Tarvis legal
 ← Back to home

Privacy Policy

Last updated: October 2026

1. Who we are

Tarvis (the "Service") is operated by ZORPH SRL, a limited liability company (société à responsabilité limitée / SRL) organized under the laws of the Republic of Moldova ("ZORPH SRL", "we", "us", "our"). ZORPH SRL is the data controller responsible for the personal data described in this policy. This policy explains what we collect, why, and your rights. Contact details are in Section 12.

2. We never hold your main keys or funds

Tarvis is a non-custodial service. To be explicit about the most sensitive category of data: we never store your wallet's main private keys or seed phrase, and we never take custody of your funds. To place trades on your behalf, we hold only a trade-only API/agent key, which we store encrypted at rest (AES-256-GCM). That key can place trades on your own exchange account but can never withdraw or transfer your funds, and you can revoke it at any time. We cannot move, withdraw, or access your assets.

3. Information we collect

  • Account data. Username and email address, and authentication data needed to operate your account.
  • Subscription and billing data. Plan, billing period, status, and payment metadata. Payments are handled by Stripe; we receive limited billing information (such as the last four digits of a card, card brand, and billing country) but do not store full card numbers. Full card data is collected and processed directly by Stripe.
  • Execution / usage data. Data generated as the Service runs your strategies server-side — such as your configuration, strategy state, signals acted on, order and position metadata, and performance metrics — so the dashboard can reflect your activity. This does not include your main keys or custody of funds.
  • Technical data. Basic device, browser, IP address, and server log data, and essential cookies, used to operate and secure the Service.
  • Usage statistics. Our own cookieless statistics of which pages are viewed, for how long, the referring site, country, and device type, and of the actions you take in the Service (such as connecting an account or starting a strategy — never your keys or passwords). When you are signed in they are tied to your account; otherwise to an anonymous identifier that changes every day and cannot be linked across days. Your IP address is not stored for this. We use no third-party analytics or advertising trackers.
  • Communications. Messages you send us (e.g., support requests).
  • AI assistant conversations. The questions you ask the in-dashboard assistant and its answers, and any feedback you submit through it.

4. How we use information

  • To provide, operate, and maintain the Service and your account;
  • To process subscriptions and payments (via Stripe) and prevent fraud;
  • To display your dashboard, analytics, and execution history;
  • To provide support and respond to your requests;
  • To secure, debug, and improve the Service;
  • To send service and transactional communications, and (where permitted) product updates you can opt out of;
  • To comply with legal obligations and enforce our terms.

Where required, our legal bases for processing include performance of our contract with you, our legitimate interests in operating and securing the Service, your consent (for example, for certain cookies or marketing), and compliance with legal obligations.

5. Service providers and sharing

We share personal data only as needed, including with:

  • Stripe — card payment processing and billing;
  • Google — "Sign in with Google" (receives your sign-in request and returns your name, email address, and profile picture to us) and reCAPTCHA bot protection on sign-up and sign-in forms (processes device, browser, and interaction data under Google's Privacy Policy);
  • Cloudflare — network delivery and security; all traffic to the site passes through Cloudflare, which processes IP addresses and request data to deliver the site and block attacks;
  • Hosting and infrastructure providers — to run the platform and store data on our behalf;
  • Zoho Mail — to send transactional email (account verification, password reset, billing, and performance reports);
  • OpenRouter (AI model routing) and the underlying AI model provider — used to power the in-dashboard and website assistant; the questions you ask and the relevant account data needed to answer are processed to generate a response;
  • Telegram — delivering the alerts you choose to receive there when you link your Telegram account, and routing your support and feedback reports to our team;
  • Legal and regulatory recipients — when required by law, to enforce our terms, or to protect rights and safety.

We do not sell your personal data. These processors are bound to handle data on our behalf under appropriate agreements.

6. Cookies and similar technologies

We use only essential cookies and similar technologies — to keep you signed in, protect against abuse (including Google reCAPTCHA on sign-up and sign-in forms), carry a referral code or a plan you picked through sign-up, and remember that you have seen the cookie notice. We do not use analytics or advertising cookies. Blocking essential cookies in your browser will stop sign-in from working.

7. Data retention

We retain personal data for as long as your account is active and as needed to provide the Service, then for the period required to meet legal, accounting, tax, and dispute-resolution obligations (generally up to the limitation periods required under applicable Moldovan and accounting law), after which it is deleted or anonymized.

8. Your rights

Depending on your location, you may have rights to access, correct, delete, port, restrict, or object to processing of your personal data, and to withdraw consent. You can exercise these rights from your account settings where available, or by contacting us (Section 12). You may also have the right to lodge a complaint with your local data-protection authority. We will respond as required by applicable law.

9. International transfers

ZORPH SRL is established in the Republic of Moldova, and we and our processors may process and store data in countries other than yours, including where Stripe and our hosting providers operate. In particular, our AI assistant provider (OpenRouter and the underlying AI model provider) may process data outside Moldova and the EEA. Where required, we rely on appropriate safeguards (such as standard contractual clauses or an adequacy decision) for international transfers.

10. Security

We use technical and organizational measures designed to protect personal data. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for safeguarding your account credentials, your main wallet keys, and your exchange accounts, which remain solely under your control.

11. Children

The Service is not directed to, and may not be used by, anyone under 18 (or the age of majority in their jurisdiction). We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it.

12. Changes and contact

We may update this policy from time to time. Material changes will be communicated by email or in-app notice, and the "Last updated" date will change. For privacy questions or to exercise your rights, contact ZORPH SRL at [email protected] (data-protection contact: [email protected]), or by mail at ZORPH SRL, Republic of Moldova.

Terms of Service · Home