Aspis Privacy Policy

Effective date: 1 October 2026

If you had an account with us before 1 October 2026, this policy applies to you from 1 November 2026. Until then, our previous privacy policy continues to apply.

Summary

This summary gives the main points. The full policy follows.

• Who we are. Aspis Protocol Ltd, a company registered in England and Wales, is responsible for your personal data. The legal term for this is "controller". We trade as Aspis and as AgentCouncil. One account works across both.
• What we collect. We collect what you give us, such as your name, email address, wallet addresses, Telegram details and billing details. We also collect what your use of our services creates, such as sign-in records and your messages to Aspis Copilot, and we read public blockchain data.
• Why. We use your data to provide our services, take payments, keep things secure, meet our legal duties and understand how our services are used. We use analytics and advertising cookies, and send marketing emails, only if you agree to them.
• AI. Aspis Copilot sends your messages to OpenAI so that it can understand them and reply. OpenAI does not use them to train its models.
• Public data. Anything recorded on a blockchain is public and permanent. So are public vault listings (see section 11).
• No selling. We do not sell your personal data.
• Your rights. You can see, correct, download or delete your data, and you can object to some uses of it. Use the Privacy section of your account page, or email info@aspis.finance. You can also complain to the Information Commissioner's Office (ICO).
• Your right to object. You can object at any time to product update and marketing emails, and we will stop. You can also object to any other use of your data that relies on our legitimate interests (see section 15).

1. Who we are

Aspis Protocol Ltd is a private limited company registered in England and Wales under company number 15506799. Our registered office is at 167-169 Great Portland Street, 5th Floor, London W1W 5PF, United Kingdom. We trade under the names Aspis and AgentCouncil.

We are the controller of the personal data described in this policy. This applies under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. For people in the European Union, it also applies under the EU General Data Protection Regulation (EU GDPR). The same company is responsible for your data wherever you live or connect from.

We are registered with the Information Commissioner's Office. Our registration number is ZB866437.

If you are in the European Union, you can contact us about anything in this policy using the details above, and you can complain to your local data protection authority (section 21).

We have not appointed a data protection officer. For any question about this policy or your personal data, email info@aspis.finance.

2. What this policy covers

This policy covers the following services, which we call the "Aspis services":

• the aspis.finance website, including its enquiry and sign-up forms;
• the Aspis web app at v3.aspis.finance, including when it opens inside Telegram;
• Aspis Copilot, our Telegram bot (@aspisprotocol_bot);
• Copilot-run vaults, which are on-chain vaults that our software trades on your instructions if you choose automated trading (see section 4.5);
• our features for organisations, meaning the Company panel and the organisation API;
• your account and your subscription.

AgentCouncil (agentcouncil.org and dashboard.agentcouncil.org) has its own privacy policy: the AgentCouncil Privacy Policy. Because the account is shared, section 3 explains what the two brands have in common.

Some services you use alongside ours have their own privacy policies, and we do not control them. Examples are Telegram, Google, your wallet app, Revolut, and the blockchains themselves.

This policy explains how we handle personal data. It does not form part of your contract with us. Our Terms of Use, Subscription Terms and Risk Disclosure set out the terms of our services and their risks.

3. One account for Aspis and AgentCouncil

We run a single account system for the Aspis web app, Aspis Copilot and AgentCouncil. It runs on our servers under the AgentCouncil name (api.agentcouncil.org). The same company, Aspis Protocol Ltd, is responsible for all of it, and no other company is involved as a controller.

The following are shared across both brands:

• your identity and sign-in details: name, nickname, email address, password (in scrambled form), profile picture, Google sign-in, and linked wallets and Telegram accounts;
• your plan and billing records, because one Pro or Max plan covers Aspis, Aspis Copilot and AgentCouncil;
• your email preferences for product updates and marketing emails, which apply to emails from both brands;
• your sign-in, security and consent records;
• your organisation membership, if you have one.

If you use AgentCouncil with the same account, your AI chats and portfolio analyses are stored in your account too. The AgentCouncil Privacy Policy explains how we handle them. Our staff tools show some summary information about them, such as how many analyses you have run.

