Privacy policy
LEVA is built to collect as little data as possible: no account, no name, no e-mail, no phone number, no advertising, no analytics tool. This policy explains what is processed, why, for how long, and your rights (Regulation (EU) 2016/679, “GDPR”, and the French Data Protection Act).
Controller
[raison sociale], [adresse du siège social]. Contact for any question or request about your data: [adresse e-mail de contact].
Data processed
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Show your balance and portfolio, prepare your transactions | Public address of the connected wallet, signed transactions you send | Performance of the contract (terms) | Not stored: processed for the request (a few seconds of cache) |
| Whitelist: compute your points and ranking | Wallet address, signature (public identifier) of each trade, token, volume in dollars and in SOL, points, date; if you are selected: the selection, your rank and points at that time | Performance of the contract (programme described in the terms) | Duration of the whitelist programme, then 12 months at most; then deleted or anonymised |
| Referrals | Chosen code, referrer and referee addresses, date of the link | Performance of the contract (at your express request, by signing a message) | Duration of the programme, then 12 months at most |
| Link between your instant wallet and your main wallet (your instant trades count for your main wallet) | Addresses of both wallets, date, signatures of both wallets | Performance of the contract (at your request, when the instant wallet is created) | Duration of the programme, then 12 months at most |
| Proof that you accepted the terms and asked for immediate execution | Wallet address, terms version, date, signature of the acceptance message | Legitimate interest: proof of consent (article L221-28 of the French Consumer Code) | 5 years after acceptance (limitation period) |
| Public whitelist ranking | Shortened wallet address (4 + 4 characters), points, volume, number of trades. For a given wallet, the Whitelist page also shows its referral code, its referrer and its referees (shortened addresses, with each referee’s volume). | Legitimate interest: transparency of the selection and of referrals | While you appear in the ranking |
| Wallet screening (sanctions, blocklist) | Address of the wallet asking for a transaction, compared in memory with the lists; for a blocked wallet: address, reason, date | Legal obligation (sanctions) and legitimate interest (providers’ terms, security) | Comparison in memory, not stored; block: while in force, then 12 months |
| Illegal content reports | Content reported, reason, name and e-mail of the reporter, decision taken | Legal obligation (Regulation (EU) 2022/2065) | 12 months after the decision |
| Wallet tracker | Wallet addresses you choose to follow | Performance of the contract | Not stored by the server: subscription in memory while the page is open; the list stays in your browser |
| Tracking the fees LEVA collects | For each trade recorded for the whitelist: the LEVA fee paid (in SOL) | Legitimate interest: monitoring the Service’s activity and revenue | Same period as the whitelist data |
| Geographic restrictions (countries where trading or leverage is not offered, see the terms) | Country of connection (two-letter code) derived from your IP address by Cloudflare | Legal obligation and legitimate interest: complying with applicable restrictions and the providers’ terms | Compared in memory on each request, not stored (except in the per-country totals below) |
| Running the Service (server load, current connections) | Hourly totals: opened and simultaneous connections, requests, distinct wallets, connections per country (no address, no IP). In memory only: the wallets active in the last 15 minutes, with their country and last action | Legitimate interest: running, sizing and securing the Service | Totals: 90 days; in-memory list: 15 minutes, erased at every restart |
| Security and abuse prevention | IP address (rate limiting, in memory) | Legitimate interest: security of the Service | A few minutes in memory; host technical logs: 30 days at most |
Wallet addresses are pseudonymous data: they do not reveal your identity, but someone who knows your address can link that wallet’s public activity to you. Solana transactions are public and irreversible: LEVA can neither change nor delete them.
Cookies and local storage
LEVA sets no cookie and places no advertising, analytics or profiling tracker, nor any third-party cookie, with one exception: Cloudflare’s security cookie, described below. LEVA’s only cookie, leva_admin, concerns the operator’s administrators alone: it keeps their admin session open for 12 hours at most.
Settings, chosen language, watchlist, tracked wallets, your trade journal, alerts and the encrypted instant-wallet key are kept only in your browser (local storage) and are not sent to LEVA (the trade journal only serves to show your profit and loss). The instant wallet key is encrypted (AES-256) with a key derived from a signature of your main wallet.
“Needed” items run the service you ask for (wallet connection, settings, watchlist…): they are exempt from consent under the French Data Protection Act (article 82) and the CNIL guidelines. The only optional item, the referral code, is kept only with your consent; without it, it is kept during your visit only.
| Item | Purpose | Type | Duration |
|---|---|---|---|
| leva.wallet | Name of the chosen wallet, to reconnect automatically | Needed | Until you disconnect |
| leva.settings.v1 | Trading presets (slippage, priority fees, amounts), display, acceptance of the terms | Needed | Until deleted |
| leva.journal.v1 | Your trade journal (profit and loss) | Needed | Until deleted |
| leva.watchlist.v1 | Tokens in your watchlist | Needed | Until deleted |
| leva.tracker.v1 | Wallets you track and their names | Needed | Until deleted |
| leva.pulseFilters.v1 | Pulse column filters | Needed | Until deleted |
| leva.alerts.v1 | Alerts about your positions | Needed | Until deleted |
| leva.locale | The interface language you chose (absent when you leave it automatic, from your browser) | Needed | Until deleted |
| leva.recentSearches | Recent searches | Needed | Until deleted |
| leva.instant.v1.<wallet> | Encrypted key of your instant wallet (never sent to LEVA), with whether it was backed up and linked to your main wallet | Needed | Until you remove it |
| SolanaMobileWalletAdapterDefaultAuthorizationCache | Authorization of your mobile wallet (Android, Mobile Wallet Adapter), so it is not asked again on every visit | Needed | Until you disconnect or delete it |
| leva.refprompt.<wallet>.<code> (session) | Remembers that the prompt to apply a referral code was already shown during this visit | Needed | Until the tab is closed |
| leva.consent.v1 | Your choice about optional storage | Needed | 6 months |
| leva.ref | Code of a referral link you followed, until a wallet connects | With consent | Until used, or until consent is withdrawn or expires (6 months) |
Your choice
On your first visit, a banner lets you accept or refuse, one as easily as the other. Your choice is kept 6 months, then asked again. You can change it at any time: .
