← Back to RiskState

Privacy Policy

Version 1.2 — Effective October 14, 2026

1. Introduction

Digital Venture Asset LLC ("Company," "we," "us," or "our") operates the RiskState API and the website at riskstate.ai. This Privacy Policy explains what information we collect, how we use it, and your rights regarding your data.

2. Information We Collect

2.1 Information You Provide

  • Waitlist registration: Email address and use case selection when you request API access
  • App account (app.riskstate.ai): Email address used to sign in with a one-time email link (no password), account creation and last sign-in dates, plan, the 16-character prefix of your API key, and the alert preferences you choose (assets, questions, channel)
  • Early-access requests: If you leave your email on the app before accounts are available to you, we store it together with what you asked to be told about (for example, which Overview answer or feature, and the asset)
  • Account information: Email address associated with your API key
  • Support communications: Any information you provide when contacting us

2.2 Information Collected Through API Usage

  • API request metadata: Timestamp, requested asset (BTC/ETH), IP address, and request headers
  • Wallet addresses: If you provide a wallet address in API requests for DeFi position lookups. We use this solely to query on-chain data from public blockchain explorers. The full address is NOT retained — only a boolean indicator (has_wallet) in the audit log.
  • Audit decision records: Every authenticated /v1/risk-state call generates a record with the policy hash, scoring version, request shape (asset, market type, flags), response summary, and data-source provider tags. This record is the system of record for compliance and post-trade review. Full schema documented at /docs/audit.
  • Policy configuration profiles: If we attach a policy_config profile to your API key (institutional customers only), we store the configured fields you authorised (e.g. desk_id, max_gross, leverage_cap, blocked_protocols, notes). Schema at /docs/policy-config.
  • Usage patterns: Request frequency, error rates, and feature usage for service improvement

2.3 Information We Do NOT Collect

  • Private keys or seed phrases
  • Trading history or portfolio balances (beyond single-request DeFi lookups)
  • Personal identity documents or KYC information
  • Cookies for advertising or cross-site tracking

2.4 Cookies and Analytics

  • Session cookie: When you sign in to the app we set one strictly necessary cookie (rs_session) that keeps you signed in for up to 30 days. It is HttpOnly, signed, and used only by app.riskstate.ai. It contains your account identifier and email, and no tracking data. Signing out deletes it.
  • Analytics: riskstate.ai and the app use Umami, a cookieless analytics tool, to count page views and button clicks (for example, which call-to-action was used). It does not set cookies or build cross-site profiles.

3. How We Use Your Information

  • To provide, maintain, and improve the Service
  • To issue and manage API keys
  • To sign you in to the app and keep your account and alert preferences
  • To send the alert emails you opted into, each with a link to stop them
  • To tell you once when the account or feature you requested through the early-access form becomes available
  • To communicate with you about service updates, security notices, or changes to these terms
  • To monitor for abuse, enforce rate limits, and ensure service integrity
  • To generate aggregate, anonymized usage statistics

We do not sell your personal information. We do not use your data for advertising. We do not share individual API request data with third parties.

4. Data Storage and Security

Waitlist submissions, API key metadata and early-access requests are stored in Netlify Blobs on servers located in the United States. App accounts are stored in a Supabase database in the United States (East), accessible only from our servers. API keys are stored as opaque tokens with the first 16 characters used as a non-sensitive prefix for audit partitioning; the full token is revealed only once at issuance (by email for waitlist keys, on screen for app keys) and is not retrievable thereafter. Sign-in tokens are exchanged for our own session cookie immediately and are never stored in your browser.

Audit decision records are retained for 365 days in the audit-decisions store, after which they are auto-deleted by a daily cleanup process. Operational request logs (errors, latency telemetry, console output) are retained for up to 30 days for incident-response purposes, then deleted. Cached API responses are evicted after 60 seconds.

