This Privacy Policy explains how YouFi Ltd ("YouFi", "we", "us") collects, uses, and protects your personal data when you interact with our website at youfi.io and the YouFi closed alpha service. It applies to personal data processed under the UK General Data Protection Regulation (UK GDPR, retained in the Data Protection Act 2018) and, where you are in the EU/EEA, the EU General Data Protection Regulation (Regulation (EU) 2016/679).
The data controller for personal data collected via youfi.io is:
We are not required to appoint a Data Protection Officer at this stage of operations under Article 37 UK GDPR / EU GDPR.
cf-ipcountry header) — used for aggregate geographic insight, never linked to your identityAuthentication is handled by Clerk, Inc. (see Section 4). We receive your email address and a user identifier from Clerk. We do not receive or store your password.
If you accept analytics cookies, we receive event data via PostHog (US region) including page views, button clicks, session duration, and session replay recordings of your interactions with the page (cursor movements, clicks, scroll behaviour, page state) so we can diagnose usability issues and bugs. PostHog masks all text inputs by default. We do not record passwords or form values. If you decline analytics, no analytics data — including session replay — is collected.
We do not collect financial information, wallet addresses, private keys, transaction data, payment information, or any data about your trading activity from the public landing page.
| Purpose | Data used | Legal basis (Art. 6 GDPR) |
|---|---|---|
| Contact you about YouFi alpha access | Email address, source tag, submission date | Consent (Art. 6(1)(a)) — given via the checkbox on the waitlist form |
| Authenticate alpha testers | Email + user identifier (via Clerk) | Performance of contract (Art. 6(1)(b)) — to provide access to the service you signed up for |
| Aggregate website analytics (only if you consent) | Pseudonymous event data, page views, browser info | Consent (Art. 6(1)(a) UK GDPR / EU GDPR) — given via the cookie banner; for cookies specifically, Reg. 6 of the Privacy and Electronic Communications Regulations 2003 (PECR) also requires consent |
| Security and abuse prevention | IP-derived country, user agent | Legitimate interests (Art. 6(1)(f)) — to detect and prevent abuse of the waitlist form |
How to withdraw consent:
Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal. We have assessed our legitimate interest in basic abuse-prevention logging (IP-country, user agent) and concluded that the interest does not override your fundamental rights — this assessment is available on request.
We use the following processors to operate the YouFi alpha. Each is bound by a written data processing agreement.
| Processor | Purpose | Region |
|---|---|---|
| Cloudflare, Inc. | Hosting, CDN, DDoS protection | Global (US/EU edge) |
| Clerk, Inc. | Authentication | United States |
| Resend, Inc. | Transactional email delivery | United States |
| Notion Labs, Inc. | Internal waitlist record-keeping | United States |
| PostHog Inc. | Aggregate analytics (only with your consent) | United States |
We do not sell, rent, or trade your personal data to third parties for marketing purposes.
Cloudflare, Clerk, Resend, Notion, and PostHog process some personal data outside the United Kingdom and the European Economic Area (typically in the United States). These transfers rely on the following safeguards, depending on the jurisdiction of the data subject:
You can request copies of the safeguards in place for any specific transfer by contacting us at [email protected].
Analytics data via PostHog is transferred to the United States and protected by the UK–US Data Bridge / EU–US Data Privacy Framework where the recipient is certified, supplemented by the UK IDTA or EU SCCs as applicable. Analytics is only enabled if you consent via the cookie banner.
| Data | Retention period |
|---|---|
| Waitlist email | 24 months from submission, or until you unsubscribe — whichever is earlier |
| Alpha account data (via Clerk) | For the duration of your account, plus 30 days after deletion request |
| Analytics events (if consented) | 13 months (PostHog default) |
| Security logs | 90 days |
You have the following rights regarding your personal data:
To exercise any of these rights, email [email protected]. We will respond within one month (Art. 12(3) GDPR).
You have the right to lodge a complaint with a supervisory authority. Because YouFi Ltd is established in the United Kingdom, the lead supervisory authority for our processing is:
EU/EEA residents: you may also lodge a complaint with the supervisory authority of your country of residence. A list is maintained at edpb.europa.eu.
We do not carry out automated decision-making or profiling that produces legal effects or similarly significant effects concerning you within the meaning of Article 22 GDPR.
Authentication session cookies set by Clerk when you sign in. These are essential for the service to function and are exempt from consent under Reg. 6(4) of the Privacy and Electronic Communications Regulations 2003 (PECR, UK) and Article 5(3) of the ePrivacy Directive 2002/58/EC (EU).
PostHog cookies are only set if you click "Accept" in the cookie banner. With your consent, this includes session replay recordings of your interactions with the page so we can diagnose usability issues and bugs (text inputs are masked by default — see Section 2.3 for details). You can change your choice at any time by clicking Manage cookies in the website footer, which re-opens the banner; declining stops further analytics collection and opts you out of session replay. We may also receive your IP address briefly during analytics initialisation. PostHog is hosted in the United States — see Sections 4 and 5 for details of the safeguards that apply to that transfer.
We do not use advertising cookies, cross-site tracking, third-party advertising pixels, social-media tracking pixels, or fingerprinting.
We may update this policy as the YouFi alpha evolves. We will post the new policy here with an updated "Last updated" date and, where required by law, notify you by email.
Questions, data subject requests, or concerns about this policy: