Contents
1. Introduction 2. Data controller 3. Data we collect 4. Purposes and legal bases 5. Recipients of data 6. Transfers outside the European Union 7. Retention periods 8. Your rights (GDPR) 9. Data security 10. Minors 11. Changes to this policy 12. ContactADVIJU INVESTISSEMENT SAS, as data controller, is committed to protecting the privacy of users of the Fibo mobile application (the "App") and of the fibo-crypto.fr website (the "Site").
This Privacy Policy explains how ADVIJU INVESTISSEMENT collects, processes, stores and protects your personal data, in accordance with:
This policy forms an integral part of the App's Terms of Service. In the event of any discrepancy, the French version prevails.
The controller of your personal data is:
ADVIJU INVESTISSEMENT SAS
Publisher of the Fibo software — non-custodial digital asset wallet
Registered office: 22 rue Durantin, 75018 Paris, France
RCS Paris 919 110 387
Contact for any question about your personal data:
Depending on the features you use, ADVIJU INVESTISSEMENT may process the following categories of data:
Email address (entered directly or obtained from the Google or Apple account you sign in with), technical account identifier, username ("@username"), profile picture if you add one, preferences (language, display currency, notifications).
Where required by a feature you choose to use (buying or selling with euros, return of assets from the former offering), your first name, last name, date of birth, nationality and postal address. Identity documents required to buy and sell with euros are collected and verified directly by the third-party provider Transak, under its own responsibility; ADVIJU INVESTISSEMENT has no access to them. Supporting documents that ADVIJU INVESTISSEMENT may request relate only to the return of assets to former clients (section 24 of the Terms of Service).
When you request a payout in euros (sale or return of assets), the account holder's name, IBAN, BIC and bank name of the account to be credited.
Public addresses of the wallets created in the App (Ethereum-compatible networks, Solana, Bitcoin), balances and positions of these wallets, history of operations carried out through the App (type, assets, amounts, fees, status, blockchain transaction identifiers). Addresses and transactions are public by nature and visible to anyone on the relevant blockchains.
If you use the social features: your list of friends on Fibo, friend requests sent and received, and your sharing settings (sharing your performance or your portfolio breakdown with your friends, off by default).
IP address, device type and model, operating system, App version, notification token, language and region, interactions with the App (screens viewed, features used), error and crash logs, and recordings of App usage sessions (see 5.1, LogRocket). These recordings exclude authentication tokens and sign-in exchanges.
Audience measurement data and cookies placed on the Site, as described in the Cookie Policy and according to the choices you make in the consent banner.
Because the App is non-custodial, ADVIJU INVESTISSEMENT does not collect and never has access to:
ADVIJU INVESTISSEMENT cannot sign, block or cancel a transaction from your wallet.
Personal data is processed for the following purposes, each based on a legal basis provided by the GDPR:
| Purpose | Data concerned | Legal basis (GDPR) |
|---|---|---|
| Providing the service: account creation, wallets, display of balances and history, execution of the operations you request, social features, notifications about your operations | Account and profile, wallet and transactions, social data, notification token | Performance of a contract (Art. 6.1.b) |
| Buying and selling with euros, payouts to your bank account | Identity, bank details, transactions | Performance of a contract (Art. 6.1.b) |
| Return of assets to former clients and verification of their identity | Identity, bank details, wallet addresses | Legal obligation (Art. 6.1.c) and performance of a contract (Art. 6.1.b) |
| Security, prevention of fraud and abuse | Technical data, transactions | Legitimate interest (Art. 6.1.f) |
| Support, diagnosis and fixing of errors, improvement of the App (error logs, session recordings, usage statistics) | Technical and usage data | Legitimate interest (Art. 6.1.f) |
| Emails about the service and its new features | Email, preferences | Consent (Art. 6.1.a) or, for existing users, legitimate interest for similar services (Article L.34-5 of the French Postal and Electronic Communications Code); you can unsubscribe at any time |
| Site audience measurement | Browsing data | Consent (Art. 6.1.a), except for audience measurement exempted under the CNIL's recommendations |
| Compliance with legal obligations (accounting, requests from authorities) | Data required by the obligation concerned | Legal obligation (Art. 6.1.c) |
Personal data is only shared with the following recipients, strictly to the extent necessary for the purposes described above:
| Provider | Service | Data concerned |
|---|---|---|
| AWS (Amazon Web Services) | Hosting of servers and database | All data processed by our servers |
| Privy | Embedded wallet, authentication, account recovery | Email, Google/Apple sign-in identifiers, wallet addresses, encrypted key shares (inaccessible to ADVIJU) |
| Biconomy | Relay and execution of transactions on Ethereum-compatible networks | Wallet addresses, transaction data |
| LI.FI | Finding and executing swaps and moves between networks | Wallet addresses, swap data |
| Google (Firebase) | Crash reports (Crashlytics), usage statistics (Analytics) | Technical account identifier, technical and usage data |
| LogRocket | Recording of App usage sessions, for support and error diagnosis | Technical account identifier, username, screens viewed, interactions, technical data |
| Expo | Delivery of notifications | Notification token, notification content |
| Site providers (hosting, delivery and security, audience measurement, consent management) | Operation of the Site | Browsing data (see the Cookie Policy) |
Transak provides the services for buying and selling crypto-assets with euros and carries out its own identity checks (KYC) and anti-money laundering controls. The data you provide to Transak is processed under its sole responsibility, in accordance with its own privacy policy.
