Eligibility Checker Privacy Policy

This Eligibility Checker Privacy Policy explains how Hecto Finance Limited (“Hecto,” “we,” “us” or “our”) handles personal information when you use the Hecto Predictions eligibility checker (the “Checker”).

It applies only to the Checker, including account sign-in, password-reset, wallet authentication, eligibility review, result evidence, access-update registration and supported-wallet invitation. Other Hecto services and third-party wallets have separate privacy policies.

Hecto Finance Limited, a British Virgin Islands company, is responsible for the processing described in this policy, except where a third party independently determines how and why it processes information.

Privacy questions and rights requests may be sent to legal@hecto.inc.

• Account details: the email address and password used to authenticate an existing Hecto account.
• Password reset: the email address submitted to request reset instructions. The response does not disclose whether an account exists.
• Wallet authentication: the wallet provider you select and the authentication proof produced when you approve a challenge.
• Contact and invitation details: an email address, selected replacement-wallet provider and related request details when you request an access update or supported-wallet invitation.
• Communications: information you include when contacting Hecto about the Checker.

• Verified identity: account identifier, normalized email, authentication method and the primary wallet associated with the account.
• Wallet records: Canton party identifiers, wallet type and other wallets already linked to the same verified Hecto account.
• Eligibility evidence: qualifying HECTO holdings from committed Canton ledger evidence and the historical Hecto Score associated with the verified account.
• Decision data: score, threshold, policy version, factor contributions, evidence references, timestamps, result and recovery guidance.
• Technical data: request time, network address, browser or device information, security events and service logs that may be processed by Hecto or its hosting and security providers.

The Checker forwards your password through Hecto’s server-side authentication gateway for verification. The Checker does not persist the password. Wallet signatures are used to prove control of a wallet against an expiring challenge and are not persisted by the Checker after authentication.

The Checker does not request or receive a wallet seed phrase or private key. Never enter either into the Checker. Your wallet provider may independently process login, device and wallet data under its own policy.

• authenticate the Hecto account or primary linked wallet;
• respond to password-reset requests without exposing account existence;
• retrieve and bind holdings and Hecto Score evidence to the intended account;
• calculate, explain and display the current eligibility decision;
• manage replacement-wallet invitations and account-linked access updates you request;
• protect the Checker, prevent fraud, investigate abuse and enforce the Checker Terms;
• maintain, troubleshoot and improve reliability; and
• comply with legal obligations and lawful requests.

Where applicable data-protection law requires a legal basis, Hecto relies on performance of a contract or steps requested before entering one; legitimate interests in providing secure, accurate and abuse-resistant access review; compliance with legal obligations; and consent where consent is specifically requested.

Where processing is based on consent, you may withdraw consent at any time without affecting processing already completed. Certain data is necessary to authenticate the account and produce a Checker result; without it, the Checker cannot operate.

The live Checker uses a strictly necessary, host-only session cookie lasting up to one hour. In production it is encrypted, authenticated, Secure, HTTP-only and SameSite=Lax. Browser scripts cannot read it.

The sealed session contains a session identifier, normalized email, authentication method, verified identity, expiry and—only where needed for member-owned wallet management—a short-lived upstream access token. The Checker does not place passwords, wallet signatures or refresh tokens in browser storage. A wallet provider may set its own necessary state when you invoke that provider.

Information may be shared with Hecto affiliates and vendors that support authentication, Hecto Score records, Canton ledger evidence, wallet connectivity, email delivery, hosting, security, monitoring and legal compliance. Depending on the route you choose, these may include a selected wallet provider and its authentication infrastructure.

We may disclose information to professional advisers, transaction counterparties in a corporate reorganization, or public authorities where required or permitted by law. We do not sell Checker personal information for money. We do not share it for unrelated third-party advertising through the Checker.

Canton party identifiers, balances and transactions may be recorded or processed by Canton participants and infrastructure outside Hecto’s control. Blockchain or distributed-ledger records may be difficult or impossible to alter or delete.

Links to external venues, wallets or Hecto services leave the Checker. Their operators determine their own processing. Review the privacy notice presented by the relevant service before continuing.

We retain Checker information only for as long as reasonably necessary for the purposes described above, including account security, dispute handling and legal compliance. The Checker session expires after one hour. Passwords and wallet signatures are discarded by the Checker after the relevant authentication request. Invitation and access-update records may be retained until the request is fulfilled, withdrawn or no longer operationally required.

Source account, wallet, score and ledger systems may retain their own records under separate schedules. Hecto applies technical and organizational safeguards designed to protect information, but no online system, wallet or transmission can be guaranteed completely secure.

Hecto and its service providers may process information outside your country. Where required, we use recognized transfer safeguards and contractual or technical measures intended to protect personal information across borders.

Depending on your jurisdiction, you may have rights to request access, correction, deletion, restriction, objection, portability, withdrawal of consent or review of certain automated processing, and to complain to a data-protection authority.

Send requests to legal@hecto.inc. We may need to verify your identity and may decline or limit a request where permitted by law, including where data must be retained for security, legal claims or compliance. Rights concerning immutable ledger data may be technically limited.

The Checker is not intended for anyone under 18, and Hecto does not knowingly collect Checker information from children. Contact us if you believe a child has provided information.

We may update this policy to reflect legal, technical or operational changes. The effective date identifies the current version. Material changes will be communicated where required by law.

Questions, accessibility requests and privacy complaints may be sent to legal@hecto.inc. Use of the Checker is also subject to the Checker Terms and Checker Risk Disclosure.