Draft for review. This text has not been checked by a lawyer yet and is not legal advice.
Privacy notice
Last updated: 21 October 2026
This notice explains what personal data Halvion collects about its users, why, and what you can do about it. [Company legal name] is the controller of that data under the UK GDPR and the Data Protection Act 2018.
What we collect about you
| Data | Why | Legal basis |
|---|---|---|
| Your Telegram ID, name, username and profile photo | To create your account, sign you in and show who you are in the account menu | Contract |
| The beta key you used and the keys you were given | To run the beta, and to know who invited whom | Contract and legitimate interests |
| Plan, payment status and Stripe customer ID | To bill you and give you the right plan | Contract |
| For Solana payments: the invoice, the wallet address you paid from and the transaction | To match your payment to your account and keep billing records | Contract and legal obligation |
| The addresses you look up and when | To count lookups against your plan, apply fair use and keep the service secure | Contract and legitimate interests |
| Session records: sign-in times, a random device ID, a one-way hash of your IP address, rough location (country, city, network) and a hash of your browser type | To keep each account to one person and stop account sharing (see below) | Legitimate interests and contract |
| Basic technical logs (IP address, browser, error reports) | To run, secure and fix the service | Legitimate interests |
We do not get your card details. Stripe collects them and processes them under its own terms.
A Solana payment is public. Anyone can see the transaction, the amount and the wallet it came from on the blockchain, and nobody (including us) can delete it. We do not publish which account a payment belongs to.
We do not sell your data and we do not run advertising trackers.
Account sharing checks
Draft: needs solicitor review before it is published.
An account is for one person (section 5 of the terms). To check this, every session leaves a record with the details in the table above. We never store your IP address itself: when a request reaches us we work out a rough location from it, then keep only a one-way hash. Records are deleted after 180 days.
Software scores these records and raises a flag when an account looks shared, for example two devices in use at once or sign-ins from places too far apart to travel between in the time. A flag never bans anyone by itself. A member of our team reviews the evidence and makes the decision, and you can appeal it (section 5 of the terms). A ban also applies to the accounts the banned person invited, so we keep the record of who invited whom.
Cookies and browser storage
We set cookies that keep you signed in, and a device cookie holding a random ID that tells your devices apart for the checks above. We treat both as strictly necessary, so they do not need consent. Your theme, your time display and any private notes you add to an address are saved in your browser's local storage. They never reach our servers.
Public blockchain data
Our reports are built from public blockchain records, which contain addresses rather than names. Some addresses may belong to individuals. We label addresses based on on-chain evidence and use careful wording ("linked to", never "is"). We do not try to find out who an address belongs to, and our terms forbid users from using reports to expose anyone's identity.
If you believe an address in our reports belongs to you and want to raise a concern about how it is labelled, message @Scholarcc on Telegram. We will review it.
Who we share data with
We use these providers, each under a contract that protects your data:
- Telegram, for signing in and for the device confirmation messages our bot sends you;
- Supabase, for sign-in and our account database;
- Stripe, for payments;
- our hosting providers, for running the website and API;
Some of these providers process data outside the UK. Where they do, we rely on UK adequacy regulations or the International Data Transfer Agreement or Addendum.
How long we keep it
We keep account and billing data while your account is open and for six years after it closes, because tax law requires us to keep billing records. Lookup history is kept for 12 months. Session records are kept for 180 days. Technical logs are kept for 30 days. If we ban an account for sharing, we keep the decision and the evidence behind it for as long as we need them to handle an appeal or a legal claim.
Your rights
You can ask us for a copy of your data, or ask us to correct it, delete it, restrict how we use it, or send it to you in a portable format. You can also object to processing that relies on legitimate interests. Message @Scholarcc on Telegram and we will reply within one month.
If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk. We would appreciate the chance to put things right first.
Changes
If we change this notice in a way that matters, we will email you before the change applies.
Contact
Message @Scholarcc on Telegram with any question about this notice or your data.