Privacy Policy

The data controller responsible for processing your personal data in connection with the Stakao platform is:

We collect only the data necessary to provide and improve the Service:

• -Account Data: Email address, used for authentication via Supabase and for important service notifications.
• -Wallet Addresses: Your public SS58 Bittensor wallet address(es). We never collect, store, or request your private keys or seed phrases.
• -Strategy Configuration: Your staking preferences, subnet allocations, and strategy settings stored to enable automated execution.
• -Billing Data: Subscription status and billing history. Payment card data is processed exclusively by Stripe and is never stored on our systems.
• -Blockchain Data: On-chain transaction history and staking positions associated with your wallet address. This data is publicly visible on the Bittensor network.
• -Usage Data: Anonymized technical logs (IP addresses, browser type, pages visited) used for security monitoring and platform improvement.

We use your personal data exclusively for the following purposes:

• -Providing, operating, and improving the Stakao platform.
• -Executing and monitoring your staking strategies on the Bittensor network.
• -Processing subscription payments and managing your account.
• -Sending service notifications (strategy alerts, billing receipts, important policy updates).
• -Responding to support requests.
• -Detecting and preventing fraud, abuse, and security incidents.
• -Complying with applicable legal obligations.

We do not use your data for targeted advertising, profiling for commercial purposes, or selling to third parties.

We process your personal data under the following legal bases pursuant to Article 6 of the GDPR:

• -Article 6(1)(b) — Contract: Processing necessary for the performance of our contract with you (providing the Service, executing strategies, managing your account).
• -Article 6(1)(f) — Legitimate Interest: Security monitoring, fraud prevention, platform analytics, and service improvement, where these do not override your fundamental rights.
• -Article 6(1)(c) — Legal Obligation: Compliance with applicable French and EU law, including financial record-keeping obligations.
• -Article 6(1)(a) — Consent: For any optional communications (e.g., product updates or newsletters), where you have explicitly opted in.

We do not sell your personal data. We share data only with the following sub-processors as necessary to provide the Service:

• -Stripe: Payment processing. Processes billing data on our behalf under Stripe's own privacy policy.
• -Supabase: Database and authentication infrastructure, hosted within the European Union.
• -Cloudflare: Frontend hosting, CDN and DDoS protection. May process IP addresses and request metadata.
• -Railway: Backend infrastructure hosting.
• -Chutes.ai: AI language model provider powering the autonomous staking agents. Portfolio data and market signals may be processed via the Chutes.ai API to generate staking recommendations. No personal identifiers are transmitted.
• -Bittensor Network: Staking transactions are broadcast to the public Bittensor blockchain and are permanently visible on-chain.
• -TaoStats (taostats.io): Bittensor network data API providing subnet metrics, validator rankings, emissions, and TAO price. Your wallet address may be queried to retrieve staking balances and history.

Some of our sub-processors may transfer data outside the European Economic Area (EEA). Where such transfers occur, we ensure appropriate safeguards are in place, including:

• -Standard Contractual Clauses (SCCs) approved by the European Commission.
• -Adequacy decisions where applicable.

Please note that transactions broadcast to the Bittensor blockchain are processed by a globally decentralized network. We have no control over geographic data processing in this context, as it is inherent to the nature of public blockchain technology.

We implement appropriate technical and organizational measures to protect your personal data:

• -All data in transit is encrypted via HTTPS/TLS.
• -Database access is protected by Row Level Security (RLS) via Supabase, ensuring you can only access your own data.
• -We never store, transmit, or request your private keys or seed phrases at any point.
• -The non-custodial architecture means your funds remain in your wallet at all times; Stakao only holds a limited staking proxy.

Despite these measures, no system is completely secure. In the event of a data breach affecting your rights, we will notify you and the relevant supervisory authority as required by law.

We retain your personal data only for as long as necessary:

• -Account Data: Retained for the duration of your account plus 3 years after closure, to fulfill legal and contractual obligations.
• -Billing Records: Retained for 10 years from the date of transaction, as required by French fiscal law.
• -Usage Analytics: Anonymized logs retained for up to 26 months, after which they are permanently deleted or further anonymized.
• -On-Chain Data: Blockchain transactions are immutable and permanently recorded on the Bittensor network. This data cannot be deleted by Altion Labs.

Under the GDPR and the French Data Protection Act (Loi Informatique et Libertés), you have the following rights with respect to your personal data:

• -Right of Access (Art. 15): You may request a copy of the personal data we hold about you.
• -Right to Rectification (Art. 16): You may request correction of inaccurate or incomplete data.
• -Right to Erasure (Art. 17): You may request deletion of your personal data, subject to legal retention obligations. Note that on-chain blockchain data cannot be erased.
• -Right to Data Portability (Art. 20): You may request your data in a structured, machine-readable format.
• -Right to Object (Art. 21): You may object to processing based on legitimate interests at any time.
• -Right to Restriction (Art. 18): You may request that we restrict processing of your data in certain circumstances.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

Stakao uses only strictly necessary cookies required for the platform to function. We do not use tracking, advertising, or analytics cookies.

• -Authentication Cookies: Used by Supabase to maintain your login session. These are essential and cannot be disabled without preventing access to the platform.
• -Session Cookies: Temporary cookies that expire when you close your browser, used to maintain application state.

No third-party tracking, advertising, or profiling cookies are used. We do not use Google Analytics or similar services.

The Stakao platform is intended exclusively for users who are 18 years of age or older. We do not knowingly collect personal data from minors. If we become aware that we have inadvertently collected data from a person under 18, we will promptly delete that data and terminate the associated account.

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. When we make material changes, we will notify you by email at your registered address and update the "Last updated" date below. Continued use of the Service after the effective date of changes constitutes acceptance of the updated policy.

For any privacy-related inquiries, data subject requests, or complaints, please contact:

If you believe your rights have not been upheld, you have the right to lodge a complaint with the French data protection authority: