DeFiRilla Privacy Policy

1. Who We Are & Data Controller Identity

This Privacy Policy applies to the website, platform, and alerting services accessible via DeFiRilla.com (collectively, the "Platform"), operated by Brightstart Nominees Pty Ltd trading as DeFiRilla (referred to as "DeFiRilla," "we," "our," or "us"), registered in Australia at 102 Victoria Street, Carlton, Melbourne, Victoria 3053, Australia.

For this Policy, 'personal information' means information or an opinion about an identified individual, or an individual who is reasonably identifiable, as defined in the Privacy Act 1988 (Cth), and is the term used for Australian privacy purposes; 'personal data' means any information relating to an identified or identifiable natural person, as defined in the GDPR or UK GDPR, and is the term used where those laws apply. Brightstart Nominees Pty Ltd is responsible for processing that information and acts as a data controller where applicable. If you have questions regarding this Privacy Policy or our data practices, contact us for privacy matters at support [at] DeFiRilla.com.

The GDPR and UK GDPR apply to DeFiRilla only to the extent required by their respective territorial scopes. DeFiRilla does not intentionally target the Platform at individuals in the EEA or UK. Analytics and server logs may incidentally record visitors located in the EEA or UK. Non-essential analytics are collected only after affirmative consent and are configured to use pseudonymous identifiers; however, pseudonymous data may still constitute personal data or personal information where it can be linked with other information to identify an individual. DeFiRilla has assessed that its incidental analytics collection does not, on the facts and configuration applicable to the Platform, amount to monitoring of the behaviour of individuals in the EEA or UK for the purposes of GDPR Article 3(2)(b), and will review that assessment if the scope, purpose, or operation of its analytics activities changes. Based on a documented assessment of the Platform's services, user-facing targeting, wallet monitoring and alerting activities, analytics, and applicable territorial criteria, DeFiRilla has concluded that it is not currently required to appoint an EU representative under GDPR Article 27 or a UK representative under the UK GDPR. This assessment covers all relevant processing activities, including monitoring and alert delivery involving submitted wallet addresses, and will be reviewed if the Platform is offered to individuals in the EEA or UK, their behaviour is monitored, or the scope, purpose, or operation of any relevant processing changes. The same review will apply if the applicable representative requirements change, and DeFiRilla will publish representative details if and when appointment becomes necessary. Where the GDPR or UK GDPR applies to you (for example, where we offer our Platform to individuals in the EEA or UK or monitor their behaviour), the rights, legal bases and breach-notification commitments in Sections 5, 12 and 17 apply to that processing; the representative assessment above concerns only Article 27 and does not limit those rights.

2. Platform Overview & Read-Only Architecture

DeFiRilla provides a passive, read-only monitoring and alerting tool for decentralised finance (DeFi) positions across blockchain networks compatible with the Ethereum Virtual Machine (EVM). DeFiRilla enables users to receive automated risk notifications (including changes in a position's Health Factor, liquidity-provider (LP) active range exits, and yield fluctuations) without requiring wallet connections or transaction signatures.

Read-Only Security Commitment

• No Wallet Connections: DeFiRilla will never ask you to connect your Web3 wallet (e.g., MetaMask, Rabby, Coinbase Wallet).
• No Signatures or Approvals: DeFiRilla never requests transaction signatures, message signing, or smart contract token approvals.
• No Access to Assets or Private Keys: The DeFiRilla Platform is designed and operated without functionality that permits DeFiRilla to access, hold, transfer, trade, stake, or manage users' private keys, seed phrases, or funds.

An 'Alerting Tripwire' (also referred to as an 'alert' or 'alert configuration') is a wallet-monitoring rule that triggers automated risk notifications when specified on-chain conditions change significantly, including changes to Health Factor, LP active-range status, and supply, borrow, or reward APRs.

3. Information We Process

Depending on how you interact with the Platform, we process the following categories of information:

4. Wallet Re-Identification & Public Blockchain Disclaimer

Pseudonymity Notice: Public wallet addresses are pseudonymous identifiers. While DeFiRilla does not require your legal name or identity, wallet addresses may become re-identifiable when combined with third-party data sources, public social profiles, or notification endpoints.

Blockchain Immutability: Public blockchain networks are decentralised, transparent, and permanent public ledgers. DeFiRilla does not control, alter, or erase public blockchain data.

