TRCBeacon Privacy Policy
Effective date: October 12, 2026
1. Who we are
1.1. This Privacy Policy explains how Rivo Labs LLC, a limited liability company organized in New Mexico, USA (File # 3308017), 1209 Mountain Road Pl NE, #10346, Albuquerque, NM 87110, USA ("Rivo Labs", "we", "us"), processes personal data in connection with TRCBeacon (the "Service"), our website https://trcbeacon.com and our Telegram bot @trcbeaconbot.
1.2. For account, eligibility, compliance and payment data, we are the controller. For Client Data (the addresses, labels and notes that business clients submit about their own wallets and counterparties), we act as a processor when we monitor addresses on the client's instructions, and the client is the controller; a data processing agreement is available on request at [email protected]. For our own purposes (the account, billing and tax records, eligibility and sanctions screening, security and abuse prevention, and compliance with law) we are a controller. If law or a legal hold requires us to keep Client Data after the account is closed, we keep it as a controller, only for that purpose (Section 4.1).
1.3. Contact for privacy matters: [email protected] (or [email protected] and @trcbeaconbot).
2. Data we collect
2.1. We collect the minimum needed to run the Service and meet our legal duties:
| Category | What | Source |
|---|---|---|
| Account | Telegram ID, username and display name; e-mail (required for a web account, optional in the bot) and a salted hash of your password (we never store the password itself); declared country; plan, settings, notification preferences | You, Telegram |
| Eligibility check | At registration the bot asks you to share your Telegram contact (phone number). This is required to register; if you decline, we cannot provide the Service. From the number we keep only the country code, the result of the check, and a salted hash of the number with the date of the check. We do not keep the full phone number | Telegram, derived |
| Network data | IP address (website, web account, API and web payment pages); country derived from it; whether the IP belongs to a VPN, proxy or hosting network; user agent; request logs | Automatic |
| Business verification (KYB) | For Business, Scale and API plans: company name, country of registration, registration number, and the contact person's name where given | You |
| Client Data | Blockchain addresses you add, your labels and notes, webhook URLs, rules and thresholds | You |
| Payment | Transaction hash, sender address, amount, time, and Telegram Stars payment identifiers. We do not receive card or bank details | Blockchain, Telegram |
| Screening records | Name or company, Telegram display name, e-mail domain, country, the sending address of payments, the list checked and its version, the time and the result | Derived |
| Support | Messages you send us and our replies | You |
2.2. Blockchain data is public. We do not link addresses to real-world identities except where you give us that link (for example, your labels), or where an address is a payment sender or a client.
2.3. We do not knowingly collect data from children. You must be 18 or older to use the Service. If we learn that we hold data of a person under 18, we delete it.
2.4. We do not collect special categories of personal data and ask you not to put them in labels or notes.
3. Why we use it, and on what basis
3.1. We process personal data for these purposes:
| Purpose | Data | Legal basis (GDPR-style) |
|---|---|---|
| Provide the Service: accounts, monitoring, notifications, webhooks, API, support | Account, Client Data, support | Contract |
| Take and verify payments, keep accounts and tax records | Payment, account | Contract; legitimate interest in meeting U.S. tax and accounting requirements (see 3.5); legal obligation where the applicable law requires it |
| Check territory and sanctions eligibility; screen clients and payment senders against SDN and other lists; block and report matches; keep records | Eligibility, network data, KYB, screening records, payment | Legitimate interest in complying with U.S. sanctions law (OFAC) and protecting the Service (see 3.5); legal obligation where the applicable law requires it |
| Prevent fraud, abuse, circumvention of controls and attacks; enforce the Terms and the AUP; security logs | Network data, account, logs | Legitimate interest |
| Respond to lawful requests from authorities; establish or defend legal claims | All as needed | Legal obligation; legitimate interest |
| Service communications (security, billing, changes of terms) | Account | Contract; legitimate interest |
| Improve and operate the Service using aggregated statistics | Aggregated, de-identified data | Legitimate interest |
3.2. Where we rely on legitimate interests, we balance them against your rights. You may object (Section 8).
3.3. Automated decisions. Sanctions and territory screening may automatically reject a registration or payment. Positive matches are reviewed by a person before a final decision, and you may ask us for a human review and to explain the outcome by writing to [email protected].
3.4. We do not use your data for advertising and do not profile you for marketing. We do not sell or "share" personal data for cross-context behavioural advertising.
3.5. Duties under U.S. law. If you are in the EEA, the United Kingdom or Switzerland, a duty under U.S. law (OFAC sanctions, U.S. tax) is not a "legal obligation" under Art. 6(1)(c) GDPR. For that processing we rely on legitimate interest (Art. 6(1)(f) GDPR); our interest is to comply with the law that applies to us. We use "legal obligation" only for duties under a law that applies to the processing.
