Privacy Policy

1. Data Controller

CRIPVELTA ("CRIPVELTA", "we", "us", or "our") is operated by:

Website: https://cripvelta.com

2. Personal Data We Collect

Account information

If you create an account, we may process your email address, name, password authentication data in the form of a securely hashed password, account creation and update dates, and information associated with your CRIPVELTA account such as XP and level.

Google Sign-In

If you choose to sign in using Google, we may receive information necessary to authenticate your account, including your email address, name, Google account identifier, and confirmation that your email address has been verified by Google.

We do not store your Google password.

Session and security information

When you log in, CRIPVELTA creates a secure authentication session. We store a cryptographic hash of the session token together with information necessary to maintain and secure your session.

Security and abuse prevention

To protect CRIPVELTA against unauthorized access, automated attacks and abuse, we may process your IP address, email address and authentication attempt information for security and rate-limiting purposes.

This information is not currently used by CRIPVELTA for advertising or behavioral profiling.

Daily Challenge information

If you use the CRIPVELTA Daily Challenge while logged in, we may store information necessary to record your participation and prevent duplicate rewards, including the challenge date, challenge identifier, XP awarded, account identifier and completion date.

3. How We Use Personal Data

We use personal data for the following purposes:

• Create and manage your CRIPVELTA account.
• Authenticate you and maintain your login session.
• Provide account-related features.
• Maintain your XP and account level.
• Record Daily Challenge participation and rewards.
• Prevent duplicate XP rewards.
• Protect accounts and CRIPVELTA infrastructure.
• Detect and prevent abusive authentication attempts.
• Apply security rate limits.

CRIPVELTA also uses external data providers to obtain market, cryptocurrency and financial news information displayed on the website.

4. Legal Bases for Processing

Performance of a contract

Processing necessary to create and operate your account, authenticate you and provide account functionality is carried out because it is necessary to provide the services you request.

Legitimate interests

Processing carried out for security, abuse prevention, authentication protection and service integrity may be based on our legitimate interests in protecting CRIPVELTA and its users.

We seek to ensure that these interests do not override your fundamental rights and freedoms.

Legal obligations

Where applicable, we may process or retain information when necessary to comply with legal obligations.

5. Cookies

CRIPVELTA currently uses an essential authentication cookie called cripvelta_session.

This cookie is used to maintain your authenticated session. It does not contain your password or email address. The session token is randomly generated, while a cryptographic hash of the token is stored on our server.

The cookie is configured as follows:

• HttpOnly
• Secure when served in production
• SameSite=Lax
• Path limited to the CRIPVELTA website
• Maximum lifetime of 30 days

CRIPVELTA does not currently use advertising cookies or behavioral tracking cookies.

If we introduce non-essential cookies, analytics technologies or advertising technologies in the future, our privacy and cookie information and, where required, our consent mechanisms will be updated accordingly.

6. Third-Party Services

Google

Google Sign-In may be used to authenticate your CRIPVELTA account. When you choose Google Sign-In, Google processes information according to Google's own privacy policies and terms.

Market and data providers

CRIPVELTA may retrieve market, cryptocurrency and financial news information from third-party data providers, including CoinGecko, Marketstack and Marketaux.

These services are primarily accessed server-side by CRIPVELTA to obtain information displayed on the website.

7. International Transfers

Some service providers used by CRIPVELTA may process information outside the European Economic Area.

Where personal data is transferred outside the European Economic Area, CRIPVELTA will seek to ensure that the transfer is carried out in accordance with applicable data protection law and using an appropriate legal mechanism where required.

8. Data Retention

We retain personal data only for as long as necessary for the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by applicable law.

Account information is generally retained while your account remains active.

Authentication sessions expire after the configured session period or may be deleted earlier.

Security and rate-limiting information may be retained for the period necessary to protect the service and prevent abuse.

Daily Challenge records may be retained while necessary to maintain the integrity of account progression and reward history.

When personal data is no longer necessary, it will be deleted or otherwise appropriately disposed of, subject to applicable legal requirements.

9. Your Data Protection Rights

Subject to applicable law, you may have the right to:

• Access your personal data.
• Correct inaccurate or incomplete personal data.
• Request deletion of your personal data.
• Request restriction of processing.
• Object to certain processing.
• Request portability of personal data where applicable.
• Withdraw consent where processing is based on consent.

You also have the right to lodge a complaint with the competent data protection supervisory authority.

For users in Spain, the relevant supervisory authority is the Spanish Data Protection Agency (AEPD).

To exercise your rights, contact us at cripvelta@gmail.com.

We may need to verify your identity where reasonably necessary to protect your account and personal information.

10. Account Deletion

You may request deletion of your CRIPVELTA account and associated personal data by contacting us at cripvelta@gmail.com.

Certain information may need to be retained where required by law or where necessary to establish, exercise or defend legal claims, prevent fraud or maintain security.

CRIPVELTA will delete or anonymize information that is no longer required for these purposes.

11. Data Security

CRIPVELTA implements reasonable technical and organizational measures designed to protect personal data against unauthorized access, alteration, disclosure or destruction.

These measures include, where appropriate:

• Password hashing.
• Secure authentication sessions.
• HttpOnly authentication cookies.
• HTTPS.
• Rate limiting.
• Server-side authentication checks.
• Protection against unauthorized session use.

However, no internet service can guarantee absolute security.

12. Children's Privacy

CRIPVELTA is not specifically directed at children.

We do not knowingly collect personal information from children where such collection would be prohibited by applicable law.

If you believe that a child has provided personal information to CRIPVELTA in circumstances where it should not have been collected, please contact us at cripvelta@gmail.com.

13. Changes to This Privacy Policy

We may update this Privacy Policy when CRIPVELTA's functionality, services, legal requirements or data-processing practices change.

The "Last updated" date at the top of this page will indicate when the policy was most recently revised.

Where required by law, we will provide additional notice of material changes.

14. Contact

If you have questions about this Privacy Policy, your personal data, or the exercise of your data protection rights, please contact:

Website: https://cripvelta.com