Política de Privacidade e de Cookies
Última atualização: 18/10/2026
Este documento jurídico está atualmente disponível apenas em inglês.
This privacy and cookie policy for Individual Entrepreneur ANDREI MALYSHOK ("we," "us," or "our"), describes how and why we might collect, store, use, and/or share ("process") your information when you use our services ("Services"), such as when you:
- Visit our website at https://criffy.com, or any website of ours that links to this privacy notice
- Use Portfolio to record and review assets, balances, transactions, Earn or Loan positions, or share a view of your portfolio
- Purchase or manage a Criffy subscription through Whop
- Engage with us in other related ways, including any sales, marketing, or events
In some cases we may use cookies to collect personal information, or that becomes personal information if we combine it with other information.
Questions or concerns? Reading this privacy notice will help you understand your privacy rights and choices. If you do not agree with our policies and practices, please do not use our Services. If you still have any questions or concerns, please contact us at [email protected].
Summary of key points
This summary provides key points from our privacy notice, but you can find out more details about any of these topics by clicking the link following each key point or by using our table of contents below to find the section you are looking for.
What personal information do we process? When you visit, use, or navigate our Services, we may process personal information depending on how you interact with us and the Services, the choices you make, and the products and features you use. Learn more about personal information you disclose to us.
Do we process private financial information? Portfolio may contain financial records and public wallet addresses you provide, linked to your Criffy account. We do not ask for wallet private keys, recovery phrases, or credentials that authorize transactions on financial accounts. See the information categories below.
Do we collect any information from third parties? We receive payment and subscription information from Whop to provide and manage paid access. We do not receive full card numbers or card security codes.
How do we process your information? We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We may also process your information for other purposes with your consent. We process your information only when we have a valid legal reason to do so. Learn more about how we process your information.
In what situations and with which parties do we share personal information? We share information where needed with providers that support the Services, including Whop for payments and subscriptions, and in the other circumstances described below. Portfolio is private by default; if you enable sharing, anyone with the link can view the information allowed by your sharing settings.
How do we keep your information safe? We have organizational and technical processes and procedures in place to protect your personal information. However, no electronic transmission over the internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorized third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information. Learn more about how we keep your information safe.
What are your rights? Depending on where you are located geographically, the applicable privacy law may mean you have certain rights regarding your personal information. Learn more about your privacy rights.
How do you exercise your rights? You can contact [email protected] to request access, correction, or deletion of your personal information or to exercise other applicable privacy rights. We will consider and act upon any request in accordance with applicable data protection laws.
Want to learn more about what we do with any information we collect? Review the privacy notice in full.
1. What information do we collect?
1.1 Personal information you disclose to us
In Short: We collect personal information that you provide to us.
We collect personal information that you voluntarily provide to us when you register on the Services, express an interest in obtaining information about us or our products and Services, when you participate in activities on the Services, or otherwise when you contact us.
Personal Information Provided by You. The personal information that we collect depends on the context of your interactions with us and the Services, the choices you make, and the products and features you use. The personal information we collect may include the following:
- email addresses
- usernames
- passwords
- information you enter in Portfolio, as described below
- notification preferences, alert filters, and support messages
Portfolio Data. When you use Portfolio, we store the records you enter and associate them with your Criffy account. These may include portfolio names and group labels; assets and custom asset prices; exchange, wallet, protocol, and custom platform labels; public wallet addresses; balances and quantities; transaction types, dates, prices, fees, and fiat amounts; and Earn or Loan position details such as principal, returns, debt, collateral, dates, and status. We also calculate and store information derived from those records and available market data, including estimated values, performance, allocation percentages, and historical snapshots, together with your sharing settings and any active share link.
Portfolio currently records information supplied by you; entering a wallet address or platform name does not connect to, verify, or grant access to that account. We do not request wallet private keys, recovery phrases, exchange passwords, or trading credentials through Portfolio. Do not enter these secrets in portfolio labels, support messages, or other fields.
Private and Sensitive Information. Financial records and wallet addresses may reveal information about your holdings or activity when linked to your account or other information. We process them to provide the features you request. We do not ask you to provide special-category information such as health data, racial or ethnic origin, religious beliefs, or biometric identifiers. Where information we process is treated as sensitive personal information under applicable law, the protections and rights provided by that law apply.
