Privacy Policy
Simi Ventures GmbH, Kiefernweg 18, 53127 Bonn, Germany (Amtsgericht Bonn, HRB 13950), is the controller of your personal data (Art. 4(7) GDPR). Contact: privacy@chainchoice.io.
Simi Ventures GmbH is required to designate a data protection officer, because the assistant profiles how readers decide (Art. 37(1)(b) GDPR), and the appointment is pending; until the officer is named here and notified to the LDI NRW (Art. 37(7) GDPR), write to privacy@chainchoice.io.
Our supervisory authority is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.
When you use the decision engine without saving anything, ChainChoice collects anonymous session analytics (page views, clicks, time on page) via localStorage. Once you accept analytics, it also keeps where you first arrived from: the host name of the referring site or the campaign tag in the link, never the page or search terms. No personal identifiers, no IP storage beyond rate-limit purposes.
When you save a decision for drift monitoring, ChainChoice collects: your email address, the decision inputs you provided to the engine (region, experience, priorities, etc.), and the resulting recommendation snapshot. Stored in Supabase, hosted in the European Union (Frankfurt, Germany).
Searches that find nothing: only if you allow analytics, when a search on ChainChoice shows no result, its words are sent so we can see what readers look for that we do not yet cover. Before they leave your browser, and again on our server, they are lowercased, their spaces collapsed and cut to at most 80 characters; if anything in them looks personal (an email address, a phone number, a web address, a wallet address or transaction hash, an IBAN, a card number or any run of six or more digits), the whole search is dropped and nothing of it is kept. The words of a search that found something are never sent, and none are kept in your browser. They are stored with the random session identifier of the usage analytics and deleted after 90 days; our internal report counts each phrase without any session identifier and shows a phrase only once two or more browsers searched it.
Server logs (Vercel) include IP addresses for rate limiting and abuse prevention. Retained for at most 30 days, then deleted.
No tracking pixels. No advertising identifiers. No cross-site tracking. Page-view analytics (Cloudflare Web Analytics, cookieless) loads only after you accept it in the consent banner.
User data is never sold, rented, or shared with advertisers, marketers, or data brokers.
- Serving pages and data, and keeping the site secure. Delivering the site, finding faults and stopping attacks. Data: IP address, browser identification, the address asked for, time. Legal basis: our legitimate interest (Art. 6(1)(f) GDPR), in a site that works and is not abused. Kept: Kept in Vercel’s request logs for at most 30 days.
- Deciding whether a provider link may be promoted in your market. Showing a paid or promotional link only where the law of your market allows it (financial-promotion, MiCA, gambling and leverage rules). Data: the country your connection comes from, as Vercel reads it from the IP address (country only). Legal basis: our legitimate interest (Art. 6(1)(f) GDPR), in not promoting a product where its promotion is barred. Kept: Not stored: the country is answered to your browser for the page you are on and kept nowhere.
- Counting requests per visitor. Stopping one visitor from overwhelming the service. Data: a keyed hash of the IP address, never the address itself. Legal basis: our legitimate interest (Art. 6(1)(f) GDPR), in keeping the service available to everyone. Kept: The counter expires with its window: one minute for most requests, one hour at most.
- Anonymous usage analytics. Learning which pages and steps help readers, without knowing who they are. Data: a random session identifier, the steps of a session, the first-touch channel (a referring host name or campaign tag), and for each step the time since the page loaded and how many links, buttons or fields had been tapped (a count, never what was tapped or typed). Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with effect for the future. Kept: Session events are deleted after 90 days and experiment events after one year; Cloudflare Web Analytics keeps page-view counts without anything that identifies you.
- The words of searches that found nothing. Seeing what readers look for that ChainChoice does not yet cover, so it can be added. Data: the words of a search that showed no result (lowercased, spaces collapsed, at most 80 characters), the search field, and the random session identifier of the usage analytics; a search that looks like it contains an email address, a phone number, a web address, a wallet address or transaction hash, an IBAN, a card number or any run of six or more digits is not kept at all; the words of a search that found something are never sent. Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with effect for the future. Kept: Deleted after 90 days with the session events. The internal report counts each phrase without any session identifier and lists a phrase only once two or more browsers searched it; a count kept longer than 90 days carries no session identifier.
