Privacy Policy

Last updated: March 15, 2025 — Your privacy is paramount. This policy explains how BalancerTrade LLC collects, processes, and protects your personal information when you use our DeFi portfolio management platform at balancertrade.com.

Effective: 2025-03-15 | Version 2.4

1. Data Controller & Contact

BalancerTrade LLC (registered address: 350 Fifth Avenue, Suite 3300, New York, NY 10118, United States) is the data controller responsible for your personal data under applicable privacy laws, including the California Consumer Privacy Act (CCPA) and the General Data Protection Regulation (GDPR) where applicable.

For privacy-related inquiries, you may contact our Data Protection Officer at:

2. Information We Collect

We collect information you provide directly, as well as data generated automatically through your use of our platform and services.

2.1 Information You Provide

2.2 Information Collected Automatically

3. Purpose & Legal Basis for Processing

We process your personal data for the following purposes, relying on the legal bases indicated:

4. Data Sharing & Third Parties

We do not sell your personal data. We may share your information with the following categories of third parties, only as necessary for the purposes described in this policy:

All third-party service providers are contractually obligated to process your data only on our instructions and to implement appropriate security measures. We conduct due diligence to ensure compliance with applicable privacy laws.

5. International Data Transfers

As a global platform serving users in the United States and internationally, your personal data may be transferred to and processed in countries outside your country of residence, including the United States. When we transfer data from the European Economic Area (EEA), Switzerland, or the United Kingdom, we rely on:

We ensure that all recipients of your data provide an equivalent level of protection as required by applicable law. By using our services, you acknowledge that your data may be processed in the United States and other jurisdictions where our service providers operate.

6. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes described in this policy, unless a longer retention period is required or permitted by law. Specific retention periods include:

When retention periods expire, your data is securely deleted or anonymized so that it can no longer be associated with you. Blockchain transaction data, once written to a public ledger, cannot be deleted—however, we do not control the blockchain itself.

7. Your Rights & Choices

Depending on your jurisdiction, you may have the following rights regarding your personal data. We will respond to all legitimate requests within the timeframes required by law (typically 30 days, extendable by 60 days for complex requests).

7.1 For All Users

7.2 For California Residents (CCPA)

If you are a California resident, you have the additional right to:

7.3 For EEA/UK Users (GDPR)

In addition to the rights above, you may:

To exercise any of these rights, please submit a request to [email protected] or use our Contact page. We may need to verify your identity before processing your request. You may also designate an authorized agent to make a request on your behalf.

8. Security Measures

We implement industry-standard technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. Our security framework aligns with ISO 27001 and NIST cybersecurity standards.

8.1 Technical Safeguards

8.2 Organizational Safeguards

Despite these measures, no method of transmission or storage is 100% secure. We cannot guarantee absolute security, but we continuously update our practices to address emerging threats. In the event of a data breach that affects your rights and freedoms, we will notify you and the relevant supervisory authority without undue delay.

9. Cookies & Tracking Technologies

Our platform uses cookies and similar tracking technologies to enhance your experience, analyze usage, and deliver relevant content. For a comprehensive description of the cookies we use, their purposes, and how to manage your preferences, please refer to our dedicated Cookie Policy.

In summary, we use the following categories of cookies:

You can manage cookie preferences at any time by clicking the "Cookie Settings" link in the footer or adjusting your browser settings. Disabling certain cookies may affect platform functionality.

10. Children's Privacy

Our services are not directed to individuals under the age of 18 (or the age of majority in your jurisdiction). We do not knowingly collect personal data from minors. If we become aware that a minor has provided us with personal data without verifiable parental consent, we will take steps to delete that information promptly.

If you are a parent or guardian and believe your child has provided us with personal data, please contact us immediately at [email protected] so we can investigate and take appropriate action.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or operational needs. Material changes will be communicated through one or more of the following methods:

We encourage you to review this policy periodically. Your continued use of our services after the effective date of any changes constitutes your acceptance of the updated policy. If you do not agree with the changes, you may close your account and cease using our services.

12. Governing Law & Disputes

This Privacy Policy is governed by and construed in accordance with the laws of the State of New York, United States, without regard to its conflict of law provisions. Any disputes arising out of or related to this policy shall be resolved through binding arbitration in New York County, New York, in accordance with the rules of the American Arbitration Association.

