Privacy Notice — Orientim

Orientim has no accounts, no database of users, no cookies, no analytics and no advertising trackers. It processes as little as a swap needs.

Draft: this text is under legal review and will be final before Orientim opens to the public.

1. Who is responsible

The controller of your personal data is Qazim Memeti, [registered address]. For anything about your data, write to [privacy email].

2. What we process, why, and on which basis

Data	Why	Legal basis
Your public wallet address, and your account for the token you receive	To read the chain for you, and to build, check and send the swap you ask for; to sign one swap at a time into your receiving account; to issue an API key bound to your wallet, and limit how many a wallet gets.	Providing the service you request
The swap: tokens, amounts, your minimum, and the transaction you signed	The same.	Providing the service you request
Your IP address	To limit how often requests can be made, counted by our servers (in Upstash Redis, which they share) and by our hosting provider's firewall, and to protect the service from abuse.	Our legitimate interest in security
Logs kept by our hosting provider: for each request, its time, the address requested (which can name a wallet or a token account), IP address and browser type; for each swap request, a few lines that together name the wallet the API key belongs to, the outcome (its error code, why a check refused it, with every address removed), which routes built it, the side of the fee and how long it took; and, when our servers fail, the error	Running, securing and troubleshooting the service, and counting errors and delays.	Our legitimate interest in security
For an API key: your wallet's SOL balance	To check that the wallet meets the minimum balance. It is not kept.	Providing the service you request
For an API key: the message your wallet signed, which accepts the Terms of Use, and its signature, your wallet address, the time, and the version of the skill that asked	To check that you control the wallet, and to keep a record that you accepted the Terms, which we can show if a dispute arises.	Our legitimate interest in establishing and defending legal claims
What you write to us	To answer you.	Our legitimate interest, or providing the service

We do not collect your name, email address (unless you write to us), identity documents, private keys or seed phrase. We keep no database of your swaps. For an API key we keep only the record that its wallet accepted the Terms (above): the key itself carries its wallet address and expiry, sealed so that only Orientim can verify it, and is never stored. The log lines above are the only record of a swap request, and they are deleted after the retention period below. They never contain your private key or your API key. We do not sell your data, use it for advertising, or profile you. When Orientim refuses a swap, for example an unsafe token, that is a technical rule about the transaction, not a decision about you.

3. Nothing in your browser

This site sets no cookies and keeps nothing in your browser's storage. The skill keeps its own records, such as the swaps in flight and its order book, on the machine where your agent runs, never on our servers.

4. Who receives it

We share personal data only as the service needs it, with:

Recipient	What for	Where
Vercel Inc.	Hosting; keeps the request logs and, in private storage, the record that you accepted the Terms	United States
Helius	Solana RPC provider: chain reads, simulations and your signed transaction, which include your wallet address	United States
Alchemy	Backup Solana RPC provider, asked only when Helius does not answer: the same data	United States
Upstash (Redis)	State our servers share: rate-limit counts, keyed by your IP address or your wallet address, and short-lived swap records, keyed by your receiving account, with the transaction's signature	United States
Jupiter	Building the route, or pricing the swap when your agent brings its own routes: the tokens, the amount and, for a route, your receiving token account	Outside the EU
The Solana network	Executes your signed transaction, which becomes public	Global and public

We may disclose data where the law, a court or a competent authority requires it, or to protect the rights and security of Orientim, its users or others.

5. Transfers outside your country

Some recipients are outside North Macedonia and the European Economic Area, including in the United States. Where the law requires it, transfers rely on an adequacy decision, including the EU–US Data Privacy Framework for certified recipients, or on the European Commission's standard contractual clauses. Write to us for a copy of the safeguards.

6. How long

Rate-limit counts: at Upstash and in our servers' memory, for the window they count, at most an hour, or 24 hours for the keys issued to a wallet; and at our hosting provider's firewall, for at most an hour.
Swap records at Upstash (which receiving account a swap in flight is signed into, and its signature): 10 minutes, past the time the transaction can still land.
Request logs and swap log lines at our hosting provider: up to [number of] days, then deleted.
The record that you accepted the Terms: while your API keys are valid, and up to 5 years after the last one expires, the time within which a claim about the Terms can be brought.
What you write to us: as long as needed to answer you, and up to 12 months after.

7. What is public by nature

Every Solana transaction, including your swaps and your wallet address, is public and permanent on the blockchain and can be read by anyone. No one, including us, can change or delete it. The rights below apply to the data we hold, not to the blockchain.

8. Your rights

You have the right to access your personal data, to have it corrected or erased, to restrict or object to its processing (including processing based on our legitimate interest), and to data portability. Because we hold almost nothing about you and cannot identify you from a wallet address alone, we may ask you to show that you control the wallet concerned. Write to [privacy email]; we answer within one month.

You may also complain to a data protection authority: in North Macedonia, the Personal Data Protection Agency; in the European Union, the authority of the country where you live.

9. Security

Connections are encrypted, the pages run under a strict content security policy, there is no database of users, and rate-limit counts are kept only for as long as they limit anything. No system is fully secure; see the risks.

10. Children

Orientim is not for anyone under 18, and we do not knowingly process children's data.

11. Changes

This notice may change. The version in force is the one on this page, with the date at the top.

12. Contact

Qazim Memeti, [registered address]. Privacy: [privacy email].