This Privacy Policy explains how Geodesics processes personal data when you visit geodesics.ai, use Geodesics APIs, software, command-line tools, agent skills, documentation, interfaces, and related services, or communicate with us (collectively, the "Services").
Geodesics is designed as non-custodial infrastructure. We do not need your private keys or recovery phrases to operate the Services, and you should never send them to us.
1. CONTROLLER AND CONTACT
1.1. Geodesics is the controller of personal data processed for the purposes described in this Policy, unless a separate agreement identifies another controller or processor arrangement. Geodesics is presently operated by its founder for and on behalf of a legal entity in the process of incorporation, which is intended to assume the controller role upon incorporation.
1.2. Questions and requests concerning privacy may be submitted through the official contact channels published at geodesics.ai. We may request proportionate information to verify your identity before responding to a rights request.
2. SCOPE AND APPLICABLE LAW
2.1. This Policy applies to personal data processed through the Services, including the public website, developer and integration services, API access, support, and security operations.
2.2. This Policy is governed by the Swiss Federal Act on Data Protection (FADP) and its implementing ordinance.
2.3. This Policy does not govern independent Third-Party Services, public blockchains, wallets, exchanges, bridges, liquidity venues, or websites that have their own privacy practices.
3. PERSONAL DATA WE PROCESS
We process only data reasonably relevant to operating, securing, supporting, and improving the Services.
3.1. Information you provide
- Contact and communications data, such as a name, handle, email address, organisation, message content, support request, feedback, or security report that you choose to provide.
- Integration and account data, such as an API Key identifier, organisation or project name, technical configuration, access role, or preferences associated with your use of restricted developer services.
- Transaction instructions, such as wallet addresses, source and destination networks, token addresses, input amounts, requested output assets, slippage settings, and other parameters submitted to request or execute a Route.
3.2. Service and transaction data
- Quote and Route data, including requested asset pairs, supported networks, expected output, price impact, fee information, gas treatment, expiry, and selected venues or transaction steps.
- Execution and status data, including a swap identifier, operation hash, transaction hash, signature or signature result, submission time, error or warning code, settlement state, refund state, and origin or destination-chain receipt.
- API and security logs, including request time, endpoint, response status, API Key identifier, rate-limit events, IP address, user agent, and diagnostic information needed to operate or protect the Services.
3.3. Website and device data
- Device and connection information, such as IP address, browser type, operating system, language, approximate region derived from IP address, referring page, and device characteristics.
- Usage information, such as pages viewed, navigation path, session duration, interactions, campaign or referral parameters, and performance or error events.
- Cookies, local browser storage, and similar technologies used for essential operation, security, preferences, and analytics as described below.
3.4. Public blockchain data
Public blockchains make wallet addresses, balances, token transfers, transaction hashes, timestamps, smart-contract interactions, and related information visible to anyone. We may read, index, associate, or otherwise process public blockchain data to quote Routes, submit and monitor Transactions, prevent abuse, investigate errors, and provide support.
Wallet addresses and public blockchain activity are pseudonymous, not necessarily anonymous. They may identify a person when combined with other information.
3.5. Data from third parties
We may receive information from blockchains, RPC and node providers, exchanges, bridges, liquidity venues, relayers, fraud and security providers, analytics providers, hosting providers, and users or integrators that instruct us to process a Transaction.
3.6. Information we do not request
We do not request or intentionally collect Wallet private keys or recovery phrases. Do not send them to us. We do not intentionally collect special categories of personal data, such as health, biometric, religious, political, or racial information. If you include unnecessary sensitive information in a message, we may delete or restrict it where reasonably possible.
