This policy explains what personal data Coinvote processes, why, who receives it, how long it is kept and how to exercise your rights.
Data Controller
Léo MESBAH EI, trading as Coinvote — RCS Saintes 131 025 520 — SIRET 13102552000019
Address: 6 rue des Acacias, 17120 Semussac, France
Privacy contact: [email protected]
Publisher, hosting provider and other legal details: see the Legal Notice.
Data We Collect
- Account data: e-mail address, username, profile and authentication data, and the data shared by a sign-in provider you choose (Google, Apple, or a Web3 wallet signature) or a social account you connect.
- Community and project content: posts, comments, votes, follows, uploaded images, project links and Launchpad metadata.
- Rewards data: Nuggets and Boost balances and transactions, vote streaks and Shop purchases.
- Connection and security data: IP address, user-agent, session identifiers, event logs and anti-abuse signals.
- Order and billing data supplied to or received from payment providers. Individuals are asked only for their name and country (postal address optional); businesses also give their company name and address. For each order we keep a purchase record (date and time, IP address and its country, browser, accepted Terms version, products, amount and billing details) as proof of the transaction and for accounting and tax obligations.
- Wallet data: public addresses and public blockchain transaction identifiers when you use Launchpad; never private keys or seed phrases.
- Messages you send us by e-mail, through forms and tickets, or on our social and messaging accounts.
- Business contact data of projects and websites: see Business prospecting.
To protect voting and sensitive forms against automated abuse and coordinated accounts, we use first-party security identifiers (cookies and local storage), a hashed browser fingerprint based on coarse browser and display capabilities, IP and network data, and action timing. These signals are used for security only, not for advertising or cross-site tracking. They can be inaccurate or manipulated, so linked accounts are reviewed by administrators before a ban. You can ask for a review at [email protected].
Public pages can generally be viewed without an account. Account features, voting, community participation, advertising purchases and Launchpad use require processing the data needed to provide those services.
Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Providing accounts, voting, Community, rewards, Boosts, Launchpad and listings; processing orders and support requests | Performance of a contract |
| Securing the Service, preventing fraud, bots and multiple accounts | Legitimate interests |
| Accounting, tax and other legal obligations | Legal obligation |
| Business statistics, improving the Service, service e-mails about your listings and orders, business prospecting | Legitimate interests |
| Analytics and advertising cookies in regions where prior consent applies; browser notifications | Consent |
Service Providers
We use service providers that process data on our behalf. We only share the data necessary for the relevant service, and we may also disclose data where required by law or by a competent authority. We do not sell your personal data.
| Provider | Used for |
|---|---|
| Hetzner Online GmbH (Germany; servers in Ashburn, Virginia, United States) | Server hosting and database infrastructure |
| Cloudflare | Content delivery, TLS, protection against abuse, security checks (Turnstile), traffic statistics and reception of e-mails sent to our addresses |
| Stripe, PayPal, NOWPayments | Payment processing and fraud prevention for orders |
| Qonto (Olinda SAS, France, EU) | Business bank account and issuing of invoices for paid orders |
| Brevo (Sendinblue SAS, France, EU) | Transactional e-mail, account notifications and marketing e-mail |
| Amazon Web Services (Amazon SES) | Sending the newsletter, and site e-mails above a daily volume |
| Oracle (OCI Email Delivery) and Reoon | Sending business prospecting e-mails, and checking that the recipient address exists |
| Google (Gmail) | Mailbox receiving a copy of e-mails sent to our addresses |
| OneSignal | Push notifications, only if you turn them on (your account identifier is linked to your device) |
| Google Analytics (Google Ireland Ltd) | Audience measurement: see Cookies |
| Coinzilla | Crypto advertising network: see Cookies |
| Sevio | Advertising network: see Cookies |
| AI language-model providers (Anthropic, OpenAI) | Drafting replies to messages sent to us, which a team member can review, and helping to review submitted articles |
| Telegram | Bots, alerts and password recovery, only if you use them; messages sent to our Telegram accounts |
| IGN Géoplateforme (France), Photon by komoot (OpenStreetMap, Germany) | Address suggestions while you type an optional invoice address; only the typed text is sent, from our server, never your IP address, and nothing is stored |
| PumpPortal, Pinata | Preparing Launchpad transactions; IPFS storage for public token metadata and logos |
Third-party content loaded by your browser
Some pages load resources directly from third parties, which then receive your IP address and browser details: fonts from Google Fonts, code libraries from cdnjs and jsDelivr, charts from DexScreener and GeckoTerminal on project pages, and a location lookup from ipinfo.io in your account settings. These parties apply their own privacy policies, as do the advertisers and websites you visit from Coinvote.
