PRIVACY POLICY – THEGAVEL.IO

Version: 1.0 · Last updated: 21 September 2026

This English version is a translation of the French Privacy Policy, provided for convenience. The French version is the reference text; in the event of any inconsistency, the French version prevails.

This privacy policy describes how ALETHEIA ANALYTICS processes personal data in connection with the operation of the interface available in particular at thegavel.io, its associated technical features, and its activities of indexing and analysing data relating to The Gavel Protocol.

It also provides information to persons whose public data recorded on the Arbitrum One blockchain is indexed by Aletheia, including where those persons have never used the thegavel.io interface.

1. Controller

ALETHEIA ANALYTICS is a French simplified joint-stock company with a sole shareholder (société par actions simplifiée unipersonnelle) with share capital of 1,000 euros, registered with the Paris Trade and Companies Register under number 107 152 662 R.C.S. Paris, whose registered office is located at 173 rue de Courcelles, 75017 Paris, France.

For the processing described in this policy, Aletheia Analytics acts as controller where it determines the purposes and means of its own processing of data.

General contact: contact@thegavel.io

Contact for data protection and the exercise of your rights: privacy@thegavel.io.

The thegavel.io interface operated by Aletheia is distinct from the open-source and permissionless software The Gavel Protocol. Aletheia does not claim to be responsible for all processing or operations carried out by the Arbitrum One blockchain, by its nodes, by network participants, or by persons who interact directly with the smart contracts independently of the Interface.

2. Scope

This policy concerns in particular:

• visitors to the Interface;
• persons who connect a wallet to the Interface;
• users of the features that make it possible to prepare interactions with the Protocol;
• persons using the MCP server made available by Aletheia by means of an AI client or other third-party software;
• persons who send a request to Aletheia;
• on-chain participants whose public information is indexed in Aletheia's systems, even where they have never used the Interface.

This policy does not describe processing decided autonomously by a wallet provider, a blockchain, a block explorer, a token issuer, an artificial intelligence client chosen by the user, or any other third-party service used independently by the user.

3. Categories of data processed

3.1. Technical access data

This data may include in particular:

• the IP address;
• the user-agent and certain information relating to the browser or device;
• the timestamp;
• HTTP requests;
• the referrer, where transmitted;
• technical errors and operating logs;
• information necessary for security and the prevention of abuse.

Routine application logs are kept for fourteen days. The bodies of RPC requests are not logged, and wallet addresses are masked so that no wallet address in clear appears in the logs retained.

3.2. Data relating to the wallet and blockchain interactions

This data may include in particular:

• the public address of a wallet;
• the network used;
• RPC requests;
• the public data necessary to display the on-chain state;
• the parameters necessary to prepare a transaction;
• transactions, positions, auctions, bids, loans and other public events relating to the Protocol;
• transaction hashes and blockchain timestamps.

Aletheia does not ask for, and must never receive, your private key, your seed phrase or your recovery phrase.

3.3. Data relating to the acceptance of documents

Aletheia records, on the server side, the elements necessary to establish the presentation and acceptance of the applicable documents and of the eligibility declarations.

The information recorded comprises:

• the public address of the wallet;
• the version of each of the documents presented, read from the published documents;
• the timestamp communicated by the client and the timestamp observed by the server;
• the seven eligibility or compliance declarations collected individually, and the version of the corresponding set of declarations;
• where the wallet permits it, an EIP-191 signature and the exact message signed, so that the signature can be verified;
• the user-agent.

The signature is optional: acceptance may be recorded without a signature if the wallet does not provide one. A signature received is verified before it is recorded and must correspond to the declared wallet address.

3.4. Contact, support and rights-request data

When you contact Aletheia, it may process your name or identifier if you provide it, your email address, your wallet address if it is necessary and voluntarily provided, the content of your request, and any attachments or other information you voluntarily send.

3.5. Data relating to the MCP server

Aletheia makes an MCP server available at mcp.thegavel.io. This server may be queried by an artificial intelligence client or other software chosen by the user. Aletheia does not itself provide, in this chain, an Anthropic conversational assistant, and does not transmit the user's requests to Anthropic on its behalf.

