Privacy Policy

Alchimie Capital LLC, Odesio

Effective date: 2026-09-12 Version: 1.7 Compliant with Regulation (EU) 2016/679 (GDPR), Art. 3(2): extraterritorial application to persons located in the European Union.

This English version is a translation provided for convenience. In the event of any discrepancy or dispute, the French version prevails.

1. Who are we?

Alchimie Capital LLC (hereinafter "Alchimie Capital", "we") is a limited liability company governed by the laws of the State of New Mexico (United States of America), with its registered office at 4405 Jager Dr NE, Ste C4, Box 2043, Rio Rancho, NM 87144. Full identification details are set out in the Legal Notice.

We operate the "Odesio" application, an educational service on crypto-assets provided on a subscription basis.

Data controller: Alchimie Capital LLC Privacy contact: contact@alchimiecapital.com EU representative within the meaning of Art. 27 GDPR: designation in progress; in the meantime, data subjects may exercise their rights by contacting contact@alchimiecapital.com.

2. What is the GDPR and why does it apply?

Although Alchimie Capital is established in the United States, the GDPR applies to our processing of the personal data of users located in the European Union, pursuant to its Article 3(2)(a) (offering of goods or services to persons in the EU).

3. What data do we collect?

3.1 Identification and account data

3.2 Billing data

Payments are processed by Whop Inc. (United States), a subscription platform that manages the payment flow and the collection of payments. We receive only:

• Subscription status (active, cancelled, expired)
• Technical identifiers of the subscription and of the plan subscribed to
• Date and amount of the transaction

We neither receive nor store any bank card data. The payment flow is hosted by Whop: banking details never pass through our systems.

Transfers outside the EU: see §5.1.

3.3 Usage data

• Progress through the learning path (completed modules, exercise scores)
• Browsing history within the Application
• Interactions with Odesio (conversation transcripts)
• Feedback and ratings
• Time spent per section

3.4 Avatar Quiz data

During the onboarding quiz, we collect:

• Income bracket (range, never an exact figure)
• Capital dedicated to crypto (range)
• Desired time horizon
• Self-reported level of crypto experience
• Learning objectives

This data is used exclusively to determine a learning profile (NOVICE, AMBITIEUX, PATRIMONIAL, CADRE_PRESSE) in order to adapt the pace and vocabulary of the educational content. It does not constitute investor profiling within the meaning of MiFID II.

3.5 Emotional journal (optional)

If the User activates this feature, they may freely record their feelings about the market. By inference, this data may reveal a psychological state and is treated as sensitive data within the meaning of Art. 9(1) GDPR. Its processing is based exclusively on separate explicit consent (Art. 9(2)(a) GDPR) and may be withdrawn at any time.

3.6 Exchange API keys (optional)

If the User connects an account on one of the supported platforms (Binance, Bybit, Kraken, Bitget, Bitvavo, MEXC, Coinbase, OKX, KuCoin, Gate, Crypto.com, HTX, Bitstamp, BingX, WhiteBIT, Bitfinex, Gemini, eToro and their regional variants) for portfolio synchronisation, they must provide read-only API keys, without trading, transfer or withdrawal rights. The keys are encrypted (AES-256-GCM) before storage. Upon connection, Odesio verifies the permissions on Binance, Bybit/Bybit EU, Coinbase and OKX/OKX EEA and rejects a permissions response that is missing or unusable. For the other connectors, reading the data does not constitute a verification of permissions: the User must check them in the settings of their platform. This verification upon connection does not retroactively certify keys already recorded.

3.7 Technical data

• IP address (anonymised after 7 days)
• Device type, OS, browser
• Access and error logs
• Cookies and similar technologies (see Cookie Policy)
• Origin of your sign-up: the parameters of the link through which you arrived on the site (utm_* parameters, click identifier, code of the conversation or of the person who recommended the Application to you). They are read from the page address upon your arrival and recorded on your account at the time of its creation, without placing any cookie, and therefore regardless of your choices in the banner. No third party receives them; they are used solely to know which video or which person brought you to us, and to remunerate that person where applicable (§4).

3.8 Odesio interaction data

• Prompts sent
• Generated responses
• Explicit feedback (thumbs up / down)
• Moderation logs

4. Why do we collect this data? (Purposes and legal bases)

In accordance with Article 6 GDPR, each processing operation is based on a specific legal basis:

4.1 Automated decision-making and profiling (Art. 22 GDPR)

Four automated processing operations concern you. None of them produces legal effects, but we prefer to describe them all, including those that influence what you see.

1. Avatar quiz. Results in a classification into one of the 4 learning profiles. Modifies only the pace and vocabulary of the content.

2. Investor profile and bias profile. Generated automatically from your answers to the test, the composition of your portfolio and your exchanges with Odesio. They are used to personalise explanations and to point out behavioural blind spots to you (for example a highly concentrated position, or a thesis contradicted by your actions).

