๐Ÿ‹OrcaLayer
Sign In

Privacy Policy

Last updated: October 23, 2026

1. Introduction

OrcaLayer ("we", "our", "us") operates the website orcalayer.com (the "Service"). This Privacy Policy explains how we collect, use, and protect your information when you use our Service.

2. Information We Collect

Account Information: You can sign in with Google, an email link, a crypto wallet (Sign-In with Ethereum) or Whop. With Google we receive your name, email address and profile picture; with an email link, your email address; with a wallet, its public address; with Whop, the account details Whop shares (your Whop user ID and email). We never receive or store your passwords. If you connect Telegram alerts, we store your Telegram user ID to send them.

Wallet Addresses: Wallet addresses you search for are publicly available on the blockchain. We do not link wallet addresses to your identity unless you explicitly save them to your account.

Usage Data & Analytics: We use analytics tools to understand how the Service is used (pages visited, features used). These set cookies and collect anonymised usage data: Google Analytics and Google Ads conversion measurement on all pages, the Whop Pixel on all pages (page views, attribution of purchases made through Whop, and device information), and Yandex Metrica on our Russian-language (/ru) pages. We do not sell this data. You can manage or decline analytics cookies via the banner shown on your first visit or through your browser settings.

We never ask for or store private keys, seed phrases, or wallet passwords.

3. How We Use Your Information

  • To provide and maintain the Service
  • To manage your account and subscription
  • To send alerts and notifications you have opted into
  • To improve the Service based on anonymous usage patterns

4. Data Sharing

We do not sell, trade, or rent your personal information to third parties. We may share data only:

  • With service providers necessary to operate the Service (hosting, authentication)
  • If required by law or to protect our rights

5. Data Security

We use industry-standard security measures including SSL/TLS encryption, secure authentication via OAuth 2.0, and access controls. However, no method of transmission over the Internet is 100% secure.

6. Third-Party Services

We use Google OAuth for authentication. When you sign in with Google, Google's Privacy Policy applies to the information they collect. We only receive the information described in Section 2. We also use third-party analytics (Google Analytics, Google Ads and the Whop Pixel on all pages, Yandex Metrica on Russian-language pages; the Whop Pixel also collects device information) โ€” the full list of sub-processors is in Section 10.

7. Your Rights

You can:

  • Request deletion of your account and associated data
  • Opt out of notifications at any time
  • Access and export your data

To exercise these rights, contact us at support@orcalayer.com.

8. Children's Privacy

Our Service is not directed to anyone under the age of 18. We do not knowingly collect personal information from children.

9. GDPR Compliance (EU Users)

If you are located in the European Economic Area (EEA), you have additional rights under the General Data Protection Regulation (GDPR):

  • Legal basis: We process your data based on legitimate interest (providing the Service) and your consent (account creation)
  • Right of access: You can request a copy of all data we hold about you
  • Right to rectification: You can request correction of inaccurate data
  • Right to erasure: You can request deletion of your account and all associated data
  • Right to data portability: You can request your data in a machine-readable format
  • Right to object: You can object to processing of your data
  • Right to withdraw consent: You can withdraw consent at any time by deleting your account

To exercise any of these rights, contact us at support@orcalayer.com. We will respond within 30 days.

10. Sub-Processors & Data Retention

We use the following third-party services to operate OrcaLayer:

  • Hetzner Online GmbH (Germany) โ€” server hosting and data storage
  • Cloudflare, Inc. (USA) โ€” CDN, DDoS protection, SSL
  • Google (USA) โ€” OAuth sign-in, plus Google Analytics and Google Ads conversion measurement (analytics cookies)
  • Yandex Metrica (Yandex, EU/Russia) โ€” usage analytics on Russian-language (/ru) pages only (analytics cookies)
  • Whop and NOWPayments โ€” subscription billing (cards and crypto); card and wallet credentials go directly to them, never to us
  • Whop (USA) โ€” the Whop Pixel on all pages: page views and attribution of purchases made through Whop (cookies, browser storage and device information)

Data retention: Account data is retained for the duration of your account. Upon deletion, all personal data is removed within 30 days. Anonymous blockchain analytics data (publicly available) is retained indefinitely.

11. API and MCP Access

This section covers requests to the OrcaLayer API and to our MCP server at https://orcalayer.com/mcp, whether you send them yourself or an AI client sends them for you (for example Claude, Cursor or another Model Context Protocol client).

What we receive:

  • The request: the endpoint or tool called and its parameters, for example a wallet address, a market id or a search term
  • Request metadata: time, client IP address, client software (User-Agent), response status and duration
  • If an API key is sent: the key's internal identifier and the plan of the account it belongs to. The key itself is never written to our logs

What we do not receive: your conversation with the AI client, your prompts, the model's answers, your files, or anything else the AI client does not include in the tool call it sends. The AI client processes your conversation under its own privacy policy.

How we use it: to answer the request, to apply rate limits and plan access, to protect the Service against abuse, and to see which endpoints and tools are used in aggregate. We do not sell it and do not use it for advertising.

Retention: the API request log is kept for 45 days and web server access logs for 15 days; both are then deleted. Daily aggregate usage counts, which contain no IP addresses, may be kept longer.

Sharing: requests are processed on our servers at Hetzner (Germany) and pass through Cloudflare (Section 10). They are not shared with any other third party, except as required by law.

The API and the MCP server return analytics derived from public blockchain records. MCP tools are read-only: they cannot place orders, move funds or change your account.

12. Discord Bot

This section covers the OrcaLayer Whale Alerts Discord bot, which server admins can add to their Discord server to post our alerts in a channel.

What we store about a server that adds the bot:

  • The server's Discord ID, its name and member count, and the Discord ID of the server owner (so we can tell the owner if the bot loses access to the alerts channel)
  • The channel chosen with /orcalayer setup and the alert options picked there (volume and market category)
  • When the bot was added, set up, paused or removed, and which alerts it posted (kept 7 days, to apply the daily limit and to retry failed posts)
  • If an admin links the server to an OrcaLayer account with /orcalayer link: which account it is linked to and since when, so the account's plan and alert filters apply to that server. The one-time link code is stored only as a one-way hash and expires after 15 minutes.

What we do not receive: the bot has no access to messages, member lists or presence. It does not read what people write in your server and it does not use any privileged Discord permissions. When someone runs a bot command, Discord sends us that command and the Discord ID of the person who ran it, which we use only to check their permission and to apply rate limits.

How we use it: to post alerts to the chosen channel, to answer bot commands, and to count servers, members and posted alerts in aggregate. We do not sell it and do not use it for advertising. Links in the bot's messages carry a campaign tag made from a one-way hash of the server ID, not the ID itself.

How to delete it: /orcalayer unlink or Unlink in Settings removes the link to your account. To remove everything, remove the bot from your server. The alerts channel and its options are deleted at once; the server's name and owner are cleared, and only the server ID with the dates it added and removed the bot is kept for our statistics. To have that removed too, write to support@orcalayer.com.

Your use of Discord is governed by Discord's own terms and privacy policy.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the "Last updated" date.

14. Contact Us

If you have any questions about this Privacy Policy, please contact us at:

support@orcalayer.com