Legal · GDPR

Privacy Policy.

LOSURIA does not collect personal data wherever technically possible. Below: what we do process, why, and your rights under GDPR.

Effective: 2026-08-21 · Version 1.6 · GDPR / Datenschutz-Grundverordnung (DSGVO)

01 · Controller & categories

Who is responsible, and what is processed.

1Controller

The data controller within the meaning of Article 4(7) of Regulation (EU) 2016/679 (GDPR) is Negentralgorhythms LLC, a Wyoming limited liability company, acting through its managing representative and using the German legal contact address identified in the Impressum. Contact: contact@losuria.com.

2Categories of data processed

2.1 Data we deliberately do NOT collect

No Wallet owner private keys, seed phrases, passkey secrets, or plaintext master secrets are submitted to the Service in the standard wallet flow. Automated execution uses authorisations you sign.
No fiat payment instruments. The Service does not operate a fiat on-ramp; users acquire crypto through their own channels.
No KYC documents are collected for the standard wallet flow. This does not waive any lawful abuse, sanctions, or regulatory screening that may apply to a particular use or jurisdiction.
No email addresses (other than what you may include in correspondence with contact@losuria.com).
No phone numbers.
No analytics, behavioural tracking, or cross-site identifiers. No third-party cookies. No advertising trackers.
No analysis, profiling, or advertising use of your IP address. The only IP processing is security-purpose HTTP access logs at the reverse proxy, used solely for abuse prevention and deleted automatically after at most 7 days (see 2.2).

2.2 Data we do collect or process

Category

Purpose

Retention

Legal basis

WebAuthn public credential identifier and public key material (per Passkey Wallet)

Passkey authentication and assignment of the credential to the correct Wallet record

Until the Passkey registration is removed or an erasure request is completed; an abandoned registration start is held only as a short-lived in-memory challenge and is not persisted

Art. 6(1)(b) GDPR (contract performance)

Passkey display handle and optional account username (chosen by you)

Finding the relevant Passkey credentials and the optional encrypted account vault; the account ledger stores a one-way lookup hash of the normalized account username rather than the plaintext username

For as long as the corresponding Passkey registration or optional account exists, or until an erasure request is completed

Art. 6(1)(b) GDPR

Optional account authentication data: per-account salt, derived login value during login, and salted login-verifier hash

Authenticating the username-based Zero-Knowledge account without receiving the passphrase or the account encryption key; Argon2id derivation occurs on your device

The derived login value is processed only for the request; salt and verifier remain until the account is erased

Art. 6(1)(b) GDPR

Account profile and encrypted continuity records

Preserving account continuity and processing requested account and deletion actions

Until the account is deleted or the relevant record is removed under the applicable retention control

Art. 6(1)(b) GDPR

Automation records: snipe, limit, DCA, grid and observation targets/signals; positions and fills

Operating the trading automation you enable, showing execution history, and letting you inspect or resume an instruction after a restart; observation only reports signals and any follow-up trade remains your own signed action; execution uses your signed authorisations

Snipe instructions: 7 days; observation targets, signals, limit and grid records: 30 days unless deleted earlier; active positions persist until closed and closed positions for 30 days; DCA records persist until completed or deleted; fills remain available in history

Art. 6(1)(b) GDPR

Signed authorisations

Submitting the buy and exit orders you signed, when the condition you named occurs

Until the order fills, expires or you deactivate it

Art. 6(1)(b) GDPR

API-key record: one-way key hash, public key ID and the derived public addresses, label, grants and Solana approval metadata

Authenticating the API credential, binding it to your owner wallet, and retaining the metadata needed to submit or cancel owner-authorised orders without storing the raw credential

Until you revoke the API key or delete the account; the raw API credential is not persisted

Art. 6(1)(b) GDPR

Intelligence API usage meter: one-way API-key hash, UTC day and request count

Counting what a paid Intelligence plan actually used, so a plan limit can be enforced and an invoice reconciled; kept apart from the anti-abuse rate limit, which protects the service rather than measuring a purchase

90 days, then automatically dropped; the raw API credential is never stored

Art. 6(1)(b) GDPR (contract performance)

Wallet, legacy Smart-Wallet and derived public addresses

Account binding, automation records, and on-chain queries such as balances, allowances and ENS

Account and automation addresses persist for the corresponding account/record retention period; ad-hoc query addresses are not separately retained

Art. 6(1)(b) GDPR

Optional encrypted account-vault and master-seed-envelope ciphertext

User-requested cross-device backup of product data and, for enrolled Passkeys, encrypted key-derivation material; current envelope writes require private WebAuthn-PRF output and reject public credential identifiers as wrapping keys

The latest vault version replaces the previous version in the active record immediately. Superseded, still encrypted vault rows may remain in the append ledger until automatic size-and-ratio-based compaction physically removes them; an account-erasure request covers both active and superseded account-vault rows. Master-seed envelopes are atomically rewritten, so a superseded envelope is physically replaced on the successful write. A legacy compatibility envelope created before 1 August 2026 is rewrapped on the next PRF-capable login and its superseded ciphertext is physically removed; until then it may not provide the same server-inaccessibility guarantee. LOSURIA stores ciphertext, nonce, scheme and version metadata.