If you have any concerns about our handling of your personal data that cannot be resolved through our internal process, you may contact the relevant data protection authority in your jurisdiction. For users in the European Union, you may lodge a complaint with your local Data Protection Authority. For California residents, you may contact the California Privacy Protection Agency (CPPA).

13. California Privacy Rights (CCPA)

This section applies exclusively to residents of California, USA, as required by the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA). We provide this information to help California residents understand their privacy rights and how we handle their personal information.

13.1 Categories of Personal Information Collected

In the preceding 12 months, we have collected the following categories of personal information from California residents:

We do not collect sensitive personal information (e.g., precise geolocation, biometric data, or health information) for the purpose of inferring characteristics about California consumers.

13.2 Business/Commercial Purpose for Collection

We collect each category of personal information for the following business or commercial purposes:

13.3 Sources of Personal Information

We collect personal information from the following sources:

13.4 Disclosure of Personal Information

In the preceding 12 months, we have disclosed the following categories of personal information for a business purpose:

We do not sell personal information as defined by the CCPA. We do not share personal information for cross-context behavioral advertising without your explicit consent, which you may withdraw at any time through our cookie preferences.

13.5 Your CCPA Rights

California residents have the following rights under the CCPA/CPRA:

13.6 How to Exercise Your CCPA Rights

To exercise your rights under the CCPA, you may submit a verifiable consumer request by:

We will verify your identity by matching the information you provide (e.g., name, email address, account details) with the information we have on file. If we cannot verify your identity, we may ask for additional information. You may designate an authorized agent to make a request on your behalf by providing written authorization signed by you and verifying your identity directly with us. We will respond to verified requests within 45 days (extendable by an additional 45 days with notice).

14. Nevada Privacy Rights

If you are a resident of Nevada, USA, you have the right to opt out of the sale of your personal information under Nevada Revised Statutes Chapter 603A. We do not sell personal information as defined by Nevada law. However, if you wish to submit a request regarding the sale of your data, please contact us at [email protected] with the subject line "Nevada Opt-Out Request." We will respond within 60 days as required by law.

15. Virginia, Colorado, Connecticut & Utah Privacy Rights

Residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), and Utah (UCPA) have additional privacy rights effective as of their respective enforcement dates. These rights include:

To exercise these rights, please use the contact methods listed in Section 13.6 above. We will respond within 45 days (extendable by 45 additional days with notice). For Virginia residents specifically, we will respond within 45 days and may extend once by 45 days if reasonably necessary.

16. European Economic Area & UK Users

This section applies if you are located in the European Economic Area (EEA), Switzerland, or the United Kingdom. BalancerTrade LLC is the data controller for your personal data. Where GDPR or UK GDPR applies, we rely on the following legal bases for processing:

16.1 Your GDPR Rights

In addition to the rights described in Section 7, EEA and UK users have the right to:

16.2 International Transfers

As described in Section 5, we transfer personal data from the EEA/UK to the United States and other countries. We rely on Standard Contractual Clauses (SCCs) as approved by the European Commission and the UK International Data Transfer Agreement (IDTA) for UK transfers. We also participate in the EU-US Data Privacy Framework (DPF) and the Swiss-US DPF where applicable. You may request a copy of the relevant transfer safeguards by contacting [email protected].

17. Data Protection Officer

We have appointed a Data Protection Officer (DPO) who is responsible for overseeing our data protection strategy and ensuring compliance with applicable privacy laws. Our DPO is reachable at:

If you have any questions about this Privacy Policy, wish to exercise your rights, or have a complaint that you would like to escalate, please contact our DPO first. We will endeavor to resolve your concern within 30 days. If we cannot, we will inform you of the reason and the expected timeline for resolution.

18. Specific Provisions for New York Residents

As a company headquartered in New York, we comply with the New York SHIELD Act (Stop Hacks and Improve Electronic Data Security Act). Under this law, we maintain a comprehensive data security program that includes:

New York residents have the right to be notified of a data breach affecting their personal information in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement. We will provide such notification in writing or electronically as required by New York General Business Law § 899-aa.

19. Data Breach Notification Procedures

Despite our comprehensive security measures, data breaches can occur. BalancerTrade has established a formal incident response plan to address any unauthorized access, disclosure, or loss of personal data. Our breach notification process is designed to comply with all applicable state and federal laws, including the New York SHIELD Act, California Civil Code § 1798.82, and the GDPR/UK GDPR breach notification requirements.