If you link your Telegram account in the Aspis web app and you have already used Copilot, your Copilot account record is merged into your web account. Its plan and history move across with it.

4. The personal data we collect

4.1 Your account

• Full name. This is required when you sign up with an email address. We use it as your display name, and you can change it. It is shown to you and, if you join an organisation, to that organisation's owner.
• Nickname. This is optional. It is a public handle, and other people can see it wherever we show it.
• Email address and password. We store your password only in scrambled (hashed) form, so we cannot read it.
• Google sign-in. If you use it, Google gives us your Google account ID, email address, name and profile picture. If we already have an account with the same email address, we link your Google sign-in to that account.
• Wallet sign-in. If you sign in with a wallet or link one to your account, we receive your wallet address and a signed message that proves you control it.
• Telegram link. If you link Telegram in the web app, Telegram gives us your Telegram ID, username, first and last name and a link to your profile photo. Telegram also asks whether our bot may message you.
• Profile picture. You can upload one (JPEG or PNG, up to 2 MB). It is stored at a public web address.
• Account settings and status. This covers your email preferences, your plan, organisation membership and role, whether you have confirmed your email address, and the dates you signed up and last signed in.

Accounts we create automatically. In three cases we create an account for you without a sign-up form:

• the first time you sign in with a wallet;
• the first time you use Aspis Copilot after choosing "I agree", using your Telegram ID;
• when our vault services receive a request that carries your wallet address or Telegram ID, for example when you create a Copilot-run vault or register as an investor through Copilot.

At first, these accounts hold only your wallet address or Telegram ID. You can add an email address and password later.

4.2 Sign-in and security records

• Sign-in sessions. Each time you sign in with email or Google, we record your IP address, a description of your browser and device (the "user agent") and the time. We also keep your sign-in tokens, in scrambled form.
• Activity record. We log sign-ups, sign-ins (including the email address and method used), password resets and changes, email confirmations, and Telegram links and unlinks.
• Records of your choices. We keep a record of when you accepted our terms and which version you accepted, when you changed your email preferences and when you made the express request at checkout (see section 4.3). Each record includes the date and time, your IP address and your browser description.
• Usage counts. Where we have switched this on, we keep daily counts of how many requests your account makes to our services, grouped by feature.
• Server logs. Our servers keep technical logs. These contain your IP address, your browser description and the addresses you requested, which can include your wallet address or Telegram ID. When something goes wrong, they also contain the content of the request. Copilot's logs contain the full content of each message you send it.

4.3 Subscriptions and payments

• Your plan. We record your plan, billing period, currency, start and renewal dates, whether you have cancelled, and the status of any renewal attempts. If our staff give you a complimentary plan, we record that and its end date.
• Checkout details. At checkout you type your cardholder name, billing address (street, city, region, postcode and country) and email address into our checkout form. These go to Revolut with your card details. Revolut sends the billing address back to us, and we store it with your account.
• Card details. You type your card number, expiry date and security code into Revolut's secure payment field. We never see or store your full card number or security code.
• Saved card. Revolut saves your card so that renewals can be taken automatically. We can see the card brand, the last four digits, the expiry date and the cardholder name, and we show these on the Billing tab of your account.
• Payment records. For each payment we keep the amount, currency, date, plan, card brand, last four digits, Revolut's order and payment references and the invoice number.
• Failed payments. For each failed payment we keep Revolut's reason for the decline, the card brand, the first six to eight digits of the card (which identify the bank that issued it), the last four digits and the expiry date.
• Invoices. We create an invoice in our accounting system, Xero. It holds your name, email address, billing address, plan, amount and payment reference.
• Billing emails. We keep a record of the billing emails we send you, such as receipts, renewal reminders, failed-payment notices and cancellation confirmations, including what they said.
• Express request at checkout. We record the date and time you ticked the box asking us to start your subscription straight away, and the version of the Subscription Terms you were shown. By ticking it you also acknowledge that you lose your 14-day right to cancel once the service starts.
• Your country. We use your IP address to look up your country with ipinfo.io. This lets us show prices in pounds, euros or US dollars.

