1. General
This Policy sets out the purposes, legal grounds, procedures and conditions of personal data processing and the measures taken to protect personal data. The personal data operator is Individual Entrepreneur Samsonov Ivan Nikolaevich (the “Operator”). TIN (INN) 253810717303. Contact email: support@fluxvpn.pro.
The Policy applies to all personal data the Operator processes in connection with the Tavyxo Wallet mobile application for iOS and Android (the “App”), the api.tavyxo.com server, the tavyxo.com website and support requests. It is publicly available at tavyxo.com/personal-data/.
2. Definitions
- Personal data — any information relating directly or indirectly to an identified or identifiable individual (data subject).
- Processing — any operation on personal data: collection, recording, systematisation, accumulation, storage, clarification, retrieval, use, transfer, depersonalisation, blocking, deletion and destruction.
- User — an individual who uses the App or the website.
- Public address — a wallet identifier on a blockchain network that cannot be used to move funds and is publicly visible on the blockchain.
3. Legal grounds
The Operator processes personal data under the Constitution of the Russian Federation, Federal Law No. 152-FZ of 27 July 2006 “On Personal Data”, the Civil Code of the Russian Federation and:
- the Terms of Use, an agreement to which the user is a party (Article 6(1)(5) of 152-FZ);
- the user’s consent to notifications, given by enabling them in the App (Article 6(1)(1) of 152-FZ);
- the Operator’s legitimate interest in keeping the service secure and operational, provided users’ rights are not violated (Article 6(1)(7) of 152-FZ).
4. Purposes, data subjects, data and retention
4.1. Providing App functions — showing balances and prices, estimating fees, broadcasting transactions signed by the user, swapping assets.
- Data subjects: App users.
- Data: public wallet addresses; amounts, assets and networks of operations; transaction hashes and transactions signed on the device; quotes and swap order records.
- Legal ground: performance of the agreement (Terms of Use).
- Retention: balance and fee requests are not stored after the response; swap order records are kept until the swap is completed and reconciled and then no longer than necessary to resolve claims and meet legal requirements.
4.2. Transfer notifications (optional).
- Data subjects: users who enable notifications.
- Data: a random device registration identifier; the push token issued by Apple or Google; platform (iOS/Android); watched public addresses; language and notification preferences; transfer events for those addresses.
- Legal ground: the user’s consent.
- Retention: until consent is withdrawn by turning notifications off or removing all watched wallets from the App, after which the registration is deleted from the server.
4.3. Security and operation of the service.
- Data subjects: App users and website visitors.
- Data: IP address and connection time; for website visitors, the requested page and browser information (user agent).
- Legal ground: the Operator’s legitimate interest.
- Retention: a limited server-log retention period, followed by deletion on rotation.
4.4. Responding to enquiries.
- Data subjects: people who contact the Operator by email.
- Data: email address, name (if provided), the content of the message and any information the sender attaches.
- Legal ground: performance of the agreement; for non-users, consent expressed by sending the enquiry.
- Retention: until the matter is resolved and then no longer than three years to handle possible claims.
The Operator does not process special categories of personal data or biometric personal data. Face ID, Touch ID and passcode checks are performed by the device operating system and their results are not transmitted to the Operator. The Operator makes no decisions with legal effects for the user based solely on automated processing. tavyxo.com uses no cookies or analytics.
5. Processing procedure
Processing is automated. The Operator collects only data required for the stated purposes and does not process data in ways incompatible with them.
Personal data is not sold or shared for advertising. To achieve the processing purposes, data may be transferred to:
- the hosting provider whose server runs the service backend;
- Apple Inc. (Apple Push Notification service) and Google LLC (Firebase Cloud Messaging) to deliver notifications;
- blockchain nodes and indexers, price providers, swap and bridge providers — only the public addresses and transaction data needed to fulfil the user’s request;
- public authorities where required by law.
Transactions signed by the user are published on public blockchain networks. Such publication is the essence of the requested operation, and blockchain records cannot be changed or deleted by the Operator or the user.
6. Cross-border transfer
The server that processes the data is located in the Republic of Singapore. Data needed to deliver notifications is transferred to Apple Inc. and Google LLC, which process it, among other places, in the United States. By using the App, the user is informed that their data may be transferred to and processed outside their country of residence. The Operator transfers abroad only the data required for the relevant function.
7. Rights of data subjects
A data subject has the right to:
- obtain information about the processing of their personal data;
- demand clarification, blocking or destruction of data that is incomplete, outdated, inaccurate, unlawfully obtained or not necessary for the stated purpose;
- withdraw consent — for notifications, simply turn them off in the App;
- appeal against the Operator’s actions or omissions to the Russian data protection authority (Roskomnadzor) or a court.
Because the App has no user accounts, a request must include a public wallet address or other details that allow the relevant records to be found. The Operator may ask for confirmation that the requester controls that address.
8. Handling requests
Requests should be sent to support@fluxvpn.pro. The Operator replies within 10 business days of receipt. This period may be extended by up to 5 business days with a reasoned notice to the requester.
Inaccurate data is corrected within 7 business days of receiving supporting information. Unlawfully processed data, data whose processing purpose has been achieved and data for which consent has been withdrawn are destroyed within the periods set by Article 21 of 152-FZ, unless otherwise required by law or agreement.
9. Protection measures
The Operator takes legal, organisational and technical measures to protect personal data against unauthorised access, destruction, modification, blocking, copying and disclosure, including:
- designing the App so that the recovery phrase, private keys and PIN never leave the user’s device;
- limiting collected data to the public and technical information required for App functions;
- encrypting data in transit between the App and the server (TLS);
- restricting access to the server and logs to those who need it to run the service;
- not logging the contents of App requests to the API;
- personally organising personal data processing and monitoring compliance with this Policy.
10. Final provisions
The Operator may amend this Policy. A new version takes effect when published on this page unless it states otherwise. The Russian version of this Policy prevails in case of discrepancy. Questions about this Policy: support@fluxvpn.pro.