What we do with your data
This English translation is provided for convenience. The French version is the only legally binding one.
Updated on 25 October 2026
Bilan DeFi (bilandefi.fr) is published by an EURL (single-member company) governed by French law, identified in the legal notice. This page describes, item by item, what the site processes, why, for how long, and who can see it. It is written based on how the site actually works and is updated when that changes. For any question: contact@bilandefi.fr.
In five lines
- An overview can be run without an account and without signing anything: only a public address is read.
- The report is calculated on demand and is not saved ; it stays in memory for at most 45 minutes, never on disk.
- Addresses no longer travel in plain text in links : they travel there encrypted, unreadable by the host.
- Nothing is sold, shared or used for advertising; no audience measurement cookies.
- An account and everything attached to it can be erased in one click from your account area.
Item by item
| Data | Why | How long | Who sees it |
|---|---|---|---|
| Wallet addresses that you enter (Ethereum and compatible networks, Bitcoin, Solana, Tron, Cosmos) | Read their public history and calculate the overview | For the duration of the calculation; in links and bookmarks, in encrypted form; stored in your account area only if you have an account | The server and the blockchain data providers queried (see below) |
| History and positions of these addresses (public blockchain data), and prices | Produce the overview without re-reading everything each time | In cache, from a few hours to 90 days (daily snapshots used to measure yield), then deleted. The cache is encrypted : each file is stored under a secret-key fingerprint, never under the address, and its content is unreadable without the key, which is kept off the disk. A copy of the disk would reveal no address | The server |
| Question asked to the assistant under an overview (optional), and a numerical summary of that overview: names of protocols, networks, tokens, amounts, no address | Explain your figures | For the time it takes to answer: neither the question nor the answer is saved by the site. To cap the cost per visitor, a digest of your IP address, unreadable and changed every day, is kept until the next day together with the associated spending | The server and OpenAI, provider of the language model, which processes the question and the summary to produce the answer |
| The report itself | Display it to you; reopen it after an answer to the points to settle without recalculating everything | 45 minutes in memory, never written to disk, never archived | You; no one else |
| Google account : email address, name, profile photo URL, technical identifier | Recognise you from one visit to the next | As long as the account exists | The server; Google knows that you signed in to bilandefi.fr |
| Email account : email address, password | Same, without going through Google. Any address will do, a Proton Mail address for example | As long as the account exists. The password is never stored: only an irreversible hash (scrypt, salted) is | The server; the confirmation email is sent through our mailing service (see below) |
| Wallet sign-in : the public address of the wallet | Open an account area linked to that address, without email or signature | As long as the account area exists | The server |
| Platform API keys (Kraken, Binance, Coinbase, OKX…) that you connect, read-only | Read your balances, transactions and bank transfers on these platforms to include them in the overview | Until you remove the platform; encrypted in the database (AES, key kept outside the database); only the last four characters of the public key remain readable | The server, at the time of reading; never displayed, never transmitted |
| Answers to the points to settle : your answers themselves | Recalculate your overview with them, and allow you to pick them up again later | On our side: never saved. They travel encrypted in the overview links (unreadable by the host and in its logs); the server reads them only in memory for the duration of the calculation. Your browser keeps them, encrypted, until you choose to “forget them” or clear the site's data | You alone : neither the publisher nor anyone else, no email summary |
| Anonymous answer counters : day, protocol, network, type of discrepancy, direction (gain or loss), answer chosen and its position in the list | Spot a general error in the engine, in order to fix it | 12 months, then automatic deletion. No amount, no address, no user fingerprint, no time: impossible to link a counter to a person or to an overview | The publisher, in its administration area (never by email) |
| Report of an inconsistency (form under the overview): message, email if you provide it, addresses in the overview | Reproduce the problem and reply to you | 12 months, then automatic deletion | The publisher, who also receives it by email |
| Contact form : name, email, message | Reply to you | 3 years at most after the last exchange | The publisher |
| Payment (paid offer, if you subscribe to one): with Stripe, your card; in crypto, the sending address and the transaction | Invoice and keep the accounts | Accounting records: 10 years (legal obligation) | The publisher, Stripe, the chartered accountant |