5. Purposes & Legal Bases for Processing (GDPR Disclosure)

We assess the legal basis for each processing activity separately. Depending on the context, the same category of data may be processed under different legal bases:

6. Wallet-to-Notification Linkage & Commercialisation Guarantee

7. Analytics, Cookies & Global Privacy Control (GPC)

8. Infrastructure & Third-Party Service Providers

Cloud Infrastructure Providers: DeFiRilla uses third-party cloud infrastructure providers, including Oracle, Heroku, and Google Cloud, as applicable, to host and operate components of the Platform. These providers may process technical information, application data, and other information necessary to provide the infrastructure services.

Telegram (Optional Destination): If you elect to receive alerts via Telegram, your Telegram Chat ID or username, the alert message text, and the technical information required to transmit and deliver the message may be processed through the official Telegram Bot API. Telegram acts as an independent controller and independently determines how it processes that information, including associated communications metadata, under Telegram's Privacy Policy; this role is recorded in the provider register.

Email (Optional Destination): If you elect to receive alerts via email, alerts are transmitted through Oracle Cloud Infrastructure Email Delivery, Oracle's email delivery service, which acts as a processor on DeFiRilla's documented instructions and processes recipient email addresses, alert content and delivery metadata solely to provide email delivery services.

Analytics Tooling: Google Analytics is used for website and product analytics and is configured to operate only after obtaining applicable user consent.

Depending on the network and technical configuration, remote procedure call (RPC) and indexing providers may process wallet addresses, network requests, query metadata and related on-chain data. For each provider and processing activity, DeFiRilla identifies the provider's applicable privacy role in the provider register. A provider acting on DeFiRilla's documented instructions is identified as a processor, while a provider determining its own purposes and means of processing is identified as an independent controller; any other legally recognised role is expressly identified for the relevant processing activity. Oracle, Heroku and Google Cloud act as processors on DeFiRilla's documented instructions when hosting components of the Platform. The provider register is kept current and is available on request at support [at] DeFiRilla.com. These providers may process information in Australia or overseas, including the United States. Cloud infrastructure providers (Oracle, Heroku, Google Cloud) receive technical and application data; remote procedure call (RPC) and indexing providers receive wallet addresses and query metadata as configured per network.

9. International Data Transfers

DeFiRilla operates from Australia and uses third-party cloud infrastructure providers that may process personal information in Australia and overseas, including the United States. The specific location depends on the provider, service, and configured hosting location.

EEA & UK Users: For transfers originating from the European Economic Area or the United Kingdom, DeFiRilla relies on the European Commission's Standard Contractual Clauses (or the UK International Data Transfer Agreement or UK Addendum, as applicable) for transfers to its cloud infrastructure providers (Oracle, Heroku and Google Cloud), to Oracle Cloud Infrastructure Email Delivery, to Telegram, and to remote procedure call (RPC) and indexing providers, in each case where the recipient is located in the United States or another country without an adequacy decision, and on adequacy decisions where available. Depending on the recipient and applicable law, safeguards may include an adequacy decision, the European Commission's Standard Contractual Clauses, the UK International Data Transfer Agreement or UK Addendum, or another legally recognised mechanism. The provider register records, for each recipient, the specific mechanism relied upon, any supplementary safeguards, and the location of the transfer, and is available on request at support [at] DeFiRilla.com.

Australian Users: We take reasonable steps in accordance with Australian Privacy Principle (APP) 8 to ensure overseas recipients handle personal information consistently with the APPs, and, where APP 8.1 applies and the overseas recipient is not otherwise subject to the APPs in relation to the information, we remain accountable for the overseas recipient's acts and practices under section 16C of the Privacy Act 1988 (Cth), subject to any applicable statutory exceptions.

10. Data Retention Policy

We retain personal information only for as long as necessary to fulfil the operational purposes for which it was collected:

