1. Controller, contact and scope
This Privacy Notice is effective from 2026-09-16. The controller for HOSTuvo is HOSTuvo. Privacy and data-protection requests may be sent to admin@hostuvo.com. HOSTuvo is responsible for determining the purposes and means of the processing described here to the extent it acts as controller. Where mandatory law requires additional formal registration or address particulars in a particular transaction or notice, HOSTuvo provides them through the applicable contractual, billing or statutory information channel.
The Notice applies to processing for which HOSTuvo determines the purposes and means. Third-party websites, exchanges, payment pages and independent services have their own privacy rules. Where HOSTuvo uses public market data, the appearance of an asset, public wallet or market event in research data does not by itself create a customer profile about the person behind that asset or address. Where another party independently determines why and how it processes information, that party has its own legal responsibilities.
References: GDPR
2. Privacy principles
HOSTuvo is designed around data minimisation, purpose limitation, access control and separation between product telemetry and market-research stores. Personal data should be collected only where a defined purpose requires it, kept accurate where relevant, protected with measures proportionate to risk and retained no longer than necessary for the purpose or a binding legal obligation. Optional measurement must not be converted into a condition for receiving a service that does not require it. A refusal of optional analytics must not be treated as permission to create an equivalent tracking identifier by another route.
No privacy document can create consent by fiction. Visiting a page is not treated as consent to non-essential storage or tracking. Consent, when relied upon, must be a real affirmative choice capable of withdrawal. Contract, legal obligation and legitimate interests are separate legal bases and are not described as consent merely for convenience. HOSTuvo should record the legal basis that actually applies to each processing operation and re-evaluate it when the product changes.
3. Categories of personal data
Depending on which functions a user activates, HOSTuvo may process account and authentication data such as an email address, Supabase user identifier, display name, authentication/session records and password-recovery state; profile and preference data such as language, theme, favourites and in-app alert choices; account-security and audit data such as account-created, profile-change or security events; subscription and entitlement data such as a Stripe customer identifier, subscription identifier, status, entitlement period and cancellation-at-period-end flag; and Data API metadata such as key identifier, prefix, label, creation time, last-use time, request count and revocation time. Full Data API secrets are intended to be shown once and should not be stored in plaintext after creation.
HOSTuvo may also process technical information necessary to deliver or secure the service, for example request time, endpoint, response status, browser/session characteristics and network identifiers in standard infrastructure logs. Retention and fields of reverse-proxy, operating-system and hosting logs are governed by HOSTuvo’s operational security and retention controls and may be updated as infrastructure changes. The product is not designed to request wallet seed phrases, private keys, exchange withdrawal credentials or custody secrets. Users must not submit such secrets through support, profile fields or any other HOSTuvo interface.
References: GDPR
4. Sources of data
Personal data can come directly from the user when an account is created, profile settings are changed, support is contacted or a paid plan is requested; from the authentication and billing infrastructure when an account, session or subscription event occurs; from the user’s browser when strictly necessary preferences or expressly consented measurement events are stored; and from security or server infrastructure when requests are processed. HOSTuvo may derive limited operational information, such as entitlement status or aggregate product-use statistics, from those events.
Market prices, order-flow observations, public order books, derivatives context, public wallet research and news-source information are obtained from market or public sources and are processed primarily as market data. They should not be merged with a user’s identity for behavioural advertising. If a future feature asks a user to connect an exchange account, wallet, portfolio or financial profile, that would be a materially different processing operation requiring a new privacy and regulatory assessment before activation.
References: GDPR
5. Purposes and legal bases in the EEA
For users in the European Economic Area, account creation, authentication, provision of requested product functions, saved preferences, subscription entitlement and customer-requested support are normally processed because they are necessary to take steps requested before a contract or to perform a contract under Article 6(1)(b) GDPR. Records needed to meet accounting, tax, consumer-protection, sanctions, law-enforcement or other mandatory duties may be processed under Article 6(1)(c). Security, abuse prevention, service integrity, limited audit trails, defence of legal claims and proportionate operational logging may rely on Article 6(1)(f) where the controller’s legitimate interests are not overridden by the user’s rights.
Optional first-party analytics and non-essential browser storage are designed to rely on consent under Article 6(1)(a) GDPR together with the applicable terminal-equipment rule, including Article 399 of the Polish Electronic Communications Law where applicable. Withdrawing analytics consent must stop new optional measurement; it does not retroactively make earlier lawful processing unlawful. HOSTuvo must document any additional basis, balancing assessment or statutory retention before using it. Sensitive-category data under Article 9 GDPR is not required for normal HOSTuvo use and users should not submit it without a clear necessity and lawful basis.