We implement reasonable administrative, technical, and physical safeguards to protect your information. However, no method of transmission over the Internet is 100% secure. We cannot guarantee absolute security. Confirmed vulnerability reports may be sent to security@likido.xyz under the disclosure policy at /security.

5. Third-Party Services

The Service relies on third-party data providers to function. These providers receive API requests from our servers, not from your device. Third-party providers include:

  • Netlify: Hosting, serverless functions, Blobs persistence (audit log, API key metadata, waitlist and early-access requests)
  • Supabase: Sign-in (one-time email links) and the app account database. Receives your email address and, during sign-in, your IP address and browser user agent.
  • Resend: Transactional email delivery: API key issuance and revocation notices, sign-in links, and the alert emails you opted into. Receives only your email address and the message body.
  • Umami: Cookieless website analytics (page views and clicks; no personal profiles).
  • Alchemy: Blockchain RPC calls for DeFi position data when a wallet address is included in a request.
  • Anthropic: AI analysis on the dashboard (receives anonymised market data only, never user account information).
  • Market data providers: CoinGecko, CoinGlass, Binance, OKX, Kraken, Bybit, CryptoCompare, Coin Metrics, BGeometrics, FRED, Frankfurter, DefiLlama, Lido, Beaconcha.in, Yahoo Finance (receive only market data queries, no user data).

We do not send your email, name, or personal information to any data provider. Wallet addresses, when provided, are sent only to Alchemy for on-chain queries.

6. Data Retention

  • Waitlist emails: Retained until you request removal or the waitlist is closed.
  • App accounts: Retained while your account exists; deleted within 30 days of a deletion request.
  • Early-access requests: Retained until the feature you asked about is available to you and we have told you once, or until you ask us to remove them.
  • Session cookie: Up to 30 days, or until you sign out.
  • API key metadata: Active until revoked by you or by us; revoked keys retained for 30 days then purged.
  • Audit decision records: 365 days, then auto-deleted by daily cleanup. Institutional pilots may opt into a long-term retention tier (up to 7 years with daily JSONL + SHA-256 manifest export) — see Hardening Modes.
  • Policy configuration profiles: Stored alongside the API key until cleared via the policy management endpoint.
  • Operational logs: 30 days.
  • Cached API responses: 60 seconds (TTL).

7. Your Rights

Depending on your jurisdiction, you may have the right to:

  • Access: Request a copy of the personal data we hold about you
  • Correction: Request correction of inaccurate data
  • Deletion: Request deletion of your personal data
  • Portability: Receive your data in a structured, machine-readable format
  • Objection: Object to processing of your data for specific purposes
  • Revocation: Request revocation of your API key at any time (app accounts can also regenerate it from the Account page)
  • Unsubscribe: Stop alert emails at any time from the link in each email or from the Account page

To exercise any of these rights, contact us at hello@likido.xyz from the email address on your account, or with the first 16 characters of your API key (the public prefix). We will confirm receipt within 5 business days and complete processing within 30 days.

8. International Users

The Service is operated from the United States. If you access the Service from the European Union, United Kingdom, or other jurisdictions with data protection laws, you acknowledge that your data will be transferred to and processed in the United States. We process data under the legal basis of contract (providing the account and the Service you requested), legitimate interest (security, abuse prevention and service improvement) and consent (waitlist registration, early-access requests and alert emails, which you can withdraw at any time).

9. Children

The Service is not directed to individuals under 18 years of age. We do not knowingly collect personal information from children.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated effective date. Material changes will be communicated via email to registered users.

11. Institutional customers

Hedge funds, prop desks, and treasury teams evaluating RiskState should read the Institutional Integration Guide for the full data classification, authentication model, audit trail schema, retention tiers (including the 7-year export option), incident response policy, and SIG Lite procurement mapping. The guide supersedes this Privacy Policy where the institutional pilot scope adds additional terms — those are negotiated under NDA per pilot.

12. Contact

For privacy-related questions or requests, contact us at: hello@likido.xyz

Digital Venture Asset LLC
Delaware, United States