Payment and Subscription Data. Payments for Criffy subscriptions are processed through Whop's hosted checkout. We send the selected plan, payment method, a checkout reference that links the purchase to your Criffy account, and, where used to prefill checkout, your email address. Card details and security codes are submitted directly to Whop or its payment providers; Criffy does not receive or store full card numbers or card security codes.
We receive and store the information needed to activate and manage paid access, reconcile payments, and handle support, refunds, and disputes. This includes checkout, payment, customer or membership, and subscription identifiers; plan and payment-method information; amounts and currency; payment, refund, dispute, trial, and subscription status; billing and access dates; and related provider event data. Our subscription integration does not send your Portfolio holdings, transaction records, or wallet addresses to Whop to process a purchase.
Criffy and Whop act as independent controllers of the personal information each processes for its own purposes. Whop processes information you provide on its checkout and payment-management pages under its own privacy notice, including information used for payment processing, verification, security, and legal compliance. Review Whop's Privacy Policy. This notice describes Criffy's processing of the payment and subscription information we exchange with Whop.
Social Media Login Data. We may provide you with the option to register with us through a supported third-party account, such as Google or Facebook. If you choose to register in this way, we will collect certain profile information about you from the social media provider, as described in the section called "HOW DO WE HANDLE YOUR SOCIAL LOGINS?" below.
All personal information that you provide to us must be true, complete, and accurate, and you must notify us of any changes to such personal information.
1.2 Information automatically collected
In Short: Some information — such as your Internet Protocol (IP) address and/or browser and device characteristics — is collected automatically when you visit our Services.
We automatically collect certain information when you visit, use, or navigate the Services. This information does not reveal your specific identity (like your name or contact information) but may include device and usage information, such as your IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country, location, information about how and when you use our Services, and other technical information. This information is primarily needed to maintain the security and operation of our Services, and for our internal analytics and reporting purposes.
Like many businesses, we also collect information through cookies and similar technologies.
The information we collect includes:
- Log and Usage Data. Log and usage data is service-related, diagnostic, usage, and performance information our servers automatically collect when you access or use our Services and which we record in log files. Depending on how you interact with us, this log data may include your IP address, device information, browser type, and settings and information about your activity in the Services (such as the date/time stamps associated with your usage, pages and files viewed, searches, and other actions you take such as which features you use), device event information (such as system activity, error reports (sometimes called "crash dumps"), and hardware settings).
- Device Data. We collect device data such as information about your computer, phone, tablet, or other device you use to access the Services. Depending on the device used, this device data may include information such as your IP address (or proxy server), device and application identification numbers, location, browser type, hardware model, Internet service provider and/or mobile carrier, operating system, and system configuration information.
- Location Data. We collect approximate location data such as country or region inferred from your IP address, hosting/security provider headers, or browser/request information. We do not ask for precise GPS location through the Services.
2. How do we process your information?
In Short: We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We may also process your information for other purposes with your consent.
We process your personal information for a variety of reasons, depending on how you interact with our Services, including:
- To facilitate account creation and authentication and otherwise manage user accounts. We may process your information so you can create and log in to your account, as well as keep your account in working order.
- To provide Portfolio and other requested features. We store your records, calculate and display portfolio summaries and estimates, maintain history, apply your preferences, and provide alerts you choose to configure.
- To provide sharing at your direction. When you enable a Portfolio share link, we make the selected information available to people who have that link, according to your sharing settings.
- To manage payments and subscriptions. We exchange payment information with Whop to link purchases to your account, provide paid access, manage renewals and cancellations, and handle refunds, disputes, and billing support.
- To support and protect the Services. We use relevant account, usage, and diagnostic information to respond to requests, investigate errors, prevent abuse and fraud, protect accounts, and improve reliability.
- To communicate and comply with law. We send requested alerts and necessary service messages, maintain records required by law, and respond to lawful requests. Optional analytics and marketing processing follows the choices described in the cookie section.
- To save or protect an individual's vital interest. We may process your information when necessary to save or protect an individual’s vital interest, such as to prevent harm.
3. What legal bases do we rely on to process your information?
In Short: We only process your personal information when we believe it is necessary and we have a valid legal reason (i.e., legal basis) to do so under applicable law, like with your consent, to comply with laws, to provide you with services to enter into or fulfill our contractual obligations, to protect your rights, or to fulfill our legitimate business interests.
If you are located in the EU or UK, this section applies to you.