4. Retention
4.1. We keep personal data only as long as needed:
| Data | Period |
|---|---|
| Account data | While your account is active and for 12 months after it is closed or ends, then deleted or anonymised |
| Client Data | While your account is active; after it is closed or ends, deleted 30 days after the export window ends (30 days from termination, Terms 17.4), except Client Data that law or a legal hold requires us to keep, which we keep as controller and only for that purpose until the obligation or hold ends |
| Screening records and payment records (incl. eligibility check results and salted phone hash, sanctions matches, KYB records, tx hashes, sender addresses) | 10 years from the date of the record, as required for sanctions compliance and accounting |
| Server, API and security logs (including IP address) | 90 days |
| Support messages | While your account is active and for 12 months after |
| Data subject to a legal hold or request | Until the matter ends |
4.2. Where you ask us to delete data that we must keep by law, we will keep only that data, restrict its use to the legal purpose, and delete it when the period ends.
5. Who receives data
5.1. We share personal data only with:
- Infrastructure and hosting providers that run our servers, databases, backups and monitoring;
- Telegram, through which we send notifications and take Stars payments (Telegram acts under its own terms and privacy policy);
- Our e-mail delivery provider — smtp.bz (individual entrepreneur Tutaev A. M., Russian Federation), which receives your e-mail address and the content of service e-mails (account confirmation, password reset, billing notices) in order to deliver them;
- Blockchain data and node providers, which receive the addresses needed to retrieve blockchain data, but not your identity;
- Sanctions and AML data providers, from which we receive list data (we do not send them your account data, except for an address that needs to be checked);
- Professional advisers (lawyers, accountants) under confidentiality;
- Authorities, courts and regulators, where the law requires or a valid request is made (see the AUP, Section 6), and in connection with blocked property and sanctions reporting;
- A successor in a merger, sale or reorganisation of the business, on equivalent privacy terms.
5.2. We do not sell personal data. Providers are bound by contract to process data only for our purposes and with appropriate security.
6. International transfers
6.1. Rivo Labs is in the United States, and data is processed in the United States and in other countries where our providers operate. If you are in the European Economic Area, the United Kingdom or Switzerland, we transfer your data to the US and other countries that may not offer the same level of protection. Transfers are made under Art. 49(1)(b) GDPR (necessary for the performance of the contract) or another lawful mechanism.
6.2. Service e-mails (account confirmation, password reset, billing notices) are sent through a provider in the Russian Federation (Section 5.1). For this purpose your e-mail address and the content of those e-mails are transferred to and processed in Russia, which has no adequacy decision under the GDPR and whose authorities may have access to data held by local providers under Russian law. The transfer is necessary to deliver e-mails you request or that are needed to perform our contract with you (Art. 49(1)(b) GDPR). We send only what is needed for the e-mail. If you do not want your e-mail address processed in Russia, use the Service through the Telegram bot without a web account.
7. Security
7.1. We use measures appropriate to the risk, including encryption in transit, access controls, separation of environments and logging. We never store private keys or seed phrases of your wallets. No system is completely secure. We will notify you and the authorities of a personal data breach where the law requires it.
8. Your rights
8.1. Subject to the law that applies to you (for example the GDPR, the UK GDPR, or US state privacy laws), you may ask us to: access your personal data and get a copy; correct it; delete it; restrict or object to its processing; receive it in a portable format; and withdraw consent where we rely on consent. You may also complain to your data protection authority.
8.2. To exercise a right, write to [email protected] or message @trcbeaconbot. We may need to verify your identity. We aim to respond within 30 days. We may refuse or limit a request where the law allows, in particular where we must keep records for sanctions and accounting purposes (Section 4), and we will explain why.
8.3. We do not discriminate against you for exercising your rights.
8.4. For Client Data, if we are the processor, we will pass requests from the data subjects to the relevant client.
9. Cookies and similar technologies
9.1. Our website uses only a minimal set of cookies or local storage that are strictly necessary: for example to keep you logged in, protect against abuse and remember basic settings. We do not use advertising, cross-site tracking or social media cookies. If we add analytics, they will be limited to aggregated, privacy-preserving statistics, and we will update this Policy and ask for consent where the law requires.
9.2. You can block cookies in your browser settings, but parts of the website may not work.
10. Your obligations for Client Data
10.1. If you add information about other people (for example, names in labels linked to addresses), you must have a lawful basis and any notices or consents required by law, and you must not breach the AUP.
11. Changes
11.1. We may update this Policy. We will post the new version with a new effective date and, for material changes, notify you in the bot, by e-mail or on the website at least 30 days before they take effect, unless a shorter period is required by law.
12. Contact
12.1. Rivo Labs LLC, 1209 Mountain Road Pl NE, #10346, Albuquerque, NM 87110, USA · [email protected] · [email protected] · Telegram @trcbeaconbot.