Privacy Policy

This policy explains what personal data Lenz collects, why we collect it, what we do with it, how long we keep it, and the rights you have over it.

Lenz is run by the team behind getlenz.io (“we”, “us”, “our”). We are the controller of the personal data described here, which means we decide why and how it is used.

Last updated: 20 August 2026 · Effective: 20 August 2026

Summary

This summary is here to help you read the rest. The numbered sections below are the full policy.

• We collect very little: an email address, your subscription and payment record, which markets you follow, and how you use the product.
• We never see bank details or card numbers. Payment is a one-way stablecoin transfer.
• We never take custody of your funds and never connect to your wallet or exchange accounts.
• We do not sell your personal data, and we do not share it for anyone else’s advertising.
• The system that writes the analysis does not read your personal data, and we do not use your personal data to train artificial-intelligence models.
• We do use it to check that a payment is lawful, to work out roughly where you are so that we only offer the Service where we may, and to detect account sharing — and a person reviews the case before any account is terminated or any payment refused.
• You can ask us for a copy of your data, ask us to correct it, or ask us to delete it — at any time, free of charge.

1. Who we are and how to reach us

1. The controller of your personal data is the operator of getlenz.io, reachable at hello@getlenz.io.
2. For anything about privacy or your data, write to hello@getlenz.io.

2. What this policy covers

1. This policy covers our website, the Lenz product, our sign-in system, our emails to you, and our support correspondence.
2. It does not cover third-party services you use to reach us or to pay us — for example your email provider, your wallet, or an exchange. Those services have their own privacy policies.
3. It should be read with our Terms of Service. This policy is a notice about how we handle personal data. It is not part of the contract in those Terms and does not create contractual rights on top of the rights the law already gives you. If this policy and the Terms of Service appear to say different things about personal data, this policy governs. It changes under section 14 below, not under clause 19 of the Terms.
4. This policy is written in English. If we publish a translation and there is any conflict, the English version governs, unless the law that applies to you requires otherwise.

3. What we collect

3.1 Information you give us

1. Your email address. This is the only thing we require to create an account, because sign-in is a link we email to you.
2. Your preferences. Which markets you choose to follow, your language and display settings, and your notification choices.
3. Support messages. What you write to us, and our replies.

3.2 Information about your subscription and payment

1. Subscription records: the tier you bought, the term you bought, the price, the dates it starts and ends, and its status.
2. Payment records: the amount, the asset and network used, the transaction reference, the confirmation status, and the wallet address the payment was sent from. A wallet address can in some circumstances identify a person, so we treat it as personal data.
3. Compliance records: the outcome of any sanctions or financial-crime screening that we or our payment provider run on a payment or on the address it was sent from, and the record of any decision to accept, refuse, return or withhold it. Clause 9.6 of our Terms of Serviceexplains when that happens.
4. We do not collect or hold bank details, card numbers, or any banking credentials.

3.3 Information we collect automatically

1. Product usage: which pages and reads you open, which depth level you expand, when, and how often.
2. Technical data: IP address, device and browser type, operating system, language setting, referring page, and time zone.
3. Approximate location: the country or region your IP address indicates. We use it to apply the availability rules in clause 2.2 of our Terms of Service, to present the Service correctly, and to help detect account sharing. We do not collect precise, satellite or device-level location.
4. Security and reliability data: sign-in attempts and their outcome, error and crash reports, and records needed to detect abuse of the Service.
5. Email delivery data: whether an email we sent was delivered, bounced or failed.

3.4 What we do not collect

1. We do not ask for your name, phone number, postal address, date of birth or identity documents.
2. We do not collect financial account data, holdings, portfolio contents or trading history. We do not connect to your wallet or to any exchange account, and nothing in the Service tells us what you decided to do with anything you read.
3. One qualification is worth stating plainly rather than glossing over. We hold the wallet address a payment was sent from (clause 3.2(b)), and the balance and transaction history of any address on a public network can be looked up by anyone who has the address. We do not do that, we do not build a profile from it, and we use the address only to identify and reconcile your payment, to meet our legal obligations, and to send a refund. But it would be untrue to tell you we could not.
4. We do not knowingly collect any special category data (such as data about health, beliefs, politics or biometrics). Please do not send us any.
5. If the law ever requires us to verify identity before providing the Service, we will tell you what is needed and why before collecting anything additional.

4. Why we use it, and our legal basis

We only use personal data where we have a legal basis to do so. These are the bases we rely on.

4.1 To perform our contract with you

1. Creating and running your account, and signing you in.
2. Giving you access to the tier you bought, and to the markets you follow.
3. Taking and confirming payment, and keeping the subscription record.
4. Sending service messages you need — sign-in links, payment confirmations, expiry reminders, and notices about changes to the Service or to our terms.
5. Answering your support requests.

4.2 Because we have a legitimate interest

We use data for the purposes below because it is necessary to run and protect the business, and we have considered your rights and concluded that these uses would not surprise you or override them.