The General Data Protection Regulation (GDPR) and UK GDPR require us to explain the valid legal bases we rely on in order to process your personal information. As such, we may rely on the following legal bases to process your personal information:
- Consent. We may process your information if you have given us permission (i.e., consent) to use your personal information for a specific purpose. You can withdraw your consent at any time. Learn more about withdrawing your consent.
- Performance of a Contract. We process account, Portfolio, sharing, alert, payment, and subscription information where necessary to provide the Services you request under our agreement with you or to take steps at your request before entering into that agreement.
- Legitimate Interests. Where your rights and interests do not override ours, we process relevant information to secure and maintain the Services, prevent fraud and abuse, diagnose problems, provide support, and establish, exercise, or defend legal claims. We do not rely on legitimate interests in place of consent where consent is required for optional cookies or marketing.
- Legal Obligations. We may process your information where we believe it is necessary for compliance with our legal obligations, such as to cooperate with a law enforcement body or regulatory agency, exercise or defend our legal rights, or disclose your information as evidence in litigation in which we are involved.
- Vital Interests. We may process your information where we believe it is necessary to protect your vital interests or the vital interests of a third party, such as situations involving potential threats to the safety of any person.
If you are located in Canada, this section applies to you.
We may process your information if you have given us specific permission (i.e., express consent) to use your personal information for a specific purpose, or in situations where your permission can be inferred (i.e., implied consent). You can withdraw your consent at any time.
In some exceptional cases, we may be legally permitted under applicable law to process your information without your consent, including, for example:
- If collection is clearly in the interests of an individual and consent cannot be obtained in a timely way
- For investigations and fraud detection and prevention
- For business transactions provided certain conditions are met
- If it is contained in a witness statement and the collection is necessary to assess, process, or settle an insurance claim
- For identifying injured, ill, or deceased persons and communicating with next of kin
- If we have reasonable grounds to believe an individual has been, is, or may be victim of financial abuse
- If it is reasonable to expect collection and use with consent would compromise the availability or the accuracy of the information and the collection is reasonable for purposes related to investigating a breach of an agreement or a contravention of the laws of Canada or a province
- If disclosure is required to comply with a subpoena, warrant, court order, or rules of the court relating to the production of records
- If it was produced by an individual in the course of their employment, business, or profession and the collection is consistent with the purposes for which the information was produced
- If the collection is solely for journalistic, artistic, or literary purposes
- If the information is publicly available and is specified by the regulations
4. When and with whom do we share your personal information?
In Short: We may share information in specific situations described in this section and/or with the following third parties.
We may need to share your personal information in the following situations:
- Service Providers and Authorized Personnel. Providers of hosting, infrastructure, security, authentication, email, customer support, and permitted analytics help us operate the Services. They and authorized personnel may access information needed for their tasks, subject to applicable access restrictions and contractual or legal obligations.
- Payments through Whop. We exchange the payment and subscription information described above with Whop and may provide relevant transaction or support records to resolve billing issues, refunds, fraud reports, or disputes. Whop's processing on its own services is described in its privacy notice.
- Portfolio Sharing You Enable. Your portfolio is private by default. Generating a share link allows anyone who obtains that link to view the shared portfolio without signing in. Recipients may forward the link or copy the information they see. The shared page does not provide editing rights and does not display your account identity or wallet addresses. However, portfolio details may still identify you when combined with other information.
- Legal and Security Reasons. We may disclose relevant information where required by law or a valid legal request, or where necessary and permitted to protect rights, investigate fraud or abuse, and enforce our agreements.
- Business Transfers. We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.
4.1 Your Portfolio sharing choices
New share links hide amounts by default, independently of whether you hide amounts in your own account view. With amounts hidden, shared visitors cannot see quantities, balances, monetary profit or loss, fees, debt, collateral amounts, or current loan-to-value ratios. They can still see asset and platform names, group labels, dates, statuses, unit prices, APY, loan-to-value thresholds, allocation and relative performance percentages, and record counts. If you choose to show amounts, the shared view also includes the relevant amounts and monetary history. Review these settings before distributing a link.
You can change the amount-visibility setting or stop sharing. Revoking a link blocks subsequent access through that link; sharing again creates a new link. Changes cannot retract information that someone has already viewed, downloaded, or copied. We ask search engines not to index shared pages, but this is not access control or a guarantee against redistribution. Shared Portfolio pages do not load Google Tag Manager or Umami analytics.