- Logging a click on a provider link. Matching a commission a provider reports to the click that earned it. Data: the provider, the page, the random click reference and the time. Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with effect for the future. Kept: Deleted after two years, the period over which programmes settle and reverse commissions.
- Answering questions in the assistant. Writing the answer you asked for. Data: the question, the conversation, the page asked from, and the profile and holdings saved in the browser. Legal basis: performing what you asked for (Art. 6(1)(b) GDPR). Kept: Conversations are deleted after one year (a conversation is removed once it is a day old and holds no message from the last year), the sources an answer cited after 90 days, and an anonymous reader’s assistant memory 30 days after its last use; life events you tell the assistant are kept until you delete the account.
- Saving a decision and sending the alerts you ask for. Watching a saved decision and telling you when it changes. Data: email address, the decision’s inputs and its result, alert settings. Legal basis: performing what you asked for (Art. 6(1)(b) GDPR). Kept: Kept until you delete it with the link in any alert email, or ask us to.
- Browser alerts. Delivering the alerts you switched on. Data: the browser’s push address and the alert, encrypted for your browser. Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with effect for the future. Kept: Kept until you switch the alerts off, or the push service ends the subscription.
- Accounts. Signing you in and keeping what you saved. Data: email address, sign-in records, and what you keep in the account. Legal basis: performing what you asked for (Art. 6(1)(b) GDPR). Kept: Kept until you delete the account, or ask us to.
- Error reports. Finding and fixing faults. Data: the error, the page and the browser’s identification. Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with effect for the future. Kept: Kept by Sentry for at most 90 days, while error reporting is configured.
- Payment for a paid plan, when one is offered. Taking payment and keeping the plan’s state. Data: email address and payment events (Stripe holds the card details). Legal basis: performing what you asked for (Art. 6(1)(b) GDPR). Kept: Payment events are deleted after 90 days; the invoices themselves are accounting records kept for the statutory period.
- Reading the balances of an address you paste. Showing the balances you asked for. Data: the Ethereum address. Legal basis: performing what you asked for (Art. 6(1)(b) GDPR). Kept: Kept only in your browser; our server sends the address and keeps nothing.
- The waiting list for a paid plan. Telling you when the plan opens. Data: email address. Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with effect for the future. Kept: Kept until the plan opens or you ask us to remove it.
- Reports of an error on the site, and our answer. Checking and correcting what we publish, and telling you what became of your report if you asked us to. Data: what you write, the page and figure the report is about, a reference, and, only if you give it and tick the box, an email address for the receipt and the outcome. Legal basis: our legitimate interest (Art. 6(1)(f) GDPR), in publishing correct information and answering the people who tell us it is wrong. Kept: The report is kept, without any contact detail, as part of the public record of corrections. An email address you gave is mailed nothing but a confirmation link until you confirm it, and erased after 7 days if you never do; once confirmed it is kept only while the report is open and for 30 days after it closes, so the outcome can reach you, and then erased.
- Evidence that a privacy request was carried out. Showing, if asked, that an erasure was done (Art. 5(2) GDPR). Data: the request’s time and a keyed hash of the IP address it came from. Legal basis: a legal obligation (Art. 6(1)(c) GDPR). Kept: Deleted after three years, the regular limitation period within which the handling of a request can be disputed (§ 195 BGB).
Security: Every connection is encrypted (TLS, HSTS). The database enforces row-level security on every table, and only server functions hold its service key. IP addresses used for rate limiting are hashed with a server secret before they leave the server. Server logs redact email addresses and tokens before they are written.