| Traffic : pages viewed, by day and by hour, and the steps of connecting a crypto wallet (page opened, wallet detected or not, click, refusal, address received, and the family of application used: MetaMask, Rabby, WalletConnect…); the device type (phone, tablet, computer), the operating system, the browser and the screen size; the campaign link through which the visitor arrived, reduced to a short name (for example “reddit/debutant”), and, for that visitor, the pages of the site viewed afterwards (their path only, without parameters); on the home page, whether the page was scrolled through and whether the visitor stayed on it for more than 30 seconds | Count visitors, measure server load and see where wallet connection fails; and, when a visitor without an account comes back for an overview on another day, invite them to open an account to receive alerts (nothing more is recorded); and adapt the site to the devices and screens actually used; and measure what an advertisement brings: how many visitors arrive via its link, how many then run an overview or open an account, and at which step the others stop | 90 days. The IP address is never kept: only an irreversible fingerprint is, calculated with a secret value specific to the site, to recognise the same visitor from one day to the next; no wallet address is included: only the application family (MetaMask, Rabby…), with no link to an address | The publisher |
| Nickname that you may have chosen (optional) | None at present: it is not displayed anywhere | As long as the account exists; deleted with it | The server only |
| Declaration “18 years or older” (the date of the declaration, never your age or your date of birth) | Reserve the welcome offer for adults | As long as the account exists | The publisher |
| Sign-in days of your account (the date only, without time or IP) | Check the “one sign-in per day for 7 days” condition of the welcome offer | 60 days, then automatic deletion | The server; the publisher, as an “n/7” counter |
| Welcome offer : address of the crypto wallet to be paid, name of the wallet application used, fingerprint of the sign-in IP and operator number (AS) of that IP, decision (pending, approved, refused, paid) and payment transaction | Pay the bonus to the right address, once per person and per household; refuse a second request from the same IP or from a server / VPN | The IP fingerprint and the AS: 30 days, then automatic deletion. The rest: as long as the account exists; for a bonus paid, the accounting record (amount, date, address, transaction) 10 years (legal obligation) | The publisher, who approves each request manually; the AS number is obtained from Team Cymru (see below) |
| Newsletter (if you sign up: checkbox at registration or button in your account area): your email address and the date you signed up | Send you the newsletter (at most one email per month); raise the welcome offer to 20 EURC | Until you unsubscribe (link in each email, or button in your account area); deleted with the account | The publisher and the site's email sending service |
| Liquidity alerts (account with verified email): for each locked position seen in your overview, the protocol, the network, the value at the time it was locked, what locked it and the encrypted link to your overview | Re-check once an hour, on the blockchain, whether liquidity has returned, and notify you by email (or by notification in the Android app, if you have enabled it): once per position | Until the alert, or until the position is no longer locked in your overview; 180 days at most; deleted with the account. The “unsubscribe” link in each email stops the alerts | The server; the email mentions neither address nor exact amount |
| Open positions in your account area (protocol, network, value in euros), as your latest overview saw them | Overnight liquidity watch: every night, protocols lacking liquidity (DefiLlama public data) are cross-checked against your positions, to notify you (liquidity falling, then returned), without you having to reopen the site | Replaced with each overview; deleted with the account | The server; the email or notification names the protocol and the network, never the address |
| Trading gain in your account area, once a day: the total, the share on your wallets and on the platforms, and the gain on each token (no address, no transaction), under a key that does not reveal the account | Tell you, in the overview, how much your trading gain has moved since the previous day, and because of which tokens | 8 days, then automatic deletion; deleted with the account | The server; displayed to you alone, in your overview |
| Notifications (if you enable “Receive alerts on this device”): the subscription provided by your browser (an endpoint at your browser's push service (Google for Chrome), and two encryption keys) | Notify you on this device when liquidity returns; the message is encrypted for your browser alone, the push service cannot read it | As long as the subscription exists: a second click removes it; deleted with the account, or as soon as the service replies that it no longer exists | The server; your browser's push service sees that a message is sent to this device, not its content |
| Limit without an account : IP fingerprint and analysed address | Limit the number of overviews per visitor without an account | 24 hours, in memory only | No one: the server compares, displays nothing |
| Host's technical logs : IP address, page requested, date | Security and diagnostics | According to the host's policy. Wallet addresses no longer appear there in plain text: links carry them encrypted | The host (DigitalOcean) and the publisher |
| Cookies | A session cookie (sign-in, 12 hours, HttpOnly), a short cookie during Google sign-in (30 minutes) and a “level” cookie (beginner, intermediate, expert: the site's vocabulary and tabs, one year, no identifier), and a “wallet” cookie (the one you chose to create, to tailor the “step by step” list, one year, no identifier). No advertising or audience measurement cookies | 12 hours / 30 minutes / 1 year | Your browser and the server |
IP addresses and wallet addresses: what is linked, and for how long
The IP address is never stored in plain text, anywhere. Three processing operations link it, in the form of an irreversible fingerprint, to something else, and they are the only ones:
- Overview without an account : the IP fingerprint and the analysed address, to apply the cap on overviews per visitor. In memory only, 24 hours, with a secret value that changes at each restart: the link does not survive.
- Protection against abuse (rate limiting, bot trap): an IP fingerprint, in memory, from one minute to 24 hours depending on the rule. No wallet address is included.
- Welcome offer (accounts only, when a crypto wallet is connected): an IP fingerprint and its operator number, attached to the bonus request, and therefore to your account and the address to be paid. This is the only IP ↔ address link written to the database; it is deleted after 30 days. To identify the operator, the IP is sent, at the time of the request, to Team Cymru's public service; the response is kept in memory for 6 hours.
Nothing else: traffic logs contain no wallet address, links carry addresses encrypted, and no database associates an IP with an overview.
Legal bases
- Calculating and displaying the overview, maintaining your account, reading the platforms you connect: performance of the service you request.
- Replying to your messages, fixing the engine using the anonymous counters, protecting the site against abuse, counting traffic: the publisher's legitimate interest.
- Invoicing and keeping accounting records: legal obligation.
Who receives data
- Hosting of the site and the database: DigitalOcean, LLC (United States), server located in Frankfurt (Germany): the data stay in the European Union.
- Blockchain data and prices : a DeFi position aggregator (Singapore), block explorers (Etherscan, Blockscout, Routescan), DefiLlama and, for NFTs, OpenSea (United States) receive the public addresses to be analysed, nothing else: not your email, not your IP (calls are made from the server), not the report. These providers are outside the European Union: transmitting a public blockchain address to them is necessary for the performance of the service you request (Art. 49(1)(b) of the GDPR (RGPD)); no other data is transmitted to them, and nothing is kept on our side once the calculation is complete.
- Exchanges that you connect: they receive your own API calls, signed with your key.
- Login : Google, if you choose “Continue with Google”; the WalletConnect relay (Reown), if you connect a wallet that way: it carries, end-to-end encrypted, the connection request between your browser and your wallet application.
- Bitcoin : mempool.space (blockstream.info as a fallback) receives the Bitcoin addresses to be analysed (public chain data).
- Tron : TronGrid (TRON DAO) receives the Tron addresses to be analysed (public chain data).
- Operator of an IP : Team Cymru (whois.cymru.com) receives the IP address of an account that connects a crypto wallet and requests the welcome offer, nothing else: neither the account nor the wallet address.
- Email delivery : the emails the site sends (address confirmation, forgotten password, alerts, newsletter, forwarding of your reports to the publisher) are sent through Brevo (Sendinblue SAS, France), which receives the recipient's address and the content of the message, solely for the duration of sending and its tracking. Your reports and replies to our emails then arrive in the publisher's mailbox, at Google (Gmail).
- AI assistant : reports received by email may be summarised by an AI assistant (Anthropic) to prepare fixes. The summary covers these messages, never your overviews or your answers to the points to settle, which do not leave your browser.
- Payment : Stripe.
- Audience measurement : Umami (Umami Software, cookieless). Its script, loaded from
cloud.umami.is, sends the path of the page viewed (without its parameters, except campaign ones), the language, the screen size, the browser and the name of the site you came from. Like any service your browser contacts, Umami receives your IP address, from which it infers the country. Never a wallet address, nor the content of an overview.
Some of these providers are located outside the European Union; transfers are governed by the safeguards provided for by the GDPR (RGPD) (standard contractual clauses or adequacy decision). No data is sold, rented or used for advertising purposes.
Your rights
You may at any time access your data, rectify it, erase it, restrict its processing, object to it or request its portability.
- Erasure : from your account area, “Delete my data” immediately erases the account, stored addresses, connected platforms and their keys, prepared tax returns, and reports linked to your addresses. There is no archive. Your answers to the points to settle are only in your browser: “forget them”, under the overview, or clearing the site's data in the browser deletes them.
- For anything else, write to contact@bilandefi.fr ; reply within one month.
- You may also refer the matter to the CNIL (French data protection authority), cnil.fr.