It does not use cookies or cross-site identifiers; URLs and referrers are redacted in the browser before events are sent. The Umami admin console is not on the public website (localhost on the server only). Legal basis: legitimate interest in operating and improving the service (GDPR Art. 6(1)(f)). Retention: aggregated statistics for up to 24 months unless deleted earlier.

Our edge web server (Caddy) writes JSON access logs with client IPs anonymised (IPv4 /24, IPv6 /48). Query strings are stripped from logged URIs; Cookie, Authorization, and Set-Cookie are not logged. Purpose: security, abuse detection, and capacity planning. Legal basis: legitimate interest (GDPR Art. 6(1)(f)). Retention: rotated logs (50 MiB × 10 files, up to 30 days).