5. What is our stance on third-party websites?
In Short: Third-party websites and services have their own privacy practices. Review their notices before providing information to them.
The Services may link to third-party websites, online services, or mobile applications, including crypto platforms, Whop, social login providers, and partner or affiliate websites. Their privacy notices explain how they process information on their services. A link does not by itself imply an endorsement, and we do not control their independent privacy practices. This does not remove Criffy's responsibilities for information we process or share under this notice or applicable law. Review the relevant third-party notices and contact those providers about their processing.
6. Do we use cookies and other tracking technologies?
In Short: Yes. We use cookies and similar technologies to run Criffy, remember requested preferences, measure aggregate usage, and support affiliate or advertising attribution when allowed by your choices.
We use an in-product cookie preferences tool to store your choices instead of a third-party cookie banner script. Optional cookies are controlled by region and by your choices:
- In regions where opt-in consent is required, functional, analytics, and marketing cookies are disabled unless you allow them.
- In the United States and other notice-based regions, analytics cookies may be enabled by default and you can opt out at any time.
- Marketing and attribution cookies are disabled unless you enable them or otherwise give the required permission.
To the extent optional advertising or attribution cookies are considered "sale," "sharing," or targeted advertising under applicable US state privacy laws, you can opt out through Cookie preferences or by contacting us as described below.
6.1 What are cookies?
Cookies are small data files that are placed on your computer or mobile device when you visit a website. Cookies are widely used by website owners in order to make their websites work, or to work more efficiently, as well as to provide reporting information.
Cookies set by the website owner (in this case, Individual Entrepreneur ANDREI MALYSHOK) are called "first-party cookies." Cookies set by parties other than the website owner are called "third-party cookies." We use both first-party cookies and limited third-party technologies for security, analytics, and attribution as described below.
6.2 Why do we use cookies?
We use cookies and similar technologies for these categories:
- Necessary cookies are required for consent storage, authentication, security, bot protection, Turnstile checks, and requested language settings.
- Functional cookies remember requested interface preferences, such as whether filters are shown or hidden.
- Analytics cookies help us understand aggregate site usage through Google Analytics, Google Tag Manager, and Umami when analytics consent is allowed or when your region permits analytics by default with opt-out.
- Marketing and attribution cookies remember affiliate, referral, promotion, and advertising attribution. These remain off unless marketing consent is allowed.
6.3 How can I control cookies?
You can review or change your choices from the cookie banner, from the Cookie preferences link in the footer, or from Cookie preferences. Necessary cookies cannot be disabled because they are required to provide the Services securely.
If you reject optional cookies, you may still use the Services, although some preferences, analytics, attribution, or promotional features may be limited. You can also use your browser controls to delete or block cookies.
The specific types of cookies and similar technologies we use are described below. The exact cookies may vary depending on your region, choices, browser, and the features you use.
Necessary cookies:
These cookies are required to provide the Services securely.
| Name: | cc_cookie |
|---|---|
| Purpose: | Stores your cookie consent choices, accepted categories, and consent revision so we can respect your preferences. |
| Provider: | criffy.com |
| Service: | Criffy Cookie Consent |
| Type: | HTTP cookie |
| Expiration: | 6 months |
| Name: | csrf_token, session and authentication cookies |
|---|---|
| Purpose: | Helps protect forms, keep you signed in, and maintain account security. |
| Provider: | criffy.com |
| Service: | Criffy |
| Type: | HTTP cookie |
| Expiration: | From the end of the session to 30 days, depending on the cookie |
| Name: | NEXT_LOCALE |
|---|---|
| Purpose: | Saves the language you requested so we can show the site in your chosen language. |
| Provider: | criffy.com |
| Service: | Criffy |
| Type: | HTTP cookie |
| Expiration: | Persistent |
| Name: | __cf_bm, _cfuvid, cf_clearance |
|---|---|
| Purpose: | Cloudflare may set these cookies for bot protection, rate limiting, traffic security, and Turnstile challenge verification. |
| Provider: | Cloudflare / criffy.com |
| Service: | Cloudflare and Turnstile |
| Type: | HTTP cookie |
| Expiration: | From the end of the session to 30 days, depending on the cookie |
Functional cookies:
These cookies save requested interface preferences. They are not used for advertising.
