Privacy Policy

Bithaven (“Bithaven,” “we,” “us,” or “our”) respects your privacy and is committed to protecting the personal information you share with us. This Privacy Policy describes how we collect, use, store, and disclose information when you use the Bithaven platform, website (bithaven.ai), APIs, MCP server, SDK, dashboard, and related services (collectively, the “Service”).

By using the Service, you consent to the practices described in this Privacy Policy. If you do not agree with this policy, please do not use the Service.

2.1 Information You Provide

• Account information: Email address and password when you create an account.
• Profile information: Optional display name, company name, or other details you add to your account settings.
• Communications: Messages, feedback, or support requests you send to us via the contact form or email.
• Policy configurations: Spending policies, address whitelists, and other settings you configure for your agent wallets.

2.2 Information Collected Automatically

• Usage data: Pages visited, features used, actions taken within the dashboard, API endpoints called, and timestamps of activity.
• Device and browser information: IP address, browser type and version, operating system, device type, and screen resolution.
• Cookies and similar technologies: Session cookies for authentication, preference cookies, and analytics cookies. See Section 7 for details.
• Log data: Server logs including request/response metadata, error logs, and performance metrics.

2.3 Blockchain and Transaction Data

• Wallet addresses: Custodial wallet addresses generated for your account and agent wallets.
• Transaction records: Sender addresses, recipient addresses, amounts, transaction hashes, block numbers, timestamps, and policy evaluation results for all transactions processed through the Service.
• On-chain data: Blockchain transactions are recorded on public, immutable ledgers. Bithaven does not control and cannot delete data recorded on-chain.

We use the information we collect to:

• Provide, operate, and maintain the Service.
• Process transactions and enforce spending policies on your behalf.
• Authenticate your identity and secure your account.
• Generate audit logs, transaction histories, and policy evaluation records.
• Send transactional notifications (e.g., transaction alerts, approval requests, low balance warnings).
• Respond to your support requests and communications.
• Detect and prevent fraud, abuse, and security incidents.
• Comply with legal obligations, including anti-money laundering (AML) and know-your-customer (KYC) requirements if applicable.
• Analyze usage patterns to improve the Service.
• Communicate product updates, changes to these policies, or other service-related notices.

We do not sell your personal information. We do not use your transaction data to build advertising profiles or serve targeted advertisements.

We may share your information in the following circumstances:

• Service providers: Third-party vendors who assist in operating the Service, including cloud hosting (Vercel, Railway), email delivery (Resend), analytics (Vercel Analytics), and blockchain infrastructure providers (Alchemy, QuickNode). These providers are contractually obligated to use your information only as necessary to provide services to us.
• Blockchain networks: Transaction data is broadcast to blockchain networks (Base L2, Ethereum) as an inherent part of processing your transactions. This data becomes part of the public, immutable blockchain record.
• Legal compliance: We may disclose your information if required by law, subpoena, court order, or governmental request, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others, or to detect and prevent fraud or security issues.
• Business transfers: If Bithaven is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change via email or prominent notice on the Service.
• With your consent: We may share information in other circumstances with your explicit consent.

We retain your personal information for as long as your account is active or as needed to provide you the Service. Transaction records, audit logs, and policy evaluation data are retained indefinitely as part of the immutable financial audit trail, which is a core feature of the Service.

If you close your account, we will delete or anonymize your personal information within 90 days, except where retention is required by law, necessary for fraud prevention, or part of the blockchain record (which cannot be deleted).

We implement industry-standard technical and organizational measures to protect your information, including:

• Encryption of data in transit (TLS/HTTPS) and at rest.
• Password hashing using bcrypt with a high cost factor.
• API key hashing — raw API keys are never stored.
• Custodial wallet private keys are never stored at rest; they are derived on-demand from an encrypted HD seed and exist in memory only during transaction signing.
• Rate limiting and brute-force protection on authentication endpoints.
• Regular security reviews and dependency auditing.

Despite these measures, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security of your information.

We use the following types of cookies and similar technologies:

• Essential cookies: Required for authentication, session management, and core functionality. These cannot be disabled without losing access to the Service.
• Analytics cookies: We use Vercel Analytics and Speed Insights to understand how users interact with the Service. These tools collect anonymized usage data.

We do not use advertising cookies or third-party tracking pixels. You can control cookie preferences through your browser settings. Disabling essential cookies may prevent you from using the Service.

Depending on your jurisdiction, you may have the following rights regarding your personal information:

• Access: Request a copy of the personal information we hold about you.
• Correction: Request correction of inaccurate or incomplete personal information.
• Deletion: Request deletion of your personal information, subject to legal retention requirements and the limitations of blockchain immutability.
• Data portability: Request your data in a structured, machine-readable format.
• Objection: Object to certain processing of your personal information.
• Withdrawal of consent: Where processing is based on consent, you may withdraw consent at any time.

To exercise any of these rights, please contact us at [email protected]. We will respond to your request within 30 days.

Your information may be transferred to and processed in countries other than your country of residence, including the United States. These countries may have data protection laws that differ from your jurisdiction. By using the Service, you consent to the transfer of your information to the United States and other countries where our service providers operate.

The Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a child under 18, we will take steps to delete that information promptly.

The Service may contain links to third-party websites or services (such as blockchain explorers, documentation sites, or partner platforms). We are not responsible for the privacy practices of these third parties. We encourage you to review the privacy policies of any third-party services you access.

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated effective date. If we make material changes, we will provide notice through the Service or via email. Your continued use of the Service after the changes take effect constitutes your acceptance of the revised policy.

If you have questions or concerns about this Privacy Policy or our data practices, please contact us:

• Email: [email protected]
• Contact form: bithaven.ai/contact