Privacy Policy

This Privacy Policy explains how Hecto Finance Limited (“Hecto,” “we,” “us” or “our”) handles personal information when you access or use Hecto Predictions, create or authenticate an account, connect a wallet, submit or support a formation, use account and vault features, or communicate with us (collectively, the “Service”).

This policy applies to Hecto’s processing for the Service. A wallet, venue, issuer, Canton participant or linked website may independently determine how it processes information and will have its own privacy notice.

Hecto Finance Limited, a British Virgin Islands company, is the controller or business responsible for the processing described in this policy, except where another entity independently decides the purposes and means of processing.

Privacy questions, complaints and rights requests may be sent to legal@hecto.inc. If applicable law requires a local representative or additional contact route, Hecto will provide that information through the Service or in a jurisdiction-specific supplement.

• Account and contact information: name, email, country, account type, business details, verification status and communications. Passwords are transmitted for authentication but are not stored by this application.
• Wallet and ledger information: selected wallet provider, public Canton party or wallet identifier, linked-account status, asset balances, transaction or lock references, network status and proof metadata. Authentication signatures are used to verify control and are not retained by this application after the request.
• Product activity: proposals, formation support, selected outcomes, amounts, vault activity, orders, settings, notifications, account events and timestamps.
• Device, network and security data: IP address, browser and device characteristics, request metadata, session events, error reports, security signals and service logs.
• Preferences: theme, display, currency and product preferences stored in your browser or account.
• Compliance information: identity, residency, eligibility, sanctions, source-of-funds, tax or similar records where required for a live feature or by law.

We receive information directly from you; from your browser or device; from the Hecto account used to sign in; from a wallet or authentication provider you invoke; from Canton participants, ledgers, venues and data providers; from compliance, identity and fraud-prevention providers; from Hecto affiliates; and from public or commercially available sources. We may derive status, aggregate metrics and risk signals from those sources.

• create, authenticate, secure and administer accounts and sessions;
• verify control of a wallet and display account-linked assets and activity;
• receive, evaluate, fund, operate and settle proposals, formations, vaults and related workflows;
• provide confirmations, essential notices, support and requested communications;
• calculate product states, balances, allocations, reference metrics and participant-backed formation progress;
• prevent fraud, abuse, market manipulation, sanctions violations, money laundering and security incidents;
• debug, maintain, measure and improve reliability and user experience;
• enforce our Terms, establish or defend legal claims, and comply with law; and
• create aggregated or de-identified information that is not reasonably linkable to an individual.

Where applicable law requires a legal basis, we rely on: performance of a contract and steps you request before entering one; compliance with legal obligations; legitimate interests in operating, securing, improving and protecting the Service and its users; and consent where we specifically request it.

Your acknowledgment of this Privacy Policy confirms that you received the notice; it is not blanket consent to every processing activity. If we rely on consent for a particular optional purpose, we will identify that purpose and provide a way to withdraw consent. Some information is necessary to provide an account or requested feature; without it, that feature may be unavailable.

In live API mode, the Service uses a strictly necessary, short-lived session cookie to keep you authenticated. It is designed to be HTTP-only and SameSite=Lax and, in production, Secure and host-only. Browser scripts cannot read an HTTP-only session cookie. The current session duration is up to one hour.

The Service may use local storage for theme and interface preferences. The current application does not use advertising cookies or third-party behavioral advertising trackers. If optional analytics, advertising or other non-essential storage is introduced, we will update this notice and provide any consent or opt-out controls required by law.

We may disclose relevant information to Hecto affiliates and service providers supporting hosting, security, authentication, email, support, analytics commissioned by Hecto, compliance, professional advice and infrastructure. Depending on your activity, information may also be provided to your selected wallet, Canton participants, validators, venues, custodians, issuers, data providers or transaction counterparties.

We may disclose information to regulators, courts, law enforcement or other authorities where required or permitted; to investigate misuse or protect rights and safety; or in connection with financing, due diligence, reorganization, merger, sale or transfer, subject to appropriate protections. The current Service does not sell personal information for money or share it for cross-context behavioral advertising, and does not use it for targeted advertising as those concepts are defined by applicable US state laws.

Wallet or Canton party identifiers and related activity may be visible to network participants or associated with information held elsewhere. Depending on the network design and participants, distributed-ledger records may be permanent or difficult to correct or delete, even when Hecto deletes corresponding off-ledger account data.

Do not place personal or confidential information in transaction memos, proposal text or other fields that may be written to a ledger unless expressly required. Hecto seeks to keep unnecessary personal information off-ledger and to use identifiers or technical safeguards where practicable.

Hecto and its providers may process information in countries other than where you live, including countries whose privacy laws differ from yours. Where European, UK, Swiss or other law restricts transfers, we use an applicable adequacy decision, standard contractual clauses, the UK International Data Transfer Agreement or Addendum, binding arrangements, consent where valid, or another recognized mechanism, together with supplementary technical and organizational measures where appropriate. You may request information about applicable safeguards at legal@hecto.inc.

We retain personal information only as long as reasonably necessary for the purposes described, including account administration, formation and transaction records, security, dispute handling, tax, anti-money-laundering and other legal obligations. Retention depends on the record, product status, jurisdiction and limitation period.

The application session expires after up to one hour. This application does not retain passwords or wallet authentication signatures after the relevant authentication request. Preview data may reset. Source account, email, wallet, venue and ledger systems maintain their own records under separate schedules. Ledger records may be immutable or retained by network participants beyond Hecto’s control.

We use administrative, technical and organizational measures designed to protect personal information, including access controls, bounded requests, short-lived sessions, origin checks, transport security and separation of server-side credentials. No internet, wallet, distributed ledger or storage system is completely secure. You are responsible for securing your devices, email and wallet and for verifying the domain and transaction details before approving a request.

Depending on where you live, you may have rights to know or access personal information; obtain a copy; correct inaccurate information; delete information; restrict or object to processing; receive portable data; withdraw consent; opt out of certain sales, sharing, profiling or targeted advertising; limit certain uses of sensitive information; and not be discriminated against for exercising a right.

Residents of the EEA, United Kingdom and Switzerland may also complain to their local data-protection authority. California and other eligible US residents may use an authorized agent where permitted. Because the current Service does not sell personal information, share it for cross-context behavioral advertising or process it for targeted advertising, no separate opt-out is currently necessary for those activities.

Submit a request to legal@hecto.inc. We may need to verify your identity and authority. We may deny or limit a request where permitted, including to protect another person, preserve security, comply with law or establish legal claims. Rights concerning information on an immutable ledger may be technically limited, but we will assess available off-ledger and supplementary measures.

The Service uses calculations and product rules to display formation states, balances, reference metrics and other results. The current Service does not use solely automated processing to make a decision that produces legal or similarly significant effects about an individual. A displayed product result is not a suitability or credit decision. If this changes, we will provide the information and rights required by applicable law.

The Service is not intended for anyone under 18. We do not knowingly collect personal information through the Service from a child. If you believe a child has provided personal information, contact legal@hecto.inc so we can investigate and take appropriate action.

We may update this policy to reflect legal, technical or operational changes. The effective date identifies the current version. We will give additional notice of material changes where required.

Questions, accessibility requests, rights requests and privacy complaints may be sent to legal@hecto.inc. We will investigate complaints and respond as required by applicable law. Use of the Service is also subject to the Terms and Risk Disclosure.