6. Cookies, local storage and similar technologies
HOSTuvo uses or may use strictly necessary browser storage for security, authentication, language continuity and other functions requested by the user. Current public-page implementation also stores a public theme preference and language choice, and can store a motion preference. An analytics-consent cookie is used to record the user’s choice; a random analytics browser identifier is created only after consent for the first-party measurement system. Authentication cookies may be HttpOnly and are used to maintain a secure account session. Cookie names, duration and scope are maintained in HOSTuvo’s live technical inventory and may change where functionality or security requirements change; non-essential storage remains subject to the applicable consent rules.
Optional analytics storage must remain off until the user gives a valid choice. The user can later change the choice through the measurement/privacy preference control and can also remove browser storage using browser controls. Blocking strictly necessary storage may prevent login or requested preferences from working. Under Polish law, storing information in or accessing information already stored on terminal equipment is subject to Article 399 of the Electronic Communications Law and the consent standard is linked to data-protection law; strictly necessary exceptions must be applied narrowly, not used as a label for convenience analytics.
7. First-party measurement
The verified first-party engagement module accepts a bounded set of consented events such as product view, methodology view, demo start and checkout start. Its event store records an event identifier, event name, day, locale, optional country/market code, source classification and timestamp. The module is expressly designed not to store the visitor’s raw IP address, account identifier, email address, authentication token, full URL or referrer in that engagement table. Public events are treated as unverified browser observations, not proof of a sale or investment outcome.
The verified retention period for those engagement-event rows is 90 days. A consent-created random browser identifier is used transiently for rate limiting and an HMAC-derived value may be used to deduplicate a first meaningful product-use event without storing the raw browser identifier in the measurement database. HOSTuvo does not treat aggregate event counts as evidence of investment success. The current code contains no advertising export or review-manipulation mechanism for these events. If an advertising, cross-site analytics or third-party tracking tool is added, this notice and consent mechanism must be reassessed first.
8. Country-based language suggestion
To make a language suggestion, the current server can read the connection address transiently, map it locally to a country using a local GeoIP database and combine that country with the browser Accept-Language header. The result is a suggestion only. The feature does not automatically redirect the user and the verified module states that visitor IP addresses are not persisted by this language-selection process. A saved explicit language choice takes priority.
Infrastructure such as a reverse proxy may independently record network information for security or operations; that is a separate processing purpose and should not be confused with the local language lookup. HOSTuvo should not use the language lookup to infer ethnicity, nationality, residence for legal eligibility, wealth, investment sophistication or political status. Geographic availability decisions, if ever required by law or regulation, need a separate documented control rather than silently reusing a language hint.
References: GDPR
9. Accounts, Supabase and session security
HOSTuvo currently uses Supabase components for authentication and account data. The verified database design contains a profile keyed by the authentication user ID, display name, member/admin role, active status, user preferences and creation time, together with audit, announcement, invite, billing-mapping and subscription tables. Row Level Security policies restrict ordinary authenticated users to their own profile, activity and subscription records, while privileged service operations are separated. Users can review active sessions and revoke other sessions through the account interface.
Passwords are handled by the authentication service rather than being intentionally stored as readable values in HOSTuvo application tables. Password-reset and verification workflows can involve email delivery and temporary session state. Users are responsible for protecting credentials and must promptly revoke suspicious sessions. The controller remains responsible for selecting processors, configuring access, limiting service-role credentials and responding to security incidents; outsourcing authentication does not transfer away the controller’s GDPR accountability.
References: GDPR
10. Payments, Stripe and subscription records
Where paid HOSTuvo PRO is activated, Stripe is used for checkout and billing infrastructure. The verified integration can create a Stripe customer with a HOSTuvo user identifier in metadata, create a subscription Checkout session, request billing-address collection, open the Stripe customer portal and synchronise subscription state back to HOSTuvo. HOSTuvo stores identifiers and status needed to map the Stripe relationship to the account. Payment-card details entered into Stripe-hosted payment interfaces are intended to be handled by Stripe rather than copied into the HOSTuvo application database.
