Privacy Notice

The data controller for the processing described here is Orion Gate LLC, 30 N Gould St, STE R, Sheridan, WY 82801, USA. Our own backend and database run on servers located in the European Union. For privacy questions or to exercise your data rights, email [email protected].

Account data. When you sign in, our backend creates an account record: a username, the email address you signed in with (if any), your wallet address, and a referral code derived from that address. That is the account data we keep. We process it to create and operate your account, on the legal basis of performing our agreement with you (the Beta Terms of Use), and we keep it for as long as your account exists. If you ask us to delete it, we do so without undue delay and in any case within one month.

Waitlist data. If you join the waitlist for our mobile app, we store the email address you submit, and — if you choose to provide them — your wallet address and social handle. This data is collected through Tally, which processes it as our service provider under its own terms. We use it to send TestFlight invites and product updates, and for nothing else. The legal basis is your consent, given when you submit the form. We keep this data until the mobile app has launched and its invites have gone out, and then delete it — sooner if you ask us to. To have your waitlist data deleted, or to withdraw your consent, email [email protected].

Built-in exposure. Some exposure is built into how the product works:

• Public blockchains record every transaction permanently, visible to anyone.
• When you request a quote, the trade details (token pair, amount, and your wallet address) go to our backend, which queries third-party aggregators and bridges (such as 0x, ODOS, LI.FI, and Squid) to find a route.
• To screen tokens for known scams, token contract addresses are sent to GoPlus, a third-party security provider. Prices and token metadata are served by LI.FI through our proxy. Because some of these calls are made by the app in your browser rather than by our servers, the provider also sees your IP address and the page you called from.
• Reading balances and broadcasting transactions requires blockchain node providers. Your wallet address and IP address reach the node operator handling the request — ours, or the one your own wallet uses. Token and network logos are loaded from third-party content networks, which likewise see your IP address.
• Privy handles authentication and processes your login under its own privacy policy. If you connect an external wallet, the connector you choose — including WalletConnect, where it is used — processes that connection under its own terms.
• AI assistant. When you use the in-app assistant, the text of your messages and the conversation so far are sent through our backend to GonkaGate, an AI gateway, which runs them on a third-party language model — Moonshot's Kimi. If you ask about your balances, what the assistant works from includes your token holdings, their amounts and their value in US dollars. Some questions additionally trigger a live web lookup through the same gateway. We do not store your conversations on our servers; the gateway and the model operator process them under their own terms. The model runs on a decentralized compute network, so the country that processes any given conversation cannot be guaranteed. The legal basis is performance of our agreement with you — the assistant cannot answer without sending your question. It never moves funds: it can only pre-fill a screen that you review and sign yourself.
• Our servers keep technical logs of the requests they handle, recording your IP address, your browser's user-agent string and the request path — which, for balance lookups, contains your wallet address. We keep these to operate, debug and secure the service, on the legal basis of our legitimate interest in running it, and only for as long as that requires.

Website cookies. This website uses Google Analytics 4 cookies to measure site traffic only if you accept them in the cookie banner, and you can change or withdraw that choice at any time via "Cookie settings" in the site footer. The legal basis is your consent; until you give it, no analytics cookies are set and no page views or events are recorded. Google Analytics sets its cookies with a two-year lifetime, which some browsers shorten to about thirteen months. Withdrawing consent stops all further collection and deletes the analytics cookies already stored in your browser. Your choice itself is remembered in your browser's local storage rather than in a cookie, and is never sent to us.

Orion does not use advertising trackers. Google's advertising signals — ad storage, ad user data, and ad personalization — stay switched off at all times, whichever option you pick in the banner.

Where your data goes. Our own backend and database are in the European Union, and the team that builds and operates Orion works from the European Union. Several of the recipients described above — aggregators and bridges, the token-security and market-data providers, the authentication provider, the AI gateway and the model operator, the node providers, the content networks and the analytics provider — are established outside the European Economic Area, so using them means data reaching a third country. Those transfers rely on the European Commission's adequacy decision for the recipient's country, the recipient's certification under such a decision, or standard contractual clauses, depending on the provider.

Your rights. You can ask us for a copy of your data, have it corrected or deleted, have our use of it restricted, object to that use, or receive it in a portable form. Where we rely on your consent — the cookie banner and the waitlist — you can withdraw it at any time, and withdrawing it does not affect processing that already took place. Email [email protected] to exercise any of these; you can also reach the team on our Discord. If you believe we have mishandled your data, you can lodge a complaint with the data protection authority in the country where you live.