Services that receive data about you to run ChainChoice
- Vercel (Vercel Inc., USA). Hosts the site and runs its server functions and edge cache. Receives every request’s IP address, browser identification and the address of the page or data asked for, in its request logs. Legal basis: Legitimate interest in delivering and securing the site (Art. 6(1)(f) GDPR). Transfer: EU–U.S. Data Privacy Framework: an active participant on the official list, read 2026-10-10. Where: Server functions run in Washington, D.C., USA (Vercel region iad1); pages and files are served from the Vercel edge location nearest you, and its request logs are kept in the USA.
- Supabase (Supabase, Inc., USA; data stored in Frankfurt, Germany). The database: saved decisions, accounts and anonymous usage events. Receives your email address and the inputs and result of a decision you save; your account when you create one, your browser contacting it directly to sign you in and keep you signed in; after you accept analytics, the steps of an anonymous session, without your IP address. Legal basis: Performing what you asked for (Art. 6(1)(b) GDPR); for the usage events, your consent (Art. 6(1)(a) GDPR). Transfer: Stored in the EU. Access from the USA is covered by the EU Standard Contractual Clauses (modules 2 and 3) in Supabase’s data processing addendum (version 1, 1 August 2026), part of its terms. Supabase is not on the Data Privacy Framework list. Where: Frankfurt, Germany.
- Upstash (Upstash, Inc., USA). Counts requests per visitor to stop abuse. Receives a hash of your IP address keyed with a server secret, never the address itself, inside a counter that expires with its window: one minute for most requests, one hour at most. Legal basis: Legitimate interest in keeping the service available (Art. 6(1)(f) GDPR). Transfer: EU–U.S. Data Privacy Framework: an active participant on the official list, read 2026-10-10. Where: The region chosen when the counter database was created, which this register has not yet read; Upstash, Inc. is in the USA.
- Groq (Groq, Inc., USA). The language model that writes the assistant’s answers. Receives when you ask the assistant: your question, the conversation so far, the page you ask from, and the profile and holdings saved in this browser (country, experience, goals, amounts). Legal basis: Performing what you asked for (Art. 6(1)(b) GDPR). Transfer: The EU Standard Contractual Clauses (modules 2 and 3) in Groq’s data processing addendum (effective 15 October 2025), part of its services agreement. Groq is not on the Data Privacy Framework list. Where: The USA.
- Anthropic (Anthropic, PBC, USA). A second language model for the assistant, and the model the search bars ask when their own rules cannot read a search, each used only while it is switched on (the search one is off by default). Receives the same as Groq, when it answers instead; and the words of a search the rules could not read, when the search model is switched on. Legal basis: Performing what you asked for (Art. 6(1)(b) GDPR). Transfer: The EU Standard Contractual Clauses (modules 2 and 3) in Anthropic’s data processing addendum (effective 24 February 2025), part of its commercial terms. Anthropic is not on the Data Privacy Framework list. Where: The USA.
- Tavily. Web search for the assistant’s research tool and the regulator feed. Receives the search terms the assistant writes from your question. Legal basis: Performing what you asked for (Art. 6(1)(b) GDPR). Transfer: Not switched on: it is not on the Data Privacy Framework list and publishes no transfer terms, so it is used only once a transfer tool is in place. Where: None while it is not switched on.
- Resend (Plus Five Five, Inc., USA). Sends the emails you ask for: verification and drift alerts. Receives your email address and the email’s content, when you save a decision or ask for alerts. Legal basis: Performing what you asked for (Art. 6(1)(b) GDPR). Transfer: EU–U.S. Data Privacy Framework: an active participant on the official list, its re-certification under review, read 2026-10-10. Where: The USA.
- Cloudflare Web Analytics (Cloudflare, Inc., USA). Counts page views and load times without cookies. Receives the page you view, its load timings and your browser’s identification, only after you accept analytics. Legal basis: Your consent (Art. 6(1)(a) GDPR, § 25 TDDDG). Transfer: EU–U.S. Data Privacy Framework: an active participant on the official list, its re-certification under review, read 2026-10-10. Where: Collected at the Cloudflare location nearest you and stored in the USA.