4.4 Wallets, vaults and blockchain data

• Connected wallets. When you connect a wallet in the web app, our servers receive its address so that we can show your deposits and vaults.
• Vaults you create. For each vault we record its name, description, website and social links, logo, manager wallet address and settings. Vaults you create from your own wallet in the web app, and Copilot-run vaults, are listed publicly. Vaults created for organisations are not listed.
• Private-vault allowlists. If you create a private vault, you may enter or upload a list of wallet addresses allowed to use it. These addresses may belong to other people, and they are written to the blockchain when the vault is created.
• Blockchain activity. We read public blockchains for vault activity: deposits into vaults (the depositor's wallet address, the amount and value, and the transaction reference), trades made by vaults, and balances.

Everything recorded on a blockchain is public and permanent. We cannot change or delete it, and neither can anyone else.

4.5 Copilot-run vaults

A "Copilot-run vault" is a vault that our software trades on your instructions; our Terms of Use use the same term. You create one in Copilot, or as an Agent-Fund in the web app.

Vaults created from 1 October 2026. The vault's manager is your own wallet. This is a wallet you connect (a browser wallet or WalletConnect), or an email or social-login wallet from our wallet provider, Reown. We never have the keys to it. When you create or use one of these vaults:

• Your trading permission. To use automated trading, you sign an on-chain permission in your own wallet. It lets our trading software swap the vault's assets through the vault's permitted exchanges, and nothing else. We record the transaction, the time, your wallet address, the version of our terms and the permission text you were shown, and when the permission expires (90 days after you sign it, unless you renew it). Granting, renewing and revoking the permission are public blockchain transactions.
• Vault API key. We issue a key that can instruct trades and orders for the vault. It cannot claim fees. We show it to you once and store only a scrambled (hashed) form, so we cannot show it again. You can revoke it and create a new one in the web app or in Copilot.
• Your instructions. We store your Telegram ID and username, your account ID, any promo code, your price-triggered orders (limit, stop-loss and take-profit), your trade instructions and your trade history.
• Manager fees. The vault pays manager fees to its manager wallet, which is your own wallet, and you claim them from that wallet. We do not receive them.

Before it carries out a price-triggered order, our software checks that your permission is still active. If you revoke the permission, or it expires, our software stops, cancels your open orders and tells you which orders were cancelled.

Legacy vaults. A Copilot-run vault or Agent-Fund created before 1 October 2026 is a "legacy vault", and we label it as one. We keep the same vault API key and instruction records for it as above. It has no signed trading permission, and its manager fees work differently. In addition:

• our servers created the vault's manager wallet. We keep its private key, encrypted, in a key management service that logs every access, until we permanently destroy it on 31 December 2026;
• we record whether you confirmed that you want automated trading to continue until 31 December 2026, and when. If you did not confirm in time, trading and orders stopped and we told you;
• manager fees are claimed straight to your verified payout address. We store that address, the record of you signing in with that wallet to prove you control it, and any request to change it. A change needs you to sign in again and takes effect after 48 hours;
• on 31 December 2026, trading and orders stop, and a final manager-fee claim goes straight to your payout address.

If you register as an investor through Copilot, we store your wallet address with your Telegram ID.

The trades our software sends are public on the blockchain. Our Terms of Use and Risk Disclosure explain what each kind of vault means for you and for the funds in it.

4.6 Aspis Copilot (Telegram)

Before Copilot handles any message, it asks you to choose "I agree" and accept our Terms of Use. If you choose "Not now", we do not keep your message or create a record about you.