Wallet addresses and transactions are, by nature, published on the relevant blockchains and visible to anyone.
Your username and profile picture are visible to other users who search for you or send you assets. Your performance and portfolio breakdown are only visible to your friends if you have enabled this in your sharing settings.
ADVIJU INVESTISSEMENT may be required to disclose personal data to the competent judicial or administrative authorities, upon request or under its legal obligations.
ADVIJU INVESTISSEMENT never sells its users' personal data. It is only shared with the recipients described above, strictly for the purposes stated.
Some providers are located outside the European Union (EU) or the European Economic Area (EEA), mainly in the United States (Privy, Google, LogRocket, Expo, and some AWS services) and in the United Kingdom (Transak). Your data may therefore be transferred to these countries.
These transfers are carried out in accordance with Chapter V of the GDPR and are covered, depending on the provider, by:
You can obtain a copy of the applicable safeguards by writing to the address given in article 12.
Personal data is kept for the following periods:
| Type of data | Retention period |
|---|---|
| Account, profile, social and wallet data | For as long as the account is used, then 3 years after account closure or last activity (civil limitation period) |
| Transaction history | 5 years from the operation |
| Accounting records relating to fees charged | 10 years (Article L.123-22 of the French Commercial Code) |
| Identity and bank details relating to the return of assets from the former offering | 5 years from the return |
| Technical logs (IP address, connections) | 12 months from collection |
| Error logs, usage statistics and session recordings | According to the provider's retention period, and no longer than 25 months |
| Site cookies and trackers | See the Cookie Policy |
| Marketing data | 3 years from the last active contact |
When these periods expire, data is deleted or irreversibly anonymised. Data recorded on a blockchain cannot be deleted (see article 8).
Under the GDPR and the French Data Protection Act, you have the following rights over your personal data:
| Right | Reference | Description |
|---|---|---|
| Right of access | Article 15 GDPR | Obtain confirmation that data about you is processed and receive a copy |
| Right to rectification | Article 16 GDPR | Have inaccurate data corrected or incomplete data completed |
| Right to erasure | Article 17 GDPR | Have your data deleted, subject to legal retention obligations |
| Right to restriction | Article 18 GDPR | Request restriction of the processing of your data in certain circumstances |
| Right to data portability | Article 20 GDPR | Receive your data in a structured, commonly used and machine-readable format |
| Right to object | Article 21 GDPR | Object to processing based on legitimate interest, and to marketing at any time |
| Withdrawal of consent | Article 7.3 GDPR | Withdraw your consent at any time, without affecting the lawfulness of prior processing |
| Post-mortem instructions | Article 85 of the French Data Protection Act | Set instructions regarding what happens to your data after your death |
| Right to lodge a complaint | Article 77 GDPR | Lodge a complaint with the CNIL |
You can exercise your rights:
You can also delete your account from the App (Profile). If there is reasonable doubt about your identity, we may ask you for proof. ADVIJU INVESTISSEMENT will respond within one month of receiving your request; this may be extended by two months for complex requests, in which case we will inform you.
Some rights (in particular erasure and rectification) cannot be exercised over data recorded on a blockchain: public addresses and transactions are immutable and public by nature. Deleting your Fibo account does not affect your assets, which remain accessible with your private keys.
ADVIJU INVESTISSEMENT implements appropriate technical and organisational measures to ensure the security and confidentiality of personal data, in accordance with Article 32 of the GDPR:
In the event of a personal data breach likely to result in a risk to the rights and freedoms of the persons concerned, ADVIJU INVESTISSEMENT notifies the CNIL within 72 hours of becoming aware of it (Article 33 GDPR) and informs the persons concerned without undue delay where the risk is high (Article 34 GDPR).
The App is intended exclusively for persons aged 18 or over. ADVIJU INVESTISSEMENT does not knowingly collect personal data about minors. If ADVIJU INVESTISSEMENT discovers that it has collected such data, it deletes it and closes the account concerned. Parents or legal guardians can contact us at the address given in article 12.
ADVIJU INVESTISSEMENT may amend this Privacy Policy to reflect legal, regulatory, technical or service changes. In the event of a material change, you will be informed by a notification in the App or by email, and the "last updated" date at the top of this document will be changed.
The current version is available at any time in the App and at fibo-crypto.fr/en/privacy-policy-2026/.
For any question about this Privacy Policy or to exercise your rights:
ADVIJU INVESTISSEMENT SAS — Personal data
Email: [email protected]
Postal address: 22 rue Durantin, 75018 Paris, France
To lodge a complaint with the supervisory authority:
Commission nationale de l'informatique et des libertés (CNIL)
3, place de Fontenoy — TSA 80715 — 75334 Paris Cedex 07, France
Phone: +33 1 53 73 22 22
Website: www.cnil.fr