Privacy Policy

Published on October 22, 2026

1. DATA CONTROLLER GROW INCUBATEUR, Société par Actions Simplifiée with a share capital of 1,000.00 euros. Registered office: 36 Rue Edmé Mariotte, 34130 Mauguio, France. RCS Montpellier 107 634 388 — SIRET 107 634 388 00014 — Intra-community VAT number: FR70107634388 — APE/NAF Code: 8299Z. Represented by its President, Steven BLASI. Contact for any questions relating to personal data: contact@cryptoscore.eu Grow Incubateur SAS acts as the data controller within the meaning of Article 4.7 of the GDPR for all the processing operations described hereafter, except for those for which a distinct capacity is expressly mentioned. 2. SCOPE This policy describes how Grow Incubateur SAS collects, uses, stores, and protects the personal data of users of the CryptoScore Pro Platform, in accordance with Regulation (EU) 2016/679 (GDPR), Directive 2002/58/EC (ePrivacy), and Law No. 78-17 of January 6, 1978, as amended. It applies to all services accessible from cryptoscore.eu: public site, user area, professional and corporate offers, application programming interface (API), artificial intelligence tools server (MCP), transactional emails, newsletter and commercial communications, notifications (including in-app announcements), satisfaction surveys, referral program, and sharing links. 3. DATA COLLECTED 3.1 Data provided by the User Identification and account. Email address, password (stored as a salted hash), last name and first name where applicable, display name, avatar, preferred language and currency. Additional profile (optional). Biography, country, date of birth, phone number, website, social media identifiers, declared investor profile, sectors of interest. Professional data (corporate offers). Company name, VAT number, country of establishment, billing address, job title, affiliated organization, role within the organization, invited members. User-generated content. Watchlist, entered portfolio and positions, personal notes, alert rules, notification settings, dashboards and widget selection, messages sent to support, reports, feedback on content. Newsletter. Email address, language, source of registration (form or relevant page, visit campaign parameters if applicable), proof of consent (text and version of the accepted notice, date, IP address and browser used during registration and then confirmation), status (pending, confirmed, unsubscribed). The newsletter is also open to persons who do not have an account. Satisfaction surveys. Optional responses to questionnaires offered in the personal area (recommendation score from 0 to 10, choices, free comment), recorded with the subscribed offer and a bracket of account seniority at the time of the response. Referral. Referral code used at registration, attached referrals, rewards; if applicable, agreement given to appear, under a non-reversible pseudonym, in the public ranking of referrers. Digital wallet address. When the User chooses to connect a wallet: public address, relevant chain, provider used. No private key is ever collected, requested, or accessible. 3.2 Automatically collected data Connection and usage data: IP address, timestamp, pages visited, actions performed, type of browser and device, technical session identifiers, API and MCP tool call logs (timestamp, tool called, volume, response code). Browsing data from trackers, under the conditions of Article 10. Source of registration (first contact). Only when the User has accepted the audience measurement: campaign parameters (utm_source, utm_medium, utm_campaign, utm_term, utm_content), referring site domain (without the full page address), landing page, short link followed, and date of first contact. This information remains on the device and is linked to the account only once, after registration. A promotional code appearing in the followed link is kept in all cases, in order to apply the requested offer. Interactions with our emails. Deliverability events (delivery, bounce, complaint, unsubscribe) as well as opens and clicks on links, timestamped and linked to the recipient address. Links in our emails contain campaign parameters identifying the original email. Interactions within the application. Display and click on in-app advertisements, on Platform banners and offers, response or non-response to surveys. Sharing links. When a sharing link is opened: the originating network indicated in the link, referring domain, anonymous visitor identifier and date, in order to count unique visits. The sharer is not counted. Purchase journey. Chosen offer and periodicity, amount, currency, Stripe payment session identifier and status (started, finalized, expired), payment recovery link provided by Stripe. 