Privacy Policy

1. Introduction

Deep Blue Alpha ("we", "us", "our") respects your privacy. This Privacy Policy explains what information we collect, how we use it, and your rights regarding your data when you use our website and services at deepbluealpha.io.

2. Information We Collect

Information You Provide

• Account Data: Email address and hashed password when you create an account
• Payment Data: Payment processing is handled by Stripe (credit cards) and NOWPayments (cryptocurrency). We do not store your full credit card number, bank account details, or private keys. We receive only transaction confirmation details.
• Alert Preferences (Pro tier and above, and Free-plan coin alerts): If you configure Alerts, we store your notification preferences including alert types, thresholds, delivery channels, and quiet-hours settings. If you connect a Telegram account for alert delivery, we store your Telegram chat ID to route notifications to your account. If you connect a Discord, Slack, or custom webhook destination, we store the webhook URL you provide so we can deliver your alerts to it; that URL is stored as you entered it, is never displayed back to you in full after saving, and is used for no purpose other than delivering your alerts. You may disconnect any channel or disable all alerts at any time from your Alerts settings page. If you receive Free-plan coin alerts, we keep a log of which alerts were sent (your user ID, the coin, and the time) to enforce the weekly limit; you can turn them off from your Watchlist page or from the link in any alert email.
• Cancellation Feedback: If you cancel a paid plan, or start to and then change plan or stay, we store the reason you choose and the outcome, linked to your account. If you cancel through our payment processor's billing portal, we store the reason and any comment you give there.
• Custom Wallet Monitoring (Whale tier): If you add Ethereum addresses to monitor, we store those addresses, any label you give them, and your notification threshold. Ethereum addresses are public on-chain identifiers, not personal data we obtain from you; we store them solely to match against on-chain activity and notify you. You may remove any monitored address at any time.
• Business Account Data: If you create a business account or switch your account to business, we store your company name, the company website if you give one, and the date and version of the Business & API Terms you accepted. We use this to show which organization the account belongs to, to apply the right plan and terms, and to email you about the Business plan (for example, when Business checkout opens). It is kept for as long as the account is active and deleted with your account as described in Section 5; the record that you accepted the Business & API Terms may be kept longer where needed to show what was agreed.
• Communications: Any messages you send us via email or support channels

Information Collected Automatically

• Usage Data: Pages visited, features used, API endpoints called, and timestamps
• Email Engagement Data: If you receive our emails, we record whether a message was opened and which links in it you clicked. Opens are measured with a small invisible image; link clicks are measured by routing links through links.deepbluealpha.io before forwarding you to the destination. We use this only to judge whether our emails are useful and worth sending. Open data is approximate — some mail apps load images automatically, which registers as an open whether or not you read the message, and blocking images in your mail client prevents open tracking entirely. Unsubscribing stops all of it; every email carries an unsubscribe link.
• Device Data: Browser type, operating system, screen resolution, and language preference
• AI Connector and ChatGPT App Requests: When an AI assistant (for example ChatGPT, Claude or Cursor) uses our public data connector at deepbluealpha.io/mcp, we receive only the tool request it sends — such as a token symbol or a time window — never your conversation, prompts, name or account details with that assistant. No sign-in is required. For each request we record the time, which tool was used, the name and version of the AI app that connected, and a salted one-way hash of the requesting IP address. The hash lets us count distinct users and enforce rate limits without storing the address itself. We do not log the token symbols or other arguments requested, and this data is used only for usage statistics, abuse prevention and service reliability. It is kept for up to 12 months.
• Network Data: IP address (handled per the privacy practices of our analytics and security providers; not retained alongside account-level identifiers in our own systems), referral source
• Cookies: Authentication tokens and analytics cookies set by first- and third-party analytics services. For visitors in the EU, EEA or UK (detected from the browser's time zone), analytics cookies are set only after you grant analytics consent via the Cookie Preferences modal. For other visitors, analytics runs by default and you can opt out at any time in Cookie Preferences. See our Cookie Policy for the complete list of cookies and their durations.

Information We Do NOT Collect

• Your cryptocurrency wallet private keys or seed phrases
• Your trading positions on any exchange
• Full credit card numbers (handled exclusively by Stripe)
• Government identification documents

3. How We Use Your Information

• Service Delivery: To provide, maintain, and improve Deep Blue Alpha
• Authentication: To verify your identity and manage your subscription
• Communication: To send service updates, security alerts, and (with consent) product announcements
• Analytics: To understand site usage. We use first- and third-party analytics services that may set cookies and collect device/usage data. For visitors in the EU, EEA or UK (detected from the browser's time zone) this happens only after consent is granted; elsewhere it is on by default and can be turned off in Cookie Preferences. We do not combine analytics data with account-level personal data to build cross-site advertising profiles, and we do not sell or share analytics data for cross-context behavioral advertising. See our Cookie Policy for the cookies these services may set and how to opt out.
• Security: To detect fraud, abuse, and unauthorized access
• Legal Compliance: To comply with applicable laws and legal requests

4. Data Sharing

We do not sell your personal data and we do not share your personal data for cross-context behavioral advertising. We share data only with the following categories of recipients, in the limited circumstances described:

• Payment Processors: Stripe and NOWPayments process your payments under their own privacy policies.
• Infrastructure Providers: Our hosting provider processes data as needed to run the Service. Categories shared: account email (for system access logs), session metadata, and request metadata.
• CDN/Security: Cloudflare provides CDN and DDoS protection, processing traffic data per their privacy policy.
• Telegram (Alerts delivery, Pro tier and above, and Free-plan coin alerts): If you connect a Telegram account to receive alerts, your Telegram chat ID and alert message content are transmitted to Telegram's servers to deliver your notifications. Telegram's handling of this data is governed by Telegram's Privacy Policy. We transmit only the minimum data necessary to route and display your alert. You may disconnect Telegram at any time from your Alerts settings (or, for Free-plan coin alerts, from your Watchlist page).
• Discord and Slack (Alerts delivery, Pro tier and above): If you connect a Discord or Slack incoming webhook, your alert message content is transmitted to that platform's servers to deliver the notification. Their handling of that data is governed by Discord's Privacy Policy and Slack's Privacy Policy respectively. We transmit only the alert content itself — never your email address, payment data, or account credentials. Note that anyone with access to the destination channel can read the alerts you route there. You may disconnect at any time from your Alerts settings, or revoke the webhook from within Discord or Slack.
• Custom Webhook Destinations (Pro tier and above): If you configure a custom webhook, alert content is transmitted to the HTTPS endpoint you specify. You control that endpoint and are responsible for its security and for any onward handling of the data it receives. We transmit only the alert payload — never your email address, payment data, or account credentials — and we do not retry failed deliveries.
• Analytics Providers: We use Google Analytics 4 (provided by Google LLC) to measure site usage; for visitors in the EU, EEA or UK (detected from the browser's time zone) it receives page-view and device data only after analytics consent is granted via the Cookie Preferences modal; for other visitors it runs by default unless they opt out in Cookie Preferences. We may also pass a non-personally-identifying categorical attribute indicating your subscription tier (for example, "free" or "alpha") so that aggregated reports can distinguish member groups. When you buy or renew a plan, and only while analytics is allowed under your Cookie Preferences, we also send Google Analytics the plan name, billing period, price paid, payment method type (card or crypto) and an internal account number, so we can measure which pages and sources lead to purchases. If you turn analytics off, we stop sending this. Google Analytics does not receive your account email, name, password, card or wallet details, or any other directly identifying information.
• Email Delivery: We use Resend (provided by Resend, Inc.) to send transactional and account emails (verification, receipts, alert digests, and our newsletter). Resend receives your email address and message content in order to deliver these emails, under its own privacy policy. Resend also processes the email engagement data described above — opens and link clicks — and reports it back to us. Resend does not receive your password or payment data.
• AI Assistant (Alpha tier and above): When you use the WHaiLE™ AI assistant, your question text is transmitted to Anthropic (provider of the Claude models) to generate a response, under Anthropic's own privacy and data-usage terms. We transmit only the query text and the on-chain data context needed to answer it — never your password or payment data.
• Legal Requirements: When required by law, subpoena, or legal process.
• Safety: To protect the rights, property, or safety of Deep Blue Alpha and its users.

If you are a data subject under EU/UK GDPR or another regime that affords you the right to obtain a list of specific subprocessors, you may request the current list by emailing team@deepbluealpha.io.