4. WHY WE PROCESS PERSONAL DATA
We process personal data for the following purposes:
- provide Quotes, build transaction operations, submit authorised Transactions, and report status;
- authenticate API access, administer integrations, and enforce rate limits;
- operate, maintain, test, troubleshoot, and improve the Services;
- monitor performance, understand website use, and improve content and usability;
- protect users, Geodesics, and third parties against fraud, abuse, attacks, and unauthorised access;
- respond to questions, support requests, legal notices, and security reports;
- maintain business, accounting, security, and dispute records;
- comply with legal obligations, court orders, sanctions, and lawful government requests; and
- establish, exercise, or defend legal claims.
We do not use personal data to make automated decisions that produce legal or similarly significant effects about individuals. Route computation and transaction risk controls are technical service functions, not automated individual decisions about a person's legal rights.
5. LEGAL BASES
Where Swiss law requires a justification for processing, we rely on one or more of the following:
- Contract: processing needed to provide requested Services or take steps at your request before providing them.
- Legitimate interests: operating and securing the Services, preventing abuse, improving reliability, understanding use, communicating with users, and protecting legal rights, balanced against your interests and rights.
- Legal obligation: processing needed to comply with applicable law, court orders, sanctions, tax, accounting, or regulatory duties.
- Consent: optional analytics or communications where consent is required. You may withdraw consent at any time without affecting earlier lawful processing.
Under Swiss law, we process personal data lawfully, in good faith, transparently, proportionately, and only for specified purposes, and we apply the FADP grounds and safeguards relevant to each activity.
6. BLOCKCHAIN TRANSPARENCY AND IMMUTABILITY
6.1. A blockchain is operated by a distributed network independent of Geodesics. Data written to a public blockchain may be permanent, replicated globally, and impossible for Geodesics to correct or delete.
6.2. A rights request made to Geodesics does not allow us to erase or alter a public blockchain record. We will apply a request to personal data in systems we control where legally required and technically feasible.
6.3. Do not encode names, contact details, secrets, confidential information, or other unnecessary personal data in transaction calldata, memo fields, token metadata, or other public blockchain fields.
7. COOKIES AND THIRD-PARTY WEB TECHNOLOGIES
7.1. The website may use cookies, local browser storage, pixels, tags, and similar technologies. These may be:
- Essential: required to deliver pages, protect the website, remember basic choices, or maintain a requested session.
- Analytics: used to understand traffic, page use, referrals, and website performance.
7.2. The current website uses Google Analytics. Google Analytics may receive online identifiers, cookie identifiers, IP-derived information, device and browser data, referral information, and website interaction events. Google acts under its own terms and privacy documentation. Where required, analytics will be used only after the appropriate consent or opt-out mechanism is available.
7.3. The website also loads resources such as fonts and icons from third-party content providers. When your browser requests those resources, the provider may receive ordinary request information such as your IP address, user agent, referring page, and request time.
7.4. You can restrict or delete cookies through browser settings and available consent controls. Blocking essential technologies may impair some functionality. Browser privacy controls and analytics opt-out tools may provide additional choices.
7.5. We do not state that every third-party technology is anonymous. Seemingly separate technical or usage events may become identifying when combined with other information.
8. HOW WE DISCLOSE PERSONAL DATA
We may disclose personal data only as reasonably necessary to the following categories of recipients:
- Infrastructure and hosting providers that operate networks, servers, databases, monitoring, security, and content delivery.
- Analytics and web-asset providers that help measure website use or deliver fonts, icons, and related resources.
- Blockchain and transaction providers, including RPC or node services, exchanges, bridges, liquidity venues, relayers, or other Route components needed to quote, submit, and monitor a Transaction.
- Professional advisers, auditors, insurers, and contractors subject to appropriate confidentiality duties.
- Authorities, courts, regulators, or other persons where disclosure is required by law or reasonably necessary to protect rights, safety, security, and the integrity of the Services.
- A successor or transaction counterparty in connection with a merger, financing, reorganisation, acquisition, insolvency, or transfer of all or part of the Services, subject to appropriate safeguards.
We may share aggregated or de-identified information that does not reasonably identify an individual. We do not sell personal data for money.