3. Proactive notifications. Odesio may open a conversation on its own initiative, with a message drafted automatically based on your situation: market movements affecting your positions, reminders of your plan, discipline status. This is the main mode of interaction of the product: the majority of conversations begin this way. You may deactivate these notifications, by category, in your preferences.

4. Suggested profit-taking levels. When you open the TP Workshop, figured levels are calculated from your actual position (quantity held, cost price, unrealised gain or loss). These are illustrative scenarios: you modify and validate them yourself, nothing is applied without your explicit action, and they do not constitute a personalised investment recommendation.

The underlying logic, in plain terms

These processing operations are based on your declared answers, on your portfolio data (which you entrust to us by connecting a wallet or an exchange, or by entering your positions) and on the history of your exchanges. A language model drafts the texts; it takes no decision on your behalf and executes no operation on your assets. Exchange connections are intended for reading data; their permission check and its limits are specified in §2.

Your rights regarding these processing operations

At any time, you may:

• View the profile assigned to you and the associated scores
• Obtain human intervention and a detailed explanation via contact@alchimiecapital.com
• Refuse segmentation (you will then be assigned to the default profile)
• Deactivate proactive notifications, in whole or by category
• Contest a classification

Odesio takes no decision producing legal effects. It is an educational assistant.

5. With whom do we share your data? (Processors)

We use the following processors. Each of them publishes a data processing agreement (DPA) incorporating the Standard Contractual Clauses (SCC 2021/914) for transfers outside the EU; the formalisation of these agreements in the name of Alchimie Capital LLC is in progress and the "Safeguards" column indicates, for each processor, its current status:

5.1 Transfers outside the EU

As Alchimie Capital LLC is established in the United States of America (New Mexico), any transfer of the personal data of our EU users to our company itself or to its US processors constitutes a transfer outside the EEA within the meaning of Chapter V GDPR. These transfers require safeguards appropriate to each recipient. Documentary verification is in progress; we do not present the following safeguards as all finalised:

• Standard Contractual Clauses (SCC) 2021/914, Module 2 (controller → processor). They are incorporated into the data processing agreements of our US processors; their formalisation in the name of Alchimie Capital LLC is in progress (status per processor in §5).
• EU-US Data Privacy Framework (DPF), EU/US adequacy decision of 10 July 2023. Processors certified under the DPF benefit from an adequacy decision; the DPF self-certification of Alchimie Capital LLC is in progress; no certification of our company is presented as obtained. The verified status may be obtained upon request at contact@alchimiecapital.com.
• Transfer Impact Assessment (TIA): the assessment and its documentation per transfer and per processor remain to be finalised. The documents actually available may be requested at contact@alchimiecapital.com.
• Supplementary technical measures: TLS 1.3 encryption in transit, AES-256-GCM at rest, minimisation, pseudonymisation, traceability of access.
• Government requests: the notification and challenge commitments must be verified in the agreement applicable to each processor; no general guarantee is given here.

Retention at Anthropic: the policy published for the API provides in principle for the deletion of inputs and outputs within 30 days, subject to exceptions, in particular contractual, legal and security-related ones. A zero-retention regime depends on an agreement and on the eligibility of the features and models used; it is not confirmed for our account.

5.2 No sale of data

We never sell your personal data to third parties for commercial, advertising or third-party profiling purposes.

6. How long do we keep your data?

7. What are your rights?

In accordance with Articles 15 to 22 GDPR, you have the following rights:

7.1 Right of access (Art. 15)

Obtain confirmation that your data is being processed and receive a copy of it.

7.2 Right to rectification (Art. 16)

Have inaccurate or incomplete data corrected.

7.3 Right to erasure / "right to be forgotten" (Art. 17)

Request the deletion of your data, except where there is a legal retention obligation (e.g. billing, 7 years).

From the account settings, a deletion request blocks access to the account and initiates the erasure of application data. The authentication identity and the captures whose ownership we can verify are deleted, with resumption in the event of a failure. Older captures, coaching copies and data transmitted to other recipients are subject to separate follow-up. The request is not presented as closed as long as this follow-up remains necessary. A restricted register retains the technical identifiers of the request, its dates and its status in order to allow its resumption, prevent unintentional re-creation and document its handling; it does not retain the erased conversations or exchange keys.

7.4 Right to restriction (Art. 18)

Request the suspension of processing in certain cases (contested accuracy, unlawful processing, etc.).

7.5 Right to data portability (Art. 20)

Receive your data in a structured, commonly used and machine-readable format (JSON).

7.6 Right to object (Art. 21)

Object to processing based on legitimate interest (in particular direct marketing).

7.7 Right to withdraw your consent (Art. 7(3))

At any time, without retroactive effect on processing already carried out.

