Privacy Policy

Yield Sniper, Inc. is the data controller for the personal data described in this policy. We decide what is collected and why. Lotvs is our product.

The company is incorporated in Delaware, United States, and is operated from Poland. Because our establishment is in the European Union, the General Data Protection Regulation (GDPR) governs how we handle your data, wherever you use Lotvs from. This policy is written around the GDPR, which sets the standard we apply to everyone.

Where you live may give you further rights under its own data protection law, for example Mexico’s LFPDPPP. Those rights are in addition to the ones below, never instead of them.

Controller

Yield Sniper, Inc.

Address

131 Continental Dr, Suite 305, Newark, DE 19713, USA

Privacy contact

legal@ysniper.com

Representative

Marcus Gomes

We have not appointed a Data Protection Officer. We answer privacy requests sent to the address above, and the company’s representative handles them.

Lotvs is designed to know as little about you as possible. We identify you by your wallet address, not by your name. We do not keep identity documents (our partners run those checks), and we never ask for your seed phrase or password.

What we do keep on our servers is your wallet address, the email you signed in with if you used Google, and a record of what you did in the app: your conversions, top ups, transfers, bank transfers, Earn movements and recurring orders, the requests an AI agent you connect makes and how they ended, a daily snapshot of what your account holds, technical error logs, when you sign in and how often, and, only if you accept analytics, how many minutes you spend in the app. There are two things worth knowing up front, and both are explained in detail below: if you connect an AI agent, what it reads about your account is shared with that agent and its provider (see AI agents), and everything you do on the blockchain is public forever, by design (see blockchain data is public and permanent).

We never sell your data, to anyone. We never use it to train AI models, and we never hand it to anyone else to train theirs. We do not share it for advertising. Lotvs contains no advertising code and no session recorder. It can count visits with Google Analytics, but only if you agree first: the measurement code is not loaded at all until you say yes, and it never sees your wallet address, your balance or what you hold. Once you are signed in, it is given a pseudonymous number that our server makes from your account with a secret key, so your visits on a phone and on a computer count as one person. The number cannot be turned back into your account. Your answer applies to every lotvs.ai site: the app, the documentation, Lotvs Pay and Cards.

Your wallet address. A public blockchain address such as 7xKX…9fQm. This is how we recognise you. It is pseudonymous: on its own it does not name you, but it is permanently linked to everything that address has ever done on the blockchain.

Your conversion history. For every conversion you make through Lotvs we store the wallet address, the transaction signature, which assets went in and out, the amounts, the fee applied if any, the status, and the time. We use this to show you your activity and to keep our own records.

Your recurring orders. If you set up a recurring order, we store its configuration: the assets, the amount per order, how many orders, how often, how many have run, the status and the timestamps. We need this to keep the schedule running.

Your email address, if you sign in with Google. We read it from the signed token issued at sign in and store it with your wallet address, to recognise your account, to show you the features offered to you, to run the invite programme and to contact you about your account.

Your top ups, transfers and Earn movements. For each one we store the wallet address, the amount, the asset, the status, the time and the transaction signature, so the app can show your activity and work out any fee.

Your card top ups, if you make one. Our card top up screens ask, on Stripe’s behalf, for what Stripe needs to sell to you: your phone number, name, home address, date of birth and, where Stripe asks for them, identity numbers and a photo of your ID. These go from your browser to Stripe, and we do not keep them. While you type your home address, what you type passes through our server to Google so it can suggest addresses; our server neither keeps nor logs it. We keep Stripe’s references for you and for each purchase, the sign-in tokens Stripegives us so you are not asked to sign in again (stored encrypted), and the record of each purchase. If a step fails, our server is told which step and Stripe’s code for the failure, never what you typed.

Your account details and bank transfers, if you open them. Bank transfers run through our partner Bridge. When you start, the legal name you type and your Google email are passed to Bridge to begin its verification; we do not keep them. We store Bridge’s references for you and your accounts, whether you were approved, and for each deposit the amount, the fee, the sender’s name and the status. For a bank account you save for withdrawals we keep only the bank’s name and the last four digits, and for each withdrawal the amount, the fee and its status. Account numbers and IBANs go straight to Bridge and are never stored by us.

A daily snapshot of your account. Once a day we record what your wallet holds and its total value, to draw your performance over time and to check the conditions of the invite programme.

