Legal
Privacy Policy
Last updated: 25 October 2026
This policy explains what personal data OpenHood (openhood.si) processes when you use our AI chat assistant for Robinhood Chain, why we process it, who receives it, how long we keep it, and the rights you have under the EU General Data Protection Regulation (GDPR).
01Who we are
The controller responsible for your personal data is OpenHood, the operator of OpenHood:
- Address: [Registered address — to be added]
- Registration number: [Company registration number — to be added]
- Email: [email protected]
In this policy, “OpenHood”, “we”, “us” and “our” refer to the operator above. For any question about this policy or your data, write to [email protected].
02What this policy covers
This policy applies to the website and chat service at openhood.si, whether you use it as an anonymous visitor or with an account. It should be read together with our Terms of Service and Cookie Policy.
OpenHood analyses public blockchain data. Information that is already public on Robinhood Chain (such as balances and transactions of a wallet address) is not created by us, but when you ask us about an address that can be linked to you or someone else, our records of that query may be personal data, and we treat it as such.
03Data we collect
Account data
You can send 10 messages without an account. After that you need a free account. When you create one we store your email address, an optional name, your password as a bcrypt hash (we never store or see the plain password), your account role, your account settings (including your “Improve OpenHood” choice) and the date the account was created.
Session data
When you sign in we create a random session token. Your browser keeps the token in a cookie; our database stores only a SHA-256 hash of it, together with its expiry date, a one-way hash of your IP address and your browser’s user-agent string. Sessions last 30 days. Signing out revokes the session on our servers.
Conversations
We store every message you send and every answer the AI gives, the chat title, timestamps, the answer mode used (for example Fast or Deep), and a record of the data lookups made to answer you (for example which token or wallet addresses were queried). We store chats for signed-in users and for anonymous visitors. Anonymous chats are linked to a random ID kept in the oh_anon cookie; if you later sign up or sign in on the same browser, those chats move to your account.
Feedback
If you rate an answer with thumbs up or down, we store the rating and any comment you add.
Usage and security data
For each request we record technical metrics: the number of AI tokens processed, the estimated cost, the data-API credits used, response time (latency) and the AI model used. We also record a one-way hashed IP address (SHA-256, truncated) to enforce the free-message limit and rate limits and to prevent abuse. We do not store raw IP addresses in our database, although they may appear briefly in server and network (CDN) logs, as with any website. A hashed IP is still treated as personal data.
What we do not collect
- We never ask for wallet private keys, seed phrases or passwords to other services. Never share them with OpenHood or anyone else.
- We do not collect payment details or government ID.
- Please do not paste personal data (yours or anyone else’s) into chats. Wallet addresses are public blockchain data, but they can be personal data if they can be linked to you.
04Why we use it and our legal bases
We only use personal data where the GDPR gives us a legal basis (Article 6). The table below summarises each category, why we use it, the legal basis we rely on, and how long we keep it. More detail on retention is in section 8.
| What we collect | Why | Legal basis | How long |
|---|---|---|---|
| Account data | Create and run your account, sign you in, apply your settings, send service emails (account and security notices) | Contract — Art. 6(1)(b) | Until you delete your account |
| Session data | Keep you signed in and protect your account against misuse | Contract — Art. 6(1)(b); legitimate interests in security — Art. 6(1)(f) | 30 days, or until you sign out |
| Conversations (signed in) | Answer your questions, show your chat history | Contract — Art. 6(1)(b) | Until you delete the chat or your account |
| Conversations (anonymous) | Answer your questions, keep your chats on this browser | Contract — Art. 6(1)(b) | Deleted after 90 days of inactivity |
| Conversations and feedback for improvement | Review answer quality, fix errors, improve prompts, build de-identified training datasets | Legitimate interests — Art. 6(1)(f), with opt-out | As above; de-identified datasets may be kept longer |
| Feedback | Understand which answers help and which do not | Legitimate interests — Art. 6(1)(f) | Kept with the chat it belongs to |
| Hashed IP counters | Enforce the free-message limit and rate limits, prevent abuse and fraud | Legitimate interests — Art. 6(1)(f) | Up to 30 days |
| Usage metrics | Run the service reliably, monitor performance and costs, detect abuse | Legitimate interests — Art. 6(1)(f) | Up to 24 months, then aggregated or anonymised |
| Any of the above, where required | Comply with legal obligations, such as responding to lawful requests from authorities | Legal obligation — Art. 6(1)(c) | As long as the law requires |
Where we rely on legitimate interests, our interests are keeping OpenHood secure, available and fair to use, and making its answers more accurate. We have weighed these against your rights and kept the data involved to a minimum. You can object at any time (see section 9).