19.1 Incident Detection & Assessment

Our security operations center (SOC) monitors systems 24/7 for potential security incidents. When a suspected breach is detected, our incident response team is immediately activated. The team assesses the scope, severity, and nature of the breach, including which categories of personal data are affected and the number of impacted individuals. This assessment is completed within 24 hours of detection.

19.2 Containment & Remediation

Upon confirmation of a breach, we take immediate steps to contain the incident and prevent further unauthorized access. This may include isolating affected systems, revoking compromised credentials, patching vulnerabilities, and engaging external forensic investigators. We work to restore the integrity and security of our systems as quickly as possible.

19.3 Notification Timeline

19.4 Content of Notification

Our breach notifications will include, to the extent possible:

19.5 Cooperation with Authorities

We fully cooperate with law enforcement and regulatory authorities during breach investigations. We maintain logs and records of all incidents for a minimum of 5 years, including the steps taken to investigate, contain, and remediate each incident. Our incident response plan is reviewed and updated at least annually, or after any significant breach, to incorporate lessons learned.

20. Third-Party Services & Links

Our platform may contain links to third-party websites, services, or applications, including blockchain explorers (e.g., Etherscan), DeFi protocols (e.g., Balancer, Uniswap), and social media platforms (e.g., Twitter, Discord, Telegram). This Privacy Policy applies solely to information collected by BalancerTrade. We are not responsible for the privacy practices of third parties, and we encourage you to review their privacy policies before providing any personal data.

When you interact with smart contracts or decentralized applications (dApps) through our interface, your transactions are processed on public blockchain networks. These networks are not controlled by us, and any data you submit to them (including wallet addresses and transaction amounts) is publicly visible and immutable. We cannot control how other parties may use this on-chain data. You should exercise caution and understand the public nature of blockchain transactions before engaging.

We also integrate with third-party service providers for identity verification, analytics, and customer support. These providers are contractually bound to process your data only in accordance with our instructions and to implement appropriate security measures. However, we recommend reviewing their privacy policies for complete transparency. A list of our current key service providers and links to their privacy policies is available upon request via [email protected].

21. Your Choices & Account Management

We believe in giving you control over your data. Here are the choices you have regarding your personal information on our platform:

21.1 Account Settings

You can review and update your account information at any time by logging into your account dashboard. You may update your name, email address, phone number, and communication preferences. For security reasons, changes to certain information (e.g., wallet address, KYC documents) may require additional verification.

21.2 Marketing Communications

You may opt out of receiving promotional emails from us at any time by clicking the "unsubscribe" link in any marketing email or by updating your communication preferences in your account settings. Please note that even if you opt out of marketing communications, we may still send you service-related messages (e.g., transaction confirmations, security alerts, policy updates).

21.3 Cookie Preferences

You can manage your cookie preferences at any time by clicking the "Cookie Settings" link in the footer of our website. You may also adjust your browser settings to block or delete cookies. However, disabling essential cookies may affect the functionality of our platform.

21.4 Account Deletion

You may request deletion of your account and associated personal data by contacting our support team at [email protected] or using the account deletion option in your dashboard. Upon receiving a verified deletion request, we will delete your personal data within 30 days, subject to legal retention obligations (e.g., AML records must be retained for 5 years after account closure). Blockchain transaction data cannot be deleted as it is recorded on public ledgers.

21.5 Data Portability

You may request a copy of your personal data in a structured, commonly used, and machine-readable format (e.g., JSON, CSV). We will provide this data within 30 days of a verified request, free of charge. For additional copies, we may charge a reasonable fee based on administrative costs.

22. Automated Decision-Making & Profiling

BalancerTrade does not engage in automated decision-making that produces legal effects concerning you or similarly significantly affects you, as defined under GDPR Article 22 and similar laws. However, we do use automated systems for the following purposes, which may involve profiling:

If you believe an automated decision has been made that unfairly affects you, you have the right to request human intervention, express your point of view, and contest the decision. Please contact [email protected] with details of your concern, and we will review the decision manually within 14 business days.

23. Data Retention Schedule (Detailed)

This section provides a detailed schedule of our data retention practices, organized by data category. Retention periods are determined based on legal requirements, operational needs, and the purpose for which the data was collected.

23.1 Account & Profile Data

23.2 KYC & Identity Documents

23.3 Transaction Data

23.4 Communication Records

23.5 Analytics & Usage Data

23.6 Security Logs

When retention periods expire, data is securely deleted using industry-standard data destruction methods (e.g., cryptographic erasure, secure overwriting, physical destruction of storage media). We maintain a data retention policy that is reviewed annually by our Data Protection Officer and legal team.

