Privacy Policy

Last updated: 21 October 2026

1. Overview

This Privacy Policy describes how Swarming Labs LTD ("Sparkling", "we", "us", or "our") collects, uses, discloses, and protects information when you use Sparkling, an AI-powered trading agent operating within Telegram and accessible via our official website at sparkling.nz (collectively, the "Service").

This policy applies globally. By using the Service, you acknowledge understanding these practices. For users in New Zealand, we are fully committed to complying with the New Zealand Privacy Act 2020, alongside international best practices for data protection.

2. Data Controller

Swarming Labs LTD
Intershore Chambers, Road Town, Tortola
British Virgin Islands
Email: [email protected]

For users in the EEA or UK, you may contact our Data Protection Officer (DPO) at [email protected].

3. Information We Collect

3.1 Information You Provide

• Account information: Telegram identifier, username, email address.
• Authentication credentials: One-time passwords for wallet recovery (not stored retrievably).
• Identity verification: Government ID, proof of address, date of birth, biometric verification (processed by a regulated partner, if required by law).
• Communications: Messages to Sparkling, trade instructions, support requests.
• Preferences and settings: Strategy parameters, notification preferences, language selection.

3.2 Information Collected Automatically

• Transaction data: Swap quotes, signed transactions, agent strategy executions, transaction hashes.
• Technical data: Device type, OS, Telegram client version, IP address (retained max 30 days unless fraud investigation), geographic region.
• Usage data: Feature interactions, error logs, performance metrics, session metadata.
• Website analytics data: When you visit our website, Google Analytics records the pages you view, how you reached the site, your device and browser type, and your approximate location.

3.3 Information From Third Parties

• Custodial wallet provider: Wallet addresses, transaction status, authentication events.
• Settlement and routing partners: Execution data, routing decisions, pricing information.
• Sanctions and compliance screening providers: Screening results for sanctions verification.

3.4 On-Chain Information

Public blockchain data (wallet addresses, transaction amounts, counterparties, timing) is accessible to anyone and analysed in connection with operating the Service and meeting compliance obligations.

4. How We Use Information

• To provide the Service: Routing instructions, executing transactions, displaying balances, operating configured Agents. (Legal basis: contract performance).
• To authenticate and secure your account: Verifying logins, sending passwords, detecting suspicious access. (Legal basis: contract performance; account security interests).
• To communicate with you: Sending transactional notifications and responding to support. (Legal basis: contract performance; customer support interests).
• To improve the Service: Analysing aggregated patterns, debugging errors, testing features. (Legal basis: product development interests).
• To prevent fraud and abuse: Detecting bots, market manipulation, account takeovers. (Legal basis: service integrity interests; anti-fraud and AML obligations).
• To comply with legal obligations: Responding to regulators, courts, and law enforcement; meeting record-keeping requirements. (Legal basis: legal obligation).
• To verify identity where required (KYC/AML): Conducting identity verification, sanctions screening, transaction monitoring. (Legal basis: legal obligation; compliance interests).
• To send service-related updates: Notifying of material changes to policies, terms, fees, or features. (Legal basis: contract performance; service interests).
• To measure and improve the website: Counting visits and measuring channels using Google Analytics. (Legal basis: your consent where the law requires it, which you can withdraw at any time).

We do not use information for marketing without opt-in consent. We do not sell personal information.

5. How We Share Information

5.1 Service Providers

We share information with vendors including cloud infrastructure providers, email services, analytics providers, identity verification providers, and customer support tools. Each is bound by written data processing agreements.

5.2 Partners Integrated With the Service

• Wallet (by Telegram): Custodial wallet partner receiving provisioning instructions, signing requests, authentication events.
• Liquidity providers and aggregators: Receive routing and execution data.

5.3 Legal and Regulatory Disclosure

We may disclose information to comply with law, regulation, legal process, or governmental requests; enforce Terms of Service; detect or address fraud or security issues; protect rights, property, or safety.

5.4 Business Transfers

In a merger, acquisition, or similar transaction, information may be transferred. The acquiring party will be bound by equally protective privacy commitments.

6. International Data Transfers

Information may be transferred to and processed in countries outside your residence, including jurisdictions with lesser data protection. For transfers from the EEA, UK, or Switzerland to inadequate jurisdictions, we rely on:

• European Commission Standard Contractual Clauses (and UK International Data Transfer Addendum where applicable).
• Supplementary technical and organisational measures consistent with Schrems II.
• The EU–U.S. Data Privacy Framework for certified US partners (e.g., Google LLC for Google Analytics).

7. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected:

8. Your Rights

Depending on your location, you have specific rights regarding your personal data:

• New Zealand Privacy Act 2020: You have the right to request access to the personal information we hold about you and to request correction of any inaccurate or incomplete data. You also have the right to complain to the New Zealand Office of the Privacy Commissioner (OPC) if you believe your privacy has been breached.
• GDPR (EEA/UK/Switzerland): Rights to access, rectification, erasure ("right to be forgotten"), restriction of processing, data portability, objection to processing, and withdrawal of consent.

How to Exercise Your Rights

Email [email protected] with:

• Your specific request and the right you wish to exercise.
• Sufficient identity verification information (we will only request details necessary to confirm you are the account owner).
• The email address associated with your Sparkling account.

We will respond within 30 days. If you are unsatisfied with our response, you may lodge a complaint with your local data protection authority.

9. Security

We implement robust technical and organisational measures to protect your information against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access, including:

• TLS 1.3 encryption for data in transit.
• Encryption of sensitive data at rest.
• Multi-factor authentication (MFA) for internal systems.
• Role-based access controls with least-privilege principles.
• Regular external security audits and penetration testing.
• Vulnerability disclosure program (report to [email protected]).
• Access logging and monitoring.
• Employee data protection training.

No system is completely secure. We encourage you to report any security issues to us.

10. Children's Privacy

The Service is not directed to individuals under 18 years of age. We do not knowingly collect personal information from children. If we learn that we have collected data from a child without parental consent verification, we will promptly delete it. Contact us if you believe we hold data concerning a minor.

11. Automated Decision-Making

The Service uses automated processing for:

• Agent strategy execution: Agents propose trades based on your rules; you confirm each trade.
• Fraud and security detection: Automated systems flag suspicious activity for human review.
• Transaction monitoring: Automated systems screen against AML and sanctions criteria.

Decisions with legal or significant effect (such as account suspension for suspected fraud) involve human review before finalisation. You have the right to request human intervention, express your viewpoint, and contest the decision.

12. Cookies and Tracking Technologies

The Sparkling website uses strictly necessary storage to function, and Google Analytics cookies to measure site usage. We do not use advertising cookies. Visitors from jurisdictions requiring it will see a cookie consent banner. For more details, please see our Cookie Policy.

13. Links to Third-Party Services

The Service may contain links to third-party websites, blockchain explorers, or partner sites. This Policy does not apply to them. We advise you to review their privacy policies before sharing any information.

14. Changes to This Policy

We may update this Policy from time to time. Material changes will be notified at least 30 days before taking effect via in-app notification or email. The "Last updated" date above reflects the current version. Material revision history is available upon request.

15. Contact Us

For questions or requests regarding this Privacy Policy, please contact us:

Postal address:
Swarming Labs LTD
Intershore Chambers, Road Town, Tortola, British Virgin Islands