Privacy Policy
Last updated: 11 August 2026
Data controller: Holdra Technologies, LLC, a Wyoming limited liability company.
Registered office: ⟨ADDRESS — FILL IN BEFORE PUBLISHING⟩
Privacy contact: privacy@holdra.ai
Read section 7 before you start. Some of what Holdra does is written to a public blockchain, and that part cannot be deleted by us or by anyone — not on request, not on account closure, not ever.
1. What we collect
- Account — your email address, and the country signal used to determine which disclosures apply to you.
- Wallet — your wallet's public address, and an identifier for it at our wallet provider. We never hold the key that controls it.
- Activity — deposits, withdrawals, swaps, savings movements, strategy settings, orders, positions, and the performance produced by them.
- Username — if you claim one, so that others can find you by it. This is off unless you turn it on.
- Screening records — the result of checking a counterparty address against sanctions lists, kept as evidence that the check was made.
- Device & usage — device identifiers, push tokens, app version, crash reports, and basic analytics used to operate the app.
We do not collect identity documents. If you buy crypto with a card, the provider named in section 4 collects those directly and we do not receive them.
2. Legal bases
Where the GDPR or a similar law applies: we process your account, wallet, and activity data to perform our contract with you; screening records and retained financial records to comply with legal obligations; and security, abuse detection, and product analytics under our legitimate interests in running a safe service. Where we rely on consent — push notifications, a public username — you can withdraw it at any time.
3. How we use it
To operate the service, authenticate you, send transactional email such as login codes, provide support, detect abuse, meet sanctions obligations, and bill you. We do not sell your personal data, do not use it for third-party advertising, and do not make automated decisions producing legal effects about you.
4. Who we share it with
Only with providers needed to run Holdra:
- Privy — wallet infrastructure. Holds your account link and the secure environment your key lives in.
- MoonPay — card purchases and sales. They perform their own identity checks and are a separate controller for that data.
- 0x — swap routing. Receives your wallet address to price a swap.
- Blockchain node and data providers — receive your wallet address when we read balances or submit a transaction.
- The exchange (Hyperliquid) — receives your address and orders when a strategy is enabled.
- Stripe — subscription payments. Card details go to Stripe, never to us.
- Hetzner, Cloudflare — hosting, website, and DNS.
- Resend — transactional email.
- Google Firebase — app distribution, push notifications, crash reporting.
We may also disclose data where legally required.
5. Where data is stored
Our primary infrastructure is in Singapore. The providers above may process data in other countries, including the United States. Where required, transfers rely on appropriate safeguards such as standard contractual clauses.
6. Retention
We keep account and activity records while your account is active, and afterwards only as long as needed for legal, accounting, security, or dispute-resolution purposes. Sanctions screening records are kept because we are required to be able to show the check happened.
7. What deletion can and cannot reach
You can delete your account in the app at any time. When you do:
- Your account is anonymised: the email is replaced, the wallet link is removed, and nobody can sign in as you again. Sessions, wallet links, recurring plans, and pending order records are deleted outright.
- Our financial and audit records — what we charged, and what the system decided — survive, no longer attached to an identifiable person. We are required to keep them, and an audit log that can be erased is not an audit log.
- Anything already on a blockchain stays there permanently. Your wallet address and every transaction made with it are public, replicated worldwide, and outside anyone's control. Deleting your Holdra account does not remove them, and no request to us can. Where a wallet address is personal data about you, this is an absolute technical limit on the right to erasure — please take it into account before you transact.
- Deleting your Holdra account does not delete your wallet. The assets remain yours; keep your sign-in and recovery method if you still hold funds.
8. Your rights
Depending on where you live, you may request access to, correction of, export of, or deletion of your personal data, object to or restrict certain processing, and complain to your data protection authority. Write to privacy@holdra.ai; we answer within one month.
9. Children
Holdra is not directed at anyone under 18, and we do not knowingly collect their data.
10. Changes
We may update this policy; material changes will be notified in the app or by email.