| Name: | showFilters |
|---|---|
| Purpose: | Saves whether the filter panel is shown or hidden in product tables. |
| Provider: | criffy.com |
| Service: | Criffy |
| Type: | HTTP cookie |
| Expiration: | 6 months |
Analytics cookies:
These cookies and event requests help us understand aggregate site usage and improve Criffy.
| Name: | _ga, ga*, _gid, _gat |
|---|---|
| Purpose: | Google Analytics and Google Tag Manager cookies used to measure visits, sessions, and site usage when analytics is allowed. |
| Provider: | criffy.com |
| Service: | Google Analytics / Google Tag Manager |
| Type: | HTTP cookie |
| Expiration: | From the end of the session to 1 year, 1 month, and 4 days, depending on the cookie |
| Name: | Umami events |
|---|---|
| Purpose: | Privacy-friendly analytics events used to understand aggregate site usage when analytics is allowed. |
| Provider: | criffy.com |
| Service: | Umami |
| Type: | script / event request |
| Expiration: | Session |
Marketing and attribution cookies:
These cookies help us remember affiliate, referral, promotion, and advertising attribution when marketing consent is allowed.
| Name: | aff, rcid, promo |
|---|---|
| Purpose: | Stores affiliate, referral, or promotion identifiers from links you clicked so we can attribute partner offers and promotions. |
| Provider: | criffy.com |
| Service: | Criffy affiliate and referral attribution |
| Type: | HTTP cookie |
| Expiration: | 7 to 30 days, depending on the cookie |
| Name: | gcl* |
|---|---|
| Purpose: | Google advertising and conversion attribution cookies used only when marketing consent is allowed. |
| Provider: | criffy.com / Google |
| Service: | Google Ads |
| Type: | HTTP cookie |
| Expiration: | Up to 90 days |
6.4 How can I control cookies on my browser?
Browser controls vary, so you should visit your browser's help menu for current instructions. Most browsers let you remove existing cookies, block cookies by default, or block cookies from specific websites. If you block all cookies, some parts of the Services may not work correctly.
For analytics and advertising choices, you can also use Cookie preferences. Google also provides browser and account-level privacy controls, including the Google Analytics opt-out browser add-on at https://tools.google.com/dlpage/gaoptout and ad settings at https://adssettings.google.com.
6.5 What about other tracking technologies, like web beacons?
Cookies are not the only way to collect usage or attribution information. Analytics and advertising providers may use pixels, tags, scripts, or event requests when the relevant category is allowed. These technologies help measure page views, interactions, conversions, and aggregate site performance. Declining optional cookies may limit these technologies.
6.6 Do we use targeted advertising?
We do not display third-party advertising banners as a core part of the Services. We may use Google Ads or similar attribution technologies to measure campaigns, referral links, affiliate links, and conversions when marketing consent is allowed. You can disable marketing cookies from Cookie preferences at any time.
6.7 How often will you update this Cookie Policy?
We may update this Cookie Policy from time to time in order to reflect, for example, changes to the cookies we use or for other operational, legal, or regulatory reasons. Please therefore revisit this Cookie Policy regularly to stay informed about our use of cookies and related technologies.
The date at the top of this Privacy and Cookie Policy indicates when it was last updated.
6.8 Google Analytics
We may use Google Analytics and Google Tag Manager to track and analyze aggregate use of the Services when analytics is allowed. We configure Google consent signals so analytics and advertising storage start denied and are updated only according to your choices and region. To opt out of being tracked by Google Analytics across websites, visit https://tools.google.com/dlpage/gaoptout. For more information on Google's privacy practices, please visit the Google Privacy & Terms page.
7. How do we handle your social logins?
In Short: If you choose to register or log in to our Services using a social media account, we may have access to certain information about you.
Where offered, you can register or sign in through a supported provider such as Google or Facebook. The provider authenticates you on its own sign-in page and shares the basic information requested in that flow, such as your email address and name and, where supplied, a locale preference. We use that information to authenticate you and create or link your Criffy account. These sign-in integrations do not request your address book, friends list, or device contacts. We do not receive the password you enter on the provider's sign-in page.
We will use the information we receive only for the purposes that are described in this privacy notice or that are otherwise made clear to you on the relevant Services. Please note that we do not control, and are not responsible for, other uses of your personal information by your third-party social media provider. We recommend that you review their privacy notice to understand how they collect, use, and share your personal information, and how you can set your privacy preferences on their sites and apps.
8. How long do we keep your information?
In Short: We keep your information for as long as necessary to fulfill the purposes outlined in this privacy notice unless otherwise required by law.
