Privacy Policy

Last updated: 2026-11-01

1. Scope

This policy describes what information the Service collects, how it is used, and the third-party processors that handle it on our behalf.

2. What we collect

Account data: email address and authentication state, processed by our identity provider (Stack Auth).
Subscription data: billing identifiers and subscription status, processed by Stripe. The Service does not store payment-card data.
Wallet identifiers (optional): if you link a Solana wallet for PRO via staking, we store the public wallet address.
Discord link (optional): if you connect Discord to unlock PRO through a membership role, we store a one-way, salted hash (HMAC-SHA256) of your Discord user ID — never the ID itself, and never your username, display name, avatar, or email. The hash is computed with a secret held only on our servers and cannot be reversed back into your account. We also store the status of that link (active, pending, revoked) and the timestamps of the last checks.
Portfolio data (optional): if you use the portfolio, we store the entries you type — the asset or pool, quantity, price paid, fees, dates and any note you add — together with the positions and profit/loss figures derived from them. You enter this yourself: we do not read balances from your wallet to build it. It is readable only by your own account, is never sold or shared with third parties, is included in your data export, and is deleted with your account.
Yield Agent questions: when you use Yield Agent, your question and the earlier messages of that conversation are sent to the AI model run by CulturaBuilder, our partner, to produce the answer. By default Yield Lab does not keep them; they are kept only if you turn on the dataset contribution described in section 2.1.
Usage data: pages viewed and high-level analytics, processed by Vercel Analytics.
Server logs and error reports: technical logs and exception reports, sensitive fields (emails, wallet addresses) are redacted before being sent to error-tracking providers.

2.1 Yield Agent dataset (optional)

On the Yield Agent page you can choose to contribute to the Yield Lab dataset. It is off until you turn it on, and using the agent never depends on it. You must be 18 or older to turn it on.

What we keep: each question you ask on the free plan in a conversation that began with the contribution already on (a conversation started before you turned it on is never kept, and neither are the earlier messages of a conversation), the lookups the agent made (the tools it called, their arguments and the Yield Lab data they returned), the agent's reasoning and its answer as shown to you (times in it appear in your time zone), the result of our number check, the screen language, the model, the app version and the time. Questions asked on the PRO plan or as an admin are not kept.
Why: to improve the agent, and to license or sell this dataset to companies that train AI models, in Brazil or abroad.
What we remove first: before anything is kept we remove emails (also when disguised, as in "name [at] mail [dot] com"), phone numbers, Brazilian tax IDs (CPF, CNPJ), ID and passport numbers written next to their name, card numbers, PIX random keys, IP addresses, postal codes and street addresses, names written after "my name is", and wallet or transaction addresses and wallet names (such as .eth or .sol) that are not public contracts. A question that contains what looks like a wallet seed phrase is not kept at all. Free text we cannot detect automatically, such as names or street addresses, may remain — do not include personal data in your questions. The licensed dataset never carries your account identifier or email.
Legal basis: your consent (LGPD, art. 7, I; GDPR, art. 6(1)(a)), given for the version of the text shown on the agent page. If that text changes in substance, we ask again.
How long: until you delete it or delete your account. On the agent page you can turn the contribution off (nothing new is kept) and delete everything already kept, at any time. If a version of the dataset that contains your records was already licensed, we notify the licensee to delete them, and later versions leave them out.

3. What we do NOT collect

We do not collect KYC documents. We do not have access to your private keys, seed phrases, or wallet contents beyond the public address.

From Discord specifically, we never read or store message content, presence/online status, direct messages, voice activity, or any member list beyond the check described below. Our Discord app does not request the Message Content or Presence intents.

3.1 How the Discord check works

To keep PRO in sync with a paid membership, our bot periodically reads the member list of a fixed, explicitly configured list of servers and checks which members hold one of a fixed list of roles. Member IDs are hashed in memory during that read; only the hashes of linked users are ever written to our database. Members of those servers who have not connected their Discord to Yield Lab are never persisted in any form.

You can disconnect at any time from your account page, which revokes the access granted through Discord and deletes the link record. A minimal record of the link/unlink event is retained to enforce an anti-abuse cooldown, and it too contains only irreversible hashes.

4. Processors

Stack Auth — authentication
Stripe — payments
Vercel — hosting, analytics, logs
Neon — database
Discord — membership role verification (optional, only if you connect it)
CulturaBuilder — runs the AI model behind Yield Agent (processes your questions to produce answers)
Sentry — error tracking (with PII redaction)
Resend — transactional email

5. Cookies

We use first-party cookies for authentication session state and theme preference. We do not use cross-site tracking cookies.

6. Your rights

You can delete your account at any time from the account settings, which removes your account data — including your portfolio and its full transaction history — from our systems. Some data may be retained by upstream processors (Stripe, Stack Auth) per their own policies.

