1. Who is responsible
WIFIMONEY KVALE (organisation number 937 755 570) is the controller responsible for personal data processed through RUGSTATION and its Telegram bot, @rugstation_bot. This policy covers the entire web application: token scans, scan history, watchlists, live monitoring, network telemetry, wallet connections, sign-in, usage limits, subscriptions, support, bot commands, account linking and followed-coin alerts.
Contact: wekvatrading@gmail.com.
2. Data we process
- Scans and monitoring: we process token addresses or links you submit, the selected network, public token and transaction data, and risk findings. Recent scan results and the device watchlist are stored in your browser. Coins you explicitly follow are stored on the service to support alerts while the dashboard is closed.
- Telegram interactions: Telegram sends us your chat identifier, message or command text, button selections and associated update information. Updates may include a Telegram user identifier, display name or username. We use the chat identifier to reply and deliver alerts. Normal bot use does not require your phone number or contacts.
- Account linking: we store the connection between your Telegram chat and your signed-in account identifier. This may be a public Phantom wallet address or an identifier for your Google-linked account. Temporary linking codes have a 15-minute validity period.
- Followed coins: we store token addresses, optional symbols, the selected network, follow expiry information and a transaction cursor used to identify new events.
- Wallet and sign-in data: public wallet addresses and public balances are used for wallet lookups. Wallet message signatures are processed to verify sign-in. Google sign-in is handled through our authentication providers and may include your email address, profile information and account identifier.
- Usage and payments: we store check timestamps and account or pseudonymous usage identifiers to apply free limits. Subscription records include customer and subscription identifiers, plan, status and billing period. Stripe processes payment details; our application does not store full card numbers.
- Technical data: hosting and service logs may include request information, IP addresses, errors, Telegram chat identifiers and command names. For anonymous check limits, the application derives a keyed, pseudonymous identifier from the IP address; this is not necessarily anonymous data.
- Support: if you email us, we process your contact details and the information you provide to respond. Please avoid sending unnecessary sensitive information.
Never send a seed phrase, private key, password or card details to the bot. RUGSTATION is read-only and does not hold or move your funds. Public blockchain information can still be personal data when linked to you.
3. Why we use data and our legal bases
We process data needed to provide the service you request, including token checks, displaying blockchain information, keeping your watchlist, verifying sign-in, responding to support requests, replying to commands, linking accounts, monitoring followed coins, delivering alerts and managing subscriptions (performance of a contract, GDPR Article 6(1)(b)). You choose whether to connect a wallet, sign in, link Telegram and follow coins, and can stop alerts at any time.
We rely on legitimate interests to secure the service, prevent misuse, enforce usage limits and diagnose failures (Article 6(1)(f)), subject to your rights and interests. Where applicable, billing records may be retained to meet legal obligations (Article 6(1)(c)). If an optional activity requires consent, we will request it separately and allow withdrawal.
The bot is not used to send marketing messages or make decisions with legal or similarly significant effects about you. Token risk ratings are informational and are not guarantees of safety or financial advice.
4. Providers and disclosures
Data is shared as necessary with Telegram to receive updates and send messages; Lovable Cloud and its infrastructure providers for hosting, storage and authentication; Google when you choose Google sign-in; and Stripe for payments. Solana RPC and market-data providers, including DexScreener, receive public wallet or token addresses needed for lookups. Opening external charts or explorer links also exposes your request information to those sites.
Telegram, Google and payment providers may also act as independent controllers under their own policies. We do not sell personal data. We may disclose information when required by law or when necessary to protect the service and users.
Providers may process data outside Norway and the European Economic Area. Where GDPR requires safeguards for a transfer we make, these must include an applicable adequacy decision or appropriate contractual safeguards, such as Standard Contractual Clauses. Contact us for information about the providers and safeguards relevant to your data.
5. Storage and retention
Telegram account links remain until disconnected. Follow records remain until removed or deleted; the end of a free follow’s 15-minute alert window does not itself guarantee deletion of the record. Linking codes expire after 15 minutes, but expiry is not a promise that every unused code is immediately erased.
The dashboard uses browser storage for recent scan history, wallet preferences and sign-in state. Authentication and payment providers may use cookies or similar storage needed for their services. This policy does not grant consent to optional advertising or tracking; any optional activity requiring consent must be explained and requested separately.
You can disconnect your wallet, sign out, remove saved coins or clear site data in your browser. Clearing site data removes local copies and may sign you out, but does not delete service-side follows, account or billing records. Signing out does not delete your account.
Usage, account and operational records are retained as needed for service operation, security, dispute handling and applicable legal obligations. Automatic deletion periods for all records are not currently defined. Contact us to request deletion or ask about a particular record. Records that must be kept for legal obligations may be retained after a deletion request; provider backups may also persist according to provider retention practices.
6. Stop alerts and request deletion
Send /stop to @rugstation_bot, or use the menu’s Stop alerts option and confirm, to remove the Telegram account link. Your followed coins stay saved, and this action does not cancel a subscription or delete all personal data. You can remove followed coins in the dashboard and manage your subscription separately.
To request access, correction or deletion, email wekvatrading@gmail.com with the subject “RUGSTATION privacy request” and enough information to identify your account. We may ask you to verify control of the account; never send a private key or seed phrase. We normally respond within one month, subject to extensions permitted by law.
7. Your rights
Where applicable under GDPR, you may request access, rectification, erasure, restriction and portability, and object to processing based on legitimate interests. If processing relies on consent, you may withdraw it without affecting earlier lawful processing. Rights may be limited by legal obligations and the rights of others.
You may complain to Norway’s Datatilsynet or your local data protection authority. Public blockchain records cannot be erased or altered by RUGSTATION, even if we delete our account linkage.
8. Security and changes
We use access controls and authenticated account-linking mechanisms to restrict access to service records. No system is completely secure. Bot messages are processed by Telegram and should not be treated as a confidential channel for sensitive information.
We may update this policy as the service changes. The effective date above identifies the current version. Material changes will be communicated through the dashboard or bot where appropriate.