ChainAnalyzer Privacy Policy

Last updated: April 23, 2026

refinancier, inc. ("Company") recognizes the protection of users' personal information as a social responsibility when providing its blockchain and anti-money-laundering (AML) analysis service, ChainAnalyzer ("Service"). We comply with the Act on the Protection of Personal Information of Japan ("APPI") and other applicable laws. This Privacy Policy ("Policy") describes the information we collect, our purposes, third-party disclosures, retention periods, and user rights.

Article 1 (Operator and Data Protection Lead)

• Operator: refinancier, inc.
• Service: ChainAnalyzer (https://chain-analyzer.com)
• Data Protection Lead: Representative Director
• Contact: Contact form

Article 2 (Information We Collect)

We collect the following information to the extent necessary for the Service.

(1) Account information

• Email address (upon registration)
• Display name and profile information (optional)
• OAuth provider identifier (if signing in via Google, Apple, etc.)
• Solana wallet address (when Phantom is connected; used only for authentication and portfolio scan within the Service)

(2) Payment information

• Subscription plan, payment history, invoice information (processing via Stripe)
• We do not store credit card numbers or CVV directly; Stripe processes them in PCI-DSS-compliant infrastructure.

(3) Service usage data

• Blockchain addresses, transaction hashes, and token contract addresses submitted for scanning
• Scan results (risk scores, detection alerts, analysis reports)
• Watchlists, batch scan jobs, case management data (Pro / Enterprise)
• API usage records (timestamps, endpoints, response statuses, rate-limit counters)

(4) Access logs and technical information

• IP address, User-Agent, access timestamps, referrer URL
• Cookies (see Article 8)
• Browser settings, screen resolution, language preferences

(5) Support information

• Name, email address, and content provided via the contact form

Article 3 (Treatment of Blockchain Addresses)

Article 4 (Purposes of Use)

We use collected information for the following purposes:

1. Providing, operating, and improving the Service
2. Authentication and account management
3. Risk analysis and report generation for blockchain addresses and transactions
4. Billing and payment processing
5. Inquiries, technical support, and notifications
6. Accuracy improvement of machine learning models and R&D of new features (in principle, in anonymized and aggregated form)
7. Detection and prevention of abuse and maintenance of Service security
8. Responding to laws, governmental requests, and court orders
9. Other purposes for which the User has provided specific consent

Article 5 (Third-Party Disclosures and External Services)

We do not disclose personal information to third parties except where required by law or with User consent. However, we entrust or transmit certain data to the following external services to operate the Service.

(1) Infrastructure and operational services

(2) External blockchain / OSINT APIs

For public blockchain data and fraud detection, the Service queries the following external APIs. Only on-chain information such as blockchain addresses and transaction hashes is transmitted to these; User personal information (such as email) is not transmitted.

• Etherscan / PolygonScan (Etherscan V2 API) — EVM chain transaction history
• Routescan — Avalanche C-Chain transaction history
• Blockstream Esplora — Bitcoin transaction history
• Helius DAS — Solana token metadata
• Birdeye — Solana token prices and liquidity
• GoPlus Security — Token security assessment
• RugCheck — Solana token risk assessment
• KYT (AnChain.AI, etc.) — Clustering and risk scores
• CoinGecko — Cryptoasset prices
• Reddit JSON API — OSINT web mention detection

(3) ScamDB API publication

We publish a portion of our known-fraud address registry (ScamDB) as a public API (/scamdb). Only blockchain addresses and the classification labels / evidence we have added are published; reporter personal information is not included.

Article 6 (International Data Transfers)

Service data is primarily processed and stored in Japan (Azure Japan East region). However, certain external services listed in Article 5 (Stripe, Google Analytics, Coinbase x402 Facilitator, and some OSINT APIs) process data in the United States or elsewhere.

For cross-border transfers of personal information, we implement one or more of the following measures pursuant to APPI Article 28:

• Ongoing review of the data protection level of the destination country / provider
• Standard contractual clauses (SCC) or other contractual safeguards
• Confirmation of participation in international certification frameworks (APEC CBPR, etc.)

Article 7 (Retention)

1. Account information: retained while the account is active.
2. Scan history, batch jobs, and watchlist discoveries: the following retention periods apply per plan, and data older than the period is automatically deleted by a daily batch job.
   • Free: 7 days
   • Starter: 30 days
   • Pro: 180 days
   • Enterprise: unlimited (subject to any individual contract provisions)
3. Payment information and billing records: retained for 7 years under the Corporate Tax Act and Electronic Book Preservation Act.
4. Support records: retained for 3 years after resolution.
5. Access logs: retained for up to 1 year for abuse investigation and security maintenance.
6. Upon request for account deletion, we will delete account information and scan history within 30 days, except where retention is required by law (billing information, tax records, etc.).
7. Anonymized and aggregated data (statistics, model training data) may be retained and used beyond the retention periods above.