5. Data Retention

We retain your account data for as long as your account is active. If you delete your account, we will remove your personal data within 30 days, except where retention is required by law or for legitimate business purposes (e.g., fraud prevention). Anonymized analytics data may be retained indefinitely.

6. Data Security

We implement industry-standard security measures including:

• HTTPS encryption for all connections (TLS 1.2+)
• Password hashing with PBKDF2-HMAC-SHA256 (100,000 iterations)
• API keys stored as SHA-256 hashes (originals never stored)
• Cloudflare DDoS protection and Web Application Firewall
• Rate limiting on authentication and API endpoints

No system is 100% secure. We cannot guarantee absolute security. In the event of a confirmed personal-data breach, we will notify affected users without undue delay, and where required by applicable law (including GDPR Article 33 and applicable U.S. state data-breach notification statutes), notify the relevant supervisory authority within seventy-two (72) hours of becoming aware of the breach.

7. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate data
• Deletion: Request deletion of your account and associated data
• Portability: Receive your data in a machine-readable format
• Objection: Object to certain processing of your data
• Withdraw Consent: Where processing is based on consent, you may withdraw it at any time

To exercise these rights, contact us at team@deepbluealpha.io.

8. International Users

Deep Blue Alpha is operated from the United States. If you access the Service from outside the United States, your data will be transferred to and processed in the United States and other jurisdictions in which our infrastructure or service providers operate.

EU / UK / EEA Users — Cross-border transfer mechanism. For transfers of personal data from the European Economic Area, the United Kingdom, or Switzerland to the United States, we rely on the European Commission's Standard Contractual Clauses (SCCs), the UK International Data Transfer Addendum, and applicable adequacy decisions, supplemented by appropriate technical and organizational measures including encryption in transit and at rest. We do not rely on user consent as the sole basis for these transfers.

9. Children's Privacy

Deep Blue Alpha is not intended for users under 13 years of age (the Children's Online Privacy Protection Act, "COPPA," threshold in the United States). For users in the European Economic Area or the United Kingdom, the digital-services age threshold ranges from 13 to 16 depending on the member state; we apply the local minimum where required. We do not knowingly collect personal data from a child below the applicable threshold. If we learn that we have collected data from a child below the applicable threshold, we will delete it promptly. A parent or legal guardian who believes a child has provided personal data may contact us at team@deepbluealpha.io to request deletion.

10. Your California Privacy Rights (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), gives you certain rights regarding your personal information.

We do not sell or share your personal information for cross-context behavioral advertising. We have not sold or shared personal information of California residents for monetary or other valuable consideration in the preceding twelve months, and we have no current plans to do so.

Categories of personal information we collect (per CCPA categories): identifiers (email, account ID), commercial information (subscription tier, payment history), internet/electronic activity (page views, feature usage), and geolocation data inferred from IP at country/region level only.

Sources: directly from you (account creation, payments) and automatically from your interactions with the Service.

Purposes: as described in Section 3 of this policy.

Your rights as a California resident:

• Right to know: Request the categories and specific pieces of personal information we have collected about you.
• Right to delete: Request deletion of personal information, subject to legal exceptions.
• Right to correct: Request correction of inaccurate personal information.
• Right to opt out of sale or sharing for cross-context behavioral advertising: Although we do not sell or share for these purposes, you may exercise this right at any time at Do Not Sell or Share My Personal Information or by emailing team@deepbluealpha.io. We will honor a Global Privacy Control (GPC) signal as a valid opt-out request where required by law.
• Right to limit use of sensitive personal information: We do not collect or use sensitive personal information for any purpose that would trigger this right.
• Right to non-discrimination: We will not discriminate against you for exercising any of these rights.

To exercise any of these rights, email team@deepbluealpha.io from the email address associated with your account, or use the contact path described above. We will respond within 45 days as required by CCPA.

Do Not Sell or Share My Personal Information. As stated above, we do not sell or share personal information for cross-context behavioral advertising. If you wish to record your preference on file, email team@deepbluealpha.io with the subject line "Do Not Sell or Share — CCPA" and include the email address on your account.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users of material changes. The "Last updated" date at the top reflects the most recent revision.

12. Contact

For privacy-related questions or requests, contact us at team@deepbluealpha.io.