The MCP server processes the technical parameters necessary to execute the requests addressed to it. In production, the MCP server's own logging keeps one line when a session is opened, indicating the client's name, its version and the associated access level. It does not log the content of requests, the wallet address or the IP address. Application technical logs are kept for fourteen days. The front-end server's access logs may nevertheless contain the IP address and the timestamp, in accordance with section 3.1.

Where the user chooses a third-party artificial intelligence client, the processing carried out by that client, in particular by Anthropic or any other provider chosen, falls within the relationship between the user and that third party and is governed by that third party's privacy documentation.

4. Purposes, legal bases and retention periods

Aletheia processes data for the following purposes:

5. Public data from the blockchain

Aletheia collects and indexes certain information publicly accessible on Arbitrum One in order to build, maintain and verify histories, indicators, series and data products relating to the activity of The Gavel Protocol.

This information may include in particular:

• public wallet addresses;
• transactions;
• borrower or lender positions;
• auctions and bids;
• loans and repayments;
• smart contract events;
• hashes and timestamps;
• data or indicators derived from this information.

The fact that information is recorded on a public blockchain does not necessarily mean that it is not personal. Where a wallet address or its history can be linked, directly or indirectly, to an identifiable natural person, Aletheia processes that information in accordance with the rules applicable to personal data.

The re-indexing and structuring of public data in a database controlled by Aletheia constitute processing separate from the operations carried out by the blockchain itself.

6. Purposes of on-chain indexing and safeguards

Aletheia uses indexing to:

• reconstruct the history of the Protocol;
• maintain the consistency and reproducibility of the data;
• calculate and verify indicators;
• produce historical series and analytics;
• develop and operate data products.

The public wallet address is kept in clear as the reconciliation key between on-chain events and their off-chain reconstruction. It makes it possible in particular to link the corresponding auctions, bids, lenders, borrowers, events and intentions, and to recalculate the series and indicators from the index. The retention period adopted is a rolling five years, with periodic review.

Aletheia does not currently use this database in order to:

• establish the civil identity of wallet holders;
• enrich wallets with identity data from other sources;
• assign an individual score to a person;
• build an individual commercial or behavioural profile;
• take an automated decision producing legal or similarly significant effects on a person.

Any move towards such purposes would require a new prior analysis. The five-year period does not prevent the exercise of a right to object or of any other applicable right: off-chain processing may, depending on the circumstances, be subject to deletion, restriction, dissociation or anonymisation in the systems controlled by Aletheia.

7. Information for on-chain participants who have never used the Interface

For participants who have never used thegavel.io, Aletheia obtains the information described above from a public source, the Arbitrum One blockchain, and not directly from the data subject.

In most situations, Aletheia holds only a wallet address and public on-chain data, without knowing the name of its holder, their email address or any other means of contacting them directly.

Where the conditions of Article 14(5)(b) of the GDPR are met, Aletheia makes this information available publicly, permanently and in an easily accessible manner, in order to provide the required information without enriching wallets with identity data solely for the purpose of notification.

Aletheia does not systematically send transactions or on-chain messages to the wallets concerned solely in order to convey this information to them.

Where an already-indexed wallet later connects to the Interface, this policy may be made directly accessible to it. If Aletheia subsequently obtains a means of direct contact reliably associated with the wallet, it may also provide the appropriate information at the first relevant communication where reasonably possible.

8. Public blockchain and rights relating to off-chain copies

Information recorded on Arbitrum One has characteristics of publicity and immutability that are not under Aletheia's control. Aletheia therefore cannot delete, cancel or rewrite a transaction already recorded on the blockchain.

This circumstance does not, however, remove the rights a person may have with regard to the processing for which Aletheia is itself responsible.

Depending on the right concerned and the circumstances, these rights may relate in particular to:

• off-chain copies;
• the indexing database;
• derived information or annotations;
• support data;
• logs;
• contact details;
• data kept in the systems controlled by Aletheia.

Where a right applies, Aletheia may in particular delete, restrict, rectify, dissociate or anonymise off-chain data that it controls, without claiming to modify the public blockchain itself.