- Sentry (Functional Software, Inc., USA). Error reports, while error reporting is configured. Receives from your browser, only after you accept analytics, the error, the page it happened on and your browser’s identification; from our server, the error and the request’s route, without your IP address. Legal basis: Your consent for browser reports (Art. 6(1)(a) GDPR); legitimate interest in a working service for server reports (Art. 6(1)(f) GDPR). Transfer: EU–U.S. Data Privacy Framework: an active participant on the official list, read 2026-10-10. Where: Sentry’s US region, or its EU region for a project set up there; no project is configured in production.
- Request tracing (the OpenTelemetry service it is pointed at). Timing and status of server requests, sent only while such a service is configured. None is. Receives the route, timing and status of a request, without your IP address. Legal basis: Legitimate interest in a working service (Art. 6(1)(f) GDPR). Transfer: None is configured; a service outside the EU is configured only with a transfer tool in place. Where: None while none is configured.
- Stripe (Stripe, LLC, USA). Takes payment for a paid plan, when one is offered. Receives your payment details and email address, entered on Stripe’s own checkout page. Legal basis: Performing a contract you enter (Art. 6(1)(b) GDPR). Transfer: EU–U.S. Data Privacy Framework: an active participant on the official list, read 2026-10-10. Where: The USA.
- PublicNode (Allnodes). Ethereum balances for an address you paste on the account page. Receives the address you paste, sent by our server, never your IP address. Legal basis: Performing what you asked for (Art. 6(1)(b) GDPR). Transfer: A public interface with no data processing agreement: it is sent the address and nothing else about you. Where: Allnodes’ public nodes, whose locations it does not publish.
- Your browser’s push service (the company behind your browser: Google LLC, Apple Inc., Microsoft Corporation or Mozilla Corporation, USA). Delivers the browser alerts you switch on. Receives your browser’s push address and the alert, encrypted so that only your browser can read it, only after you switch on browser alerts. Legal basis: Your consent (Art. 6(1)(a) GDPR, § 25 TDDDG). Transfer: Chosen by your browser, not by us. Each company’s participation in the EU–U.S. Data Privacy Framework has not yet been read for this register. Where: The USA, at the push service your browser chose.
Referral programmes: a paying link carries a code and a random click reference, never data that identifies you
- impact.com (Impact Tech, Inc., USA). Runs the referral programmes of the providers in its network (on 2026-10-20, Bitpanda and Coinbase, both pending): it records which sign-ups came through a ChainChoice link and pays the commission. Receives nothing from us that identifies you. When you follow a paying link, the link carries ChainChoice’s referral code and a random click reference, and the provider and impact.com record your visit under their own privacy policies; they report back only whether a sign-up qualified, against that click reference. Role: An independent controller for its own tracking (Art. 4(7) GDPR), not our processor. Legal basis: For the click reference and the outcome reported against it: our legitimate interest in being paid for a referral (Art. 6(1)(f) GDPR). Transfer: None from us: your browser goes to the provider itself, and the outcome reported back is stored with our database in Frankfurt. Where: The USA, for impact.com’s own records.
- Providers’ own referral programmes (the provider whose link you follow, such as Ledger). A provider that runs its own programme records which sign-ups came through a ChainChoice link and pays the commission. Receives nothing from us that identifies you: the link carries ChainChoice’s referral code and a random click reference, and the provider records your visit under its own privacy policy. Role: An independent controller for its own tracking (Art. 4(7) GDPR), not our processor. Legal basis: For the click reference and any outcome reported against it: our legitimate interest in being paid for a referral (Art. 6(1)(f) GDPR). Transfer: None from us: your browser goes to the provider itself. Where: Wherever the provider keeps its records, as its own privacy policy states.
Read only by our server: they receive nothing about you
- CoinGecko. Prices, market data and the coin list. Receives nothing about you: our server asks, and your browser reads the answer from this site.
