1. Who we are
In this policy, "Cleave", "we", "us" and "our" have the meaning given in Section 1 of the Terms of Use: they refer collectively to the Cleave Parties, without identifying any of them. Cleave is the controller of the personal data processed in the Services. Contact: info@cleave.fi. Email is the contact method this policy provides where the law allows email.
2. Summary
- We do not ask you to create an account or to give a legal name, an identity document, a private key or a seed phrase. If you type a name, email, handle or other detail into a form, a message or a tool argument, we receive what you send.
- Wallet addresses, transactions and balances on public blockchains are public. Anyone can see them, and nobody can delete them.
- To give you quotes and track transfers, we process the wallet addresses, tokens, amounts, chains and transaction hashes contained in your requests.
- We use your IP address only briefly, for example for rate limits and bot checks. We configure our own application logs and databases not to store raw IP addresses. Our hosting and network providers keep IP addresses in their own request logs, for the periods in Section 8.
- The website sets no analytics or advertising cookie of its own and runs no advertising or analytics trackers of its own. It stores some data in your browser so the app works, such as your transaction history.
- We do not sell your personal data, and we do not share it for cross-context behavioural advertising.
3. Data we collect
3.1 Public blockchain data
When you sign a transaction, it is recorded on a public blockchain with your wallet address, the recipient, the tokens, the amounts and other details. This data is public, permanent and outside our control. We read public blockchain data, through our own and third-party nodes and indexers, to build quotes, check routes, track transfers, complete deliveries and detect risk.
Wallet addresses and transaction data on a public chain are personal data when they can be linked to a person. We usually obtain that data from the chain or from your request, not by asking you for a profile. Where we obtain it from the chain, telling each affected person individually is impossible or would be a disproportionate effort, because the data is public and the set of addresses is unbounded. This policy is the notice of that processing. We cannot correct or delete data held on a public chain.
3.2 Request data
When you use the app, the APIs or the Agent Services, your requests may contain:
- wallet addresses (for example the sending wallet, the recipient and, for some features, a refund address);
- tokens, amounts, chain IDs, slippage and other quote settings;
- transaction hashes, quote request IDs and order details;
- a partner key identifier, for partner requests;
- the app or client version; and
- for Agent Services, tool arguments, prompts or other free-text fields.
A tool argument, prompt or other free-text field may contain whatever the sender puts in it. We treat that text as request data, and we do not ask an Agent to send a person's name, message contents or identity documents. We use request data to answer the request. We log a summary of each API request (for example the route, chains, token addresses, amounts, status, timings, errors and partner key identifier) for operations, security and statistics. We configure our log lines not to contain an IP address; some, such as logs of diagnostic reports and relayer activity, contain transaction hashes or wallet addresses. Our hosting and network providers may also record the full request, including its URL (which can contain wallet addresses and transaction hashes) and IP address, in their own request logs.
3.3 Network and device data
- IP address. Our network provider passes us the IP address of each request. We use it only transiently: as the key for rate limits; to check, together with our bot-check provider, that a contact message or diagnostic report comes from a person; and, for partner keys, to enforce an IP allowlist the partner chose. We configure our own application logs, databases and metrics not to store a raw IP address. Where abuse prevention needs a record, we store a salted hash, with a salt that changes every day, for up to one day. Hosting and network providers keep IP addresses in their logs for the periods in Section 8.
- Coarse location and network. From the IP address our network provider derives the country, the network (ASN) and the data center that served the request. We log these in request logs. We do not collect precise location.
- Device and browser data. Your browser sends standard information such as the user agent. Our hosting providers process it in their request logs. We do not use a vendor whose product is a persistent device fingerprint, and we do not build an identifier for that purpose.
3.4 Contact messages
If you use the contact form, we receive the topic, your message, the page you sent it from and the app version, plus anything you choose to add: a reply address (an email address, a social handle or a wallet address), a transaction hash, a chain, and your wallet address if you tick the option to include it.
3.5 Diagnostic reports
When a transaction fails or a transfer is delayed, the app may automatically send us a diagnostic report so we can find and fix the problem. A report can contain the report type, chain IDs, transaction hashes, a quote request ID, the route, the token, the amount, the recipient address, an error message and the app version. It never contains private keys.
3.6 Relayer, gas top-up and payments
- When our Relayer completes a delivery, or a gas top-up is ordered or executed, we process the transaction and order details: chains, transaction hashes, sender, recipient and refund addresses, amounts, fees and status.
- When you pay through x402 or another payment protocol, the payment authorisation (including the paying address, amount and nonce) passes through us and a third-party payment facilitator. The facilitator processes it under its own privacy policy and may screen it.