• Wallet Addresses & Notification Destinations: (a) Retention period: Wallet addresses and notification destinations are retained while the associated Alerting Tripwire remains active, subject to a maximum initial retention period of 12 months from creation. (b) Expiry and deletion: At the end of that period, the tripwire automatically expires and, except for the dispute-resolution records described below, its associated data is deleted from active production systems and application databases within 30 days after expiry, and from DeFiRilla-controlled backups and disaster-recovery systems within 90 days after expiry, unless the user expressly confirms renewal through the Platform before expiry. (c) Renewal and reactivation: Each qualifying renewal establishes a new 12-month retention period from the date of confirmation; reactivation of an expired or cancelled tripwire establishes a new 12-month retention period only from the date of reactivation, provided the configuration has not yet been deleted from active production systems (deletion from backups does not extend the reactivation period). Receiving or acknowledging an alert does not constitute renewal. (d) Deletion on request or cancellation: Following a deletion request or alert cancellation, and except for dispute-resolution records, we delete the relevant wallet address, notification destination, alert configuration, alert settings, and notification-destination linkage from active production systems and application databases within 30 days, and from DeFiRilla-controlled backups and disaster-recovery systems within 90 days, unless a specific law requires longer retention. (e) Investigation extension: A documented active investigation may extend an applicable retention period by no more than 12 months beyond the stated period; no legal-compliance or dispute-resolution exception permits retention beyond that combined maximum unless a specific law, regulation or court order expressly requires longer retention, in which case the data is retained only for the period that law, regulation or order requires. (f) Third-party providers: Information held by third-party providers identified as independent controllers is subject to their retention practices; where DeFiRilla can request deletion, it will do so promptly but cannot guarantee deletion within 90 days. (g) Undeliverable alerts: If alerts remain undeliverable for one continuous month after reasonable delivery-retry procedures, DeFiRilla may deactivate the Alerting Tripwire and will delete its associated data from active production systems and application databases within 30 days of deactivation, and from DeFiRilla-controlled backups and disaster-recovery systems within 90 days of deactivation; these deadlines do not extend any other applicable retention period. Mere non-renewal or failure to acknowledge an otherwise successfully delivered alert does not trigger early deletion.
• Blockchain Query Logs & Technical Server Logs: Ordinary blockchain-query and technical server logs used for system stability, debugging, and routine auditing are retained for a maximum of 90 days and then automatically deleted. Only logs formally designated as security logs under DeFiRilla's documented log-classification policy qualify for retention beyond 90 days; all other blockchain-query and technical server logs must be deleted within 90 days. The designation must record the security purpose, data categories, responsible owner, creation date, and scheduled deletion date. Ordinary blockchain-query, debugging, and routine-audit logs must not be reclassified as security logs solely to extend retention. Security logs are retained only for the minimum period necessary for security monitoring, incident investigation, legal compliance, or dispute resolution, and in no event longer than 12 months from creation; the only permitted extensions are a documented active investigation extension of no more than 12 months (for a combined maximum of 24 months) or retention expressly required by a specific law or court order; security logs are automatically deleted when the applicable retention period expires.
• Analytics Data: DeFiRilla retains analytics data for 14 months. At the end of this period, data subject to deletion under the configured Google Analytics retention settings is deleted; where Google Analytics provides anonymisation rather than deletion for a particular data element, that element is anonymised instead, in accordance with the applicable configuration and Google Analytics processing practices.
• Dispute Resolution & Record-Keeping Data: Following alert cancellation, expiry or a deletion request, the wallet address, notification destination and alert configuration history needed to establish, exercise or defend legal claims are retained in a restricted-access dispute-resolution archive for a maximum of 12 months, and are then permanently deleted or irreversibly anonymised, unless extended under the investigation rule stated in the Wallet Addresses & Notification Destinations bullet of this Section.
• Indirectly Collected Public Blockchain Data: Public blockchain information relating to non-users and other indirectly collected blockchain data is retained only in the minimum fields and at the granularity necessary for a documented purpose of security, service operation, or service improvement. DeFiRilla records the purpose, data fields, start date, responsible owner, review date, and deletion or anonymisation trigger for each retention category; reviews each category at least every 12 months and deletes or anonymises the data when that purpose ends; in all cases, no category may be retained for more than 24 months, except that a documented active investigation may extend the applicable period only in accordance with the single 12-month investigation-extension cap stated above. Where specific retention periods apply to associated technical logs or derived data, those periods are described in this Section.

11. Security Safeguards

DeFiRilla maintains appropriate technical and organisational security measures designed to protect personal information stored and processed on infrastructure managed by DeFiRilla and provided by third-party cloud infrastructure providers.

• Encryption-in-transit (TLS/HTTPS) enforced across all web endpoints and API communications.
• Encryption-at-rest for internal databases and data stores.
• Least-privilege administrative access controls and credential management.
• Routine monitoring for system vulnerabilities and unauthorised access attempts.