Once you have agreed, when you use Copilot we collect:

• Your Telegram details. Each time you interact with the bot, Telegram gives us your Telegram user ID, username, first name (and sometimes last name), language setting, whether you have Telegram Premium, the chat ID and message IDs.
• Everything you send the bot. This includes your text messages, captions, commands and button taps, as well as the bot's replies. If you send an image, it goes to OpenAI to be described, and we store the description with your messages.
• Wallet addresses. These are addresses you give the bot to track, analyse or follow. They can be yours or someone else's.
• Vault API keys. Copilot never asks for your vault API key, and you must not paste it into a chat. If you do, it is stored with your messages like any other text and can be sent to OpenAI as part of the chat history. Revoke it and create a new one in the web app or in Copilot.
• How you arrived. This means the details carried in the link you used to start Copilot. They can include campaign tags, the Telegram ID of anyone who referred you and, if you accepted analytics cookies on our website, your website analytics ID (see section 4.9).
• Referrals. Our referral programme is suspended. We keep the referral records created while it ran: who referred whom, and whether the referred person made a first trade.

Copilot works only in private chats with you. It ignores Telegram groups and does not store messages sent in them.

We keep your messages and the bot's notifications to you in Copilot's own database. We also keep them in the database of our analytics service, together with a record of which buttons you tap.

4.7 Organisations and the organisation API

• Organisation details. We record the organisation's name, owner, plan, number of seats, billing arrangements and contract details.
• Members. We record each member's email address, name, role, last sign-in date and account creation date. The organisation's owner can see these.
• Adding people. An owner can add a person using their email address. If that person has no account, we create one and email them a link to set a password. If they already have an account that is not in an organisation, it is added to the organisation.
• API keys. For each organisation API key we keep its name, its first few characters, a scrambled (hashed) form of the key, who created it and when it was last used. After a key is shown to you once, we do not keep it in readable form.
• API access. When an organisation uses its API key, our systems look up the organisation owner's account and the verified wallet addresses of its members. This tells us what the key is allowed to do.
• Organisation vaults. Members can see the deposits into their organisation's vaults, including depositors' wallet addresses.

4.8 Forms on aspis.finance

When you submit a form on aspis.finance, for example to ask for trial access or updates, we collect:

• your email address, and your name or Telegram username if the form asks for it;
• which form you used, and the address of the page, including any campaign tags in it;
• if you have accepted marketing cookies, the campaign tags kept in our TILDAUTM cookie. The form sends no other cookies;
• your IP address and the time.

4.9 Cookies, analytics and linking your activity

We use analytics and advertising technologies only if you accept them in our cookie banner. The Cookie Policy lists each one. If you accept:

• Amplitude records your device ID, the pages you visit, your clicks and your form interactions (not what you type), and how you arrived: the referring site, campaign tags and ad click IDs. It also records every visit (session replay). Text you type is masked before a recording is sent, and our admin pages and the screens that show API keys are not recorded. The events we send to Amplitude do not include your email address, your messages, wallet addresses, holdings or payment details.
• Google Analytics records the pages you visit, your device and browser, and your approximate location based on your IP address.
• X (Twitter), on aspis.finance only and only if you accept marketing cookies, receives details of your visit and of actions such as clicking a link to Copilot, so that we can measure our adverts on X. X can also use this data for its own purposes, under its own privacy policy. For collecting this data on aspis.finance and sending it to X, we and X are jointly responsible (joint controllers). We are responsible for asking for your consent and for telling you about it, and X is responsible for what it does with the data once it has it. You can use your data protection rights about this data with us or with X.

If you accept analytics cookies, we also link your activity across our website, web app and Copilot:

• links to Copilot on our websites carry your Amplitude device ID, and when you open Copilot through such a link, we connect that ID to your Telegram ID;
• when you connect a wallet in the web app, we send the wallet address and your device ID to our analytics service;
• if you open the web app from a link in Copilot, the link carries your Telegram ID, and we record that you came from Copilot.

Our analytics service stores these links so that we can see how people move between the website, the web app and Copilot. It sends the resulting events to Amplitude and Google Analytics, using your Telegram ID as your user ID. It does not send your wallet addresses to Amplitude.

Copilot usage analytics. This does not involve cookies. We record how you use Copilot: the commands you use, the buttons you tap, how you arrived, and whether you have connected a wallet or vault. We send these events to Amplitude and Google Analytics with your Telegram ID. They do not include your messages, email address, wallet addresses, holdings or payment details.