1. Keeping the Service secure — detecting and preventing abuse, account sharing, automated scraping, fraud, and attacks.
2. Keeping the Service working — diagnosing errors, monitoring performance, and fixing faults.
3. Understanding how the product is used in aggregate — which reads are opened, which depth levels are useful — so we can improve it.
4. Offering the Service only where we may — using your approximate location to apply the availability rules in clause 2.2 of our Terms of Service.
5. Not handling unlawful funds — screening payments and the addresses they come from, where a legal obligation does not already require it of us.
6. Protecting our legal position — keeping records that let us establish, exercise or defend legal claims.
7. You can object to any of these uses at any time (see section 10).

4.3 Because you consented

1. Sending you marketing or newsletter emails, where you asked for them. You can withdraw consent at any time, and every such email has a one-click unsubscribe link.
2. Setting non-essential cookies or similar technologies (see section 11).
3. Withdrawing consent does not affect anything we did lawfully before you withdrew it.

4.4 Because the law requires it

1. Keeping accounting, tax and transaction records for the period the law requires.
2. Screening payments, and the addresses they come from, against sanctions and financial-crime requirements, and keeping a record of what we checked and what we decided.
3. Responding to a lawful request from a court, regulator or public authority.

5. Automated analysis, and what it does not do with your data

5.1 The analysis is not about you

1. The analysis Lenz publishes is produced by an automated system driven by artificial intelligence, and no human analyst writes, reviews, verifies or approves it before it is published. That system reads market data, economic data and news. It does not read your personal data, and nothing about you is used to write it. The only thing your account determines is which of those reads you are shown.
2. The reads published for a market are the same for every subscriber whose tier includes that market. They are not personalised to you and are not based on anything about you.
3. We do not use your personal data to train, fine-tune or evaluate artificial-intelligence models, and our contracts with the model providers we use require them not to train on anything we send them.
4. If you write to support and we use an automated tool to help us answer, we send it only what is needed to answer you, on the same no-training terms. Please do not put anything into a support message that you would not want handled that way.

5.2 Automated checks, and where a person steps in

1. We run automated checks on how the Service is used: on sign-in attempts, on whether a payment has been confirmed, on sanctions and financial-crime screening, and on patterns that suggest an account is being shared or that content is being extracted in bulk.
2. Those checks can lead to an account being suspended, and a suspension affects a service you have paid for. We would rather say so than pretend otherwise.
3. So that no decision of that kind is taken by software alone: an automated check may suspend access temporarily, but a person reviews the case before any account is terminated, or any payment is refused, returned or permanently withheld.
4. You can ask us to explain such a decision, put your side of it, and have it reviewed by a person, by writing to hello@getlenz.io. We reply within the time in clause 10.2(c). Clause 18.3(d) of our Terms of Service says what happens if we conclude there was no breach.
5. Apart from those checks, we do not make decisions about you by automated means that produce legal effects for you or similarly significantly affect you, and we do not profile you.

6. Who we share it with

6.1 We do not sell your data

1. We do not sell personal data, we do not rent it, and we do not share it with anyone for their own advertising or marketing.

6.2 Service providers who process data for us

We use a small number of suppliers to run the Service. They act on our written instructions, may only use the data to provide their service to us, and are bound by a data processing agreement.

1. Hosting and infrastructure — a commercial cloud infrastructure provider: stores the account and subscription data.
2. Email delivery — Resend: sends sign-in links, service messages and, if you asked for them, newsletters.
3. Payment processing — Plisio: creates the payment request, watches the network for the transfer, and tells us when it has been confirmed.
4. Product analytics — none. We do not use a third-party product-analytics service.
5. Error monitoring — none. Technical faults are recorded in our own server logs, covered by section 8.
6. Customer support tooling — our self-hosted support desk: handles support correspondence.

6.3 Other disclosures

1. Professional advisers — our accountants, auditors, insurers and lawyers, where they need it and under a duty of confidence.
2. Legal and regulatory — where we are required by law, or where disclosure is necessary to establish, exercise or defend legal claims, or to protect the safety or rights of anyone.
3. Business transfer — if the business or its assets are reorganised, merged or sold, data may transfer to the buyer, who must continue to protect it under this policy or an equivalent one. We will tell you if this happens.

6.4 What the blockchain shows

1. A stablecoin payment is recorded on a public network. The transaction, the amounts and the addresses involved are visible to anyone and cannot be deleted, by us or by anyone else. That record is outside our control and is not something we can erase on request.
2. We do not publish anything linking you to a transaction.

7. Sending data to other countries

1. We and our suppliers may store or process personal data in countries other than the one you live in, and the data-protection rules there may be different.
2. Where we transfer personal data out of the European Economic Area or the United Kingdom, we do it only where there is a lawful basis for the transfer — a formal adequacy decision covering the receiving country, or standard contractual clauses (with the UK addendum where relevant), together with any extra safeguards the transfer needs.
3. You can ask us for details of the safeguards that apply to a particular transfer by writing to hello@getlenz.io.

8. How long we keep it

We keep personal data only as long as we need it for the purpose we collected it for, or as long as the law requires.