12. Your Privacy Rights (GDPR & Australian Privacy Framework)

Depending on your geographic location, you may exercise specific rights regarding your personal information:

European Economic Area (EEA) & United Kingdom (GDPR / UK GDPR)

• Right of Access & Rectification: Request confirmation, copies, or corrections of the personal data we hold about you.
• Right to Erasure ("Right to be Forgotten"): Request erasure of your personal information, subject to applicable legal exceptions. DeFiRilla will assess relevant production systems, backups, logs, and third-party processors and explain any retention required by law, security, or technical constraints. For DeFiRilla-controlled active production systems and application databases, deletion will be completed within 30 days after cancellation or a valid deletion request; deletion or overwrite of DeFiRilla-controlled backups and disaster-recovery copies will be completed within 90 days after cancellation or a valid deletion request, except that the wallet address, notification destination and alert configuration history held in the restricted-access dispute-resolution archive are retained for up to 12 months and are not used for any other purpose during that period, and unless a specific law, regulation or court order expressly requires a longer period, or a documented active investigation requires a longer period (not exceeding a further 12 months for an investigation), in each case as described in Section 10.
• Right to Restriction or Objection: Request restriction of processing or object to certain processing where the applicable data protection law provides that right.
• Right to Data Portability: Where Article 20 of the GDPR or the corresponding UK GDPR provision applies, you may request a structured, commonly used and machine-readable copy of the following personal data you have provided to us and that we process by automated means on the basis of consent or performance of a contract: the wallet addresses, notification destinations and alert settings of your active alert configurations. Data processed on the basis of legitimate interests is not covered by this right; this includes security logs, dispute-resolution records, and public blockchain data processed for security, service operation or service improvement, while wallet addresses processed under Article 6(1)(b) for monitoring and requested alert delivery remain within the portability scope where Article 20 otherwise applies.
• Right to Withdraw Consent: Where processing is based on consent (e.g., analytics), withdraw that consent at any time without affecting prior lawful processing.

Australia (Privacy Act 1988 / Australian Privacy Principles (APPs))

• Access & Correction: Request access to or correction of personal information held by DeFiRilla.
• Anonymity & Pseudonymity: Where lawful and practicable, you may interact with DeFiRilla without providing your legal name or identity, and DeFiRilla does not require your legal name to provide the alerting service.
• Privacy Enquiries & Complaints: You may complain to us about our handling of your personal information. We will handle your complaint in accordance with the timeframes set out in Section 18 ('Complaints Handling Process'), including acknowledgement within 7 days and a substantive response within 30 days, which may be extended only in limited circumstances permitted by the Privacy Act 1988 (Cth) and applicable Australian Privacy Principles, in which case we will notify you of the revised timeframe and the reason for the extension. If you are dissatisfied with our response, you may complain to the Office of the Australian Information Commissioner. We will handle access and correction requests in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles, including any applicable legal exceptions.

We respond to privacy requests within the timeframe required by applicable law. Under the GDPR and UK GDPR, we generally respond within one month and may extend that period by up to two further months where permitted for complex or numerous requests; we will notify you of any extension and the reason for it. For Australian privacy requests, we will acknowledge receipt within 7 days and provide a substantive response within 30 days, or within any shorter or longer period required or permitted by the Privacy Act 1988 (Cth) and applicable Australian Privacy Principles. We may need to verify your identity before processing a request. To exercise your rights, contact us at support [at] DeFiRilla.com.

Rights Regarding Indirectly Collected Blockchain Information: If you believe DeFiRilla processes personal information relating to you that was obtained indirectly from public blockchain data, you may contact us at support [at] DeFiRilla.com to request access, correction, restriction, objection, or erasure where applicable. Please provide the relevant wallet address or other information sufficient to identify the data concerned. We will assess the request under applicable law and explain any legal limitations or reasons for refusal.

13. United States Privacy Rights (CCPA/CPRA and other Applicable State Laws)

If you reside in California or another US state with applicable privacy legislation, you may have rights regarding your personal information under the specific law applicable to you. The rights listed below apply only to the extent provided by that applicable law and are subject to its definitions, exemptions, and statutory limitations:

• Right to Know & Access: You have the right to request details regarding the categories and specific pieces of personal information we have collected, used, disclosed, or processed about you, as required by applicable law.
• Right to Deletion & Correction: You have the right to request the deletion or correction of inaccurate personal information held by us, subject to legal exceptions.
• No Sale or Sharing of Personal Information: DeFiRilla does not sell your personal information or share it for cross-context behavioural advertising (as defined under applicable law). If our practices change, you will be notified and may exercise your right to opt out of any future sale or sharing, including through a Global Privacy Control signal as described in Section 7.
• Non-Discrimination: We will not discriminate against you (such as denying services or altering service quality) for exercising any privacy rights available to you.
• Right to Portability: Where applicable state law provides this right, you may request a portable copy of the personal information you have provided to us.

