Privacy Policy

1. Who we are

The traql service (traql.io, app.traql.io, api.traql.io and the @traqlcheckbot Telegram bot) is operated by Traql ("traql", "we", "us").

We are the data controller for the personal data described here. For any privacy question, or to exercise the rights in section 9, write to [email protected] — that address is monitored and is the fastest route to a human. Full operator details and a postal address are available on request to the same address, and are provided to regulators and data protection authorities on request.

2. What we collect

2.1 Account data

When you create an account we store your email address, a hash of your password (Argon2id — we never store the password itself and cannot recover it), whether the email has been verified, the date the account was created, and your balance of screening checks.

Email verification and password-reset links are stored only as SHA-256 hashes with a short expiry; the raw token exists only in the email we send you.

2.2 Session data

Signing in sets a single strictly necessary cookie, traql_session (HttpOnly, Secure, SameSite=Lax, scoped to .traql.io). It holds an opaque session identifier — no personal data is encoded in it. The matching session record lives in our Redis store and expires after 7 days, or immediately when you sign out.

2.3 API keys

API keys are stored as a short non-secret prefix plus a hash of the secret. The secret itself is shown to you once, at creation, and cannot be retrieved from us afterwards.

2.4 Usage records

For each screening request we record:

• timestamp, network, and whether the subject was an address or a transaction;
• the address or transaction hash that was screened (see section 4);
• the resulting risk score, band and flag categories;
• response time, HTTP status and payment status;
• the account or API key that made the request;
• a SHA-256 hash of the IP address. We do not store raw IP addresses in our usage records — the hash lets us detect abuse and enforce rate limits without keeping the address itself.

2.5 Payment data

Packs are paid by crypto invoice through our payment provider, NOWPayments. We never see or store card numbers or bank details. From a completed payment we keep the provider name, the provider's transaction reference, the amount as reported by the provider, and which pack was credited.

Keyless API calls paid over x402 settle on the Base network. The paying wallet address and the transaction are public on-chain by the nature of the protocol; we retain the payment reference to prevent the same payment being replayed.

In the Telegram bot, packs may also be paid with Telegram Stars, which is handled entirely by Telegram under its own terms.

2.6 Telegram bot data

If you use the bot, we store your Telegram user identifier, your bot check balance, and how you first reached the bot (for example, which link you came from). We do not receive your phone number or your Telegram contacts.

2.7 Site measurement (no cookies)

To understand how many people reach our site and how far they get, our own servers record a small set of events: a page view on the landing pages, the start and the result of a demo check, a click on a call-to-action button, and the signup and purchase steps in the dashboard. This is separate from the Google measurement described in section 6.

For each such event we keep:

• the event name, the page path (without its query string) and the timestamp;
• the host name of the site you came from — for example www.google.com — but not the full referring URL;
• whether the device is a phone or a desktop, derived from the user agent; we do not store the user agent itself;
• the campaign labels of an advertisement you clicked (utm_source, utm_medium, utm_campaign);
• a SHA-256 hash of your IP address, and a SHA-256 hash of the advertising click identifier (gclid). Neither the address nor the click identifier is stored in its original form, and the hashes cannot be matched back to an advertising profile.

This measurement reads and writes nothing on your device: no cookies, no local or session storage, and no device fingerprinting. Because it does not access your device and does not identify you, it runs on our legitimate interest in knowing whether our site works, and it is not governed by the cookie banner. You can still object to it under section 9.

2.8 Technical logs

Our servers and our CDN (Cloudflare) generate short-lived operational logs that may include IP addresses, user agents and requested URLs. These are used for security, abuse prevention and debugging, and are rotated on a short schedule.

3. Why we process it, and on what legal basis

4. Addresses and transactions you screen

Blockchain addresses and transaction hashes are public data on a public ledger. They are not, in themselves, information about you — but because a screening request is made from your account, we treat the pairing of the two as personal data and handle it accordingly.

We keep screened subjects to produce your result, to cache repeat lookups so they are fast, to bill correctly, and to measure and improve the quality of our scoring. We do not sell your query history, and we do not share it with third parties for their own purposes.