9. INTERNATIONAL TRANSFERS
9.1. The Services and Third-Party Services may process data in Switzerland and other countries. Those countries may have privacy laws different from the laws where you live.
9.2. Where required, we use a lawful transfer mechanism, such as a recognised adequacy decision, approved standard contractual clauses, contractual safeguards recognised by the FDPIC, or another legally permitted basis. We may supplement contractual safeguards with technical and organisational measures where appropriate.
9.3. Public blockchain data is replicated according to the operation of the relevant network and cannot be limited to a particular country by Geodesics.
10. RETENTION
10.1. We retain personal data only for as long as reasonably necessary for the purposes described in this Policy, including service delivery, security, fraud prevention, troubleshooting, legal compliance, accounting, dispute resolution, and enforcement.
10.2. Retention depends on the type of data and context. We consider:
- how long an integration, API credential, support matter, or transaction remains active;
- the time needed to investigate incidents and maintain reliable transaction records;
- applicable limitation periods and legal, tax, accounting, or regulatory duties;
- the sensitivity and volume of the data; and
- whether data can be aggregated, de-identified, or securely deleted.
10.3. Public blockchain records are retained by the network, not by Geodesics, and may remain available indefinitely.
10.4. Backups and security logs may remain for a limited period after operational data is deleted. De-identified statistics may be retained where they no longer identify an individual.
11. SECURITY
11.1. We use reasonable technical and organisational measures designed to protect personal data, such as access controls, encryption in transit where appropriate, monitoring, logging, dependency and infrastructure management, and incident-response procedures.
11.2. No online or blockchain system is completely secure. We cannot guarantee that unauthorised access, loss, misuse, or alteration will never occur.
11.3. You are responsible for protecting your Wallet, private keys, recovery phrases, API Keys, signer credentials, devices, and integration environment. Use strong access controls, least-privilege permissions, allowlists, spending limits, and secure secret storage.
11.4. If a personal data breach is likely to result in a high risk to affected persons, we will notify the competent authority and affected persons when and as required by applicable law.
12. YOUR RIGHTS AND CHOICES
12.1. Subject to applicable law and exceptions, you may have rights to:
- obtain information about whether and how we process your personal data;
- access personal data and receive relevant details about its source, purpose, recipients, and retention;
- correct inaccurate or incomplete personal data;
- request deletion or destruction of personal data;
- object to or request restriction of certain processing;
- receive or transmit data in a structured, commonly used format where portability applies;
- withdraw consent for processing based on consent; and
- complain to a competent data protection authority, including the Swiss Federal Data Protection and Information Commissioner where applicable.
12.2. Submit a request through the official contact channels on geodesics.ai. Describe the right you wish to exercise and the context of your relationship with the Services. Do not send private keys or recovery phrases.
12.3. We may ask for proportionate information to verify identity and authority. We generally respond within 30 days where the FADP applies, subject to lawful extensions, restrictions, and exceptions.
12.4. Rights are not absolute. We may retain or withhold information where necessary to comply with law, protect another person's rights, preserve security, establish or defend claims, or satisfy another lawful ground. We will explain a restriction where required.
12.5. We cannot modify or delete data controlled by a public blockchain or independent Third-Party Service. You should direct requests concerning an independent service to that service's controller.
13. CHILDREN
The Services are not directed to children under 18, and we do not knowingly collect personal data from them. If you believe a child has provided personal data, contact us through geodesics.ai so that we can assess and address it.
14. CHANGES TO THIS POLICY
14.1. We may update this Policy to reflect changes in the Services, technology, law, or data practices. The revised Policy will show a new effective date and be published through official channels.
14.2. If a change materially affects how we process personal data, we will provide additional notice or seek consent where required by law.
15. CONTACT
Privacy questions, rights requests, and concerns may be submitted to info@geodesics.ai. Do not include private keys, recovery phrases, or unnecessary sensitive information.