Your AI agent, if you connect one. We store the name you gave the connection, which AI product it reported itself to be, what you allowed it to do, and the country you were in when you approved it. For each request the agent makes we store what it asked for (a payment or a conversion), the amount, the recipient or the asset, the note and the reason it gave, whether you approved, declined or let it expire, and the transaction you signed if you approved it. If you were invited to test an agent account, we also keep a log of every payment and conversion made from it. See AI agents.

Messages to the earlier in-app assistant. Lotvs used to include a built-in assistant. It has been removed and nothing new is collected. Messages sent to it before are still kept; see how long we keep it.

Invites. If you invite someone or were invited, we store who invited whom, when, how the invite is going, and the transaction that paid the reward. We also keep a keyed hash of the IP address of each sign in, used only to spot people inviting themselves; it cannot be turned back into your address. The person who invited you sees only the first letter and domain of your email and how the invite is going, never your balance. If you invite others, they see the first name from your Google account, which you can change.

Your mobile number, if you claim a reward. To receive an invite reward you confirm a mobile number with a code sent by SMS through Prelude, which sends and checks the code for us and, to stop SMS fraud, also sees the IP address and browser of the request. We do not store the number: we keep a keyed hash of it, to make sure one number is used by one account, and its last four digits, to show you which number you verified.

Technical error logs. When something breaks, such as a failed recurring order or a network error, we log what happened: the error message and stack trace, and where relevant the wallet address and transaction signature involved.

Ordinary server logs. Our hosting provider records standard request information, including IP addresses, for security and reliability. We do not use it to build a profile of you. We also read the country, and in the United States the state, your connection comes from, to apply the country rules in our Terms and to show you what is offered where you are. We store it only where this policy says so: for an AI agent you approve, and to pick the currency of an invite reward.

To be explicit about what does not exist on our servers:

• No identity documents. No passport, ID card, driving licence, selfie, proof of address or tax number. We run no identity checks of our own. Identity checks happen with our partners: Stripe when you top up with a card, and Bridge (through Persona) when you open account details. Those providers keep the data; we only learn whether you were approved.
• No seed phrase or password for your account. We never ask you for them, and nobody from Lotvs ever will.
• No date of birth, home address or identity numbers. When our card top up screens ask for them, they go to Stripe and we do not keep them. Bridge may ask for them in its own verification. A mobile number is asked for only if you claim an invite reward, and we keep a keyed hash of it and its last four digits, not the number.
• No payment card details or bank account numbers. Card details go to Stripe, and bank account numbers go straight to Bridge.
• No advertising or behavioural tracking data. There is no advertising pixel and no session recorder. Visit counting through Google Analytics runs only with your agreement, and is never used for advertising.

Under the GDPR we need a lawful reason to process your data. Here is each purpose and the basis we rely on.

Where we rely on legitimate interests, we have considered your rights and interests and concluded that this processing is limited and expected. You can object at any time; see your rights.

What you should know before you connect one:

• The agent reads your account so it can tell you about it and ask you to approve a payment or a conversion. Nothing it asks for happens until you approve it.
• We keep a record of every request the agent makes, linked to your wallet address, so you can review it in the app.
• We do not control what the agent’s provider keeps or how long it keeps it, or what else you tell the agent in your conversations with it.
• Connecting an agent is optional. You can disconnect it at any time, and it stops receiving anything from us straight away.

We do not use what your agent reads or asks, or anything else about you, to train AI models. What the provider of your agent does with the conversations you have with it is set by that provider’s own terms, which are worth reading.

We never sell your data, we never share it for advertising, and we never give it to anyone to train AI models. We do share it with the providers below, because the product cannot work without them. Each acts under its own privacy policy, and several are independent controllers rather than our processors.

We may share information about your account and activity with our payment partners, Stripe and Bridge, when they need it for their own fraud or anti-money laundering checks. We may also disclose data if the law requires it, including to report to the authorities, if we need to respond to a valid legal order, or to establish or defend a legal claim. If our business is ever sold or merged, data may transfer to the buyer, and this policy would continue to apply until the buyer gives you notice of any change.

This one is important and it is different from everything else in this policy. Every transaction you make (every conversion, every transfer, the amounts, the timing and the addresses involved) is written to the Solana public ledger. Anyone in the world can read it, copy it and keep it.

This cannot be undone. No one, including us, can edit, hide or delete a confirmed blockchain transaction. That is how the network works.

This has a real consequence for your privacy rights: we can delete what is in our database, but we cannot delete anything from the blockchain. If your wallet address ever becomes linked to your identity, for example through an exchange, a card top-up provider, or because you shared it, your whole on-chain history can be linked to you as well.