Merger or acquisition
If we take part in a merger, acquisition or asset sale, we will inform you before your personal data is transferred or becomes subject to a different privacy policy.
What other people can see
Your public name, profile, posts, comments and project listings can be visible to other users and to search engines, depending on your privacy settings. We never display your e-mail address publicly. Aggregated information that does not identify anyone may be published and used for statistics and promotion.
Cookies
Where prior consent applies (EU/EEA, United Kingdom, Switzerland, Brazil, or when your country cannot be determined), advertising providers are not loaded and analytics cookies are not set before you accept them in the cookie banner. Until then, Google Analytics runs with Google Consent Mode, without cookies, and only receives anonymous signals used for aggregated statistics. You can change your choice at any time from the cookie preferences panel.
In other countries, analytics and advertising scripts load without a banner, and you can opt out with the "Your privacy choices" link.
You can also block or delete cookies in your browser settings; some features, such as staying signed in, then stop working.
| Cookie | Purpose | Duration |
|---|---|---|
| Strictly necessary and preferences | ||
PHPSESSID | Session | Session |
long_term_auth | Staying signed in | 10 days |
google_persistent_auth | Google sign-in | Session |
__Host-cv_vote, cv_dv, cv_xr | Security and protection against abuse | 30 days |
cc_cookie | Your cookie choices | 182 days |
cv_ads_optout | Your opt-out from analytics and advertising | 1 year |
cv_css | Page loading optimisation | 30 days |
cv_show_widgets, cv_recent_search | Widget visibility, recent searches | Session, 7 days |
cv_rank1_seen, cv_hh_lp_closed, cv_hub_lp_promo_closed | Remembering a message you have seen or closed | 180 days, 400 days, 30 days |
| Analytics (subject to your choice) | ||
_ga*, _gid | Google Analytics | Up to 2 years, 1 day |
cv_utm, cv_ref | Campaign and affiliate attribution | 30 days |
| Advertising (subject to your choice) | ||
| Coinzilla cookies | Displaying ads, limiting repetition and measuring them | Set by Coinzilla |
| Sevio cookies and local storage (including the ID5 identifier) | Displaying ads, limiting repetition and measuring them | Set by Sevio |
E-mails and notifications
We send account, security, order and listing e-mails needed for the Service. Newsletters and marketing e-mails can be stopped with the unsubscribe link they contain. Browser and app notifications are only sent if you turn them on, and can be turned off in your settings.
Business prospecting
We may contact crypto projects, websites and other businesses about listings, advertising or partnerships. For this we use professional contact details taken from public sources or from the project's own listing, such as a name, an e-mail address or a social handle, and we check that the e-mail address exists. Our basis is our legitimate interest. Reply "stop" to any such message, or write to [email protected], and we stop contacting you; we keep your address on a suppression list so that this choice is respected.
Launchpad and public blockchain data
Launchpad creators submit token metadata and a logo, which may be stored on public IPFS infrastructure through Pinata and copied to public blockchain or third-party pages. Wallet addresses, mint addresses and transaction signatures are public by design and may remain visible on the Solana network even after a Coinvote account or listing is removed. Coinvote never asks for or stores a seed phrase or private key. New launches incur no Coinvote service fee: we do not collect billing-identity snapshots or tax-location evidence solely to invoice a free launch, and no fee receipt is issued. Authentication, token metadata, wallet/mint addresses, signatures, consent and technical security records remain necessary for creation, listing and abuse prevention. Separate paid Boost purchases still require their own billing and payment records. Accounting records and receipts for historical paid launches remain retained under the applicable legal obligations; removing future service fees does not delete them.
