Privacy Policy

1. Controller

Nabla Finance OÜ, registry code 17287187, Pikk 7, Tallinn 10123, Estonia, is the controller of personal data collected through this website. Contact for all privacy matters: contact+privacy@hedgepay.app.

Because the controller is established in the European Union, the General Data Protection Regulation (GDPR) applies to all personal data we process through this website, wherever you are located. Where the law of your country gives you additional rights, section 9 explains how to use them.

2. What we collect and why

2.1 Beta list. When you join the beta list we collect your email address, the country you select, your name if you give it, the time of submission, and the country inferred from your IP address by our hosting provider. We use this to contact you about beta access, to plan the order in which countries open, and to prevent duplicate or automated sign-ups. Legal basis: your consent (GDPR art. 6(1)(a)), which you give by ticking the box on the form and can withdraw at any time.

2.2 Contact form and email. When you write to us we keep your message, your email address and our reply to answer you and to keep a record of the exchange. Legal basis: our legitimate interest in responding to enquiries (art. 6(1)(f)), or performance of pre-contractual steps at your request (art. 6(1)(b)).

2.3 Technical data. Our hosting provider records IP address, browser type, requested page and timestamp in server logs for security and to keep the site running. We use the country derived from your IP address to suggest a country page; this happens in your browser and is not stored by us beyond the session. Legal basis: legitimate interest in security and operation (art. 6(1)(f)).

2.4 Analytics. We use Google Analytics to understand how the site is used: pages visited, approximate location, device and browser, referral source. If you visit from the European Union, analytics cookies are set only after you accept them in the cookie banner; legal basis: consent (art. 6(1)(a)), which you can withdraw through the cookie settings link in the footer. If you visit from elsewhere, analytics runs on the basis of our legitimate interest in understanding and improving the site (art. 6(1)(f)); you can opt out at any time through the same cookie settings link or by blocking cookies in your browser.

2.5 Bot protection. Our forms use Cloudflare Turnstile to distinguish people from automated submissions. Turnstile processes technical signals from your browser and may set a cookie; it does not require you to solve a puzzle. Legal basis: legitimate interest in preventing abuse (art. 6(1)(f)).

We do not collect identity documents, financial account details or transaction data through this website. Those are collected only in the application, under its own privacy policy, when you become a user.

3. Who receives your data

We share personal data only with providers who process it on our instructions:

• Cloudflare, Inc. (USA) — hosting, content delivery, bot protection, and the database that stores beta-list entries.
• Google LLC (USA) — Google Analytics, only if you consent to analytics cookies.
• Mailgun Technologies, Inc. (a Sinch company, USA; EU data region selected) — delivery of contact-form messages to us and of beta invitations to addresses on the beta list.

We may also disclose data where the law requires it, or to protect our rights or the safety of others. We do not sell personal data and we do not share it with advertisers.

4. International transfers

Cloudflare, Google and Mailgun are based in the United States and are certified under the EU–US Data Privacy Framework, which the European Commission recognises as providing adequate protection. Where a provider is not certified, transfers rely on the European Commission’s Standard Contractual Clauses. Copies of the safeguards are available on request.

5. Retention

• Beta-list entries: until you are invited and create an account (after which the application’s policy applies), until you ask us to delete them, or 12 months after the beta programme closes, whichever comes first.
• Contact-form messages: 24 months from the last exchange.
• Application logs: 7 days. Our hosting provider retains edge request logs under its own policy.
• Analytics data: per Google Analytics retention setting, which we set to 14 months.

6. Security

Data in transit is encrypted (TLS). Beta-list data is stored in an access-controlled database. Access is limited to people who need it to run the programme. No system is completely secure; if we become aware of a breach affecting your data we will notify you and the supervisory authority as the law requires.

7. Your rights (GDPR)

You have the right to access the personal data we hold about you, to have it corrected or deleted, to restrict or object to its processing, to receive it in a portable format, and to withdraw consent at any time without affecting processing done before withdrawal. To exercise any of these, email contact+privacy@hedgepay.app. We may ask you to confirm your identity. We respond within one month.

You can complain to a supervisory authority. Ours is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee). You may also complain to the authority in your own EU country.

8. Children

This website and the beta list are not directed at people under 18. We do not knowingly collect data from them. If you believe we have, contact us and we will delete it.

9. Country-specific information

Brazil. If you are in Brazil, the Lei Geral de Proteção de Dados (LGPD) also applies. You have the rights listed in article 18 of the LGPD, including confirmation of processing, access, correction, anonymisation, deletion, portability, and information about sharing. Our contact person for LGPD matters (encarregado) can be reached at contact+privacy@hedgepay.app. The supervisory authority is the ANPD.

Argentina. If you are in Argentina, Law 25.326 also applies. You have the rights of access, rectification, updating and deletion of your data, exercisable free of charge at intervals of not less than six months unless a legitimate interest is shown. The Agencia de Acceso a la Información Pública (AAIP) is the authority responsible for enforcing Law 25.326 and receives complaints about non-compliance.

Colombia. If you are in Colombia, Law 1581 of 2012 also applies. By ticking the consent box you give your prior, express and informed authorisation to the processing described in this policy. You may know, update, correct and delete your data and revoke your authorisation at any time by emailing us. The Superintendencia de Industria y Comercio (SIC) is the supervisory authority.

Other countries. If the law of your country gives you rights beyond those listed here, you can exercise them by contacting us and we will honour them where the law applies to us.

10. Changes

We may update this policy. The date at the top shows the current version. Material changes will be announced on this page and, where we hold your email, by email.