3.3 Third-party data Delegated authentication. In the event of connection via Google or Apple: account identifier, email address and, where applicable, name and photograph transmitted by the provider. Payment. Subscription status, billing history, amounts paid, discounts applied, payment failures and customer identifier transmitted by Stripe. No credit card data is received or stored by Grow Incubateur SAS. During a payment, the source and originating campaign of the account (first contact) are attached to the Stripe payment session as metadata, in order to link the revenue to the campaign. On-chain verification. GROW Token balance associated with the declared address, read publicly on the blockchain, for the sole purpose of assigning the corresponding subscription tier. Wallet profile enrichment. When a wallet is verified, the Platform queries public directories (ENS, Lens, Farcaster, Gravatar) to suggest a display name or avatar. This information never replaces User input and can be deleted at any time. 3.4 Absence of sensitive data The Platform does not collect any data falling under Article 9 of the GDPR (origin, opinions, health, sexual orientation, biometric or genetic data). The User is urged not to communicate such data, particularly in free-text fields. 4. PURPOSES AND LEGAL BASES Purpose Legal Basis GDPR Article Account creation and management Performance of a contract 6.1.b Provision of subscribed features (scores, rankings, widgets, portfolio) Performance of a contract 6.1.b Management of subscriptions, payments, and billing Performance of a contract and legal obligation 6.1.b and 6.1.c Retention of invoices Legal obligation 6.1.c Alerts, notifications, and notification center Performance of a contract 6.1.b Access to the API and artificial intelligence tools (MCP) Performance of a contract 6.1.b Transactional emails (registration confirmation, security, reset, billing, payment failure) Performance of a contract 6.1.b Newsletter (double confirmation), win-back offers after termination (including, where applicable, a promotional code), and prospecting for individuals without an account Consent 6.1.a Lifecycle emails addressed to account holders: welcome, onboarding, end of free access, reminder for a started but unfinished payment Legitimate interest — "existing customer" exception of Article L34-5 of the French Post and Electronic Communications Code (similar services, opposition possible at any time) 6.1.f Measurement of email deliverability, opens, and clicks; frequency capping; opposition list Legitimate interest (respect for opposition: legal obligation) 6.1.f and 6.1.c In-app announcements (new features, offers) and measurement of their clicks Legitimate interest (can be disabled in preferences) 6.1.f Linking registration to its original campaign (first contact) Consent (audience measurement) 6.1.a Application of a promotional code present in the tracked link Pre-contractual measures at the request of the User 6.1.b Analysis of revenue and campaign performance (amounts, acquisition source) Legitimate interest 6.1.f Satisfaction surveys (NPS) and micro-polls Legitimate interest (optional participation) 6.1.f Public ranking of referrers (pseudonymized) Consent 6.1.a Statistics on opening sharing links Legitimate interest (persistent identifier: consent) 6.1.f and 6.1.a Consolidated view of a customer's journey (support, customer relations) Legitimate interest 6.1.f Audience measurement and usage statistics Consent (unless exempt configuration) 6.1.a Personalization of display and recommendations Consent 6.1.a Security, fraud prevention, and fight against abuse Legitimate interest 6.1.f Rate limiting and usage quotas Legitimate interest 6.1.f Service improvement and correction of anomalies Legitimate interest 6.1.f Management of support requests and complaints Legitimate interest 6.1.f Defense of legal rights in court Legitimate interest 6.1.f Where processing is based on legitimate interest, a balancing test has been conducted between this interest and the rights and freedoms of the individuals; the User may object to this under the conditions set out in Article 11. 4.1 Newsletter Subscription to the newsletter, with or without an account, is based on an unchecked consent box accompanied by a versioned notice (current version: nl-consent-v1 ). It only becomes effective after clicking the confirmation link sent by email (double opt-in), which is valid for seven (7) days. Unconfirmed requests are automatically deleted after thirty (30) days. Each sending includes a one-click unsubscribe link; account holders may also unsubscribe from their profile. Unsubscription is immediate and the address is added to an opposition list so that no further commercial communications are sent to them. 4.2 Lifecycle emails and service communications Account holders may receive, without being subscribed to the newsletter, emails related to the use of the service: welcome, onboarding assistance, information before the end of free access, reminders when a payment has been started but not finalized (with the secure recovery link provided by Stripe). These sendings relate to services similar to those already used and fall under Article L34-5 of the Code des postes et des communications électroniques: the person was informed upon the creation of their account and may object to this free of charge, at any time, via the link present in each email. Win-back offers sent after termination (accompanied, where applicable, by a personal promotional code) are reserved for persons subscribed to the newsletter. Strictly transactional emails (security, billing, payment failure) continue to be sent as long as the contract is in effect. The number of commercial emails sent to the same person is capped over a rolling period of seven (7) days; unsubscribed, invalid, hard-bounce addresses, or those that have reported a message as spam are excluded from all commercial sendings. Our emails are sent via Brevo, which transmits deliverability events as well as opens and clicks. This data is used to measure the effectiveness of sendings, to comply with the frequency cap and oppositions, and to cease sendings to inactive addresses; it is not used to create an advertising profile and is not communicated to any third party. 4.3 Attribution and commercial performance In order to determine which campaigns lead to registrations and purchases, the Platform may link a newly created account to its first contact (see Article 3.2). This linking only occurs if the User has accepted the "Audience Measurement" category; otherwise, only an eventual promotional code is transmitted. Linking is refused on the server side for accounts older than 30 days. The amounts paid and the acquisition source feed internal revenue and campaign performance statistics, which are consulted by authorized personnel in aggregated form. Authorized personnel may consult, for the purposes of support and customer relations, a consolidated timeline of an account (registration, origin, subscriptions and payments, emails received, opens and clicks, notifications). This view is for strictly internal use. 4.4 In-app ads, surveys, referral and sharing In-app ads. Advertisements (new features, offers) may appear in the notification center. They can be disabled at any time in the notification preferences. Clicking on an ad is recorded once per recipient to measure the interest of the campaign. Surveys. Participation in satisfaction surveys is optional. Results are exploited in an aggregated manner (by offer and by seniority); comments are read by the team to improve the service. Referrer ranking. A referrer only appears in the public ranking after having expressly accepted it, under a pseudonym that reveals neither their name nor their email address. They may withdraw their consent at any time from the Referral page. Sharing links. Opens of a sharing link are counted per unique visitor and per day, based on an anonymous identifier: stored on the device if audience measurement is accepted, limited to the current tab otherwise. 5. ABSENCE OF AUTOMATED DECISION-MAKING PRODUCING LEGAL EFFECTS Scores, ratings, risk indicators, and signals published by the Platform are calculated automatically from market, on-chain, and public data. They relate to digital assets and not to persons. No decision producing legal effects regarding a person, or significantly affecting them within the meaning of Article 22 of the GDPR, is taken solely on the basis of automated processing. The automatic assignment of a subscription tier linked to the holding of GROW Token is part of the execution of the contract and remains reversible at any time. 6. CONTENT GENERATED BY ARTIFICIAL INTELLIGENCE The Platform uses artificial intelligence models provided by Mistral AI SAS (a company under French law), or operated by Grow Incubateur SAS on its own servers, to produce asset descriptions, analytical summaries, news syntheses, conversational assistant responses, and the automatic translation of the interface and content. For editorial content (descriptions, summaries, news, translations), only public market data and Platform content are submitted to the models. Conversational assistant : when the User asks a question, it is transmitted to the model and, if the User is logged in, the account information useful for the response (CryptoScore identifier, offer, language, currency, watchlists, portfolios and positions, alerts, support requests), read with their own access rights. Conversations are kept in the User's browser and recorded by the Platform (questions, answers, ratings), in order to ensure support, security, and service improvement; they are accessible only to authorized personnel. The artificial intelligence tools made available to the User (MCP server) operate on explicit authorization: the User connects an external assistant to their account themselves and may revoke this authorization at any time from their personal area (Profile › Security or developer console › MCP Connections); the assistant sessions are then immediately terminated and the revocation is logged. The returned data is limited to the scope of their subscription and their own account. 