One thing to be aware of: to score an address we must read the chain. That means the address or transaction hash you submit is sent to the blockchain data providers listed in section 5, which is unavoidable for any on-chain analysis tool. We send them the address only — never your identity, your email or your account.

5. Who we share data with

We do not sell personal data. We share it only with the service providers we need to run traql, each bound to process it on our instructions:

We may also disclose data where we are legally required to — for example in response to a valid order from a competent authority — or to establish or defend legal claims.

traql is an independent product. The names above, and the names of the public data sources we ingest (see our FAQ), are used descriptively to identify those services and their data. They do not imply any partnership, sponsorship or endorsement.

6. Cookies and analytics

We keep this deliberately small. Two categories:

• Strictly necessary. The traql_session cookie described in section 2.2, and your cookie choice itself — a traql_consent cookie (Secure, SameSite=Lax, scoped to .traql.io so that one answer covers both this site and your dashboard, kept for six months). It holds nothing but the choice you made and its date, and our servers never read it. These are set without consent because the service cannot work without them.
• Analytics and advertising. Google Analytics and Google Ads measurement, delivered through Google Tag Manager, used to understand which pages bring sign-ups. These are set only after you consent. We implement Google Consent Mode v2: until you choose, analytics, advertising, ad-personalisation and ad-user-data storage are all denied by default, and the tag manager container itself sets no cookies.

You can change your mind at any time — change cookie preferences — or clear cookies in your browser. Refusing analytics does not limit any part of the service.

Separately from both categories, we run our own cookieless site measurement, described in section 2.7. It stores nothing on your device, which is why it is not part of the banner above; it is the reason we can keep the advertising cookies genuinely optional.

7. How long we keep it

• Account data — while your account exists, and for up to 30 days after you ask us to delete it (to absorb accidental deletions), then erased.
• Sessions — 7 days, or until you sign out.
• Email verification and reset tokens — until used or expired, a matter of hours.
• Usage records — up to 24 months, after which they are deleted or reduced to aggregates that identify no one.
• Site measurement events (section 2.7) — up to 24 months, then deleted or reduced to aggregates.
• Payment records — as long as tax and accounting law requires, typically up to 7 years.
• Server and CDN logs — 30 days.

8. Security

Passwords are hashed with Argon2id. Session tokens, API key secrets and email tokens are stored only as hashes. IP addresses in usage records are stored only as SHA-256 hashes. All traffic is served over TLS. Session cookies are HttpOnly and Secure, and state-changing requests are origin-checked against CSRF. Data is hosted in the European Union.

No system is perfectly secure. If you believe you have found a vulnerability, please report it to [email protected] before disclosing it publicly.

9. Your rights

Under the GDPR, the UK GDPR and comparable laws you can ask us to: give you a copy of your data; correct it; delete it; restrict or object to how we use it; provide it in a portable format; and withdraw any consent you have given (without affecting what we did before you withdrew it).

If you are in California, the CCPA/CPRA gives you rights to know, delete and correct, and to opt out of "sale" or "sharing" of personal information. We do not sell or share personal information as those terms are defined there, and we do not use it for cross-context behavioural advertising.

Email [email protected] and we will respond within 30 days. You can delete your account at any time from the dashboard. If you think we have handled your data badly, you are entitled to complain to your local data protection authority.

10. International transfers

Our infrastructure runs in the European Union (Frankfurt, Germany). Some providers listed in section 5 are established outside the EEA. Where data reaches them, the transfer relies on the European Commission's Standard Contractual Clauses or on an adequacy decision, together with the technical measures described in section 8.

11. Children

traql is a professional tool and is not directed at children. You must be at least 18 to create an account. If we learn that we hold data about a child, we delete it.

12. Changes to this policy

If we change this policy we will update the date at the top of this page, and for material changes we will notify account holders by email before the change takes effect.

13. Contact

Privacy and data requests: [email protected]
Legal notices: [email protected]
Security reports: [email protected]
General support: [email protected] or @traql_support_bot

Traql · operator details and postal address on request