Erase everything
In the terminal settings, “Delete LEVA data from this browser” removes all these items. The encrypted key of your instant wallet is only removed if you tick the box for it: withdraw your funds or export the key first, or they would be lost. You can also clear the site’s data from your browser settings (the instant wallet key then goes too).
Third parties in your browser
Token images are loaded through LEVA’s server (your browser does not contact their hosts). Fonts are served by LEVA. Cloudflare, which protects the site, may set a security cookie (__cf_bm or cf_clearance, 30 minutes by default) when it has to check that a connection does not come from a bot: it only serves the security of the service and is exempt from consent. Your wallet (extension or app) and the Solana node your browser connects to apply their own rules: see the third-party services.
Automated decision
The whitelist selection relies on an automatic ranking by points (volume of trades that paid the LEVA fee, plus 20% of referees’ points), following the public rules of the terms. You can ask for a person to review your situation and contest an exclusion by writing to [adresse e-mail de contact].
Recipients and processors
Your data is never sold or rented. It is only sent to the providers the Service needs: host (Amazon Web Services EMEA SARL, servers in Frankfurt, Germany), delivery and protection network (Cloudflare) which receives connections to the site, Solana node provider (RPC) which receives the addresses looked up and the transactions sent, Jupiter (wallet address for swaps and limit orders), Jito (signed transactions) and, once real leverage opens, Lavarage (wallet address for positions). Your browser only contacts LEVA, through Cloudflare, and your wallet: the other services are called by LEVA’s server, which does not pass on your IP address. Wallet screening runs on that server against a downloaded sanctions list: your address is sent to no screening service. The full list, with the data sent to each, follows.
Third-party services
LEVA relies on these services to read the blockchain and execute trades. The LEVA server makes most calls on your behalf and only sends them what is strictly needed. LEVA uses no advertising, analytics, tracking or embedded social-network tool.
| Service | Role | Data received | Called by |
|---|---|---|---|
| Amazon Web Services EMEA SARL | Hosting of the site and server (Frankfurt, Germany) | IP address, requests (including wallet addresses looked up) | Your browser |
| Cloudflare, Inc. | Delivery and protection network: receives connections to the site, filters attacks, passes them to the server and gives the visitor’s country | IP address, requests (including wallet addresses looked up) | Your browser |
| Fournisseur de nœud Solana (RPC) / Solana node provider | Reading the blockchain, sending transactions | Wallet addresses looked up, signed transactions | LEVA server |
| Jupiter (Powered by Jupiter, routage Metis / Metis routing) | Swap routing, token prices and information (including the organic score), limit orders (Jupiter Trigger) | Address of the wallet that swaps or places a limit order | LEVA server |
| Jito (block engine) | Sending transactions (MEV protection depending on your preset) | Signed transactions | LEVA server |
| Lavarage | Leverage lending pools (public offers; positions once real leverage opens) | Today: none. Once real leverage opens: wallet address and transactions of your positions | LEVA server |
| PumpPortal | New pump.fun tokens and migrations | No data about you | LEVA server |
| GeckoTerminal (CoinGecko) | Charts and trade history (“Data: GeckoTerminal” under the chart) | No data about you | LEVA server |
| DexScreener | Trading pairs, “Dex Paid” status | No data about you | LEVA server |
| Passerelles IPFS (passerelle de LEVA, Orbitor, Pinata de pump.fun) et hébergeurs d’images / IPFS gateways and image hosts | Token images and descriptions, chosen by their creators and relayed by the LEVA server | No data about you | LEVA server |
| Liste de sanctions (OFAC, Trésor américain) / sanctions list | Wallet screening, when enabled: the list is downloaded by the LEVA server | No data about you | LEVA server |
| Votre wallet (Phantom, Solflare, Backpack…) / your wallet | Signing your transactions, chosen and installed by you | The transactions and messages you sign (under its own policy) | Your browser |
| Solscan, X (Twitter) | Only if you click an explorer or share link | What you view on those sites | Your browser |
These services are run by independent companies under their own terms.
Transfers outside the European Union
LEVA’s server and its data are hosted in the European Union (Frankfurt, Germany). Some providers are located outside the EU (notably in the United States). For the providers LEVA chooses to run the Service (host, delivery network, Solana node), the transfer relies on an adequacy decision (Data Privacy Framework) where the provider is certified, or on the European Commission’s standard contractual clauses signed with it. Jupiter, Jito and Lavarage receive your wallet address or your transaction because they carry out the operation you ask for: that transfer is necessary for the performance of the contract (article 49(1)(b) GDPR) and only happens when you ask for it.
Your rights
You have the right of access, rectification, erasure, restriction, objection (including to appearing in the public ranking) and portability, and may give instructions about your data after your death. Write to [adresse e-mail de contact] with your wallet address; since LEVA only knows that address, we may ask you to sign a message with that wallet to check it is yours. Answer within one month. You can also complain to your data protection authority (in France, the CNIL: cnil.fr).
Security
Encrypted connections (HTTPS), no private key on the server, minimal data, restricted access, abuse protection. The Service is not intended for people under 18.