Stripe acts under its own and/or processor responsibilities depending on the specific operation and its contractual documentation. Users should review the Stripe notices shown in the payment journey. HOSTuvo should not claim that no payment information is processed merely because card numbers are not stored locally: billing identifiers, subscription status, billing address information available through the provider and transactional records can still be personal data. Accounting or tax records may need to be retained for statutory periods applicable to HOSTuvo; this document does not invent a period before the operator’s jurisdiction and accounting obligations are confirmed.
References: GDPR
11. Support, complaints and correspondence
When a user contacts support, makes a complaint, requests a refund, asserts a legal right or reports a security issue, HOSTuvo may process contact details, account information, correspondence, attachments and facts needed to investigate and respond. Users should redact wallet seeds, private keys, passwords and unnecessary financial or identity documents. Support correspondence may be retained for the period necessary to resolve the matter, demonstrate compliance, prevent repeated abuse and establish, exercise or defend legal claims, subject to applicable limitation and retention rules.
Support and privacy correspondence is handled through admin@hostuvo.com unless another verified channel is displayed in the Service. A social-media account or an address not controlled by HOSTuvo is not a substitute. If HOSTuvo uses an external email-delivery provider, ticketing platform or connected application, that recipient is added to the processor/recipient inventory before personal data is routinely routed there.
References: GDPR
12. Market analysis and separation from user profiling
HOSTuvo’s core analytical data consists of market observations such as prices, candles, spreads, order books, order flow, derivatives context, public market news and model outputs. These data sets are used to produce market-oriented scores and explanations. A score assigned to BTC, ETH or another market is not, by itself, a score assigned to the user. Current automatic market models are not intended to make decisions that produce legal or similarly significant effects about an individual user.
If a user manually marks that they hold a position or saves favourites, those interface choices must not silently be repurposed for creditworthiness, insurance, employment, political profiling or behavioural advertising. A future function that combines a user’s capital, losses, risk tolerance, portfolio or personal circumstances with a recommendation could change both the privacy and financial-regulatory classification of the service and must be reviewed before launch.
13. Data API and security metadata
For eligible accounts, HOSTuvo can issue read-only Data API credentials. The verified design stores a key identifier, key prefix, label, timestamps, request count, entitlement information and revocation state; the complete secret is intended to be displayed only once. Server systems necessarily process the presented credential to authenticate each API request. Users should treat API keys as secrets, rotate or revoke them if exposed, and must not publish them in client-side source code or public repositories.
API rate limiting, abuse detection and security logs may involve technical metadata. These controls serve availability and security, not cross-context advertising. If an organisation integrates the Data API into its own service and supplies personal data to HOSTuvo contrary to the documented API design, the parties’ controller/processor roles may need to be assessed separately; the public market-data API is not intended as a channel for uploading customer databases or special-category personal data.
References: GDPR
14. Recipients and processors
Personal data may be made available only to recipients that need it for a defined purpose, such as hosting and infrastructure providers, Supabase for authentication/database functions, Stripe for billing, communications providers used for transactional email or support, professional advisers bound by confidentiality, and public authorities where disclosure is legally required. The exact legal entity, service region, role and contract for each processor must be maintained in an internal processing inventory and reflected in this notice when material to the user.
HOSTuvo does not, based on the verified measurement implementation, sell first-party engagement events to advertising brokers or use them for cross-context behavioural advertising. This statement must be revalidated if new marketing scripts, pixels or SDKs are installed. Disclosure to an exchange or public data source merely to fetch market information should not include user account data unless that disclosure is necessary, documented and lawful.
References: GDPR
15. International transfers
Cloud, authentication, billing, communications and security providers may process data from locations outside the user’s country. For data protected by the GDPR, a transfer outside the EEA must use a lawful transfer mechanism where required, for example an adequacy decision, Standard Contractual Clauses together with appropriate supplementary safeguards, or another mechanism permitted by Chapter V GDPR. A vendor’s global brand name does not by itself establish a lawful transfer.
HOSTuvo must verify the actual processing regions and transfer terms of Supabase, Stripe, hosting and any communications vendor used in production. This notice does not promise that all data remain in the European Union. Where a local law grants equivalent or additional transfer rights, HOSTuvo must comply with that law to the extent it applies.
References: GDPR
16. Retention
Retention is purpose-specific. Verified consented engagement-event rows are deleted after 90 days. Account and profile data may be kept while the account is active and for a proportionate period afterward where necessary to close the relationship, prevent fraud, honour deletion/objection choices or defend claims. Subscription and transaction records may be retained for mandatory accounting, tax, consumer and legal-claims periods. Security/audit records may be retained for a period proportionate to security and evidentiary needs. Backup copies may expire on a controlled rotation rather than disappearing immediately from every backup when an active record is deleted.