- DeFi Llama. Yields, total value locked, stablecoin and DEX volumes. Receives nothing about you: our server asks, and your browser reads the answer from this site.
- alternative.me. The crypto fear and greed index. Receives nothing about you.
- CryptoCompare (CCData). News headlines. Receives nothing about you.
- Public chain and market data (L2BEAT, beaconcha.in, chainid.network, CoinPaprika, Coinbase Exchange and 1inch). Rollup, validator, chain and market facts the comparisons cite. Receives nothing about you.
- Regulators (the U.S. SEC’s EDGAR, the U.S. Treasury’s sanctions list, and the licence registers of ESMA, the New York DFS, GLEIF and the UK FCA). Filings, sanctioned addresses and the licences firms hold. Receives nothing about you.
- Drainer and scam lists (GoPlus, scams.so and WalletGuard). Known wallet-drainer addresses. Receives nothing about you.
- GitHub (GitHub, Inc., USA). Public address labels, the identity of our own build jobs, the issues our extraordinary-review watcher files in our own repository, and the licence-register snapshots our daily register sync commits to it. Receives nothing about you.
- Bing Webmaster Tools (Microsoft Corporation, USA). Telling Bing which of this site’s pages to crawl. Receives nothing about you: our server sends up to 100 of our own page addresses a day.
- Google Search Console (Google LLC, USA). How this site appears in Google Search. Receives nothing about you: our server reads our own search data.
The Octopus terminal, a separate product not currently offered on chainchoice.io
- Blockchain data providers (Blockchair, ENS Ideas, Koios, TronGrid, XRPSCAN, Mintscan, Toncenter, Keplr, mempool.space, Etherscan, Alchemy, Helius, Reservoir, DEX Screener and Cloudflare’s Ethereum gateway). Balances, names, approvals and holdings of the addresses you add to the terminal. Etherscan also gives the comparison pages gas prices, a request that carries nothing about you. Receives the addresses (or an extended public key) you add and the symbols you hold, sent by our server, never your IP address. Legal basis: Performing what you asked for (Art. 6(1)(b) GDPR). Transfer: Most are public interfaces with no data processing agreement: they are sent what you add and nothing else about you. The keyed ones (Alchemy, Helius, Reservoir) are not configured.
- Chainalysis (Chainalysis Inc., USA). Sanctions and cluster screening of addresses you add, while it is configured. Receives the addresses you add, sent by our server. Legal basis: Legitimate interest in not serving sanctioned addresses (Art. 6(1)(f) GDPR). Transfer: EU–U.S. Data Privacy Framework: an active participant on the official list, read 2026-10-10.
- Custody, brokerage and signing connections (Anchorage Digital, Fireblocks, Mesh Connect and DocuSign). The accounts and mandates you connect in the terminal, while they are configured. Receives your account identifiers, holdings and the documents you sign, when you connect or sign. Legal basis: Performing what you asked for (Art. 6(1)(b) GDPR). Transfer: None is configured; each is configured only with a transfer tool in place.
- Pinata and Voyage AI (Pinata, USA, and Voyage AI, part of MongoDB, Inc., USA). Publishing a receipt you choose to pin, and finding similar memos, while configured. Receives a receipt you pin, which becomes public on IPFS; the text of your memos and receipts, for similarity. Legal basis: Performing what you asked for (Art. 6(1)(b) GDPR). Transfer: Neither is configured; each is configured only with a transfer tool in place.
- Push and SMS alerts (Google LLC’s Firebase Cloud Messaging and Twilio Inc., both USA). Alerts you ask the terminal to send, while configured. Receives your device token or phone number and the alert’s text. Legal basis: Performing what you asked for (Art. 6(1)(b) GDPR). Transfer: EU–U.S. Data Privacy Framework: both are active participants on the official list, read 2026-10-10.
- CryptoPanic. Headlines in the terminal. Receives nothing about you.