We keep personal information for as long as necessary for the purposes set out in this notice, taking into account the type of information, your use of the Services, security and support needs, applicable legal requirements, and the establishment, exercise, or defense of legal claims. Account and Portfolio records support the ongoing Services. Some billing, refund, dispute, security, and compliance records may need to be retained after a subscription or account ends, including for tax, accounting, fraud-prevention, or legal obligations.
Deleting a portfolio in the interface removes it from your normal account views and makes its shared link unavailable. It does not immediately erase the underlying database records or backups. To request erasure of retained Portfolio data or your account information, contact [email protected]. We assess and act on those requests under applicable law, including any required or permitted retention. Ending a subscription, deleting a portfolio, and requesting erasure of personal information are separate actions.
When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymize such information, or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible.
9. How do we keep your information safe?
In Short: We aim to protect your personal information through a system of organizational and technical security measures.
We have implemented appropriate and reasonable technical and organizational security measures designed to protect the security of any personal information we process. However, despite our safeguards and efforts to secure your information, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorized third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information. Although we will do our best to protect your personal information, transmission of personal information to and from our Services is at your own risk. You should only access the Services within a secure environment.
10. Do we collect information from minors?
In Short: We do not knowingly collect data from or market to children under 18 years of age.
The Services are intended only for people aged 18 or older. A parent's or guardian's permission does not make a person under 18 eligible to use them. We do not knowingly collect or solicit personal information from, market to, or sell personal information about children under 18. If we learn that a person under 18 has provided personal information, we will deactivate the account and take appropriate steps to delete the information, subject to applicable legal obligations. If you become aware of such information, please contact [email protected].
11. What are your privacy rights?
In Short: Depending on your state of residence in the US or in some regions, such as the European Economic Area (EEA), United Kingdom (UK), Switzerland, and Canada, you have rights that allow you greater access to and control over your personal information. You may review, change, or terminate your account at any time, depending on your country, province, or state of residence.
In some regions (like the EEA, UK, Switzerland, and Canada), you have certain rights under applicable data protection laws. These may include the right (i) to request access and obtain a copy of your personal information, (ii) to request rectification or erasure; (iii) to restrict the processing of your personal information; (iv) if applicable, to data portability; and (v) not to be subject to automated decision-making. In certain circumstances, you may also have the right to object to the processing of your personal information. You can make such a request by contacting us by using the contact details provided in the section "HOW CAN YOU CONTACT US ABOUT THIS NOTICE?" below.
We will consider and act upon any request in accordance with applicable data protection laws.
If you are located in the EEA or UK and you believe we are unlawfully processing your personal information, you also have the right to complain to your Member State data protection authority or UK data protection authority.
If you are located in Switzerland, you may contact the Federal Data Protection and Information Commissioner.
Withdrawing your consent: If we are relying on your consent to process your personal information, which may be express and/or implied consent depending on the applicable law, you have the right to withdraw your consent at any time. You can withdraw your consent at any time by contacting us by using the contact details provided in the section "HOW CAN YOU CONTACT US ABOUT THIS NOTICE?" below.
However, please note that this will not affect the lawfulness of the processing before its withdrawal nor, when applicable law allows, will it affect the processing of your personal information conducted in reliance on lawful processing grounds other than consent.
Opting out of marketing and promotional communications: You can unsubscribe from our marketing and promotional communications at any time by clicking on the unsubscribe link in the emails that we send, or by contacting us using the details provided in the section "HOW CAN YOU CONTACT US ABOUT THIS NOTICE?" below. You will then be removed from the marketing lists. However, we may still communicate with you — for example, to send you service-related messages that are necessary for the administration and use of your account, to respond to service requests, or for other non-marketing purposes.
11.1 Account Information
If you would at any time like to review or change the information in your account or terminate your account, you can:
- Log in to your account settings and update your user account.
- Edit your Portfolio records or revoke sharing through the Portfolio controls.
- Contact [email protected] to request account closure, access to your data, correction, or erasure of retained information.
We may need to verify your identity before acting on a request. We will explain any information that we must or may retain under applicable law, as described in the retention section. A request made to Criffy does not automatically delete information Whop holds for its own purposes; you can also exercise relevant rights with Whop under its privacy notice.
