Subprocessors

Version: 2026-11-01 draft

Updated 1 November 2026.

Effective: [Effective date: set when published]

Virtus Blockchain Labs LLC ("we", "us") uses the companies below to run Terminal. Each one receives personal information only to do the job named here. This list is part of the Privacy Policy.

Summary. A server host runs Terminal. Stripe takes card payments. A mail provider sends email. A language-model provider writes notes and chat replies: Anthropic for paying accounts, xAI for everyone else. Google and GitHub handle sign-in if you choose them. Telegram, Discord, and your browser's push service carry alerts only if you turn on those destinations.

Always used

• [Hosting provider: owner to confirm]. Runs the server and the database that hold the service. Receives everything Terminal stores, such as accounts, alerts, notes, logs, and payment records. Where: [Hosting location: owner to confirm]
• [Backup storage: owner to name once off-site backups run (H-08)]. Keeps an encrypted copy of the database off the server. Receives the same data, encrypted before it leaves the server. Where: [Location]
• Anthropic. Writes notes and chat replies for paying accounts, with its Claude model. Receives the prompt, which can hold your instructions, market facts, stored notes, names of connected accounts, text read from a connected account for that run, and your chat message. Never your password, your API keys, or your payment details. Where: United States.
• xAI. Writes notes and chat replies for everyone who does not pay (free accounts, trials, beta and complimentary grants, and visitors who are not signed in), and the notes the server writes on its own. A Grok program on our server sends it the same kind of prompt, under our own xAI subscription. A non-paying account's prompt never goes to Anthropic. On a server set up with an xAI key, xAI's API can also take Anthropic's place for paying accounts. Where: United States.
• Groq. Used only on a server set up with a Groq key. It writes for non-paying accounts when the Grok program on our server cannot run. It writes for paying accounts only when the server is set up to use it in place of Anthropic. Receives the same kind of prompt. Where: United States.
• Resend, or the SMTP mail provider set on the server [owner to name the SMTP provider]. Sends email: confirmation, password reset, alerts, receipts, renewal notices. Receives your email address and the message, which can include your name, a link, a receipt, or an alert. Where: United States.

Used when you choose them

• Stripe. Used when you pay by card, and for tax on a charge when Stripe Tax is on. Receives your name and email, the plan or pack, the price, your billing address and any tax ID you enter when tax applies, and the card details you type into Stripe's form. We never see the full card number. Where: United States.
• Google. Used when you sign in with Google, or connect a Google app such as Gmail, Drive, Calendar, Sheets, Docs, or YouTube (when new Google connections are turned on for this server). Receives your name, email, and Google account id. For a connected app, the tokens and the content that connection needs for a run you asked for. Where: United States.
• GitHub. Used when you sign in with GitHub. Receives your name, email, and profile id. Where: United States.
• Telegram. Used when you add Telegram as an alert destination, or write to Terminal's Telegram bot. Receives your Telegram chat id, the alerts sent to it, and the messages you send the bot. A message you send the bot to ask a question also goes to the language-model provider above. Where: [Counsel: confirm Telegram's processing location]
• Discord. Used when you add a Discord webhook as an alert destination. Receives the alert text sent to that webhook. Where: United States.
• Your browser's push service (for example Google, Apple, Mozilla, or Microsoft, depending on the browser). Used when you turn on phone or browser alerts. Receives an encrypted alert message and the push address your browser gave us. The push service cannot read the message. Where: depends on the browser.
• Typesafe. Used when the safety check is turned on for this server. Receives your chat message, or an alert's name and instructions. It sends back a decision, which we store. Where: [Counsel: confirm location]
• Coinbase (Coinbase Developer Platform). Used when your software pays for a call in USDC through x402. It is the payment service the server uses unless it is set up with another one. Receives the paying wallet address, the amount, and the signed payment. Where: United States.

Not on this list

These do not receive your personal information from us:

• Webhooks and bots you set up. When you add your own webhook address or a bot preset, we send the alert to the address you chose. That company works for you, not for us.
• Tools you connect with your own key. When you connect a tool such as GitHub, Slack, Notion, Linear, Dropbox, or Airtable with a key you paste, we use your key to check it and to read what a run you asked for needs. That company works for you, not for us. The text we read can go into the prompt, as the language-model entries above say.
• Market data sources, including CoinDesk Data, Coinbase and Kraken public market data, Kraken Futures, Hyperliquid, Pyth, and public economic and news sources. We fetch numbers from them. We do not send them who you are. The Data sources notice lists them.
• Sanctions and location lists. We download the US Treasury sanctions list and a public IP-to-country file and check them on our own server. Your address and name do not leave the server for that check.
• Public blockchains. A USDC payment through x402 is public on the Base network, like any transfer. When anchoring is on, we write a fingerprint of a batch of alert receipts to Base. A fingerprint holds no name, email, or account id.
• TokensMarketCap. Terminal and tokensmarketcap.com are the same company. If you sign in through tokensmarketcap.com, that site sends us your name and email to open your Terminal account.

Changes

We add a company to this list before it starts receiving personal information. If you want an email when this list changes, write to contact@tokensmarketcap.com. [Counsel: decide whether paying business customers get advance notice and a right to object.]