24. Complaints & Dispute Resolution

We are committed to resolving any concerns you may have about our handling of your personal data. Our complaint process is designed to be accessible, transparent, and efficient. Here is how to raise a concern and what you can expect:

24.1 Internal Complaint Process

Step 1: Contact our Privacy Team directly at [email protected] or via our Contact page. Please provide a detailed description of your concern, including any relevant account information and the specific issue you are experiencing. We will acknowledge receipt within 3 business days.

Step 2: Our Privacy Team will investigate your complaint, which may involve consulting with our legal, security, and compliance teams. We will provide a substantive response within 30 days of receipt. If we need additional time due to the complexity of the issue, we will notify you and provide an expected resolution date (not to exceed 60 days total).

Step 3: If you are unsatisfied with our response, you may escalate your complaint to our Data Protection Officer (DPO) at [email protected]. The DPO will review the case independently and provide a final determination within 15 business days.

24.2 External Recourses

If your complaint is not resolved to your satisfaction through our internal process, you have the right to lodge a complaint with the relevant supervisory authority:

We will not retaliate against you for filing a complaint with a regulatory authority. We encourage you to contact us first so we can address your concerns directly and efficiently.

25. Supplementary Information for Specific Jurisdictions

In addition to the rights and protections described elsewhere in this Privacy Policy, the following provisions apply to residents of specific jurisdictions where we operate or have users.

25.1 Canada (PIPEDA)

For users in Canada, your personal information is collected, used, and disclosed in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws. You have the right to access and correct your personal information held by us. We will obtain your consent before collecting or using your information for any new purpose not previously disclosed. Our Privacy Officer can be reached at [email protected]. If you have an unresolved privacy concern, you may file a complaint with the Office of the Privacy Commissioner of Canada (OPC) at priv.gc.ca.

25.2 Australia (Privacy Act 1988)

For users in Australia, we comply with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth). You have the right to access and correct your personal information, and to make a complaint if you believe your privacy has been breached. We will respond to your complaint within 30 days. If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au. Please note that our services are provided from the United States, and your data may be transferred and processed there.

25.3 Brazil (LGPD)

For users in Brazil, we process your personal data in accordance with the Lei Geral de Proteção de Dados Pessoais (LGPD). We have appointed a representative in Brazil for LGPD compliance purposes. You have the rights under LGPD, including confirmation of processing, access, correction, anonymization, blocking, deletion, portability, and revocation of consent. To exercise these rights, contact [email protected]. You may also lodge a complaint with the Autoridade Nacional de Proteção de Dados (ANPD) at gov.br/anpd.

25.4 South Korea (PIPA)

For users in South Korea, we comply with the Personal Information Protection Act (PIPA). We have a domestic representative in South Korea to handle privacy inquiries and data subject requests. You have the right to access, correct, delete, and request suspension of processing of your personal information. We will respond to your request within 10 days. If you are unsatisfied, you may contact the Personal Information Protection Commission (PIPC) at pipc.go.kr.

25.5 Japan (APPI)

For users in Japan, we handle your personal information in accordance with the Act on the Protection of Personal Information (APPI). You have the right to request disclosure, correction, addition, deletion, or suspension of use of your retained personal data. We will respond to your request without undue delay. For inquiries, contact [email protected]. You may also contact the Personal Information Protection Commission (PPC) at ppc.go.jp.

25.6 Singapore (PDPA)

For users in Singapore, we comply with the Personal Data Protection Act (PDPA). You have the right to access and correct your personal data, and to withdraw consent for the collection, use, or disclosure of your data, subject to legal or contractual restrictions. We will respond to your request within 30 days. You may contact our Data Protection Officer at [email protected]. If you have an unresolved complaint, you may contact the Personal Data Protection Commission (PDPC) at pdpc.gov.sg.

26. Data Security Incident Response Plan Summary

Our comprehensive incident response plan is designed to quickly detect, contain, and remediate any security incidents involving personal data. The plan is aligned with the NIST Cybersecurity Framework and ISO 27001 standards. Key components include:

We test our incident response plan at least twice annually through simulated breach exercises. Our security team maintains relationships with external incident response firms, cyber insurance providers, and law enforcement agencies to ensure rapid support when needed.

