Privacy Policy

1. INTRODUCTION

Orion Financial Intelligence Inc. operates the Orion platform, an onchain vault and portfolio management product. This Privacy Policy applies to both our marketing website and our decentralized application (dApp).

Authentication is wallet-based (SIWE). We do not collect traditional account fields such as email, password, phone number, or legal name in our core user records.

2. INFORMATION WE COLLECT

2.1. Information you provide.

• Wallet address and blockchain network when you connect and authenticate via SIWE.
• Cryptographic signature to prove wallet ownership. We verify the signature; we never receive or store your private keys.
• Terms of Service acceptance, including the version accepted and timestamp. We may record your IP address and browser user agent for compliance records.

2.2. Information collected automatically.

• Session data while you are logged in: internal user ID, linked wallet(s), IP address, user agent, and session timestamps.
• Security logs for authentication events, fraud prevention, and service reliability. We limit sensitive identifiers in security logging where feasible.
• API usage necessary to display vaults, portfolio balances, transaction history, and performance analytics.
• Error monitoring data on the dApp (e.g., error reports, browser type, hashed wallet identifier, chain ID, and wallet connector type).
• Compliance screening data on the dApp: we use your IP address to determine your approximate country (and, for Ukraine, region) so that we can enforce the geographic restrictions in our Terms of Service. When you connect a wallet or take certain actions, we send the wallet address to our sanctions-screening provider, CompliAPI, to check it against global sanctions lists (including OFAC, EU, UK, and other official sources they maintain). If a check indicates a restricted location or a sanctioned address, access to the dApp may be blocked automatically. We cache screening outcomes briefly in our systems to limit repeat lookups; we do not maintain a long-term record of screening results.
• Website analytics on our marketing site when Google Analytics is enabled (see Section 4).

2.3. Information from public blockchains. If you interact with Orion smart contracts, your transactions (including wallet address, amounts, and transaction hashes) are public on the blockchain. We index this public data through third-party indexing services to power the application. We cannot delete onchain records.

2.4. Pre-login indexing. We may create internal user records when indexing public onchain activity associated with a wallet address, including before you log in or accept our Terms of Service. This allows us to display portfolio and vault data derived from public chain events.

2.5. Optional profile information. Vault managers may have a display name, description, or icon URL associated with their wallet address. Administrators may set vault display labels.

2.6. Derived analytics. We compute and store portfolio performance metrics (such as daily equity, profit and loss, and returns) derived from indexed onchain activity.

2.7. What we do not intentionally collect. Through the Orion platform described in this policy, we do not intentionally collect email addresses, postal addresses, government identification, payment card data, biometrics, or social media profiles.

3. HOW WE USE INFORMATION

We use the information described above to:

• Authenticate you and maintain secure sessions
• Provide portfolio, vault, and protocol features
• Enforce our Terms of Service and role-based access controls
• Compute and display performance analytics in the application
• Protect against fraud, abuse, and security incidents
• Operate and improve our website and application
• Screen wallet addresses against sanctions lists and enforce geographic access restrictions
• Comply with legal obligations

4. COOKIES, LOCAL STORAGE, AND SIMILAR TECHNOLOGIES

4.1. Marketing website (orionfinance.ai).

• Google Analytics: When enabled, we use Google Analytics 4 with IP anonymization and without persistent client-side storage cookies for analytics.
• Session storage: We use browser session storage for UI preferences (such as dismissing site banners).
• We do not use cookies for wallet authentication on the marketing site.

4.2. Application (app.orionfinance.ai).

• Local storage: After SIWE login, access and refresh tokens and your authenticated wallet address are stored in your browser's local storage. Our backend does not use httpOnly cookies for session management.
• Session storage: We use session storage for UI state (such as whether you have seen the loading intro).
• Session lifetimes: Access tokens expire after approximately 15 minutes; refresh tokens expire after up to 7 days (server-side).

4.3. Wallet extensions. Wallet providers (such as MetaMask) operate independently and may use their own cookies, local storage, or telemetry. Their practices are governed by their own privacy policies.

4.4. Security note. Because session tokens are stored in browser local storage rather than httpOnly cookies, a compromise of your browser (for example, through cross-site scripting) could allow unauthorized access to your session. We use short-lived access tokens and other safeguards to reduce this risk, but no method is completely secure.

5. WHERE WE STORE INFORMATION

Data is processed on servers operated by us and our infrastructure providers, primarily in the United States.

• Short-lived authentication data (such as login sessions and one-time verification values)
• Application databases for accounts, wallets, terms acceptance records, indexed onchain activity, and derived analytics
• Operational logs for security monitoring, troubleshooting, and service operation

6. SHARING AND SUBPROCESSORS

We do not sell your personal information. We share data only in the following circumstances:

• Service providers that host or operate our infrastructure, under contractual safeguards - including Amazon Web Services and Vercel (application hosting and edge network, which also provides the approximate location derived from your IP address)
• CompliAPI (real-time sanctions screening of wallet addresses we transmit for list matching; governed by CompliAPI's privacy notice and terms)
• Google Analytics (marketing site analytics, when enabled)
• Sentry (error monitoring on the dApp)
• Reown / WalletConnect (wallet connection infrastructure and related analytics)
• The Graph and blockchain RPC providers (reading and indexing public blockchain data)
• Public blockchains, when you choose to transact onchain
• When required by law or to protect rights, safety, and security

Wallet providers are controlled by you, not by Orion. Our Services may link to third-party sites; we are not responsible for their privacy practices.

