BLU Tron Privacy Policy

Effective date: 29 October 2026 · Version: 1.0

This policy covers BLU Tron (the "Service"): our MCP server, used from your AI assistant or with an API key, and the sign-in at auth.transatron.io. The rest of transatron.io is covered by the Transatron Privacy Policy. If you aren't a user but an address of yours appears on the TRON blockchain, see section 3.

Who we are. Transatron Ltd, registered in England and Wales (company number 16620180), is the controller of this data. Privacy contact: company@transatron.io.

1. In short

• We collect only what we need to run your account and answer your queries.
• Your queries are private. Other users never see them. We don't publish them, sell them or use them to train AI. Our own operators see them only for support, security and abuse handling. We disclose them to anyone else only when the law requires it or in the other cases section 7 describes.
• BLU Tron has no AI model inside. Your AI assistant (for example Claude or ChatGPT) is run by its own provider. We receive only the tool calls it sends us, never your conversation.

2. What we collect from users

• Sign-in. Sign-in is handled by WorkOS with Google, using the basic scopes openid, email and profile. We store the account identifier WorkOS gives you, your email address (only if Google confirms it's verified), when you joined and when you last used the Service. Google also sends your name and picture; we don't store them. We never access your Gmail, Drive, contacts or other Google data. You need a verified email to have an account.
• Account. Your email, plan, status and end date. If you use an API key, we store only a one-way hash of it.
• Usage records. For each tool call: an internal account number and a short hash of your sign-in identity (never your token), the client and tool you used, timing, cost, outcome, the block height, and your IP address. We also keep the query we ran (which may include the addresses and transaction hashes you asked about) and a hash of its result, so you can re-check an answer later. Only your account can retrieve these records through the Service; a query reference on its own reveals nothing to anyone else.
• Feedback. What you or your AI assistant write when sending feedback through the Service, with references and a summary of your recent tool calls (no query text). Your assistant may send feedback on its own when a task fails. API keys in feedback are removed before it is stored.
• Exports. Files you ask us to export. The download link works for 24 hours and is a secret: anyone who has it can download the file, so share it carefully. Files are deleted after 7 days.

3. If you're not a user: blockchain data and labels

BLU Tron reads a copy of the public TRON blockchain: addresses, transactions, transfers, delegations, votes and permission changes since the first block. Addresses are pseudonymous but can sometimes be linked to a person. If one linked to you appears, this is our notice to you.

• What we hold: what the blockchain records about the address and, for some addresses, a category label (for example "exchange" or "scam") licensed from a third-party label source, shown with its date and confidence. No entity names, and no names or contact details of the people behind addresses.
• Source, purpose and basis: the public blockchain and the licensed label source. We use them to run a research tool over public blockchain activity, on the basis of our and our users' legitimate interests (UK GDPR Art. 6(1)(f)).
• Who sees it: our users, anywhere in the world. Our terms forbid using the Service to stalk, harass, dox or unlawfully profile anyone.
• How long: our copy is kept while we run the Service; labels change when the source updates them. The blockchain itself is public and permanent.
• Labels are opinions: a label is the source's assessment of an address, not a finding by us about any person, and it may be wrong.
• Your rights: you can ask what we hold about an address you control, object to our processing, and ask us to review a label at company@transatron.io. We'll review it with the source and tell you the outcome. We can't change the blockchain itself. We haven't contacted you directly because we have no way to reach the people behind hundreds of millions of addresses (UK GDPR Art. 14(5)(e)). This published notice is how we inform you. Section 8 rights apply to you too.

4. Google user data

BLU Tron's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use your verified email and sign-in identifier only to run and support your account and to contact you about it, never for advertising. We transfer them only to WorkOS and our hosting providers to run the Service, for security, where the law requires, or in a sale or merger of our business, and then only with your explicit prior consent.

5. Why we use your data

• To provide the Service (account, sign-in, queries, exports, emails about your account or changes to our terms): performance of our contract with you.
• For security, abuse prevention, fair-use limits, support and improvement (usage records, feedback, aggregate statistics): our legitimate interests in a safe, working service.
• For the blockchain data and labels in section 3: our and our users' legitimate interests.
• To handle your requests and answer lawful demands from courts, regulators or police: legal obligation.

We don't sell personal data, don't send it to any AI provider (your own assistant receives only the answers to its own requests) and don't use it to train AI. The Service sets no cookies. The WorkOS sign-in page may set cookies strictly needed to sign you in, which need no consent.

6. How long we keep it

7. Who we share it with

Our operators can see usage records for support, incidents and abuse handling; that access is logged. We disclose data when the law requires, or to protect our rights or users. In a sale or merger, data may pass to the new owner under the same protection (Google data only with your consent, section 4). No one else receives it.

Transfers. Our data is hosted in Germany, which UK law treats as adequate. WorkOS, Google and Cloudflare may process sign-in or network data in the US, under the UK–US data bridge where the provider is certified, otherwise under standard contractual clauses with the UK addendum in our contract with them. Ask us for a copy of the safeguards.

Security. Connections use TLS 1.2 or later. Export files and backups are encrypted at rest. API keys are stored as hashes and can be revoked. The Service is read-only: it can't move funds or sign transactions.

8. Your rights

You can ask to access, correct, delete, restrict or port your personal data. You can also object to any use based on our legitimate interests, including security logging. Write from your account email to company@transatron.io. We may verify it's you and will reply within one month.

Deleting your account: we disable it the same day. Within one month we delete your sign-in record and email, and ask WorkOS to delete your account there. Usage records stay under an internal account number until their deletion date (section 6). They are pseudonymised, not anonymous. Feedback stays unlinked from you until its 180-day limit. You can remove BLU Tron's Google access at myaccount.google.com/permissions.

Complaints: write to company@transatron.io. We'll acknowledge within 30 days and tell you the outcome. You can also complain to the UK regulator, the Information Commission (ICO), at ico.org.uk.

9. Other

• Children: the Service is for professional use, not for anyone under 18.
• Changes: we'll post changes here with a new date and version, and email you before any material change. If we change how we use Google data, we'll ask you to agree first.
• Contact: privacy and legal company@transatron.io · product questions blu@transatron.io · support support@transatron.io. Our registered office address is on the Transatron Privacy Policy page.