Deposit matching. We compare the wallet addresses that deposit into vaults with the wallets linked to Copilot users. We do this to send deposit notifications to vault creators and to understand how vaults are used.

4.10 Messages you send us

If you email us or contact support, we keep your message, your contact details and our reply.

4.11 Sensitive information

We do not ask for sensitive information, such as information about your health, religion or political views, or about criminal offences. Please do not include it in Copilot chats or messages to us. If you do, we will process it only as part of those messages.

5. What you must give us

• To create an account with an email address, you must give us your full name, your email address and a password. You can use Google sign-in instead of a password.
• To buy a plan, you must give us your email address, cardholder name, billing address and card details. The card details go to Revolut.
• Copilot cannot work without the Telegram details that Telegram sends us.
• Everything else is optional, including analytics and marketing cookies.

If you do not give us the information a feature needs, we cannot provide that feature.

6. Where we get your data from

• From you, when you sign up, use our services, fill in forms or contact us.
• From your device and browser, through sign-in records and server logs, and through analytics and advertising cookies if you accept them.
• From Telegram, when you use Copilot or link Telegram in the web app.
• From Google, if you sign in with Google.
• From Revolut, which sends us your payment results, billing address and a summary of your saved card.
• From public blockchains. We read these directly and through Alchemy, The Graph and public blockchain nodes. We get vault activity, deposits, trades and balances, and the trading permissions that vault owners sign.
• From ipinfo.io, which tells us the country linked to your IP address.
• From other people:
  • an organisation owner who adds you to their organisation;
  • a vault creator who adds your wallet address to a private vault's allowlist;
  • a Copilot user who gives us your wallet address to track or analyse;
  • someone who referred you to Copilot while our referral programme ran.
• From AgentCouncil, when you use the same account there.

7. How we use your data and our lawful bases

Data protection law allows us to use personal data only when we have a lawful basis. We rely on these:

• Contract. We need the data to provide a service you have asked for, or to take steps you ask for before a contract.
• Legal obligation. The law requires us to use or keep the data.
• Legitimate interests. We, or someone else, have a genuine reason to use the data, and that reason is not outweighed by your rights. Where we rely on this, the table names the interest. You can ask us how we weighed it against your rights.
• Consent. You have agreed. You can withdraw your consent at any time.

8. Emails, Telegram messages and marketing

Service emails. We send emails that you need in order to use your account. These include email confirmation, password resets, organisation invitations, receipts, renewal reminders, failed-payment notices, cancellation confirmations and account-closure confirmations. You cannot unsubscribe from these while you have an account, because they are part of providing the service. Aspis emails come from no-reply@aspis.finance, and replies go to info@aspis.finance.

Product updates. If you have an account, we may send you occasional emails about new features and changes to our services. We send them only if we gave you a simple way to refuse them when you signed up and you did not refuse, or if you have opted in. If someone else created your account for you, for example an organisation owner who added you, we send them only if you opt in. Every product update email has an unsubscribe link. You can turn these emails off, or back on, at any time in the Privacy section of your account page, or by emailing info@aspis.finance. Turning them off does not affect service emails.

Marketing emails. We send offers and campaigns only if you have agreed to receive them. You can agree by ticking the box when you sign up, or by switching on "Marketing emails" in the Privacy section of your account page. You can withdraw at any time in the same place, or by using the unsubscribe link in any marketing email.

Your choices for product updates and marketing emails apply to emails from both Aspis and AgentCouncil.

Website forms. We use the details you give us in a form to reply to your request, for example to give you the trial access you asked for. We send you marketing emails only if you have agreed to receive them.

Copilot messages. Copilot replies to your messages. It also sends notifications about your vaults and orders (including orders cancelled because a trading permission ended), alerts when wallets you follow make a trade, and update messages such as market reports and news about Copilot. To stop update messages, send /stop_updates in Copilot; you will still get replies and the notifications and alerts you asked for. To stop all messages from Copilot, block the bot in Telegram. This also stops notifications about your vaults and orders.