7. PUBLIC BLOCKCHAINS

Blockchain transactions are publicly visible and permanent. Deposits, withdrawals, wallet activity, and transaction hashes recorded onchain exist outside Orion's control. We index this public data to provide the Services, but we cannot erase, modify, or restrict access to data that exists on a public blockchain.

8. INTERNATIONAL TRANSFERS

Your information may be processed and stored in the United States. If you access the Services from outside the United States, you acknowledge that your information may be transferred to, stored in, and processed in the United States, where data protection laws may differ from those in your jurisdiction. If you are located in Europe, see Section 14 for the safeguards we rely on.

9. RETENTION

• Authentication and session data: typically from a few minutes up to 7 days, depending on the data type
• Account and indexed activity data: retained until you ask us to delete or anonymize it (see Section 10), subject to what we must keep for legal, security, and operational purposes
• Security and operational logs: retained for a limited period consistent with our operational and legal needs
• Onchain data: permanent

10. YOUR RIGHTS AND CHOICES

Depending on your location, you may have rights to access, correct, delete, restrict, or port your personal data, or to object to certain processing. Because blockchain transactions are public and immutable, we cannot erase data that exists onchain. If you are located in Europe, see also Section 14.

10.1. Manual privacy requests (DSAR). We do not currently offer a self-service data-export or account deletion portal. To exercise your privacy rights relating to data we control in our databases, email legal@orionfinance.ai with a subject line indicating a privacy or data request. Please describe the right you wish to exercise (for example, access, correction, deletion, portability, restriction, or objection).

• Verification: We may require proof of wallet ownership (such as a signed message from the wallet associated with your account) before fulfilling a request.
• Response: We will acknowledge your request promptly and respond within the timeframe required by applicable law, where a statutory deadline applies.
• Deletion: Where feasible, we can delete or anonymize data in our databases upon verified request. Public blockchain data and data we are required to retain for legal or security purposes may be excluded.

10.2. What we can provide today.

• Access: Much of your portfolio and account information is available in the App while you are logged in. A full export of all data we hold may require a manual request.
• Correction: Wallet addresses are cryptographic identifiers and generally cannot be changed. Manager and vault display names are controlled by administrators, not self-service editing.
• Portability: onchain transaction history is already public. App-derived metrics stored in our databases may be provided on request where technically feasible.

10.3. Self-service options. You may log out to invalidate your current server session. You can disconnect your wallet at any time in your wallet extension.

11. SECURITY

We use industry-standard measures including encryption in transit, access controls, rate limiting, and security monitoring. No method of transmission or electronic storage is 100% secure. We cannot guarantee absolute security.

12. CHILDREN

Our Services are not directed to individuals under 18 years of age. We do not knowingly collect personal information from children.

13. CHANGES TO THIS POLICY

We may update this Privacy Policy from time to time. We will post the revised policy with an updated "Last Updated" date. Where required by law, we may notify you or request renewed acceptance of updated terms. Your continued use of the Services after changes constitutes acceptance of the updated policy where permitted by law.

14. ADDITIONAL INFORMATION FOR EUROPEAN USERS

This Section applies if you are located in the European Economic Area, the United Kingdom, or Switzerland ("Europe"), and supplements the rest of this Privacy Policy.

14.1. Controller. Orion Financial Intelligence Inc., 300 Creek View Road, Suite 209, Newark, Delaware 19711, United States, is the controller of the personal data described in this Privacy Policy. You can reach us at legal@orionfinance.ai.

14.2. Legal bases for processing. We rely on the following legal bases under the GDPR and UK GDPR:

• Contract: to authenticate you, maintain your session, and provide portfolio, vault, and protocol features, including the wallet address, signature, session data, indexed onchain activity, and derived analytics described above.
• Legitimate interests: to keep the Services secure and prevent fraud and abuse (security logs and error monitoring), to keep records of your acceptance of our Terms of Service, and to operate and improve the Services. We balance these interests against your rights and freedoms.
• Legal obligation and legitimate interests: to screen wallet addresses against sanctions lists and enforce geographic access restrictions, and to comply with other legal requirements.

14.3. Automated decisions. Access to the dApp may be blocked automatically if our checks indicate a restricted location or a sanctioned wallet address. We do not otherwise make decisions about you based solely on automated processing. If you believe you were blocked by mistake, email legal@orionfinance.ai and a person will review your case. You may also express your point of view and contest the decision.

14.4. Your rights. You have the right to access your personal data, to have inaccurate data corrected, to have it erased, to restrict or object to its processing (including processing based on our legitimate interests), and to receive a portable copy of data you provided. Where we rely on your consent, you may withdraw it at any time. To exercise a right, follow the process in Section 10. We will respond within one month, which may be extended where the law allows. Data recorded on a public blockchain cannot be erased by us (see Section 7).

14.5. Complaints. You have the right to lodge a complaint with the data protection authority in the country where you live or work, or where you believe a violation occurred. We would appreciate the chance to address your concern first.

14.6. International transfers. We are based in the United States. Where we share personal data with service providers outside Europe (see Section 6), we rely on the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions) where the provider is certified, and otherwise on the European Commission's Standard Contractual Clauses and, for the United Kingdom, the UK International Data Transfer Addendum. You can request information about these safeguards at legal@orionfinance.ai.

14.7. Retention. See Section 9. We keep account and indexed activity data until you ask us to delete or anonymize it, subject to what we must keep for legal, security, and operational purposes.

15. CONTACT INFORMATION

For questions about this Privacy Policy, or to submit a privacy or data-access request, contact:

Orion Financial Intelligence Inc.
300 Creek View Road, Suite 209
Newark, Delaware 19711, United States

Email: legal@orionfinance.ai