DeFi Research Data Services is operated by Northern Vector Systems, which is
the controller of the personal data described here except where it processes
data on an organization’s behalf (section 7). Questions and requests go to
privacy@dfrds.com.
[REVIEW: controller's legal name and address; whether a data protection
officer or an EU/UK representative must be named.]
1. What we collect
Account data. Your name, email address, password (stored only as a
bcrypt hash), whether two-factor authentication is on (the secret is stored
encrypted; recovery codes are stored as hashes), the Google account
identifier if you sign in with Google, the organizations you belong to and
your role in each, the version of the terms you accepted and when.
Your work. Research projects, pages, blocks and their version history,
comments, annotations, value notes, saved transactions, citations, saved
queries, watchlists, alerts, classroom assignments, data requests and the
exports they produce. This is the content of the service; we store it because
you asked us to.
Usage and security data. The pages you request and when, the IP address
and browser user agent of each request (in server logs), sign-ins, sign-outs
and failed sign-in attempts, password resets, API key use per day, data
exports and downloads, and changes to an organization’s membership. These are
written to an audit log that your organization’s admins can read (see
Your data). The audit log never contains a password:
a failed sign-in records the address tried, and nothing else about the
attempt.
Billing data. Plans are paid through Stripe. Stripe holds the card
details; we hold your organization’s Stripe customer and subscription
identifiers, the plan, the renewal date and the billing events Stripe sends
us (payment succeeded, payment failed, subscription changed). We never see a
full card number.
Support and security correspondence. Emails you send to support@dfrds.com,
privacy@dfrds.com or security@dfrds.com, and our replies.
We do not collect data from other sources about you, and we do not buy or sell
personal data.
2. Why we process it
| Purpose | Data | Legal basis [REVIEW: bases per jurisdiction] |
|---|---|---|
| Running the service you signed up for | Account data, your work, billing data | Performance of the contract |
| Keeping accounts and organizations secure | Usage and security data, audit log | Legitimate interest in security; contract |
| Billing and tax records | Billing data | Contract; legal obligation |
| Telling you about changes to the service, the terms or your account | Account data | Contract; legitimate interest |
| Improving the platform from aggregate usage | Usage data, aggregated | Legitimate interest |
| Answering support and legal requests | Correspondence | Legitimate interest; legal obligation |
We do not use your data for advertising, and we do not profile you.
3. Who sees it
Your organization’s admins see the names, emails, roles and join dates of
members, each member’s data-export count over the last 30 days, and the
organization’s audit log, which includes members’ sign-ins, exports and API
key use.
People you share with. Work in a shared research space is visible to the
space’s members. A published page is public. A guest review link shows one
page to whoever holds the link until it expires.
Our staff see account data and the audit log when running the platform.
Staff may open an account “as” its holder to investigate a support problem;
the session is time-limited, recorded in the audit log, and announced to the
account holder by email.
Sub-processors. Services that host or process data for us, listed with
their location and purpose at /legal/sub-processors.
Each is bound by a contract that limits its use of your data to providing
its service to us.
Authorities. When the law requires it, and after checking the request is
valid. We tell you unless we are prohibited from doing so.
4. How long we keep it
Retention follows the plan that covers you, so a paid organization keeps a
longer window than a free one. The numbers below are the plan limits named
in the plans guide; the Free plan’s values are given as the
default.
| Data | Kept for |
|---|---|
| Account data | Until you delete the account, then removed at once (section 5) |
| Research you discard | The plan’s trash_retention_days (Free: 30 days), then purged by a nightly job |
| Page version history | The plan’s version_history_days (Free: 30 days), then purged nightly |
| Data exports and account exports on S3 | 7 days from completion, then purged nightly |
| Audit log | 2 years, then deleted [REVIEW: audit retention] |
| Billing records and invoices | The period tax law requires, typically 7 years [REVIEW] |
| Database backups | 30 days; a deleted account persists in backups until they age out |
| Server logs (IP, user agent, URL) | 30 days [REVIEW] |
| Support correspondence | 2 years after the thread closes [REVIEW] |
5. Deleting your account
You can delete your account from the account page. What happens is described
in Your data and summarised here.
Deleted at once: your profile, credentials and second factor; your
notifications, alerts, saved queries and watchlists; your data requests and
their export files; your personal organization and its API keys; your
memberships of every organization and space; and research projects you
created in your personal space, with their pages, versions and comments.
Retained: work you created in a space you share stays with the space,
attributed to a deleted user, because your colleagues’ pages may cite it.
Billing records for organizations you administered stay for as long as tax law
requires. Audit log rows stay for their retention period with the actor
recorded as a deleted account, because the log exists to be complete.
If you administer a shared organization you must hand it to another admin
before you can delete your account.
6. Your rights
Depending on where you live you may have the right to access, correct,
export, delete or restrict the use of your personal data, to object to
processing based on legitimate interest, and to complain to a supervisory
authority. [REVIEW: name the authority and the right-to-lodge wording per
jurisdiction.]
You can exercise most of these yourself: edit your profile on the account
page, request an export of everything you own (a zip, emailed within minutes),
and delete the account. For anything else, or if you cannot sign in, write to
privacy@dfrds.com from the address on the account and we answer within 30
days.
7. When we act for your organization
A university or research desk that manages members through the platform is
the controller of its members’ personal data, and we process it on its
instructions under the data processing addendum. If you are a
member of such an organization and have a question about how it uses your
data, ask its admins first; we help them answer.
8. International transfers
The platform is hosted on Amazon Web Services in [REVIEW: region]. Some
sub-processors are in the United States. Where data leaves the jurisdiction it
was collected in, we rely on [REVIEW: standard contractual clauses, the UK
addendum, adequacy decisions or the Data Privacy Framework, as applicable],
and the sub-processor list names the mechanism per provider.
9. Cookies
The platform sets a session cookie and, if you ask, a remember-me cookie. If
you allow it in the banner, it also sets Google Analytics cookies, which count
visits and show which pages are read; without your consent Google Analytics
receives only cookieless page-view signals. There is no advertising tracking.
The cookie notice has the details, and Cookie settings at
the foot of every page changes your answer.
10. Children
The platform is for adults and for students of institutions that have
accepted our terms. We do not knowingly hold data about anyone under 16
[REVIEW: threshold]; tell us at privacy@dfrds.com if you believe we do and
we remove it.
11. Changes
This policy is versioned. We email account holders about changes that affect
what we collect or why at least 14 days before they take effect, and the
previous version is available on request.