Cookies and similar technologies: Most Web browsers are set to accept cookies by default. You can usually set your browser to remove or reject cookies. You can also review or change Criffy cookie choices from Cookie preferences. If you remove, reject, or disable optional cookies, this could affect certain preferences, analytics, attribution, or promotional features of the Services.
If you have questions or comments about your privacy rights, you may email us at [email protected].
12. Controls for do-not-track features
Most web browsers and some mobile operating systems and mobile applications include a Do-Not-Track ("DNT") feature or setting you can activate to signal your privacy preference not to have data about your online browsing activities monitored and collected. At this stage, no uniform technology standard for recognizing and implementing DNT signals has been finalized. As such, we do not currently respond to DNT browser signals or any other mechanism that automatically communicates your choice not to be tracked online. If a standard for online tracking is adopted that we must follow in the future, we will inform you about that practice in a revised version of this privacy notice.
California law requires us to let you know how we respond to web browser DNT signals. Because there currently is not an industry or legal standard for recognizing or honoring DNT signals, we do not respond to them at this time.
13. Do United States residents have specific privacy rights?
In Short: If you are a resident of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Montana, New Hampshire, New Jersey, Oregon, Tennessee, Texas, Utah, or Virginia, you may have the right to request access to and receive details about the personal information we maintain about you and how we have processed it, correct inaccuracies, get a copy of, or delete your personal information. You may also have the right to withdraw your consent to our processing of your personal information. These rights may be limited in some circumstances by applicable law. More information is provided below.
13.1 Categories of personal information we collect
The categories of personal information we collect depend on how you use the Services, whether you have an account, and which cookie choices apply to you. In the past twelve (12) months, we may have collected:
- Identifiers, such as email address, username, account identifiers, session identifiers, affiliate or referral identifiers, and authentication information.
- Internet or other electronic network activity information, such as IP address, browser and device information, pages viewed, product interactions, searches, referring URLs, and analytics events when analytics is allowed.
- Commercial and financial records, such as subscription plan, billing and payment status, refunds and disputes, promo code use, and Portfolio assets, balances, transactions, wallet addresses, Earn and Loan positions, and derived estimates. Payment card details are handled by Whop and its payment providers.
- Geolocation information, limited to approximate country or region inferred from IP address, security providers, hosting headers, or browser/request information.
- Preferences and settings, such as requested language, filter visibility, cookie preferences, notification settings, and Portfolio sharing choices.
- User-provided content and support information, such as messages you send us, contact form content, and support requests.
Account authentication information and financial records may be considered sensitive personal information under some laws. We use such information for the requested Services and the security, support, and legal purposes described in this notice, subject to applicable restrictions and rights. We do not ask for special-category information or financial account credentials that authorize transactions through Portfolio.
13.2 Sources of personal information
Learn more about the sources of personal information we collect in "WHAT INFORMATION DO WE COLLECT?"
13.3 How we use and share personal information
Learn about how we use your personal information in the section, "HOW DO WE PROCESS YOUR INFORMATION?"
We may disclose personal information to service providers that help us provide the Services, including hosting, security, bot protection, analytics, email, authentication, customer support, payment, subscription, and infrastructure providers. We may also disclose information if required for legal compliance, fraud prevention, business transfers, or to protect rights and security.
We do not sell personal information for money. We may use optional advertising or attribution technologies only when marketing consent is allowed. If those technologies are considered "sharing," "sale," or targeted advertising under applicable US state privacy laws, you can opt out through Cookie preferences or by contacting us.
13.4 Your rights
You have rights under certain US state data protection laws. However, these rights are not absolute, and in certain cases, we may decline your request as permitted by law. These rights include:
- Right to know whether or not we are processing your personal data
- Right to access your personal data
- Right to correct inaccuracies in your personal data
- Right to request the deletion of your personal data
- Right to obtain a copy of the personal data you previously shared with us
- Right to non-discrimination for exercising your rights
- Right to opt out of the processing of your personal data if it is used for targeted advertising (or sharing as defined under California’s privacy law), the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects ("profiling")
Depending upon the state where you live, you may also have the following rights:
- Right to obtain a list of the categories of third parties to which we have disclosed personal data (as permitted by applicable law, including California's and Delaware's privacy law)
- Right to obtain a list of specific third parties to which we have disclosed personal data (as permitted by applicable law, including Oregon’s privacy law)
- Right to limit use and disclosure of sensitive personal data (as permitted by applicable law, including California’s privacy law)
- Right to opt out of the collection of sensitive data and personal data collected through the operation of a voice or facial recognition feature (as permitted by applicable law, including Florida’s privacy law)
13.5 How to exercise your rights
To exercise these rights, email [email protected], visit https://criffy.com/contact, or use the contact details at the bottom of this document. Describe the right you wish to exercise and the account concerned; do not send passwords, private keys, or payment card details.