Art. 6(1)(b) GDPR

SQLite migration metadata and encrypted legacy store snapshots

Reconciling the bounded persistence migration and recovering a legacy write after a crash without changing the legacy read authority; snapshots remain opaque and no private key is stored

Until the corresponding legacy store is cut over or the migration snapshot is replaced; conflict and rollback records follow the applicable store retention and erasure control

Art. 6(1)(b) GDPR

Web Push subscription endpoint + p256dh + auth keys

Delivering opt-in notifications for execution and account events.

Persisted in an append-only on-disk ledger so push survives restarts; ends when you revoke push permission or delete the subscription

Art. 6(1)(a) GDPR (consent)

Public business-contact data: Telegram handle, channel role/title, public invitation evidence, outreach/reply/opt-out metadata

Responding only to a current public invitation for promotional or partnership requests at that exact handle; the source is the public channel description or pinned post. The first message identifies LOSURIA, links this Article 14 notice, and provides an immediate STOP/objection path. Generic public admin or support details are not enough.

Uncontacted candidates: at most 30 days. Invitation, sent, reply and opt-out evidence: at most 3 years after the last contact for compliance and legal defence; then only a minimal one-way suppression value while outreach remains active, so an objection is not forgotten. The public invitation text itself is not retained, only its source label and SHA-256 digest.

Art. 6(1)(f) GDPR (legitimate interest in answering an expressly published business-contact invitation); compliance with Section 7 UWG is a separate prerequisite before any message is sent

Operational metrics (request counts, latencies, error counters; aggregated)

Service health monitoring

~24 hours

Art. 6(1)(f) GDPR (legitimate interest)

Application logs (for example timestamps, severity, error/request IDs, public transaction hashes or Wallet addresses where operationally necessary)

Fault diagnosis, security monitoring and incident reconstruction; passphrases, raw API credentials, private keys and request bodies are not logged

Short-lived and automatically rotated under size-bounded retention controls; entries are discarded as the rotation advances and are not kept longer than necessary for these purposes

Art. 6(1)(f) GDPR (legitimate interest in secure and reliable operation)

Reverse-proxy HTTP access logs (IP address, timestamp, requested path, status code, user agent)

IT security and abuse prevention; automatically banning IP addresses that flood authentication endpoints with failed attempts

Rolling, at most 7 days, then automatically deleted

Art. 6(1)(f) GDPR (legitimate interest in network and information security)

Email correspondence with contact@losuria.com

Handling legally required notices (GDPR data-subject requests, sanctions enquiries, regulatory correspondence, contractual notices). Not a general support channel.

Until the matter is closed plus statutory retention obligations (typically 6 years for tax-related correspondence under § 147 AO)

Art. 6(1)(b) and 6(1)(c) GDPR

2.3 Public on-chain data

The blockchains supported by the Service are public. Wallet addresses, balances, transactions, and contract interactions associated with addresses you derive through LOSURIA are visible to anyone in perpetuity. We do not control and cannot delete on-chain data.

02 · Recipients, transfers, security

Where data goes and how it is held.

3Recipients / third-party processors

Recipient

What is shared

Why

Push delivery services (Mozilla, Apple, Google)

Your push endpoint URL and the encrypted notification payload

Delivering opt-in push notifications

Telegram (only for an explicitly invited business-outreach conversation)

The public Telegram handle, LOSURIA's message, channel title and the recipient's reply or STOP instruction

Delivering a business enquiry only to the exact handle currently published for promotional or partnership requests, and receiving the response

Blockchain peers and the RPC provider selected for the active chain/mode

Managed execution traffic is handled according to the selected path. A browser connection to a user-supplied RPC can expose the User's IP address and RPC parameters such as public wallet, token and contract addresses or a signed transaction to that provider.

Reading blockchain state and broadcasting User-signed transactions. Some Solana and explicit bring-your-own-RPC modes connect to the endpoint the User selects. Manual Monad actions may use the selected endpoint; automated Monad sniping uses the configured execution path and a User-signed order.

We do not "sell" personal data to any party.

4International transfers

The Service is hosted in Germany. Some third parties (notably the push delivery services operated by Mozilla, Apple, and Google) may process data outside the EU/EEA. Telegram processes an explicitly invited business conversation under its own privacy terms and may process it outside the EU/EEA. A third-party RPC endpoint deliberately selected by the User is governed by that provider's own privacy terms and location. Where LOSURIA engages a processor, we rely on the EU Standard Contractual Clauses or equivalent safeguards where applicable. You may request a copy of the relevant transfer mechanism from contact@losuria.com.