We send emails only when they are needed to run your account, such as security or account notices. We do not send marketing emails unless you have given your consent.
05Improving OpenHood and your opt-out
Unless you opt out, we may use your conversations and feedback to make OpenHood better. This means:
- reviewing chats and feedback to evaluate answer quality and find mistakes;
- fixing errors and improving our prompts and data lookups;
- creating de-identified training datasets, with email addresses removed, which may be used to fine-tune AI models.
How to opt out
Go to Settings → Data controls and turn off “Improve OpenHood with my chats”. The switch is available to signed-in users and to anonymous visitors. Chats covered by your opt-out are excluded from review and from training datasets. Opting out does not affect how the service works for you.
De-identification removes direct identifiers such as email addresses, but chat text can still contain whatever you typed. This is one more reason not to paste personal data into chats.
07International transfers
Some providers, including OpenAI and Cloudflare, are based in the United States or process data outside the European Economic Area. Where personal data is transferred outside the EEA, we rely on the EU–US Data Privacy Framework (for certified recipients) and/or the European Commission’s Standard Contractual Clauses. You can ask us for more information about these safeguards at [email protected].
08How long we keep data
- Anonymous chats are deleted after 90 days of inactivity.
- Signed-in chats are kept until you delete them or your account.
- Deletion is immediate: deleting a chat or your account removes it from our live database straight away. Backups, if any, roll off within 30 days.
- Feedback is kept with the chat it belongs to and deleted with it.
- Sessions expire after 30 days, or earlier when you sign out.
- Hashed-IP counters for free-message and rate limits are kept for up to 30 days.
- Usage metrics are kept for up to 24 months, then aggregated or anonymised.
- De-identified training datasets may be kept longer. They contain no email addresses and exclude chats you opted out of.
09Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you and get a copy;
- rectify data that is inaccurate or incomplete;
- erase your data (“right to be forgotten”);
- restrict how we process your data in certain cases;
- object to processing based on legitimate interests — including use of your chats to improve OpenHood, which you can switch off yourself;
- data portability: receive the data you gave us in a machine-readable format;
- withdraw consent at any time where we rely on consent, without affecting processing that happened before;
- lodge a complaint with a supervisory authority (see section 14).
Self-service tools
In Settings → Data controls, signed-in users can use Export my data to download their data as a JSON file, and Delete account to permanently delete their account, chats, feedback and sessions. You can also delete individual chats at any time.
For anything else, email [email protected]. We may ask you to confirm your identity before acting on a request. We respond within one month; if a request is complex, that period can be extended by up to two further months, and we will tell you if so.
OpenHood does not make decisions about you based solely on automated processing that have legal or similarly significant effects. Automated labels in answers (such as a token risk rating) describe tokens, not you.
10Security
We protect your data with measures including:
- HTTPS encryption for all traffic;
- bcrypt hashing for passwords and SHA-256 hashing for session tokens;
- cookies marked
httpOnly,SecureandSameSite; - rate limiting and origin checks on our endpoints;
- API keys kept server-side with the minimum permissions needed.
No method of transmission or storage is completely secure. If a personal data breach occurs that is likely to put your rights at risk, we will notify the supervisory authority and, where required, you, as the GDPR requires.
11Children
OpenHood is not intended for anyone under 18, and you must be 18 or older to use it. If we learn that we hold data about someone under 18, we will delete it. If you believe a minor has used the service, please contact [email protected].
13Changes to this policy
We may update this policy when our service or the law changes. We will change the “Last updated” date at the top, and if a change is material we will let you know in advance, for example in the app or by email.
14Contact and complaints
Questions, requests or concerns: [email protected]. We would like the chance to resolve any issue first, but you always have the right to complain to a supervisory authority. In Slovenia, where we are based, this is:
Informacijski pooblaščenec (Information Commissioner of the Republic of Slovenia)
Dunajska cesta 22, 1000 Ljubljana, Slovenia
www.ip-rs.si
You may also complain to the data protection authority in the EU country where you live or work, or where you believe an infringement took place.
See also: Terms of Service · Cookie Policy
This document is provided for transparency. If anything here is unclear, contact [email protected].