HOSTuvo maintains purpose-specific retention schedules for authentication records, application audit records, infrastructure logs, support correspondence, billing records, Data API records, backups and security-incident evidence. “Forever” is not a default retention period. Where law requires longer storage, access is restricted to that legal purpose rather than kept available for unrelated marketing.
References: GDPR
17. Security
HOSTuvo uses technical and organisational controls intended to reduce risk, including TLS in production, server-side authorisation, account/session checks, CSRF/origin controls for state-changing account operations, database Row Level Security, separation of privileged credentials, hashed or one-time credentials where designed, rate limiting and audit events. These controls reduce risk but no internet service can promise absolute security or uninterrupted availability.
Users should use unique passwords, protect email accounts and devices, revoke suspicious sessions and API keys, and avoid sending secrets that HOSTuvo does not need. Security research or vulnerability reports should be sent through the published security/support channel once that channel is finalised. HOSTuvo should document and test access reviews, key rotation, backup protection, incident response and least-privilege controls as the service evolves.
References: GDPR
18. GDPR and EEA data-subject rights
Where the GDPR applies, a person may have the right to obtain information and access to personal data, rectify inaccurate data, erase data in applicable circumstances, restrict processing, receive eligible data in a portable format, object to processing based on legitimate interests or direct marketing, and withdraw consent without affecting prior lawful processing. A person also has the right to lodge a complaint with the competent supervisory authority. These rights are subject to statutory conditions and exceptions; for example, erasure does not require deletion of records that must lawfully be retained to meet a legal obligation or defend claims.
HOSTuvo should verify identity proportionately before disclosing account data. It must not demand excessive identification when a less intrusive check is adequate. Requests should be answered within the time limits required by applicable law, with extensions used only where legally allowed and communicated. Privacy requests may be sent to admin@hostuvo.com; supervisory-authority competence follows applicable law.
References: GDPR
19. Automated processing, AI and profiling
HOSTuvo uses automated market models and may use AI-assisted systems to analyse market information or prepare explanations. Those systems are designed to assess markets, not to make solely automated decisions about a person that produce legal or similarly significant effects within Article 22 GDPR. Market rankings, risk labels and model confidence are not credit scores or employment decisions. AI-generated text can be incorrect and should not be treated as proof that personal data about a user are accurate.
If a future feature starts using a user’s personal financial circumstances, behaviour or profile to make significant eligibility, pricing or regulated suitability decisions, HOSTuvo must assess whether Article 22, profiling transparency, a Data Protection Impact Assessment or financial-sector suitability rules apply. This notice does not pre-authorise such a future feature.
20. Children and age limits
HOSTuvo is intended for adults and for persons legally capable of using the relevant service in their jurisdiction. Crypto-asset analytics and paid subscriptions are not designed for children. The final Terms are expected to set an 18+ contractual threshold unless a stricter local rule applies. HOSTuvo does not knowingly design profiles or advertising for children through the verified first-party measurement system.
If the controller learns that personal data of a child were collected without a lawful basis or required parental authorisation, it should take appropriate steps to delete or restrict the data. Age restrictions do not justify collecting identity documents from every visitor by default; any age-assurance measure must be proportionate to the risk and privacy impact.
References: GDPR
21. California and other United States privacy rights where applicable
If the CCPA/CPRA applies to HOSTuvo and a California consumer, that person may have statutory rights to know/access categories and specific pieces of personal information, delete data subject to exceptions, correct inaccurate data, opt out of sale or sharing, limit certain uses of sensitive personal information, and receive non-discriminatory treatment for exercising rights. The verified HOSTuvo first-party measurement module is not designed to sell personal information or share it for cross-context behavioural advertising. Applicability thresholds and statutory definitions must nevertheless be assessed against HOSTuvo and actual business activity rather than assumed from this notice.
HOSTuvo does not adopt a blanket “California applies worldwide” promise. Other US federal or state privacy, consumer, biometric, communications or breach-notification laws may apply depending on where users and the operator are located and what future features collect. If a legally recognised browser signal such as Global Privacy Control applies to a processing operation, the final implementation must honour it as required.
