Privacy Policy

This policy follows Brazil's Lei Geral de Proteção de Dados (LGPD, the General Data Protection Law, Law 13.709/2018). It explains what data Aval stores, what it is for, who it is shared with and how you can request access, correction or deletion. Questions and requests go to contato@avalcrypto.com, which is also the channel for our data protection officer.

Waitlist

We store your email, the sign-up date and the IP address of the request. The email is used to let you know when your spot opens and to send Aval news. The IP is used to block bulk sign-ups. The legal basis is your consent, given in the checkbox, and you can withdraw it whenever you want.

Your account

When you sign in with the access link, we create an account with your email, plan, account status and creation date. We do not ask for a password, name, CPF (Brazilian taxpayer ID), phone number or bank details. The legal basis is performing the service you requested.

The access link is valid for 15 minutes and works only once. We store only a cryptographic fingerprint (hash) of it, never the link itself. To prevent abuse, we count how many links each email requested in the last hour.

Cookies

After you sign in, your browser receives a session cookie, needed to keep you signed in for up to 30 days. It is signed, cannot be read by scripts on the page and only works on this site. When you click Sign out, it is deleted.

If you accept in the cookie notice, Google Analytics (through Google Tag Manager) sets cookies to measure visits and product use, such as page views, sign-ups and checkout steps. Without your consent, no measurement cookies are set. We do not use advertising cookies. The legal basis is your consent, and you can change your choice by clearing the site's data in your browser. Google acts as a processor and may process this data outside Brazil.

Connections with Claude, ChatGPT and other apps

When you authorize an app to use Aval, we store a record of that authorization: the app's name, the redirect address it provided and the access tokens. The tokens are stored in a way that not even we can read them back. To apply your plan's quota, we count how many trade evaluations your account requested each minute. The connected app receives only the responses from Aval's tools (scoreboard, signals and evaluations). It never receives your email from us.

Payments

Paid plans are processed by Mercado Pago, which receives your card or Pix details directly from your browser. Aval stores only the payment or subscription ID, the amount, the plan, the status and the dates, to activate the plan and handle cancellation and refund requests. The CPF you enter at payment goes to Mercado Pago and is not stored by Aval. The legal basis is performing the contract and complying with legal and tax obligations, which may require keeping these records for up to 5 years.

Hyperliquid wallet

If you turn on real execution, Aval stores the public address of your main wallet, the address of the agent wallet and the agent wallet's key, encrypted with a key unique to your account. It also stores a record of the orders sent (coin, side, size, price, status and date). Addresses and trades on Hyperliquid are public on the blockchain itself. Disconnecting the wallet deletes the agent key, and deleting the account also deletes the order records. The legal basis is performing the contract.

Bot protection

The sign-up and sign-in forms use Cloudflare Turnstile to tell people apart from bots. It analyzes technical signals from the browser and the connection during the challenge. The legal basis is our legitimate interest in keeping the service secure.

Who we share data with

No one, for commercial purposes. Aval runs on Cloudflare, which hosts the site and the data, sends the access emails, forwards contact messages and measures visits without cookies. Cloudflare acts as a processor and may process data outside Brazil, with the contractual safeguards provided for in Article 33 of the LGPD. The scoring model (JEV, from TypeSafe) receives only the market data for each setup, never personal data.

How long we keep it

Your waitlist sign-up is kept for as long as the list exists or until you ask to leave. Your account is kept until you request deletion, and a deletion request includes the authorizations of connected apps. Access links expire in 15 minutes.

Your rights

You can ask for confirmation that we process your data, and for access, correction, deletion, portability and information about who we share it with. You can also withdraw your consent at any time. Write to contato@avalcrypto.com from your registered email. We respond within 15 days. If you are not satisfied, you can also file a complaint with the Autoridade Nacional de Proteção de Dados (ANPD, Brazil's National Data Protection Authority).