Privacy Policy

Last updated: 15 Oct 2026

1. Introduction

This Privacy Policy describes how Swarming Labs LTD (“Sparkling”, “we”, “us”, or “our”) collects, uses, discloses, and protects your information when you use Sparkling, a self-custody AI assistant operating within Telegram and accessible at sparkling-australia.com (the “Service”).

This policy applies globally. By using the Service, you acknowledge and understand these practices. For users in Australia, we comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), under the oversight of the Office of the Australian Information Commissioner (OAIC).

2. Data Controller

Swarming Labs LTD
Intershore Chambers, Road Town, Tortola
British Virgin Islands
Email: [email protected]

3. Information We Collect

3.1 Information You Provide

  • Account information: Telegram identifier, username, email address.
  • Authentication credentials: One-time passwords (OTP) for wallet recovery (we do not store these in a retrievable format).
  • Identity verification: Government-issued ID, proof of address, date of birth, or biometric verification (processed by a licensed third-party provider, if legally required).
  • Communications: Messages sent to Sparkling, trade instructions, and support requests.

3.2 Information Collected Automatically

  • Transaction data: Swap quotes, signed transactions, agent strategy executions, and on-chain transaction hashes.
  • Technical data: Device type, operating system, Telegram client version, IP address (retained for a maximum of 30 days unless required for fraud investigation), and approximate geographic region.

4. How We Use Your Information

  • To provide the Service: Routing instructions, executing transactions, and displaying balances. (Legal basis: Contract performance).
  • To authenticate and secure your account: Verifying logins and detecting suspicious access. (Legal basis: Contract performance and legitimate interest in account security).
  • To prevent fraud and abuse: Detecting bots, market manipulation, and account takeovers. (Legal basis: Legitimate interest and AUSTRAC AML/CTF obligations).
  • To comply with legal obligations: Responding to regulators, courts, and law enforcement agencies. (Legal basis: Legal obligation).

We do not use your information for marketing purposes without explicit opt-in consent. We do not sell your personal data.

5. Information Sharing

We share information with third-party vendors, including cloud infrastructure providers, email services, analytics providers, and identity verification providers. Each vendor is bound by a written data processing agreement. We may disclose information to comply with the law, regulation, legal process, or lawful government requests, including those from ASIC or AUSTRAC.

6. Cross-Border Data Transfers

Your information may be transferred to and processed in countries outside Australia. In accordance with APP 8, we take reasonable steps to ensure that overseas recipients do not breach the Australian Privacy Principles. For transfers from the EEA or UK, we rely on European Commission Standard Contractual Clauses and supplementary technical measures.

. Data Retention

  • Account information: Duration of use plus 12 months after closure.
  • Transaction records: 7 years from the date of transaction (in line with ATO record-keeping requirements).
  • KYC information: 7 years after account closure (in line with AUSTRAC requirements).
  • Technical logs and IP addresses: 30 days (90 days for security investigations).

8. Your Rights

Under the Privacy Act 1988 and the APPs, you have the right to access your personal information, request corrections, and lodge complaints about our handling of your data. You may also lodge a complaint with the Office of the Australian Information Commissioner (OAIC). To exercise these rights, please email [email protected]. We will respond within 30 days.

9. Security

We implement technical and organisational measures to protect information against accidental or unlawful destruction, loss, alteration, or unauthorised disclosure, including TLS 1.3 encryption in transit, encryption of sensitive data at rest, and regular external security audits. Crucially, we never request or store your private keys.

10. Notifiable Data Breaches

In the event of an eligible data breach, we will comply with the Notifiable Data Breaches (NDB) scheme under Part IIIC of the Privacy Act 1988, notifying affected individuals and the OAIC as soon as practicable.

11. Changes to This Policy

We may update this Policy. Material changes will be notified at least 30 days before taking effect. The “Last updated” date above reflects the current version.

12. Contact Us

General privacy inquiries: [email protected]