We do not market to you by text message or phone call, and we do not sell your contact details.

9. AI and automated processing

How Copilot uses AI. Copilot uses OpenAI's models to understand your messages and reply to them. Each time it replies, it sends OpenAI the recent history of the chat (up to about the last 32 messages), usernames, and any vault or wallet information needed for the answer. Images you send are also passed to OpenAI to be described. OpenAI processes this data on our behalf. We use OpenAI's paid business service. Under OpenAI's terms for business use of its API, it does not use this data to train its models, but it may keep it for up to 30 days to check for abuse.

We do not use your conversations to train our own AI models.

Copilot trades only when you confirm. If you ask Copilot to make a trade in a Copilot-run vault, it first shows you a summary: the tokens, the amount, the route and the maximum slippage. It trades only after you press Confirm. If you do not say which token to use, Copilot asks you. AI can misunderstand a message and it can be wrong, so check the summary before you confirm, and check what Copilot tells you before you rely on it.

Automated decisions. We do not make decisions about you that have legal effects or similarly significant effects based only on automated processing. Some things do happen automatically:

• if all attempts to take a renewal payment fail, your account moves to the Free plan. We email you after each failed attempt and when your plan ends, and you can buy a plan again at any time;
• plan limits, such as how many vaults or Agent-Funds you can create, are applied automatically;
• price-triggered orders you have set up are carried out automatically, without asking you again, when their conditions are met and your trading permission is still active;
• when your trading permission is revoked or expires, our software cancels your open orders automatically and tells you which orders were cancelled;
• analytics profiles help us understand how our services are used. We do not use them to make decisions about you.

The AgentCouncil Privacy Policy covers AgentCouncil's AI analysis and chat.

10. Who we share your data with

We share personal data only as described below. The service providers in the first table act on our instructions, except where the table says they also use the data for their own purposes.

Other people who may receive your data:

• Organisation owners and members, as described in section 4.7.
• Other Copilot users. If someone referred you to Copilot while our referral programme ran, they may be able to see your Telegram username. They cannot see whether you have bought a plan. Vault creators are told about deposits into their vaults, with a shortened form of the depositor's wallet address.
• Our professional advisers, such as lawyers, accountants, auditors and insurers, where they need the data to advise us.
• Police, regulators, courts and other authorities, where the law requires it, or where we need to protect our rights, our users or the public.
• A buyer or successor, if we sell, merge or reorganise our business. They must use your data as this policy describes.

Our staff. Access to personal data is limited to staff who need it for support, security or administration. Depending on their role, they can see:

• the list of accounts, with email, names, plan, organisation, last sign-in and main wallet or Telegram ID;
• each account's sign-in sessions (with IP address and browser), consent history, activity summary and usage counts;
• how many AI analyses and chat messages an account has, and summaries of its vaults and deposits;
• Copilot conversation history, and the ability to look up Copilot users by username.

To help with a problem, authorised staff can also view your account as you see it. We record key staff actions, such as viewing an account as a user, changing a plan or changing someone's email preferences, in an audit log.

We do not sell your personal data. We do not give advertising networks your email address, wallet addresses or Telegram details.

11. What other people can see

• Blockchains. Every transaction is public and permanent. That includes deposits, trades, vault manager addresses, private-vault allowlists and the automated-trading permissions that vault owners sign. For vaults created from 1 October 2026, the manager address is the owner's own wallet address.
• Public vault listings. A vault's name, description, links, logo, manager wallet address and on-chain history are visible to anyone.
• Your nickname and profile picture, wherever we display them. Your profile picture is stored at a public web address that anyone with the link can open.
• Organisations. If you are a member of an organisation, its owner can see your details (section 4.7).

If you think content on our services that is about you is wrong or should not be there, email info@aspis.finance.