7. RECIPIENTS AND PROCESSORS Data is neither sold, rented, nor assigned. It is accessible to authorized personnel of Grow Incubateur SAS, according to the principle of least privilege, and to the following processors, acting on documented instructions under agreements compliant with Article 28 of the GDPR: Sub-processor Role Data Location OVH SAS Hosting of the entire Platform on servers operated by Grow Incubateur SAS: website, database, authentication, server functions, file storage Gravelines, France BookMyName / Scaleway Domain name and DNS France Stripe Payments Europe Ltd Payment, billing, payment recovery links; receives the chosen offer, the amount, and the original campaign (metadata) Ireland Brevo SAS Sending of transactional emails, newsletters, and lifecycle emails; tracking of deliverability, opens, and clicks; management of unsubscribes France Mistral AI SAS Generation and translation of editorial content France Google Ireland Ltd / Apple Distribution International Ltd Delegated authentication (at the User's choice) Ireland The list of sub-processors is kept up to date. Any substantial change is brought to the attention of Users under the conditions of Article 15. Data may furthermore be communicated to the competent administrative or judicial authorities, upon regular requisition and within the strict limits thereof. 8. TRANSFERS OUTSIDE THE EUROPEAN UNION The Platform's architecture prioritizes hosting within the European Union. When a transfer to a third country is nevertheless likely to occur, notably for a provider's technical support, it is governed by: an adequacy decision by the European Commission, where one exists; failing that, the standard contractual clauses adopted by the European Commission on June 4, 2021; additional technical and organizational measures (encryption in transit and at rest, partitioning, minimization, access logging). A copy of the safeguards implemented can be obtained upon request sent to contact@cryptoscore.eu. 9. RETENTION PERIODS Data Retention Period User account and associated content Duration of the account, then deletion within 30 days Inactive account 3 years without login, after prior reminder Invoices and accounting documents 10 years (legal obligation) Connection and security logs 12 months API and MCP call logs 12 months Proof of consent to trackers Up to 36 months from collection User choices regarding trackers 6 months, then new request Messages sent to support 3 years from the last exchange Prospects and commercial requests 3 years from the last contact Newsletter — unconfirmed request Confirmation link valid for 7 days; request deleted after 30 days Newsletter — confirmed subscription and proof of consent Until unsubscribing, then 3 years of proof of consent and withdrawal Opposition list (unsubscribed, invalid, or complaint addresses) As long as necessary to ensure compliance with the opposition (address only) Email events (deliverability, opens, clicks) 3 years from sending First contact on the device (before registration) Maximum 30 days, then automatic deletion First contact linked to the account Duration of the account Payment attempts (started carts) 3 years from the attempt, and at most the duration of the account Responses to satisfaction surveys Duration of the account; aggregated results kept in anonymous form Agreement to sponsor rankings Until withdrawal of agreement or account deletion Opening of sharing links Maximum 25 months Audience measurement data Maximum 25 months At the end of these periods, the data are deleted or irreversibly anonymized. Market data relating to digital assets, devoid of personal character, are kept for historical and statistical purposes. 10. TRACKERS AND COOKIES This article serves as the tracker management policy within the meaning of Article 82 of the Data Protection Act (loi Informatique et Libertés) and the guidelines and recommendation "cookies and other trackers" of the CNIL, in their consolidated version of January 16, 2026. 10.1 Tracker Categories Category Purpose Consent Necessary Authentication, session, load balancing, remembering tracker choices, essential preferences (language, currency, theme, time zone), requested promotional or referral code, closing of banners and advertisements, current offer basket; ephemeral identifiers limited to the tab for the presence counter, performance measurement (Web Vitals, sampled) and ad display capping Not required (Art. 82 exemption) Security and Anti-fraud Session protection, abuse detection, rate limiting Not required (Art. 82 exemption) Audience Measurement Attendance and usage statistics with retained visitor identifier, visit origin (referrer, campaign parameters), linking registration to its original campaign (first contact), counting unique visitors of sharing links Required, unless exempt configuration compliant with CNIL Personalization Adaptation of display, recommendations and highlights Required Marketing and Advertising Partner advertising networks, persistent marketing identifier, display capping and A/B…