California residents may request the categories and specific pieces of personal information collected, the sources of that information, the business or commercial purposes for collection, the categories of third parties to whom it was disclosed, and deletion or correction where applicable. Submit requests by emailing support [at] DeFiRilla.com with the subject line "US Privacy Request."

14. Data Deletion Limitations & Blockchain Immutability

The deletion and backup-retention timeframes described in Section 10 apply to data deleted following alert cancellation or a valid deletion request (except for the dispute-resolution records retained for up to 12 months as described in Section 10).

Third-party providers that act as independent controllers, as identified in the provider register described in Section 8, may retain information according to their own documented retention practices; providers acting as processors on DeFiRilla's documented instructions retain information only as those instructions and the periods in Section 10 permit; where DeFiRilla controls or can request deletion, we will submit deletion requests promptly, but cannot guarantee deletion from independent provider systems within 90 days.

Blockchain Disclaimer: Deletion from DeFiRilla does not, and cannot, alter, delete, or remove public transaction records or other data recorded on underlying blockchain networks; subsequent blockchain transactions may update blockchain state, but DeFiRilla does not control or erase the underlying blockchain records.

15. Children's Privacy

DeFiRilla is not directed toward or intended for use by children, and age-related privacy rights and thresholds are determined according to applicable law. We do not knowingly collect personal information from children. If we become aware that a child has provided personal information, we will promptly initiate deletion from active systems and complete that deletion within 30 days, and from DeFiRilla-controlled backups and disaster-recovery systems within 90 days, subject to the retention periods and limitations described in Sections 10 and 14; we will also promptly request deletion from relevant third-party providers, although residual copies may remain in security logs for the period stated in Section 10 and in independent provider systems in accordance with those providers' own retention practices as described in Section 14.

16. Automated Decision-Making (ADM) Disclaimer

DeFiRilla's automated alerts are technical, rule-based notifications generated from public blockchain data and user-configured monitoring parameters. They are strictly informational and are not intended to make automated legal, credit, financial, or eligibility decisions concerning users.

17. Data Breach Response

DeFiRilla maintains an internal incident response procedure. Suspected personal data breaches are assessed promptly. Where the GDPR or UK GDPR applies, if a personal data breach is likely to result in a risk to the rights and freedoms of natural persons, we will notify the competent supervisory authority without undue delay and, where feasible, within 72 hours after becoming aware of the breach; where the breach is likely to result in a high risk to the rights and freedoms of natural persons, we will also notify affected individuals without undue delay, subject to applicable exceptions. Where the Australian Notifiable Data Breaches scheme applies, if we determine that an eligible data breach has occurred because unauthorised access to, disclosure of, or loss of personal information is reasonably likely to result in serious harm to one or more individuals and remedial action has not prevented that likelihood of serious harm, we will notify the Office of the Australian Information Commissioner and affected individuals as soon as practicable, unless an exception applies.

18. Complaints Handling Process

If you believe DeFiRilla has processed your personal information in violation of applicable privacy laws or this Policy:

• Internal Review: Contact DeFiRilla's privacy contact (the person responsible for handling privacy enquiries and complaints) directly at support [at] DeFiRilla.com. We will acknowledge your complaint within 7 days, investigate it promptly, and provide a substantive response within 30 days, or within any shorter or longer period required or permitted by applicable law.
• Regulatory Escalation: If you are dissatisfied with our response, you retain the right to lodge a complaint with your local regulatory authority:
  • Australia: Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.
  • EEA: Your local data protection supervisory authority in the relevant EEA jurisdiction.
  • UK: The UK Information Commissioner's Office (ICO).

19. Important Notice: Terms and Risk Disclaimer

This Privacy Policy addresses data collection and privacy practices only. DeFiRilla provides informational monitoring and automated notifications only and does not provide financial, investment, legal, or tax advice. Alerts may experience delays or delivery failures due to network congestion or RPC node interruptions. For complete terms governing platform use, please consult our separate Terms of Service.

20. Contact Information

For all privacy-related questions, data requests, or complaints:

Support Email: support [at] DeFiRilla.com
Registered Address: 102 Victoria Street, Carlton, Melbourne, Victoria 3053, Australia
Website: https://DeFiRilla.com