We are a Delaware company operated from Poland, and our providers are in several countries, mainly the United States. So your data will be transferred outside the European Economic Area.

For those transfers we rely on the European Commission’s Standard Contractual Clauses, or on an adequacy decision where one covers the provider, and we assess whether additional safeguards are needed. For customers outside the EEA, we also follow the transfer rules of their own country’s law where it has them.

You can ask us for details of the safeguards that apply to a particular transfer by writing to legal@ysniper.com.

We keep data only as long as we need it. We have not yet built automatic deletion for most of what we keep, so this is what happens today:

To have your data deleted, write to us at legal@ysniper.com (see your rights). We will delete what we hold about you, or strip your wallet address from it so it can no longer be linked to you, except what the law requires us to keep, and we will tell you what that is. As explained under blockchain data, none of this affects the blockchain, which keeps its own permanent record.

Lotvs sets no advertising trackers. Google Analytics’ own cookies (_ga and one named for our measurement id), used to tell a returning visitor from a new one, are set only if you accept when asked, and never at all in the admin area. Two other cookies: lotvs_analytics keeps your answer to that question for a year, for every lotvs.ai site, so you are asked once; and lotvs_ref, set only when you open someone’s invite link, holds their six letter code so the invite counts when you sign up, and is deleted when you sign in or after 30 days. Decline and none are written; you can change your mind by clearing this site’s data and answering again. What the app otherwise uses is your browser’s local storage, which stays on your device and is never sent to us as a tracking signal. Here is exactly what goes in it.

If you install Lotvs as an app on your phone, a service worker also stores the pages and images you have visited so it can load quickly and work on a poor connection. It never stores balances, transactions or anything from our API.

You can remove all of this at any time by clearing your browser’s site data. Doing so signs you out of the app, but it does not affect what is in your account.

You have rights over your personal data, and we will not charge you or treat you differently for using them.

Under the GDPR (Europe) you can ask for access to your data; correction of it; deletion of it; restriction of how we use it; a copy in a portable format; and you can object to processing based on legitimate interests. Where we rely on consent, you can withdraw it at any time. You also have the right to complain to your national data protection authority. In Poland, where we operate, that is the President of the Personal Data Protection Office (UODO).

We do not sell your personal data and we do not share it for advertising, so there is nothing of that kind for you to opt out of.

If you are outside the EEA and your country’s law gives you similar rights, we will honour them in the same way and within the same timescale. Write to us at the address below.

How to exercise any of these rights: email legal@ysniper.com from the address you use, and tell us your wallet address and what you want. We answer requests sent to that address. Your wallet address is how we find your data, so we cannot act without it. We may ask you to prove you control that wallet, usually by signing a short message with it, because otherwise anyone could request someone else’s data. We will reply within 30 days, and we will tell you if we need longer.

Two honest limits. First, we cannot delete anything from the blockchain. Second, we may need to keep some records to meet a legal obligation or to defend a legal claim, and we will tell you if that is the case.

Lotvs is for adults. It is not intended for anyone under 18, and we do not knowingly collect data from children. If you believe a child has used Lotvs and given us data, write to legal@ysniper.com and we will delete what we hold. Please note that we cannot remove anything already recorded on the blockchain.

The strongest protection here is keeping little: we do not keep identity documents, card details or bank account numbers, and an AI agent you connect can read and ask, but it cannot move money.

On top of that, traffic to Lotvs is encrypted in transit with HTTPS, our database is hosted on managed infrastructure with access restricted to the people who need it, and the credentials we use to reach third-party services are never exposed in the app.

We will not pretend to more than that. We are a small team, we hold no security certification, and we have not had an independent security audit. No service on the internet is perfectly secure. The most important part of your security is in your hands: protect the account you sign in with, keep your device and any seed phrase safe, and check every transaction before you approve it.

We will update this policy as the product changes and as the law develops. The “Last updated” date at the top always shows the current version. If we make a change that materially affects your rights, for example a new category of data or a new recipient, we will give you notice in the app or by other reasonable means before it takes effect.

For any privacy question or request, or to exercise your rights, write to us at the address below; we answer requests sent there. You can also read our Terms of Service.

Email

legal@ysniper.com

Controller

Yield Sniper, Inc.

Address

131 Continental Dr, Suite 305, Newark, DE 19713, USA

Phone

(302) 601-7229