Under certain US state data protection laws, you can designate an authorized agent to make a request on your behalf. We may deny a request from an authorized agent that does not submit proof that they have been validly authorized to act on your behalf in accordance with applicable laws.
13.6 Request verification
Upon receiving your request, we will need to verify your identity to determine you are the same person about whom we have the information in our system. We will only use personal information provided in your request to verify your identity or authority to make the request. However, if we cannot verify your identity from the information already maintained by us, we may request that you provide additional information for the purposes of verifying your identity and for security or fraud-prevention purposes.
If you submit the request through an authorized agent, we may need to collect additional information to verify your identity before processing your request and the agent will need to provide a written and signed permission from you to submit such request on your behalf.
13.7 Appeals
Under certain US state data protection laws, if we decline to take action regarding your request, you may appeal our decision by emailing us at [email protected]. We will inform you in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decisions. If your appeal is denied, you may submit a complaint to your state attorney general.
13.8 California "Shine The Light" Law
California Civil Code Section 1798.83, also known as the "Shine The Light" law, permits our users who are California residents to request and obtain from us, once a year and free of charge, information about categories of personal information (if any) we disclosed to third parties for direct marketing purposes and the names and addresses of all third parties with which we shared personal information in the immediately preceding calendar year. If you are a California resident and would like to make such a request, please submit your request in writing to us by using the contact details provided in the section "HOW CAN YOU CONTACT US ABOUT THIS NOTICE?"
14. Do other regions have specific privacy rights?
In Short: You may have additional rights based on the country you reside in.
14.1 Australia and New Zealand
We collect and process your personal information under the obligations and conditions set by Australia's Privacy Act 1988 and New Zealand's Privacy Act 2020 (Privacy Act).
This privacy notice satisfies the notice requirements defined in both Privacy Acts, in particular: what personal information we collect from you, from which sources, for which purposes, and other recipients of your personal information.
If you do not wish to provide the personal information necessary to fulfill their applicable purpose, it may affect our ability to provide our services, in particular:
- offer you the products or services that you want
- respond to or help with your requests
- manage your account with us
- confirm your identity and protect your account
At any time, you have the right to request access to or correction of your personal information. You can make such a request by contacting us by using the contact details provided in the section "HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?"
If you believe we are unlawfully processing your personal information, you have the right to submit a complaint about a breach of the Australian Privacy Principles to the Office of the Australian Information Commissioner and a breach of New Zealand's Privacy Principles to the Office of New Zealand Privacy Commissioner.
14.2 Republic of South Africa
At any time, you have the right to request access to or correction of your personal information. You can make such a request by contacting us by using the contact details provided in the section "HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?"
If you are unsatisfied with the manner in which we address any complaint with regard to our processing of personal information, you can contact the office of the regulator, the details of which are:
The Information Regulator (South Africa) General enquiries: [email protected] Complaints (complete POPIA/PAIA form 5): [email protected] & [email protected]
15. Do we make updates to this notice?
In Short: Yes, we will update this notice as necessary to stay compliant with relevant laws.
We may update this privacy notice from time to time. The updated version will be indicated by an updated "Revised" date at the top of this privacy notice. If we make material changes to this privacy notice, we may notify you either by prominently posting a notice of such changes or by directly sending you a notification. We encourage you to review this privacy notice frequently to be informed of how we are protecting your information.
16. How can you contact us about this notice?
If you have questions or comments about this notice, you may email us at [email protected] or contact us by post at:
Individual Entrepreneur ANDREI MALYSHOK 49 Besarion Zhghenti Street, Tbilisi 0183, Georgia
17. How can you review, update, or delete the data we collect from you?
Based on the applicable laws of your country or state of residence in the US, you may have the right to request access to the personal information we collect from you, details about how we have processed it, correct inaccuracies, or delete your personal information. You may also have the right to withdraw your consent to our processing of your personal information. These rights may be limited in some circumstances by applicable law. Send your request to [email protected] with enough information to identify your account and the request. We may verify your identity or authority and will respond in accordance with applicable law.