1. Account data (email address, preferences) — for as long as your account is open, then deleted within 30 days of closure.
2. Subscription and payment records — for 7 years, because tax and accounting law requires us to keep transaction records.
3. Support correspondence — 24 months after the matter is closed.
4. Product usage data — 12 months in identifiable form, after which it is aggregated so that it no longer identifies anyone, and kept in that aggregated form.
5. Technical, security and sign-in logs — 90 days, unless a record is needed longer to investigate an incident.
6. Marketing consent records and unsubscribes — for as long as needed to prove consent and to make sure we do not email you again.
7. Where we need to keep something to establish, exercise or defend a legal claim, we keep it until that matter is finally resolved.

9. How we protect it

1. We use technical and organisational measures appropriate to the risk, including encryption of data in transit, access controls that limit who inside the business can see personal data, single-use expiring sign-in links, logging of administrative access, and regular review of our suppliers.
2. We keep the amount of personal data we hold deliberately small. The less we hold, the less there is to lose.
3. No system is completely secure. We cannot guarantee the security of data sent over the internet, and you send it at your own risk.
4. If a breach of personal data occurs that is likely to result in a high risk to your rights, we will tell you, and we will notify the relevant authority where we are required to.

10. Your rights

10.1 What you can ask for

Subject to the conditions and exceptions in the law that applies to you, you have the right to:

1. Access — get confirmation of whether we hold personal data about you and a copy of it.
2. Rectification — have inaccurate data corrected and incomplete data completed.
3. Erasure — have your data deleted where we no longer need it, where you withdraw the consent it relied on, or where you successfully object to its use.
4. Restriction — have us pause our use of your data while a dispute about it is resolved.
5. Objection — object to any use we base on a legitimate interest, and object at any time to direct marketing, which we will always stop.
6. Portability — receive the data you gave us in a common machine-readable format, and have it sent to another provider where that is technically feasible.
7. Withdraw consent — at any time, where our use was based on consent.
8. Complain — to your local data protection authority. If you are in the European Economic Area or the United Kingdom, that is the supervisory authority for the place where you live, work, or where the issue arose. We would appreciate the chance to put things right first.

10.2 How to exercise them

1. Write to hello@getlenz.io from the email address registered on your account, and tell us what you want.
2. We may need to confirm that the request is really from you before we act on it. We will not ask for more information than we need to do that.
3. We respond within one month. If a request is complex, we may extend that by up to two further months, and we will tell you within the first month if we do.
4. Exercising your rights is free. We may charge a reasonable fee, or decline, only where a request is clearly unfounded or excessive, and we will explain why.
5. If we cannot do what you asked, we will tell you why and what you can do next.

10.3 Deleting your account

1. You can ask us to close your account and delete your data at any time by writing to hello@getlenz.io.
2. We will delete your account data. We must keep the transaction record of any payment for the period tax and accounting law requires, and we cannot remove anything already recorded on a public payment network (see clause 6.4).
3. Deleting your account does not entitle you to a refund of a prepaid term. Refunds are covered by ourTerms of Service.

10.4 Rights in other regions

1. Some regions give people additional or differently-named rights — for example a right to know what is collected, a right to delete it, or a right not to be discriminated against for exercising a right.
2. Rather than run different processes for different places, we apply the rights in clause 10.1 to everyone, wherever you are. If your local law gives you a right we have not listed, tell us and we will honour it where it applies to you.

11. Cookies and similar technologies

1. Strictly necessary — a small number of first-party cookies keep you signed in, remember your language and display choices, and protect against abuse of the sign-in system. The Service cannot work without them, so they are set without consent.
2. Analytics — we use analytics to understand aggregate usage. Where consent is required for these, we ask for it before setting them, and you can decline without losing access to anything.
3. No advertising cookies. We do not run advertising on the Service and we do not set advertising or cross-site tracking cookies.
4. Because we set no optional cookies there is nothing to consent to and no banner to configure. You can clear or block cookies in your browser — though blocking the strictly necessary ones will stop sign-in from working.

12. Emails we send you

1. Service emails — sign-in links, payment confirmations, expiry reminders and important notices about the Service or these policies. These are part of the Service, so you cannot unsubscribe from them while you have an account.
2. Marketing emails — only if you asked for them. Every one has a one-click unsubscribe link, unsubscribing takes effect promptly, and we will not penalise you for it.
3. We may record whether an email was delivered or bounced so that we can tell when we have lost contact with you.

13. Children

1. The Service is for adults. You must be at least 18 to use it, and it is not directed at children.
2. We do not knowingly collect personal data from anyone under 18. If we learn that we have, we will delete it and close the account. If you believe a child has given us data, write to hello@getlenz.io.

14. Changes to this policy

1. We may update this policy, for example when we change a supplier, add a feature, or where the law changes.
2. We will post the updated policy with a new “last updated” date. Where a change materially affects how we use your personal data, we will tell you by email or in the Service before it takes effect, and where the law requires your consent for the change, we will ask for it.

15. How to contact us

For any question about this policy, about your data, or to exercise any of your rights:

• Email: hello@getlenz.io

Please write from the email address registered on your account so that we can identify you.

Last updated: 20 August 2026