YouTube API Services, TikTok and Instagram
Coinvote publishes its own short videos on its official social accounts. To do so, Coinvote's internal publishing tool uses the YouTube API Services (YouTube Data API, upload only), the TikTok Content Posting API and the Instagram API, exclusively for Coinvote's own channels and accounts. These tools are used by the Coinvote team only: they are not offered to Coinvote users and never send Coinvote users' personal data to YouTube, Google, TikTok or Meta.
By watching or interacting with Coinvote videos on YouTube, you are also bound by the YouTube Terms of Service, and Google processes your data under the Google Privacy Policy. TikTok and Instagram apply the TikTok Privacy Policy and the Instagram Privacy Policy.
- Data accessed and stored: the authorisation tokens of Coinvote's own accounts (stored encrypted on our servers), the basic profile of those accounts (name, avatar) and the identifiers and status of the videos we upload. We do not read, analyse or store data about YouTube, TikTok or Instagram viewers.
- Sharing: this data is not shared with third parties or used for advertising.
- Revocation and deletion: access can be revoked at any time from the Google security settings (YouTube) or the connected-apps settings of TikTok and Instagram. Disconnecting an account from Coinvote revokes its token and deletes the stored tokens immediately; upload logs are deleted within 30 days on request to [email protected].
International transfers
Our servers are located in the United States, and some providers may process data elsewhere outside the European Economic Area. Where required, we use an adequacy decision or appropriate safeguards such as standard contractual clauses.
Retention
| Data | How long |
|---|---|
| Account, profile and activity | While the account exists, subject to the deletion rights below |
| Purchase records | 10 years |
| Detailed anti-abuse signals and device associations | 30 days |
| Security identifiers in your browser | Renewed after 30 days |
| Your data export file | 7 days |
| Decisions on abuse and appeals; messages; other records | For as long as needed for these purposes, to resolve disputes and to meet legal obligations, then deleted or anonymised |
Security
Connections use HTTPS, passwords are stored hashed, and access to the data is restricted. No system is completely secure, but we limit the use of personal data to the purposes described here.
Deleting your data or account
Account deletion: you can delete your account from your account settings. This removes your account, login data, connected social links, comments, watchlist and the listings you own.
Other data: account deletion does not automatically remove everything. Community posts, vote history and rewards records can remain in our systems, and order records are kept for the period above. To have them erased as far as the law allows, or to delete specific data without deleting your account, write to [email protected].
We verify your identity for security purposes and aim to complete requests within 30 days. If we must keep specific data for legal or security reasons, we tell you.
Your Rights
Under the GDPR and subject to its conditions, you have the right to:
- access your personal data and obtain a copy of it;
- rectify inaccurate or incomplete data;
- erase your data;
- restrict its processing;
- object to its processing, including at any time to direct marketing;
- port your data to another organisation or to yourself;
- withdraw your consent at any time, without affecting earlier processing.
To exercise these rights, contact [email protected]. We have one month to respond. You can also lodge a complaint with a data protection authority, such as the CNIL in France.
Self-service data export: you do not have to wait for a manual answer to exercise your right of access and portability. From your account settings, the Download my data section prepares a JSON file containing the personal data linked to your account (profile, billing details, votes, posts and comments, orders, Boost credits, Launchpad launches). The file is generated in the background and never contains your password, password reset codes, wallet private keys or seed phrases. The export is free; to keep the service available for everyone, a new export can only be requested at a limited frequency.
Children's Information
coinvote.cc does not knowingly collect personal information from anyone under the age of 18. If you believe that your child has provided this kind of information on our website, please contact us immediately and we will make our best efforts to promptly remove it from our records. We encourage parents and guardians to guide their children's online activities.
Changes to This Privacy Policy
We may update this policy to reflect changes in our services, our processors or the applicable law. The date of the latest revision is shown at the top of this page. When a change materially affects how we process your personal data — for example a new processor, a new purpose or a longer retention period — we inform registered users by e-mail at the address linked to their account, before or at the time the change takes effect, and we display the updated policy here. Where a change requires your consent, we ask for it again instead of assuming it.