5Storage and security

Production servers are access-controlled and operated under the operator's administrative control.
All transport is TLS 1.3 only.
Wallet authentication and signing use WebAuthn Passkeys (FIDO2). The optional username-based account vault uses a locally processed passphrase: the passphrase and account encryption key never leave the device; the backend stores only a salt and salted verifier as described in 2.2.
Application logs exclude request bodies, passphrases, raw API credentials and private keys, but may contain the limited pseudonymous/public operational identifiers disclosed in 2.2. The reverse proxy keeps security-purpose HTTP access logs (including IP address) solely for abuse prevention and deletes them automatically after at most 7 days.
Access to operational systems and credentials is restricted to authorised operations personnel and protected by least-privilege controls.

No system is fully secure. We cannot guarantee against breach. In the event of a personal-data breach affecting your rights or freedoms, we will notify the supervisory authority within 72 hours and you without undue delay, as required by Articles 33 and 34 GDPR.

03 · Your rights

What you can ask us to do.

6Your rights (Articles 15–22 GDPR)

You have the right to:

request access to the personal data we hold about you (Art. 15);
have inaccurate data rectified (Art. 16);
have your data erased ("right to be forgotten", Art. 17);
have processing restricted (Art. 18);
receive your data in a portable format (Art. 20);
object to processing based on legitimate interest (Art. 21);
not be subject to a decision based solely on automated processing that produces legal or similarly significant effects (Art. 22). The opt-in snipe automation operates only on parameters you actively configure. The optional trader ranking uses confirmed public-chain receipts for display and does not determine access, price, eligibility, or any legal effect.
withdraw a consent you have granted, at any time and without affecting the lawfulness of processing carried out before withdrawal.

If LOSURIA contacts a publicly designated business handle, you may object to direct marketing at any time simply by replying STOP or by emailing us. We will stop the communication and retain only the minimum suppression record needed not to contact that handle again while outreach remains active.

To exercise any of these rights, email contact@losuria.com with sufficient detail to identify your account (handle and/or wallet address). We respond within one month per Art. 12(3) GDPR.

Right to lodge a complaint

Under Article 77 GDPR, you may lodge a complaint with a supervisory authority, in particular in the EU Member State of your habitual residence, place of work, or the place of the alleged infringement. We do not describe a German authority as a “lead supervisory authority” because the controller is established outside the EU and an EU representative or hosting location does not by itself create a main establishment under Article 56 GDPR.

04 · Cookies, children, automation

Local storage, minors, and automated decisions.

7Cookies and local storage

LOSURIA does not set tracking cookies, analytics, advertising trackers, or any third-party cookies.

Opening any page on this site stores nothing on your device — no cookie, no local storage, and no request that would set one.

Two functional first-party cookies exist. Each is set only by an action you take, and each is strictly necessary to deliver what that action asked for. None is used for analytics, advertising or profiling, and none is readable by anyone else:

losuria_ref — set only if you open a /r/<address> referral link directly. Holds one address and a server signature over it for 30 days, is unavailable to browser scripts, and credits that verified first referral at signup. An unsigned ?ref=… value is ignored.
losuria_ref_gate — set only when you enter a partner code, for 30 days, so the partner page you unlocked stays reachable.

Additionally, the PWA uses browser localStorage on your device to persist:

Your wallet roster: handle, public EOA and chain addresses, recovery salt and public metadata. Passkey Wallet owner keys are derived on demand and are not persisted. If you deliberately import a private key, current imports are stored passkey-encrypted; an older import created before that protection existed may remain in its legacy device-local form until you remove or re-import it.
Your per-wallet authentication session token (server-side maximum lifetime: 7 days) and cross-tab logout marker. This token can access authenticated account data but cannot sign a fund-moving transaction.
Your preferences and device-local product data, such as the active wallet, MEV-saved counter, last-used chain, contacts and watchlist.

Browser-local data remains on your device unless you explicitly enable the encrypted account vault, in which case only the client-side encrypted vault payload is uploaded as described in section 2.2. Local data is removed when you click "Forget all wallets" in the Wallets tab or clear browser storage; the version cookie can be removed in your browser settings.

8Children's data

The Service is not directed at children under 18. We do not knowingly process data from minors. If you believe we have, contact us and we will erase it.

9Automated decision-making

The opt-in snipe-automation feature executes trades autonomously from the owner-authorised parameters you configure (target token, signed input amount, minimum output, relayer gas ceiling and expiry). This is not "profiling" in the sense of Art. 22 GDPR — no decisions about you as a person are produced. The only decision made is whether a configured trade matches a configured market event.

10Changes to this policy

We will publish changes on this page. The "Effective" date at the top reflects the most recent revision. Material changes affecting your rights will be flagged at least 14 days before they take effect, where reasonably feasible.

11Contact for data-protection requests

Data-subject requests under Articles 15–22 GDPR: contact@losuria.com. We respond within one month as required by Article 12(3) GDPR. This address is for data-subject requests only and is not a general support channel.

Back · Terms of Use · Impressum · AI transparency

Follow: Telegram · launches · @LOSURIA