Privacy policy

Information we use and where it comes from

When you sign in with X or Google, our authentication service receives the identifiers and profile information permitted by that provider, such as your account ID, username, display name, avatar and email when supplied. We associate this identity with your Provenance profile and session. We do not receive your X or Google password.

We store the profile details, preferences, favorite collections, saved NFTs, alerts and notification destinations you provide or configure. Linking a wallet can involve its address, signed verification messages, transaction references and evidence connecting it to your account. Never provide a wallet seed phrase or private key.

We also obtain publicly available wallet transactions, NFT holdings, marketplace records and social profile information from blockchains, marketplaces, public social sources and data providers. Automated wallet links, scores and rankings are estimates that can be challenged; a public source does not make every inference correct.

Community features process your posts, comments, messages, reactions and reports. Support requests contain what you send us. Browser and infrastructure data can include IP addresses, request times, device/browser details, security events and, if you allow it, performance measurements and optional local history.

Purposes and legal bases

We use account and feature data to provide the service you request: authentication, profiles, wallet verification, saved lists, messages, alerts and responses from Alex. Where necessary for that service, the basis is performance of our agreement with you or steps you request before using it.

We rely on legitimate interests to maintain security, prevent abuse, moderate content, handle support, improve the service and analyse public NFT and wallet activity. These interests include keeping the platform reliable and providing useful collection information. You can object to processing based on legitimate interests and request review of information about you.

Optional browser measurement and history-based personalization depend on your cookie choices. You can withdraw that permission in Cookie settings. We process information required by applicable law on the basis of that legal obligation. Accepting terms or signing in does not grant blanket consent to unrelated uses of your data.

Public information, messages and contributions

Your displayed profile, posts, comments, public interactions and the wallet or NFT information exposed by a feature may be visible to other users. Direct messages are shared with their participants and processed by the infrastructure providing them; they are not advertised as end-to-end encrypted. Administrators may access information where needed for support, moderation or security.

Attributed contributions may appear on the public supporters board with the donor username, avatar where applicable, amount in the native currency and date. The board does not display a per-person USD total. A blockchain transfer itself is public and cannot be erased by Provenance. Contact us to discuss the attribution or publication of a contribution.

Profile privacy controls affect what specific features display. They do not make public blockchain records private or stop processing needed to operate your account. We can review incorrect wallet associations and requests to remove links to your profile.

Alex and AI providers

Alex sends the messages needed for a response, recent conversation history, page context and relevant account context to an AI provider. For a signed-in user, that context can include profile details, linked wallets, NFT activity, interests, favorites and alert settings. Responses currently use DeepSeek; Anthropic is also integrated for chat and learning-memory processing. These providers may process data outside the European Economic Area, including China and the United States.

Learning memory can be enabled by default for signed-in users. It stores concise notes about interests, experience and prior explanations. You can inspect, disable and clear it using Alex’s memory controls; disabling it clears the saved notes. We use this limited memory to personalize the service based on our legitimate interest in continuity, subject to your controls and right to object. Cookie rejection does not by itself disable this separate account feature.

Opening questions may be normalized and counted to provide suggested questions. Messages reporting a bug or requesting a feature may be retained as feedback with account details when available. Do not include passwords, keys, sensitive personal information or confidential information about other people in chat. AI responses can be inaccurate.

Service providers and international processing

Supabase provides authentication, database and storage services. The primary Provenance database is configured in Ireland (eu-west-1); this does not mean that all support, authentication, subprocessors or other providers process data exclusively in the EU. Vercel hosts the site and application. Cloudflare provides domain services and routes contact email to Google’s mail service. Resend processes outgoing service email, and Telegram or browser push services process notifications when you configure them.

Blockchain data services, including Helius and Alchemy, process the wallet or token identifiers needed for relevant queries. DeepSeek and Anthropic process AI requests as described above. X, Google, wallet apps, linked marketplaces and public blockchains also have their own roles and privacy rules. Some act as independent controllers for their own services.

Providers can process information in other countries, including the United States and China. Transfer arrangements depend on the provider and the applicable contract. Contact us to request the safeguards and contractual information applicable to your data; this policy does not represent that every provider keeps information in the EU.

Provider information: Supabase, Vercel, Cloudflare, Google, Resend, X, Telegram, DeepSeek API terms and Anthropic.

How long information is kept

Account details, linked-wallet records, preferences and content are generally retained while needed to provide your account and the features you use. You can remove information through available controls or request deletion. You can delete your account from My Profile; contact us if a deletion fails or you need help with information not covered by that control.

Account deletion removes the profile and linked authentication identities and attempts to remove associated user content and settings. Contribution records remain with the account link removed; blockchain transactions remain public. Moderation bans and the fact that an invitation was used may remain to prevent abuse. Information needed for a specific legal obligation or dispute can be retained for that purpose.

Optional performance measurements have a 90-day retention period. Cookie and browser-storage durations are listed in the cookies policy. Feedback, security records, AI-provider records and backups follow the purpose for which they are held and the relevant provider’s retention arrangements; contact us for the applicable details. We do not promise that all copies disappear immediately when an account is deleted.

Your choices and rights

You can request access, correction, deletion, restriction and, where applicable, portability of your personal information. You can object to processing based on legitimate interests, withdraw consent for future processing and ask for review of an automated score or wallet association. Withdrawing consent does not affect processing already carried out lawfully.

Use the contact details below. Tell us which account or information your request concerns; we may ask for proportionate verification of your identity. We normally respond within one month, with any permitted extension explained. You may complain to the Spanish Data Protection Agency (AEPD) or your competent supervisory authority.

Basic account identifiers are necessary for a signed-in account; wallet information is needed for wallet-based features. You can choose not to use optional features or providers. This policy applies alongside the cookies policy and terms and conditions. Material changes will be reflected in the policy date and, where required, brought to your attention or presented for a new consent choice.