9. Recipients and service providers

Access to data is limited to the persons and service providers who need it in the course of their duties or of the service concerned. Aletheia may in particular use hosting and infrastructure providers, RPC and blockchain providers, email providers and security providers.

9.1. Hetzner

Hetzner provides in particular the hosting infrastructure for the backend, the API and PostgreSQL. For the configuration currently documented, the dedicated server concerned is located in Helsinki, Finland. Hetzner acts as a processor for the hosting processing entrusted to it by Aletheia.

9.2. Blockchain infrastructure and server-side RPC providers

For reads of on-chain data, the browser communicates with Aletheia's infrastructure via api.thegavel.io and does not call any third-party RPC provider directly. The available reads are served from Aletheia's internal index.

Where residual real-time reads are necessary, Aletheia's servers query Alchemy. dRPC is used on the server side for certain indexing operations and may also act as a fallback provider for reads, for resilience purposes.

In this architecture, RPC providers receive the IP address of Aletheia's server infrastructure, and not the IP address of the user's device. The requests addressed to them may nevertheless contain or concern wallet addresses, transactions or other public on-chain events necessary for the read requested.

Alchemy acts as a processor for the operations carried out on Aletheia's behalf in connection with the provision of RPC services. Under its contractual framework, Alchemy may also determine certain purposes of its own, in particular with regard to improving its services, security, and the prevention of fraudulent or illegal activity.

9.3. MCP server and third-party artificial intelligence clients

Aletheia operates the MCP server mcp.thegavel.io in order to make structured data available to compatible software. Aletheia does not use Anthropic as a processor to provide this server and does not transmit the user's requests to Anthropic on its behalf.

Where the user chooses Claude, another artificial intelligence client or any other third-party software to connect to the MCP server, that third party may process the user's data for its own purposes and by its own means, under its own terms and privacy policy. The user should consult the documentation of the third party they choose.

9.4. Namecheap

Namecheap Private Email is used for the general email associated with contact@thegavel.io and for the dedicated address privacy@thegavel.io, which is now operational. Messages sent to Aletheia may therefore involve the processing of the email address, the identity provided, correspondence metadata, the content of the message, attachments and, where applicable, a voluntarily provided wallet address.

For the email service, Namecheap acts as a processor under its DPA. Its separate registrar or DNS functions must not be confused with this email processing.

9.5. Vercel

Vercel may be involved in the hosting, delivery or technical operation of the frontend. The data concerned is limited to the technical data necessary to provide these functions.

9.6. CoinGecko

The BTC price used by the Interface is not requested directly from CoinGecko by the browser. The call to the provider is made from Aletheia's server infrastructure and the result is served to the browser by Aletheia's API. CoinGecko therefore does not directly receive the visitor's IP address in connection with this flow.

10. International transfers

Certain service providers may be established, or may process data, outside the European Economic Area (EEA). Where processing is carried out in a country recognised by the European Commission as ensuring an adequate level of protection, the transfer relies on the applicable adequacy decision.

Where a transfer is made to a country not covered by an applicable adequacy decision, Aletheia puts in place the appropriate safeguards required by Articles 44 et seq. of the GDPR. These safeguards may include in particular the standard contractual clauses adopted by the European Commission, an assessment of the context of the transfer and, where necessary, supplementary technical or organisational measures.

Alchemy may in particular process certain data in the United States. For processing carried out on Aletheia's behalf, its contractual framework incorporates the European Commission's standard contractual clauses applicable to transfers between controller and processor. The RPC calls concerned are issued by Aletheia's server infrastructure and do not directly expose the IP address of the user's device.

Namecheap Private Email may involve processing in the United States. The Namecheap DPA incorporates the standard contractual clauses applicable to the transfers concerned.

dRPC is used only on the server side for certain indexing operations and, where applicable, as a fallback provider for reads. The calls are issued from Aletheia's infrastructure and do not directly expose the IP address of the user's device. Where a transfer to a third country not covered by an adequacy decision takes place, Aletheia puts in place the safeguards required by Articles 44 et seq. of the GDPR.

