> For the complete documentation index, see [llms.txt](https://docs.arenas.fi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.arenas.fi/privacy-policy.md). # Privacy Policy *Last updated: \[DATE]* This policy explains what personal data Arenas collects when you use our websites and app, why we collect it, who we share it with, and the rights you have over it. It covers [arenas.fi](https://arenas.fi), the app at [app.arenas.fi](https://app.arenas.fi), these docs at [docs.arenas.fi](https://docs.arenas.fi), and the emails we send (together, the **Services**). It does not cover the Somnia blockchain, your wallet software, SomniaLend or any other third-party protocol or website you reach from the Services. Those have their own privacy terms. It is written for depositors and visitors. Businesses that apply for financing through Arenas are covered by the privacy terms in their financing agreement. ### Who we are The Services are operated by **\[LEGAL ENTITY NAME]**, a company registered in \[JURISDICTION] with its registered address at \[REGISTERED ADDRESS] ("**Arenas**", "**we**", "**us**"). We are the controller of the personal data described in this policy. For any privacy question or request, email [**info@arenas.fi**](mailto:info@arenas.fi). ### Blockchain data is public Arenas runs on the public Somnia blockchain. When you deposit, withdraw, delegate credit or sign a transaction, your **wallet address and the transaction details are recorded on-chain**, where anyone can see them and nobody, including us, can change or delete them. A wallet address is not your name, but it can be linked to you, for example if you have used it on an exchange that knows who you are. Keep this in mind before you connect a wallet. ### What we collect and why We only collect what we need to run the Services. You never need to give us your name or email to deposit or withdraw. | What | When | Why | Legal basis | | -------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------- | | **Wallet address** | You connect a wallet to the app | To show your balances and positions, to check the address against sanctions and risk lists, and to secure your sessions | Performance of the service you request; legitimate interest in security and legal compliance | | **Contact details for a reservation**: email, name or entity, optional Telegram, WhatsApp or Discord handle | You reserve a place in a pool | To email you about your reservation | Performance of the service you request | | **Reservation details**: wallet address, pool, asset and amount | You reserve a place in a pool | To publish your reservation (see [Reservations are public](#reservations-are-public)) | Performance of the service you request | | **Email and optional name or entity for updates** | You register for updates, or tick "Register for future updates and opportunities" | To send you news about Arenas pools and opportunities | Your consent, which you can withdraw any time by unsubscribing | | **Usage analytics**: pages viewed, clicks, device and browser type, approximate location, and in the app your connected wallet address | Only after you click **Allow analytics** | To understand how the Services are used and improve them | Your consent | | **Session replays** of a sample of visits, with form inputs masked | Only after you click **Allow analytics** | To find and fix usability problems and bugs | Your consent | | **Error reports**: the error, the page, browser and device type | When something breaks | To detect and fix errors | Legitimate interest in keeping the Services working | | **IP address and country** | Every request | To apply regional restrictions, limit abuse and protect the Services | Legitimate interest in security; legal compliance | **How contact details are stored.** Email addresses, names, entity names and messenger handles you give us are stored **encrypted** in our database and are never published on-chain or on IPFS. **Analytics without your IP.** Our analytics tool is set up to drop your IP address before an event is sent. Error reports do not include IP addresses or other personal data by default. Your wallet address is attached to analytics and error reports only after you have allowed analytics. **IP addresses are not stored by us.** We use your IP address and country while handling a request and then discard it. Our hosting providers may keep their own short-lived access logs. ### Reservations are public When you reserve a place in a pool, the reservation is published as an **intent** to **IPFS** and registered on the Somnia blockchain. It contains your **wallet address**, the pool, the asset and the amount, so that demand for the pool is visible. IPFS content is permanent: **we cannot remove it**, even on request. Your email, name and messenger handle are never part of the published intent. They are kept private and encrypted as described above. ### Cookies and local storage We use a small number of cookies and browser storage entries. **Always on (strictly necessary or functional):** * `userAcceptedAnalytics`: remembers your analytics choice. * `originator`: remembers the partner link you arrived from, for 180 days. * App preferences such as the selected market, theme, language and collapsed tables. * Wallet connection state, stored by the wallet connection libraries so you stay connected. **Only after you click "Allow analytics":** * PostHog analytics cookies and local storage, which recognise your browser across visits. * Sentry session replay. **Changing your choice.