27. Vendor Due Diligence & Data Processing Agreements

All third-party service providers who process personal data on our behalf undergo a rigorous vendor due diligence process before engagement. This process includes:

We maintain a register of all vendors who process personal data on our behalf, which is reviewed quarterly by our Data Protection Officer. Current key vendors include: Amazon Web Services (cloud infrastructure), Google Cloud (analytics), SendGrid (email delivery), Jumio (identity verification), and Amplitude (product analytics). A complete list of sub-processors is available upon request via [email protected].

28. Contact Information & Data Protection Officer

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please do not hesitate to contact us. We are committed to responding promptly and transparently.

28.1 Primary Contact

28.2 Data Protection Officer (DPO)

28.3 EU/UK Representative

For users in the European Union and the United Kingdom, we have appointed a representative for data protection matters as required by Article 27 of the GDPR and Article 27 of the UK GDPR. Our EU representative is BalancerTrade Europe Ltd, registered in Ireland. For UK-specific matters, our UK representative is BalancerTrade UK Ltd. Both representatives can be contacted at [email protected] or via post at the address provided upon request.

29. Definitions

For the purposes of this Privacy Policy, the following terms have the meanings set forth below:

30. Accessibility of This Policy

We are committed to ensuring that this Privacy Policy is accessible to all users. If you require this policy in an alternative format (e.g., large print, audio, or translated into another language), please contact us at [email protected] and we will provide a suitable version within 14 days. We support the Web Content Accessibility Guidelines (WCAG) 2.1 AA standards across our platform, including this policy page.

31. Effective Date & Version History

This Privacy Policy is effective as of March 15, 2025. It supersedes all previous versions. We maintain a version history of material changes for transparency:

We encourage you to review the current version each time you use our platform. If we make material changes that affect your rights or our use of your data, we will notify you as described in Section 11. Your continued use of our services after the effective date of any changes constitutes your acceptance of the updated policy.

32. Acknowledgment

By using BalancerTrade's platform and services, you acknowledge that you have read and understood this Privacy Policy and agree to the collection, use, and disclosure of your personal data as described herein. If you do not agree with any part of this policy, please discontinue use of our platform and contact us to close your account.

Thank you for trusting BalancerTrade with your personal information. We are committed to protecting your privacy and providing you with a secure, transparent, and innovative DeFi portfolio management experience.

Privacy Policy Summary

BalancerTrade LLC collects personal data including name, email, wallet address, and transaction history to provide DeFi portfolio management services. We use this data for service delivery, compliance with AML/KYC regulations, security, and analytics. We do not sell your personal information. Data is retained as required by law (typically 5-7 years for financial records). Under the CCPA, California residents have the right to know, delete, and opt out of data sharing. For GDPR, EEA users have rights of access, rectification, erasure, and portability. Contact our DPO at [email protected] or write to 350 Fifth Avenue, Suite 3300, New York, NY 10118.

Cookie Policy Summary

BalancerTrade uses essential cookies for platform functionality (session management, authentication), analytics cookies (Google Analytics, Amplitude) to understand usage patterns, and functional cookies to remember your preferences. We do not use marketing cookies without your explicit consent. You can manage cookie preferences via our cookie consent banner or browser settings. Essential cookies cannot be disabled as they are necessary for platform operation. Analytics data is anonymized where possible. For more details, see our full Cookie Policy at /cookie-policy. Contact [email protected] for questions.

Terms of Service Summary

By using BalancerTrade, you agree to these terms. Our platform provides access to DeFi portfolio management tools and liquidity pools. You are responsible for your wallet security and transaction decisions. We do not provide financial advice. All services are provided "as is" without warranties. We may suspend accounts for suspicious activity or policy violations. Users must comply with all applicable laws, including sanctions and AML regulations. BalancerTrade LLC is governed by New York law. Disputes are resolved through binding arbitration in New York County. Fees and conditions are subject to change with notice.

Risk Disclosure Summary

Trading and investing in DeFi protocols, cryptocurrencies, and digital assets involves substantial risk. You may lose all or part of your investment. Past performance does not guarantee future results. Smart contract vulnerabilities, market volatility, liquidity risks, regulatory changes, and technological failures can affect portfolio value. BalancerTrade does not guarantee returns, protection against losses, or the accuracy of analytics. Our platform is for informational and educational purposes only. Always conduct your own research and consult a qualified financial advisor. By using our services, you acknowledge these risks.