You may request further information on the safeguards applicable to a specific transfer by contacting Aletheia.

11. Local storage and similar technologies

The Interface uses the browser's local storage and similar technical mechanisms for certain functions that are necessary or requested by the user.

The items currently documented include in particular:

• gavel_compliance_ack_v1, used as a local acceptance marker to avoid asking for acceptance again on each visit, without replacing the server record;
• gavel-theme, used to remember a display preference;
• gavel.lastWalletRdns, used to remember the last wallet software used;

Where storage on, or reading from, the device is strictly necessary to provide the service expressly requested by the user, its use falls within the applicable exemption under Article 82 of the French Data Protection Act (loi Informatique et Libertés). The mechanisms described are not used, in the configuration covered by this policy, for the purposes of behavioural advertising.

The user may delete the information stored locally by means of their browser. Such deletion may cause certain preferences to be reset or require certain confirmations to be renewed.

The Montserrat font is self-hosted by Aletheia. The Interface does not call Google Fonts to load this font.

12. Security

Aletheia implements appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration, disclosure or destruction, taking into account the nature of the processing and the risks identified.

These measures are adapted and reassessed in line with changes in the architecture, the services used and the risks. No security measure can, however, guarantee zero risk. Aletheia does not publish in this policy technical details whose disclosure could reduce the security of its infrastructure.

13. Your rights

Subject to the conditions laid down by the GDPR, you may in particular request:

• access to the personal data concerning you;
• rectification of inaccurate data;
• erasure of data where the legal conditions are met;
• restriction of processing;
• the exercise of your right to object where the processing is based on legitimate interest;
• portability where the conditions laid down by the GDPR are met.

Where you object to processing based on legitimate interest, in particular to certain off-chain indexing operations, Aletheia examines your situation in accordance with Article 21 of the GDPR.

The right to object does not necessarily mean that Aletheia is required to erase all information originating from the blockchain. However, where the legal conditions are met, Aletheia acts on the off-chain processing it controls.

The right to portability does not necessarily cover the derived data, analyses or indicators created by Aletheia.

14. Verification of a request relating to a wallet

In order to protect data against fraudulent requests, Aletheia may ask for the elements reasonably necessary to verify that a request does indeed come from the data subject.

Where a request relates solely to a wallet and no civil identification is necessary, Aletheia may in particular offer proof of control of the address by means of a non-transactional cryptographic message signature. Such a signature involves no blockchain transaction and no transfer of crypto-assets.

Aletheia will never ask you for:

• your private key;
• your seed phrase;
• your recovery phrase;
• your wallet password.

15. Automated decisions and profiling

Aletheia does not currently carry out any decision based solely on automated processing that would produce legal effects concerning a person or similarly and significantly affect them.

The indexing of on-chain data is not currently used to assign a personal score, build a commercial profile of a wallet holder, determine their civil identity or take an individual automated decision concerning them.

16. Minors

The Interface is not intended for persons under the age of eighteen. Aletheia does not knowingly seek to collect their data in connection with the use of the Interface.

17. Third-party links, wallets, AI clients and services

The Interface and associated services may contain links to, or allow interactions with, services operated by third parties, in particular wallets, blockchain networks, RPC providers or artificial intelligence clients. These third parties determine their own privacy practices where they act as independent controllers. Aletheia recommends consulting their terms and policies before using them.

18. Changes to this policy

Aletheia may amend this policy to take account of a change in processing, a change in the technical architecture, a change of service provider, a new feature, or a legal or regulatory development.

The applicable version states the date of its last update. Where a substantial change warrants it, Aletheia provides appropriate information. Where future processing would require consent that is not currently required, that consent would be obtained before the processing concerned is implemented.

19. Contact and complaints

For any question relating to this policy or to exercise your rights, you may contact:

ALETHEIA ANALYTICS, 173 rue de Courcelles, 75017 Paris, France

Email: privacy@thegavel.io

You also have the right to lodge a complaint with the Commission nationale de l'informatique et des libertés (CNIL), the French supervisory authority for the protection of personal data.