7.8 Right relating to automated decisions (Art. 22)

Request human intervention on automated decisions producing significant effects (see Art. 4.1 above).

7.9 Right to lodge a complaint with a supervisory authority (Art. 77)

You may lodge a complaint with the competent authority of your State of residence:

• France: Commission nationale de l'informatique et des libertés (CNIL), https://www.cnil.fr/fr/plaintes
• Belgium: Data Protection Authority (APD/GBA), https://www.autoriteprotectiondonnees.be
• Luxembourg: Commission nationale pour la protection des données (CNPD), https://cnpd.public.lu
• Switzerland: Federal Data Protection and Information Commissioner (FDPIC/PFPDT), https://www.edoeb.admin.ch
• Other EU States: authority listed at https://edpb.europa.eu/about-edpb/board/members_fr

7.10 How to exercise your rights

Send your request to contact@alchimiecapital.com specifying:

• Your identity (e-mail address of the account)
• The right(s) you wish to exercise
• A copy of an identity document (in case of doubt as to your identity; it will be deleted after verification)

We respond within 30 days (possibly extendable by 60 days for complex requests, with prior notice).

Free of charge, except for manifestly unfounded or excessive requests.

8. How do we protect your data? (Security, Art. 32 GDPR)

We implement appropriate technical and organisational measures:

8.1 Technical measures

• TLS 1.3 encryption in transit
• AES-256-GCM encryption at rest for sensitive data (API keys, emotional journal)
• Encryption keys managed outside the database (environment variables) and versioned, allowing their rotation
• Multi-factor authentication (MFA) available to all Users
• Mandatory MFA for administrator accounts
• Annual penetration test by an independent provider
• Weekly vulnerability scans (Snyk, GitHub Security)
• Network isolation (no Docker ports exposed on 0.0.0.0)
• Daily encrypted backups with 30-day rotation

8.2 Organisational measures

• Principle of least privilege for access to data
• Logging of access to databases
• Regular training of the Noesia Labs teams (technical processor)
• Data processing agreements (DPA) in place or being formalised with all processors (detailed status in §5)
• Confidentiality clause in all contracts
• Breach management procedure (breach protocol)

8.3 Personal data breach (Art. 33-34)

In the event of a personal data breach presenting a risk to your rights and freedoms, we notify:

• The competent supervisory authority within 72 hours
• You yourself, if the risk is high, without undue delay

9. Cookies and similar technologies

The placing and reading of cookies on your device are governed by a dedicated policy: Cookie Policy.

In summary:

• Strictly necessary cookies: placed without consent (authentication, cart, security)
• Analytics, audience measurement and marketing cookies: subject to your prior consent via the cookie banner (opt-in)

10. Minors

The Services are strictly reserved for persons aged 18 or over. We do not knowingly collect data from minors. If you become aware that a minor has created an account, contact us at contact@alchimiecapital.com for immediate deletion.

11. Specific provisions for non-EU jurisdictions

11.1 United States (federal and state privacy acts)

As Alchimie Capital LLC is governed by the laws of the State of New Mexico, it is subject to US federal legislation and to the laws of the States in which it carries out its activity. US residents benefit in particular from the following rights depending on their State of residence:

As a matter of prudence, we apply by default the most protective standard (EU GDPR) to all users, including US users. Specific requests mentioning the applicable law ("CCPA Request", "VCDPA Request", etc.) are handled at contact@alchimiecapital.com.

As a US LLC, Alchimie Capital also complies with its transparency obligations under the Corporate Transparency Act (31 U.S.C. § 5336

• BOIR filing with FinCEN of beneficial owners).

11.2 United Kingdom (UK GDPR)

UK residents benefit from rights equivalent to those under the EU GDPR. Supervisory authority: Information Commissioner's Office (ICO) (https://ico.org.uk).

11.3 Switzerland (nFADP)

Swiss residents benefit from the new Federal Act on Data Protection (in force since 1 September 2023). Authority: Federal Data Protection and Information Commissioner (FDPIC/PFPDT).

11.4 Canada (PIPEDA, Quebec Law 25)

Canadian residents benefit from the federal PIPEDA and, for Quebec, from Law 25 amending the Act respecting the protection of personal information in the private sector.

12. Changes to this Policy

We may amend this Privacy Policy. Substantial changes will be notified to you by e-mail or via the Application with 30 days' notice. The date of the last update appears at the top of the document.

13. Contact

Data protection (exercise of rights) and general contact: contact@alchimiecapital.com Registered office: Alchimie Capital LLC, 4405 Jager Dr NE, Ste C4, Box 2043, Rio Rancho, NM 87144, New Mexico, United States EU representative (Art. 27 GDPR): designation in progress; rights may be exercised by contacting contact@alchimiecapital.com in the meantime.

Last updated: 2026-09-12, v1.7 (origin of sign-up recorded on the account without cookies, attribution to a referrer)