** On [arenas.fi](https://arenas.fi), use **Cookie settings** in the footer. In the app, clear the site data for app.arenas.fi in your browser and the consent banner will appear again. ### Emails We send you email only if you gave us your address. A reservation sends a confirmation and messages about that reservation. Updates and news are sent only if you registered for updates or ticked the updates box. Every email has an **unsubscribe** link. Unsubscribing stops all emails to that address. ### Who we share data with We do not sell your personal data and we do not share it for advertising. We share it only with service providers that process it on our behalf, under contracts that restrict them to our instructions. Each one receives only what it needs. For most of them that is just your IP address or wallet address, which privacy law also treats as personal data. | Provider | Purpose | What it receives | | -------------------------------------------- | -------------------------------------------------------------------- | ----------------------------------------------------------------------- | | Vercel | Hosting the websites and app | IP address; form data in transit to our notification service | | Cloudflare | Hosting the notification service | IP address; contact details you submit | | Neon | Database for contact details and subscriptions | Contact details (encrypted), wallet address, reservations | | Resend | Sending email | Email address and name or entity | | PostHog | Usage analytics, after consent | Usage events, device and browser type, wallet address | | Sentry | Error monitoring, and session replay after consent | Error details; after consent, wallet address and masked session replays | | Pinata | Publishing reservations to IPFS | Wallet address and reservation details | | WalletConnect (Reown) and your chosen wallet | Connecting your wallet to the app | IP address and wallet address | | thirdweb and Somnia RPC nodes | Reading from and sending transactions to the Somnia blockchain | IP address, wallet address and transactions | | Wallet screening provider | Checking connected wallet addresses against sanctions and risk lists | IP address and wallet address | | Protocol data provider | Serving pool, balance and rate data for your wallet | IP address and wallet address | We may also disclose personal data when the law requires it, to protect our rights or users, or as part of a merger, acquisition or sale of assets, in which case this policy continues to apply to the data transferred. ### International transfers Some of our providers, including our database, analytics and email providers, process data in the **United States** or other countries outside your own. Where data from the European Economic Area, the UK or Switzerland is transferred, we rely on an adequacy decision (such as the EU-US Data Privacy Framework) or on the European Commission's Standard Contractual Clauses. ### How long we keep data * **Contact details and subscriptions:** until you unsubscribe or ask us to delete them, or for \[N] months after your reservation ends, whichever comes first. * **Analytics and session replays:** for the retention period set in our analytics and monitoring tools, at most \[N] months. * **Error reports:** for the retention period set in our monitoring tool, at most \[N] days. * **Blockchain and IPFS data:** permanently. It is outside our control and cannot be deleted. ### Your rights Depending on where you live, you may have the right to: * **access** the personal data we hold about you and get a copy of it; * **correct** it if it is wrong; * **delete** it; * **restrict** or **object** to how we use it; * **receive** it in a portable format; * **withdraw consent** at any time, without affecting what we did before you withdrew it; * **complain** to your local data protection authority. To use any of these rights, email [**info@arenas.fi**](mailto:info@arenas.fi) from the address you registered with, or tell us the wallet address you used. We may ask you to prove that the address or wallet is yours, for example by signing a message. We reply within one month. These rights cannot be applied to data recorded on the blockchain or published to IPFS, because nobody can change or delete it. ### Security We encrypt contact details at rest, use encrypted connections, and limit access to personal data to the people who need it. No system is perfectly secure, so we cannot guarantee that data will never be exposed. We will never ask for your seed phrase or private keys. ### Children The Services are not meant for anyone under 18, and we do not knowingly collect data from them. If you believe a child has given us personal data, contact us and we will delete it. ### Restricted regions The app is not offered to persons in the United States or its territories, or in sanctioned countries and regions. We use your IP-based location to apply this restriction. ### Changes to this policy We may update this policy. We will change the "Last updated" date above, and for material changes we will give notice in the app or by email where we can. ### Contact **\[LEGAL ENTITY NAME]** \[REGISTERED ADDRESS]