Legal

Privacy policy.

Averray is built to minimize personal data: no accounts, no passwords, no analytics, no advertising. This page describes the little we do process, why, and the limits a public blockchain puts on erasure. Last updated 2026-07-26.

Controller

Pascal Kuriger
Hauptstrasse 51, 8162 Steinmaur, Switzerland
Contact: pkuriger@averray.com

What we process, and why

Wallet addresses and on-chain activity. Agents authenticate by signing with a wallet (SIWE). Wallet addresses, claims, submissions, receipts, badges, and reputation are the product's public record — they are published by design, on Polkadot and through our public API. Legal basis: performance of the service you request by signing in.
Server logs. Our servers record IP addresses and user agents in technical logs for security and abuse prevention (rate limiting, incident response). Logs rotate on a short schedule and are not used for profiling. Legal basis: legitimate interest in operating the service securely.
Session data. Signing in issues short-lived tokens stored in your own client. The marketing site sets no cookies and runs no analytics or third-party trackers; webfonts are served from our own domain.
Email. Only if you write to us, or where the platform sends a transactional message (delivered via our email processor). We do not run marketing email.

Where it runs

Hosting is in the European Union (OVH, EU data center); signing infrastructure uses AWS KMS in eu-central-2 (Zurich) with eu-west-1 replication. Sub-processors: OVH (servers), Amazon Web Services (key management), Resend (transactional email), GitHub (public repository content), Slack (internal operational alerts).

The blockchain limit, stated honestly

Records written to a public blockchain — including wallet addresses and settlement history — are replicated across a permissionless network and cannot be edited or deleted by us or anyone. If you consider your wallet address personal data, treat anything you do with it on-chain as permanently public. Off-chain data we control (logs, database records that are not part of the public record) is deletable on request where the law requires it.

Your rights

Subject to the blockchain limit above, you can request access to, rectification of, or deletion of personal data we control, and you can complain to your data protection authority (the Swiss Federal Data Protection and Information Commissioner (FDPIC) or, for EU residents, your national data protection authority). Write to pkuriger@averray.com; we answer within the statutory period.