3.7 Partners and API key holders
For partners we keep a partner identifier, a hash of each key, its status and limits, any IP allowlist the partner set, timestamps and internal notes, plus the business contact details the partner gives us.
3.8 Data stored in your browser
The site does not set an analytics or advertising cookie of its own. It uses your browser's local storage and session storage to:
- keep your transaction history, so you can track and recover transfers (stored on your device only);
- remember settings such as slippage, imported tokens and the last wallet you connected; and
- cache token lists, prices, balances and API metadata so pages load faster.
This data stays on your device until you clear it. Storage needed to carry out a quote, swap or transfer you request (such as your transaction history), and storage of settings you chose, is used on the basis the law allows for that storage. WalletConnect and Cloudflare Turnstile may set their own cookies or similar storage; their policies govern that storage.
3.9 Data we do not collect
We do not ask for your legal name, postal address, phone number, identity document, private key or seed phrase, and we do not run advertising, analytics or session-recording trackers of our own. If you type such a detail into a form, a message or a tool argument, we receive what you send. We will never ask for your seed phrase or private key.
4. Third parties your browser contacts directly
To work, the app connects from your browser straight to third-party services. They receive your IP address and the request, which may include your wallet address or transaction hashes, under their own privacy policies:
- public blockchain RPC nodes, to read balances and send transactions;
- block explorers and indexers, to show your activity and transaction status;
- name-resolution services, to look up names such as .eth names;
- token-list and token-image hosts, to show token names and logos;
- status services of third-party protocols and bridges, to track cross-chain transfers;
- WalletConnect (Reown), when you connect a wallet through WalletConnect; its software may also send its own usage and error data to WalletConnect; and
- Cloudflare Turnstile, the bot check used on the contact form and some requests.
Your wallet software is also a third party, with its own privacy practices.
5. How we use data
We use data to:
- provide the Services: quotes, routes, transaction data, tracking, deliveries, gas top-ups and support;
- keep the Services secure and available: rate limits, bot checks, abuse and fraud prevention, and protecting users, partners and the Contracts;
- detect and fix problems, such as failed transactions, risky tokens and delayed transfers;
- measure and improve the Services, using aggregated statistics;
- answer your messages;
- manage partner access, limits and referral fees;
- comply with law, sanctions, and lawful requests from authorities; and
- establish, exercise or defend legal claims and enforce our Terms.
We do not use personal data to advertise, and we do not build marketing profiles. We do check requests, tokens, addresses and transactions for security, abuse, sanctions, and whether a route can be served. Those checks decide only whether we serve the request. They are not a decision about credit, employment, insurance or another legal entitlement. You can object to checks that rely on legitimate interests, as Section 11 describes; we will then stop, unless we show compelling grounds or the check is required by law.
6. Legal bases (EEA and UK)
Where the GDPR or UK GDPR applies, we rely on:
- Contract, where a contract exists: to return the quote, route, delivery, Gas Top-Up or partner service you asked for (Sections 3.2 and 3.6, and 3.7 for partners);
- Legitimate interests, where no contract was formed or the activity is wider than performing it: to answer that same request, to secure the Services, to prevent abuse, to send and act on diagnostic reports, to keep short operational logs, to receive and answer contact messages (including optional details you choose to add), to improve the Services with the metrics in Section 8, and to defend claims. Our interests are balanced against yours, and you may object;
- Legal obligation: where a specific law requires us to process data, including a binding sanctions or law-enforcement duty. A voluntary block is legitimate interests, not a legal obligation; and
- Consent: only where we ask for it separately. You can withdraw consent at any time, without affecting earlier processing.
Browser storage that is strictly necessary to provide the app you request is used without consent, as the law permits.
7. Sharing
We do not sell personal data. We share it only with:
- Service providers (processors) acting for us: hosting and content-delivery providers, network and security providers (including bot checks), cloud database and log providers, blockchain node (RPC) providers, and a messaging service we use to receive contact messages and operational alerts;
- Third-Party Services on your route: when you sign a transaction, its data goes to the blockchain and to the protocols, bridges, liquidity sources, relayers or payment facilitators on that route, which act under their own terms and policies;
- Partners: if you reach Cleave through a partner's app, that partner sees what you do in its app; we share with a partner only data about its own requests and fees;
- Authorities and others where required: to comply with law, a court order, sanctions or a lawful request, or to protect the rights, safety and property of Cleave, our users or others; and
- Successors: a person that later becomes a Cleave Party, including through a transfer of the Services or of assets, subject to this policy.