You can also download everything we hold about you as a JSON file from the account settings, at any time and without asking us first. The export and the deletion cover the same set of data.

If you connected Discord, disconnecting it from the account page deletes the stored link immediately; you do not need to contact us first.

If you contributed to the Yield Agent dataset, you can turn it off and delete what was kept from the agent page; the account export and the account deletion include it.

Contact: for questions about this policy, or to request access to or deletion of your data, write to yieldlab4@gmail.com.

7. Data location

Data is processed primarily in AWS us-east-1 (USA) by Neon and Vercel.

8. Changes

Material changes to this policy will be reflected in the "Last updated" date above.

2. What we collect

Account data: email address and authentication state, processed by our identity provider (Stack Auth).

Subscription data: billing identifiers and subscription status, processed by Stripe. The Service does not store payment-card data.

Wallet identifiers (optional): if you link a Solana wallet for PRO via staking, we store the public wallet address.

Discord link (optional): if you connect Discord to unlock PRO through a membership role, we store a one-way, salted hash (HMAC-SHA256) of your Discord user ID — never the ID itself, and never your username, display name, avatar, or email. The hash is computed with a secret held only on our servers and cannot be reversed back into your account. We also store the status of that link (active, pending, revoked) and the timestamps of the last checks.

Portfolio data (optional): if you use the portfolio, we store the entries you type — the asset or pool, quantity, price paid, fees, dates and any note you add — together with the positions and profit/loss figures derived from them. You enter this yourself: we do not read balances from your wallet to build it. It is readable only by your own account, is never sold or shared with third parties, is included in your data export, and is deleted with your account.

Yield Agent questions: when you use Yield Agent, your question and the earlier messages of that conversation are sent to the AI model run by CulturaBuilder, our partner, to produce the answer. By default Yield Lab does not keep them; they are kept only if you turn on the dataset contribution described in section 2.1.

Usage data: pages viewed and high-level analytics, processed by Vercel Analytics.

Server logs and error reports: technical logs and exception reports, sensitive fields (emails, wallet addresses) are redacted before being sent to error-tracking providers.

2.1 Yield Agent dataset (optional)

On the Yield Agent page you can choose to contribute to the Yield Lab dataset. It is off until you turn it on, and using the agent never depends on it. You must be 18 or older to turn it on.

What we keep: each question you ask on the free plan in a conversation that began with the contribution already on (a conversation started before you turned it on is never kept, and neither are the earlier messages of a conversation), the lookups the agent made (the tools it called, their arguments and the Yield Lab data they returned), the agent's reasoning and its answer as shown to you (times in it appear in your time zone), the result of our number check, the screen language, the model, the app version and the time. Questions asked on the PRO plan or as an admin are not kept.

Why: to improve the agent, and to license or sell this dataset to companies that train AI models, in Brazil or abroad.

What we remove first: before anything is kept we remove emails (also when disguised, as in "name [at] mail [dot] com"), phone numbers, Brazilian tax IDs (CPF, CNPJ), ID and passport numbers written next to their name, card numbers, PIX random keys, IP addresses, postal codes and street addresses, names written after "my name is", and wallet or transaction addresses and wallet names (such as .eth or .sol) that are not public contracts. A question that contains what looks like a wallet seed phrase is not kept at all. Free text we cannot detect automatically, such as names or street addresses, may remain — do not include personal data in your questions. The licensed dataset never carries your account identifier or email.

Legal basis: your consent (LGPD, art. 7, I; GDPR, art. 6(1)(a)), given for the version of the text shown on the agent page. If that text changes in substance, we ask again.

How long: until you delete it or delete your account. On the agent page you can turn the contribution off (nothing new is kept) and delete everything already kept, at any time. If a version of the dataset that contains your records was already licensed, we notify the licensee to delete them, and later versions leave them out.

3. What we do NOT collect

We do not collect KYC documents. We do not have access to your private keys, seed phrases, or wallet contents beyond the public address.

3.1 How the Discord check works

4. Processors

Stack Auth — authentication

Stripe — payments

Vercel — hosting, analytics, logs

Neon — database

Discord — membership role verification (optional, only if you connect it)

CulturaBuilder — runs the AI model behind Yield Agent (processes your questions to produce answers)

Sentry — error tracking (with PII redaction)

Resend — transactional email

6. Your rights

You can also download everything we hold about you as a JSON file from the account settings, at any time and without asking us first. The export and the deletion cover the same set of data.

If you connected Discord, disconnecting it from the account page deletes the stored link immediately; you do not need to contact us first.

If you contributed to the Yield Agent dataset, you can turn it off and delete what was kept from the agent page; the account export and the account deletion include it.

Contact: for questions about this policy, or to request access to or deletion of your data, write to yieldlab4@gmail.com.