12. International transfers

We are based in the UK. Some of our service providers are in the European Economic Area (EEA), and some are in the United States or other countries (see section 10). When personal data goes to a country that the UK has not recognised as giving adequate protection, we use one of these safeguards:

• for the EEA and New Zealand: UK "adequacy regulations", which recognise these places as giving adequate protection;
• for United States providers certified to it: the UK Extension to the EU-US Data Privacy Framework, also known as the UK-US data bridge;
• otherwise: the International Data Transfer Agreement approved by the ICO, or the International Data Transfer Addendum to the European Commission's standard contractual clauses, together with our assessment of the risks of the transfer. These are usually included in the provider's data processing terms;
• for Copilot's messages through Telegram, where none of these is available: the transfer is necessary to provide the service you have asked for, because Copilot works only through Telegram's servers.

Transactions you send to a public blockchain are copied to computers around the world. That is how blockchains work, and it is outside our control.

If you are in the EU, transfers of your data to us in the UK rely on the European Commission's decision that the UK gives adequate protection. Our onward transfers use the EU equivalents of the safeguards above.

To ask for more information about these safeguards, or a copy of them, email info@aspis.finance.

13. How long we keep your data

14. Closing your account and deleting your data

How to close your account. In the Aspis web app, go to the Privacy section of your account page and choose "Close my account". To confirm, type your account's email address. This option is available only for accounts that have an email address. If your account has only a wallet or a Telegram ID, email info@aspis.finance and we will close it for you, or add an email address to your account first. If you own an organisation, contact us first so that the organisation can be handed over or closed.

What happens straight away:

• we remove your name, the link to your profile picture, your Google sign-in, password and billing address, and replace your email address with a placeholder;
• we delete your sign-in sessions, linked wallets and Telegram accounts, activity record, usage counts, the AgentCouncil chats and analyses linked to your account, and any AgentCouncil enquiries made with your email address;
• we stop all future payments and remove you from any organisation;
• we send you an email confirming that your account has been closed.

What we keep, and why:

• Payment, failed-payment and billing-email records: amounts, dates, plan, card details (brand and last four digits, plus, for failed payments, the first six to eight digits and expiry date) and payment references. UK tax and company law require us to keep payment records. The records in our own database are no longer linked to your account, but your invoices in Xero still show your name, email address and billing address;
• Consent and email-preference records, including IP address and browser, and the record of your express request at checkout, so that we can show what you agreed to or objected to;
• The staff audit log, which may include your email address, so that we can show what our staff did;
• A placeholder account record, holding your nickname (if you chose one), your billing country, your last plan details and your Revolut customer reference.

What closing your account does not delete automatically. To delete any of the following as well, email info@aspis.finance. We will delete it within one month, unless we have to keep it:

• your Copilot data (messages, Copilot usage records and referral records);
• your Copilot-run vault records;
• your vault records and aspis.finance form entries;
• the links between your devices, wallets and Telegram ID in our analytics service, and your data held by Amplitude and Google Analytics;
• your profile picture file and any vault logos;
• your saved card at Revolut.

Server logs and backups are deleted as described in section 13. We cannot delete anything recorded on a blockchain.

Your vaults. Closing your account does not move or withdraw assets from any vault. It also does not revoke an automated-trading permission you signed in your wallet. To stop automated trading, use "Stop automated trading" in the web app or in Copilot, or revoke the permission from your wallet, before you close your account. If you own a legacy vault, contact us before you close your account.

Copilot. If you message Copilot again after we have deleted your Copilot data, a new record is created, just as it would be for a new user.

15. Your rights

You have these rights over your personal data:

• Access. You can ask for a copy of your personal data and information about how we use it.
• Rectification. You can ask us to correct data that is wrong or incomplete.
• Erasure. You can ask us to delete your data. We will do so unless we have to keep it, for example payment records we must keep by law, or data we need for a legal claim.
• Restriction. You can ask us to pause using your data. For example, you can do this while we check whether it is accurate, or while we consider an objection.
• Portability. Where we use data you gave us because of a contract or your consent, you can ask for a copy in a common machine-readable format, or ask us to send it to another organisation.
• Objection. You can object to any use of your data that relies on legitimate interests. We will stop unless we have compelling legitimate grounds that outweigh your interests, or we need the data for legal claims.
• Objection to direct marketing. You can object to direct marketing at any time, including any profiling for direct marketing. This right is absolute: if you object, we will stop.
• Withdrawing consent. Where we rely on your consent, you can withdraw it at any time. Doing so does not affect what we did before you withdrew.
• Automated decisions. If we make a significant decision about you based solely on automated processing, you can be told about it, give us your views, have a person look at it again and challenge it (see section 9).
• Complaint. You can complain to the ICO or, if you are in the EU, to your local data protection authority (see section 21).

These rights apply under UK law and, if you are in the EU, under EU law. Some rights have exceptions. If an exception applies to your request, we will explain it.

16. How to use your rights

You can do many things yourself:

The "Download a copy" file contains the main data in your account record. It does not yet include everything we hold. For example, it leaves out your payment history, your data held by Copilot and our vault services, and analytics data. For a complete copy, email us.

When you email us, tell us which right you want to use and, if it is about Copilot, your Telegram username. We may ask for information to confirm that the request comes from you, for example a reply from the email address on your account or a message signed with your wallet. If we need more information to find your data or to confirm your identity, the time limit starts once we receive it.

We will reply within one month. If a request is complex, or you have made several, we can take up to two more months. If so, we will tell you within the first month and explain why. We do not charge for requests. We may refuse, or charge a reasonable fee for, requests that are manifestly unfounded or excessive, and if we do, we will explain why.

17. Security

We protect personal data with appropriate technical and organisational measures. These include:

• encrypted connections (HTTPS/TLS) for all our websites, apps and services, including the connections between our servers and to our databases;
• passwords stored only in hashed form;
• card details handled by Revolut, which is regulated and certified to the card industry's security standard, so that we never receive your full card number;
• vault API keys and organisation API keys stored only in hashed form, and shown to you once;
• sign-in tokens that expire after 15 minutes, with refresh tokens that expire after 7 days;
• for vaults created from 1 October 2026, an on-chain trading permission that lets our software only swap a vault's assets through its permitted exchanges, and never transfer or withdraw them;
• for legacy vaults, manager keys kept encrypted in a key management service that logs every access, until we destroy them on 31 December 2026;
• staff access limited to people who need it, with key staff actions recorded.

No system is completely secure. If a breach of your personal data is likely to put your rights and freedoms at high risk, we will tell you without undue delay.

Keep your vault API keys and account password to yourself. Copilot will never ask for your vault API key, and we will never ask for your wallet's seed phrase or private key.

18. Children

Our services are for adults aged 18 or over. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us their data, email info@aspis.finance and we will delete it.

19. Cookies

We use strictly necessary cookies and similar technologies to run our websites. We use analytics and marketing cookies only if you accept them. Our Cookie Policy lists every cookie and similar technology we use, and explains how to change your choice at any time using "Cookie settings" at the bottom of every page.

20. Changes to this policy

We will update this policy when our services or the law change. The date at the top shows when it last changed. If we make a significant change, for example using your data for a new purpose or sharing it with a new type of recipient, we will tell you before the change takes effect. We will do this by email or with a notice in our services. Where a change needs your consent, we will ask for it.

21. Complaints

If you are unhappy with how we have handled your personal data, please tell us first at info@aspis.finance, with "Data protection complaint" in the subject line, or by post to our registered office. We aim to acknowledge your complaint within 5 working days, and will always do so within 30 days. We will look into it without undue delay, keep you informed, and tell you the outcome.

You also have the right to complain to the Information Commissioner's Office, the UK's data protection regulator:

• website: ico.org.uk
• phone: 0303 123 1113
• post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

If you live in the EU, you can also complain to the data protection authority in your country.

22. Contact us

• Aspis Protocol Ltd
• Registered in England and Wales, company number 15506799
• Registered office: 167-169 Great Portland Street, 5th Floor, London W1W 5PF, United Kingdom
• Email: info@aspis.finance