- Google Fonts and unpkg (Google LLC, USA, and the public code hosts unpkg and jsDelivr). The receipt PDF’s fonts, and the text-recognition engine for a document you scan. Receives your IP address and browser’s identification, from your browser, when you generate a receipt PDF or scan a document. Legal basis: Performing what you asked for (Art. 6(1)(b) GDPR). Transfer: Google LLC is an active participant in the EU–U.S. Data Privacy Framework (official list, read 2026-10-10); the code hosts have no data processing agreement.
One JSON file: everything ChainChoice keeps in this browser, and the rows our server holds for this browser’s analytics session. Signed in, it adds everything your account holds.
Right of access (Art. 15 GDPR): request a copy of all data held linked to your email.
Right to rectification (Art. 16 GDPR): correct inaccurate data held about you.
Right to erasure (Art. 17 GDPR): delete all data linked to your email. Use the "Delete all my data" link in any drift alert email, or email privacy@chainchoice.io.
Right to restriction of processing (Art. 18 GDPR): ask us to keep your data but stop using it while a question about it is settled.
Right to data portability (Art. 20 GDPR): receive the data you gave us in a machine-readable format. The button above downloads, as one file, what this browser keeps and the rows our server holds for its session; signed in, it adds everything your account holds, including what is kept under its confirmed email address (saved decisions, alerts, subscriptions). Without an account, write to privacy@chainchoice.io.
Right to object (Art. 21 GDPR): object at any time to processing based on our legitimate interest, for reasons arising from your situation; and stop receiving alerts at any time via the unsubscribe link.
Right to withdraw consent (Art. 7(3) GDPR): withdraw any consent at any time, with effect for the future, without affecting what was done before.
Right to lodge a complaint (Art. 77 GDPR) with a supervisory authority, in particular the one where you live or work, or ours: the LDI NRW, named in section 1.
Write to privacy@chainchoice.io to use any of these rights. We answer within one month of receiving the request (Art. 12(3) GDPR), and say why if we need longer.
You do not have to provide any personal data to use ChainChoice. Saving a decision or receiving alerts needs an email address; without one, the engine works without saving.
ChainChoice ranks providers by published criteria and, when you answer its questions, by your answers. It takes no decision about you that has legal or similarly significant effects (Art. 22 GDPR): it shows a ranking, and you decide what to do with it.
What the assistant infers about you (profiling, Art. 4(4) GDPR). From what you write and do, the assistant keeps a user model: your goals, recurring concerns, past decisions, rejections and convictions, kept with your account, or for an anonymous reader who allowed analytics for 30 days after its last use. From that model, the answers it gave you before and the last 90 days of what you did with them, it scores an archetype of how you decide. For each question it reads the emotional tone (worry, fear of missing out, fatigue, regret, overconfidence) and the communication style, to set the tone and length of its answer; those two reads are not stored.
None of this decides anything about you. It shapes the wording and emphasis of an answer, never which provider ranks first: the ranking follows the published criteria and your answers to its questions, and the answer is checked against that ranking before you see it. The stored model is in your data download (section 7). You can switch all of it off below; the assistant then keeps no model of you and answers from what you write in the conversation.
On: the assistant adapts its answers to the model it keeps of you, as described above.
Some recommendations link to providers with whom ChainChoice has affiliate agreements. When you follow a link on this site that carries a provider's referral code and then sign up with, deposit at or transact with that provider, and the provider confirms it, the provider pays Simi Ventures GmbH, which operates ChainChoice, a commission. This never affects scoring or ranking — see Editorial Policy for details.
A link to a provider carries tags that name ChainChoice, the category and the place on the page; a paying link also carries the referral code and a random click reference. None of them identifies you. The programmes that receive them are listed in section 5.
Saved-decision subscribers are notified by email of material changes. The current version and effective date are listed at the bottom of this page.
Simi Ventures GmbH, Kiefernweg 18, 53127 Bonn, Germany. Privacy questions: privacy@chainchoice.io. Response within one month.