Privacy
A2 Route — Privacy Policy
Effective date: 29 September 2026.
Controller: A2vanta LLC (Thailand), company registration No. 0845566026586, registered address: 119/23 Moo 6, Pa Daet Subdistrict, Mueang Chiang Mai District, Chiang Mai 50100, Thailand
Contact: in the bot: /support (routed to @A2metabot) · e-mail: alex@a2vanta.com
Data protection contact: privacy@a2route.com; until that mailbox is active, use alex@a2vanta.com. We have not appointed a Data Protection Officer; A2vanta LLC handles personal-data requests directly.
A2 Route (a2route.com, the Telegram bot and the API) screens crypto addresses and transactions for sanctions and illicit-funds exposure. This policy explains what we process, why, and your rights.
1. What we collect
Account and usage (bot, Mini App, API)
- Telegram user id and display name (received when you start the bot). We do not receive your phone number.
- For Business/API accounts: contact e-mail from your application, API key metadata (creation, expiry, last use).
- Addresses and transaction ids you submit, the network, the direction (incoming/outgoing), and optional invoice reference.
- Screening results: verdict (ALLOW / REVIEW / BLOCK), completeness, risk labels, reason, data-as-of date, cache flag.
- PDF reports we issue for you, their SHA-256 fingerprint and report id.
- Credits, packages, subscriptions, payment references and on-chain ids of payments you make to us.
- Monitored address list (Pro).
- Support and dispute messages and our replies.
- Technical logs: timestamps, request ids, error codes, rate-limit counters. Addresses in shared logs are hashed.
Website (a2route.com)
- /lead form: e-mail, optional Telegram handle, source and UTM parameters, and a salted SHA-256 hash of your IP address. We do not store the raw IP.
- /verify: the fingerprint or report id you enter; nothing is stored beyond standard server logs.
- /account: Telegram Login data (Telegram user id, display name) and a server session.
We collect no KYC data, identity documents, or counterparty names.
2. Why we process it and on what basis
| Purpose | Data | Legal basis where GDPR applies |
|---|---|---|
Run the screening you request, issue reports, /verify | submitted addresses/txids, results, reports | contract (Art. 6(1)(b)) |
| Accounts, credits, billing, fraud prevention (one free grant per user) | Telegram id, payments, ledger | contract; legitimate interest |
| Support and disputes | your messages, check id | contract |
| Security, abuse and rate limiting, service reliability | technical logs, hashed IP | legitimate interest |
| Replying to a lead request | e-mail, Telegram handle | consent / pre-contractual steps |
| Accounting and tax records | payment records | legal obligation |
3. Who we share data with
Data providers. To screen an address or transaction we send the address or transaction id, the network and the direction to third-party risk-intelligence and blockchain-data providers (MistTrack by SlowMist, GoPlus, TronGrid, Alchemy, Blockscout and publicnode public RPC) and match it against public sanctions lists we host locally (OFAC SDN, EU consolidated list, UK sanctions list). We never send your Telegram identity, e-mail, invoice reference or account data to a provider. On a fresh check (and, if not already captured at check time, when a PDF is issued), the free sender profile sends the public sender address and network to TronGrid for TRON, or to Blockscout and publicnode RPC for supported Ethereum checks, to read balances, activity and token-transfer history. The token contract may also be sent; no Telegram identity or account data is sent. Provider data is used under the providers' own terms. See the Data sources page.
Infrastructure. Hosting by netcup GmbH in Germany; Telegram (Bot API, Login Widget).
Authorities. Only where the law requires.
We do not sell personal data or use it for advertising.
4. Retention
The periods below run from the event stated in each row, unless a legal hold requires longer retention.
| Data | Retention |
|---|---|
| Reports, fingerprints and the check they belong to | 24 months from report issue; /verify is available during this period |
| Screening results and cache | result snapshots 24 months from the check; free/beta address cache up to 24 hours; confirmed-transaction cache may be reused until invalidated |
| Credit ledger and payment records | 5 years for Thai accounting and tax records, or longer where a legal hold applies |
| Telegram id, display name | for the life of the account; on closure replaced by a keyed hash used only to prevent repeated free grants |
| Support and dispute messages | 24 months from case closure |
| Lead form data | up to 24 months from submission, or earlier on a valid deletion request |
| Technical logs | 90 days |
5. Security
TLS for all traffic to a2route.com and to providers. Access restricted to the operator team. API keys expire within 90 days. Secrets never appear in logs. Reports are stored immutably. Backups are access-restricted. No system is fully secure; report suspected problems via /support.
6. Your rights
You can request access, correction, deletion, restriction or portability, and object to legitimate-interest processing, via /support or the data protection contact above (alex@a2vanta.com until privacy@a2route.com is active). We answer within 30 days.
On account closure we revoke keys, close subscriptions and stop processing. We keep the credit ledger, payment records and issued reports for the periods above: banks rely on /verify, and accounting law requires payment records. Unused prepaid balance is handled under the Terms.
EU/EEA users may complain to a supervisory authority; we are established outside the EU — complain to the supervisory authority of your EU country. We have no EU representative at present. When an EU customer is onboarded, we will designate a representative where GDPR Art. 27 requires one.
7. Cookies
The bot uses no cookies. The website sets only a session cookie for /account after Telegram Login; no advertising or third-party analytics cookies.
8. Children
The service is for businesses and professionals and not intended for anyone under 18.
9. International transfers
Providers outside the EU/EEA (e.g. SlowMist, GoPlus, Alchemy, TronGrid, Blockscout and publicnode) receive only addresses, transaction ids, networks and token contracts where needed, never client identity data. Providers may process these requests outside the EU/EEA under their own terms. Where GDPR Chapter V applies to a provider transfer, the required transfer safeguards must be in place.
10. Changes
We may update this policy. Material changes are announced in the bot and on the site with a new effective date.