8. Retention
The table shows how long each kind of data is kept today. Most periods are 90 days or less.
| Data | How long |
|---|---|
| Rate-limit and bot-check use of your IP address | Transient; salted daily hashes up to 1 day |
| Quote records (request ID, tokens, amount, recipient, transaction data) | Up to 2 hours |
| Request logs we write (no IP address; some lines contain a transaction hash or a wallet address) | 90 days |
| Hosting and network provider request logs (can contain an IP address and a full URL, which can contain a wallet address or a transaction hash) | Up to 30 days under the settings we use; a provider's own stated period applies to its logs, and we do not control a provider's backup cycle |
| Usage metrics (no IP address, no wallet address; may include a partner key ID, chains, tokens and a data center) | About three months, the period fixed by our provider, which can be a few days over 90 |
| Relayer and delivery records (chains, transaction hashes, sender, recipient, amounts, fees, status) | Up to 90 days; some message records up to 30 days |
| Gas top-up orders and payments | Up to 90 days |
| Alerts, risk detections and diagnostic report results in our systems | Up to 90 days |
| Copies of contact messages, diagnostic reports and operational alerts delivered to our messaging tool (message, reply address, wallet, transaction hash, recipient) | 30 days |
| Partner key records | Until the key is revoked; a revoked marker is kept so the key cannot be reused |
| Data in your browser | Until you clear it |
| Public blockchain data | Permanent and outside our control |
Public token data, such as token lists and token risk flags, is not personal data and may be kept longer. We may keep data longer if the law requires it, or to deal with a specific security incident or legal claim, only for as long as needed.
9. International transfers
We and our providers process data in countries other than yours, including the United States. Where the GDPR or UK GDPR requires a tool for that transfer, we use, as applicable: an adequacy decision, including the EU-US Data Privacy Framework for a US provider that is certified; the European Commission's standard contractual clauses, with the UK Addendum or the UK International Data Transfer Agreement for UK data; and any further measure the law then requires. The standard contractual clauses stay in place whatever happens to the Data Privacy Framework. Email info@cleave.fi for the relevant instrument and the providers it covers.
10. Security
We use technical and organisational measures to protect data, including encryption in transit, access controls, data minimisation, hashing of IP-derived keys with rotating salts, and short retention. No system is perfectly secure. You are responsible for the security of your wallet, keys, devices and Agents.
11. Your rights
11.1 EEA and UK
Under the GDPR and UK GDPR you have the right to access, correct and delete your personal data, to restrict or object to processing (including processing based on legitimate interests), to data portability, and to withdraw consent. You may complain to your local data protection authority, and we ask that you contact us first so we can try to help.
11.2 California and other US states
If you are a California resident, the CCPA as amended by the CPRA gives you the right to know what personal information we collect, use and disclose; to access it; to delete it; to correct it; to opt out of its sale or sharing; to limit use of sensitive personal information; and not to be discriminated against for using these rights. In the last 12 months we collected these categories: identifiers (wallet addresses, IP addresses used transiently, and any email address or handle you send us); commercial information (transaction and order details); internet or network activity (request data and logs); coarse geolocation (country and network); and the contents of messages and reports you send us. We collected them from you, your browser or Agent, and public blockchains, for the purposes in Section 5, and disclosed them only to the recipients in Section 7. Telemetry that your wallet-connection software sends to its own operator is that operator's processing; we do not receive it back. We do not sell or share personal information, as those terms are defined in the CCPA, we do not give personal information to anyone for cross-context behavioural advertising, and we do not use or disclose sensitive personal information for purposes that require a right to limit. Residents of other US states with privacy laws have similar rights, and may appeal a decision by replying to our answer.
11.3 How to use your rights
Email info@cleave.fi. You may use an authorised agent. Because we do not hold accounts or names, we may ask you to prove control of a wallet address (for example by signing a message) or give details that let us find the data, and we may be unable to identify data that is not linked to you. We delete or anonymise data we hold that we can link to you, and we forward a deletion request to a processor where we can identify the record. We do not control copies in a provider's backup cycle or a provider's own logs. We cannot change or delete data on public blockchains, data held only in your browser, or data held by Third-Party Services under their own policies. We answer within the time the law requires.
12. Children
The Services are not for anyone under 18. We do not knowingly collect personal data from children. If you believe a child has sent us personal data, contact us and we will delete it.
13. Changes to this policy
We may update this policy by posting the new version at https://cleave.fi/privacy and changing the date. If we start processing a new category of data, or use data for a new purpose, including for a new product or feature, we will update this policy before we do it. Where the law requires consent, we will ask. Continued use after the new date is acceptance only to the extent the law allows a privacy notice to be accepted that way. It is not consent.
14. Contact us
Cleave Protocol. Email: info@cleave.fi. You can also use the form at https://cleave.fi/contact. Never send a seed phrase or private key.