References: CCPA
22. United Kingdom and other jurisdictions where applicable
For users protected by UK GDPR and the Data Protection Act 2018, HOSTuvo should provide substantially equivalent transparency, rights handling, security and international-transfer safeguards to those described for the EEA, adapted to UK law. Non-essential cookies or similar storage may also be subject to PECR consent rules. Separate financial-promotion rules can apply to cryptoasset communications capable of having effect in the United Kingdom; a privacy notice does not authorise financial promotion or regulated activity.
Where Swiss FADP, Brazil LGPD, Canada PIPEDA or substantially similar provincial laws, Australian Privacy Act, Japanese APPI or another mandatory privacy regime applies, HOSTuvo will apply mandatory local rights and safeguards to the extent legally required. A cross-border savings clause is not a claim that HOSTuvo has completed registration or appointed a representative in every country. Market availability should be limited where compliance requirements are not yet met.
References: ICO
23. Personal-data incidents
HOSTuvo should maintain an incident process to investigate suspected confidentiality, integrity or availability incidents, contain exposure, preserve proportionate evidence, restore service and assess notification obligations. Under the GDPR, a personal-data breach may require notification to the competent supervisory authority without undue delay and, where feasible, within 72 hours after awareness unless the statutory risk threshold is not met; high-risk breaches may also require communication to affected persons.
Not every service outage is a personal-data breach, and not every security alert proves unauthorised access. Incident communications should distinguish confirmed facts from hypotheses. Users reporting a suspected compromise should provide the minimum information needed for investigation and should never send wallet seed phrases or passwords.
References: GDPR
24. Law-enforcement and compulsory disclosure
HOSTuvo may disclose personal data when a legally binding request, court order or statutory duty requires it, after assessing the requesting authority, scope and legal basis to the extent permitted. It may also preserve or disclose proportionate information where necessary to establish, exercise or defend legal claims or protect rights and security under an applicable legal basis. This does not create a voluntary right to disclose user databases to any person who merely asks for them.
Where a request conflicts with applicable transfer restrictions, secrecy duties or fundamental rights, the controller should seek appropriate legal review and challenge or narrow the request where reasonably available and lawful. Users may not always be notified of a request where law prohibits notification.
References: GDPR
25. Changes to this notice
This Notice may be updated when processing changes, a supplier changes, a legal requirement changes or HOSTuvo adds a new feature. Material changes are dated and communicated in a manner proportionate to their impact. A new version cannot retrospectively create consent for processing that required consent when it occurred. Where a new purpose is incompatible with the original purpose, HOSTuvo identifies an appropriate legal basis and provides required information before proceeding.
Archived versions are retained so that HOSTuvo can identify which notice applied at a particular time. This page states the current version and effective date. Material changes are handled under the rules described above and do not retrospectively create consent for earlier processing.
References: GDPR
26. Contact, complaints and supervisory authority
Privacy requests, questions and data-protection complaints concerning HOSTuvo may be sent to admin@hostuvo.com. A privacy request does not require opening or keeping a paid subscription. If appointment of a Data Protection Officer or EU/UK representative becomes legally required, the relevant contact will be published here.
An EEA data subject also has the right to complain to the supervisory authority competent under the GDPR. For processing subject to Polish supervisory competence, the authority is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych). Cross-border competence depends on the circumstances of the processing. Contacting HOSTuvo first is welcome but is not a condition of the right to complain to a supervisory authority.
References: GDPR
27. Accountability and non-waiver
HOSTuvo maintains an internal processing inventory covering controller contacts, processors, transfer mechanisms, retention, browser storage, account/data-rights workflows, incident response and telemetry controls. These records are reviewed as the product changes. New telemetry or a new use of personal data must have an identified lawful basis and, where required, a valid consent mechanism before activation.
Nothing in this notice asks a user to waive mandatory privacy, consumer or communications rights. Privacy rights cannot be contracted away by calling data “anonymous” when it remains reasonably linkable to a person. Conversely, a technical identifier is not automatically identifying in every context; classification must reflect the actual means reasonably likely to be used. The objective is accurate, auditable processing rather than maximum collection or maximum disclaimer language.
Sources and references
Legislation, official guidance and supplier information. Applicability depends on the specific circumstances. A reference is not an approval of HOSTuvo by an authority.
HOSTuvo is the Service Operator and data controller for the processing described here. Contact: admin@hostuvo.com. This document states the effective HOSTuvo rules while preserving mandatory user rights.