Privacy Policy

1. Controller and contact

For privacy inquiries, please contact info@xgr.network.

2. Website hosting and security

Our server infrastructure uses STRATO. Technical requests may process IP address, date and time, requested URL, referrer, user agent, and HTTP status to deliver the service, maintain reliability, prevent abuse and investigate incidents. Legal basis: Art. 6(1)(f) GDPR (legitimate interests). Logs are retained only as necessary or where legally required. XITA does not run marketing trackers, advertising cookies or a newsletter.

3. Wallets and public blockchain information

Connecting your self-custodial wallet may expose its public wallet address to this interface. Transaction approval and signing are handled by wallet software. XITA does not request or retain private keys or seed phrases and does not take custody of your cryptoassets through the transfer interface. Public addresses, transaction hashes, amounts, events and proof records may be available to blockchain RPC providers and permanently recorded on public networks. The operator cannot generally erase blockchain records. Required interface processing is based on Art. 6(1)(f) GDPR.

4. Join applications and status emails

To propose a CoinGecko-listed ERC-20 token, an applicant supplies public project information, the original chain and token contract, CoinGecko ID, desired routes, a contact email address and a declared relationship to the token (founder, team member, authorized representative, holder, community member or other). The email is used for application confirmation and updates relating directly to review, deployment, first independently verified token locking/TVL and public-listing status. We do not send marketing emails based on Join applications.

After the email has been confirmed, public project information and the applicant role category may be included in a GitHub draft pull request. The private contact email and confirmation token are not included in public GitHub PRs or token configuration files. Email confirmation does not establish token ownership or authority to represent the token project.

The contact email and internal application record are stored in a restricted server-side location outside Git and the webroot. One-time confirmation tokens are stored only as cryptographic hashes and expire after 24 hours. Expired unconfirmed requests are deleted. Active application records are generally retained for up to 366 days, and rejected or completed/publicly listed contact records for 180 days after the relevant event, subject to mandatory retention obligations.

Legal basis: Art. 6(1)(b) GDPR when processing is necessary for requested pre-contractual steps, and otherwise Art. 6(1)(f) GDPR (legitimate interests in verifying applications, preventing abuse, ensuring reliable project reviews and communicating relevant status changes). Applicants may contact us to request deletion or to stop future updates, subject to overriding legal duties.

5. Paid XITA service fees and tax records

When you request a signed quote for a paid XITA Execution Gateway service, we record the client IP address received through our trusted reverse proxy and an approximate two-letter country code derived locally from IP-to-country network data, together with the source of that country determination. We link this private quote evidence to the actual paid, confirmed on-chain service fee using the fee event, network, gateway, payer wallet and unique quote nonce. We also record the native service fee, EUR equivalent, market-data source and timestamp. An unexecuted quote is not treated as a paid service.

This processing supports commercial accounting, tax-law compliance, auditability and prevention of duplicate bookings (Art. 6(1)(c) GDPR insofar as tax-law obligations apply; otherwise Art. 6(1)(f) GDPR for robust accounting controls). IP-derived geolocation can be incorrect and is not, by itself, conclusive evidence of a customer's tax residence. Quote data and paid tax evidence are restricted to authorized back-office roles and are not disclosed through the public transfer index or published on blockchains. Unpaid quote evidence is subject to a short technical retention period; completed fee and accounting records are kept only for the applicable statutory accounting and tax retention periods, after which unnecessary IP details are deleted or anonymized. Country-code and tax classifications may be reviewed or corrected where legally required.

6. Service providers and recipients

• STRATO: hosting and related technical access records.
• Zoho Mail: application confirmation and transactional status emails (Zoho Corporation GmbH, Essen, Germany).
• GitHub: public token/project data, declared applicant role category and code-review records, without private contact email.
• CoinGecko: verification of the submitted public coin profile and original token identity.
• Public RPC/explorer providers: blockchain queries and associated connection metadata.

Where personal data is processed outside the EU/EEA, legally required transfer safeguards are used.

7. Your rights

Under Arts. 15–21 GDPR, subject to applicable conditions, you may request access, rectification, erasure, restriction, portability and object to processing. Where consent is the legal basis, you may withdraw it prospectively. You can lodge a complaint with the competent supervisory authority. Contact: info@xgr.network.

8. Updates and external services

Wallet providers and linked sites have independent privacy notices. Significant changes to XITA's processing will be reflected in an updated policy and revision date.