Article 8 (Cookies and Similar Technologies)

1. The Service uses cookies to maintain authentication sessions, save preferences, and improve the Service.
2. Main cookie categories:
   • Essential cookies: Supabase authentication session cookie
   • Functional cookies: language and theme preferences (stored in browser localStorage)
   • Analytics cookies: Google Analytics usage measurement (_ga, etc.)
3. Users can disable cookies via their browser settings, but disabling the authentication session cookie will prevent staying signed in.
4. Users can opt out of Google Analytics via the Google Analytics Opt-out Browser Add-on.

Article 9 (Machine Learning and AI Use)

1. For quality improvement, we use collected data in principle in anonymized and aggregated form for training and evaluation of machine learning models (Isolation Forest, AutoEncoder, GraphSAGE, etc.).
2. When generating AI analysis summaries via generative AI (Azure OpenAI Service's GPT-5.4, o3, etc.), blockchain addresses, scan results, and analysis prompts are transmitted to Azure OpenAI. Under Microsoft's enterprise agreement, our transmitted data is not used to train OpenAI's models (Azure OpenAI Data Privacy policy).
3. Users may disable AI analysis features (available on Pro plans and above, via settings).

Article 10 (User Rights)

Under APPI, Users may exercise the following rights regarding their personal information:

1. Disclosure: request disclosure of personal information held by the Company.
2. Correction, addition, or deletion: request correction, addition, or deletion if the content is inaccurate.
3. Suspension of use or deletion: request suspension or deletion where information is processed beyond the scope necessary for the purposes of use.
4. Suspension of third-party disclosures: request suspension of third-party disclosures.
5. Complaints: file complaints regarding the handling of personal information.
6. To exercise these rights, please contact us via the contact form. We will verify that the requester is the User and respond within a reasonable period.

Article 11 (Security Measures)

We implement the following measures to prevent leakage, loss, alteration, and unauthorized access to personal information:

• Organizational: designation of Data Protection Lead, internal policies, regular audits
• Human: employee training and confidentiality obligations
• Physical: Azure Japan East data center physical security (24/7 monitoring, biometric access, redundancy)
• Technical: TLS encryption in transit, encryption at rest (Azure Storage Service Encryption, etc.), Row-Level Security (RLS) access control, API key authentication, rate limiting, Web Application Firewall

Article 12 (Minors)

1. The Service is not intended for users under 18 years of age. Due to the financial / compliance nature of the Service, minors should not use the Service.
2. Users aged 18 or over but under 20 should use the Service with the consent of a legal guardian.
3. If we become aware that we have inadvertently collected personal information from a person under 18, we will promptly delete it.

Article 13 (Additional Provisions for EU/EEA and UK Users)

Users residing in the EU/EEA or the United Kingdom are additionally guaranteed the following rights under the GDPR and UK GDPR:

• Right to data portability
• Right to restriction of processing
• Right not to be subject to automated decision-making (including profiling)
• Right to lodge a complaint with a supervisory authority

Legal bases: performance of a contract necessary to provide the Service (GDPR Art. 6(1)(b)), legitimate interests (Art. 6(1)(f) — fraud prevention, security), and consent (Art. 6(1)(a) — marketing, etc.).

Article 14 (Enterprise DPA)

Enterprise plan customers wishing to execute a Data Processing Agreement (DPA) should contact us via the contact form. We will provide a DPA template aligned with GDPR Art. 28 and APPI entrustment requirements on a per-case basis.

Article 15 (Incident Response)

In the unlikely event of leakage, loss, or corruption of personal information, we will promptly respond in compliance with the reporting obligation to the Personal Information Protection Commission (APPI Art. 26) and the notification obligation to affected Users. Affected Users will be notified by email or via in-Service announcement.

Article 16 (Amendments to this Policy)

1. We may amend this Policy due to changes in law, additions to Service features, or other reasonable causes.
2. For material changes (expanded purposes of use, expanded third-party disclosures, etc.), we will provide prior notice by email or in-Service announcement.
3. The amended Policy takes effect upon publication on the Service.

Article 17 (Contact)

Please direct questions, disclosure requests, and complaints regarding this Policy to:

refinancier, inc.
ChainAnalyzer Personal Information Desk
Website: https://chain-analyzer.com
Contact form: https://chain-analyzer.com/contact_us

---

Supplementary Provisions

• This Policy takes effect on April 23, 2026.
• In the event of any discrepancy between the Japanese version of this Policy and any other language version, the Japanese version prevails.