Privacy policy

Last updated [Date of publication]

We collect only what we need to run Mintoo, keep it safe and meet our legal duties. We don't sell your data and we don't show ads.

Template

This page is a placeholder for the operator to complete. Text in [square brackets] must be filled in, and the whole page reviewed by a qualified lawyer, before Mintoo goes live.

1. Who is responsible

The controller under the GDPR is [Company name] [GmbH or UG (haftungsbeschränkt)], [Street and number], [Postcode] [City], Germany, [hello@your-domain].

[Data protection officer: name and email, or remove if none is required]

2. What we process

  • Account: your email address, or your Apple or Google sign-in, and the date you joined.
  • Profile: your name, @username and, if you add them, a photo and bio.
  • Friends: who you are connected with through invite links, and who you block.
  • Chats: messages, notes on payments and payment requests.
  • Wallet: your public Solana wallet address and the payments linked to it. Never your private key.
  • Verification: whether you are verified (status only, once verification is offered), and your country.
  • Safety: your sending totals against limits, and signals of unusual activity (for example, many payments in a short time).
  • Security: passkeys you add (public part only), sign-in sessions, IP address and device information.
  • Notifications: a push token, if you turn on notifications.

3. Why, and on which legal basis

Running Mintoo
Account, profile, friends, chats, wallet and notifications. Art. 6(1)(b) GDPR (contract).
Limits, fraud and sanctions checks
Sending totals, unusual-activity signals, country checks. Art. 6(1)(c) GDPR (legal obligation) where it applies, otherwise Art. 6(1)(f) (our interest in preventing fraud and abuse).
Security
IP address, sessions, passkeys, abuse protection. Art. 6(1)(f) GDPR (our interest in a secure service).
Push notifications
Only if you turn them on. Art. 6(1)(a) GDPR (consent), which you can withdraw in Settings.
Support and complaints
What you send us. Art. 6(1)(b) and (f) GDPR.

4. Identity checks and adding money

Identity verification and adding money by bank transfer aren't available yet. They will be provided by a licensed verification and payments partner, acting as its own controller. We'll name the partner here, with a link to its privacy policy, before the feature starts. We'll receive only the result of the check, not your documents.

5. The blockchain is public

Payments are recorded on the Solana network, a public ledger. Anyone who knows a wallet address can see its payments: amount and time, not your name, username or messages. Nobody, including us, can change or delete data on the ledger.

6. Service providers

We use these processors under data processing agreements. They may process data only on our instructions.

Privy (Privy, Inc., USA)
Sign-in, sign-in emails and your self-custodial wallet.
Vercel (Vercel Inc., USA)
Hosting the app and storing profile photos. [Region]
Neon (Neon, Inc., USA)
Database for account, profile, friends and chats. [Region, e.g. EU (Frankfurt)]
Ably (Ably Realtime Ltd, UK)
Delivering new messages and payments to your screen in real time.
Push services
If you turn on notifications, your browser's push service (Apple, Google or Mozilla) delivers them.
Solana RPC provider
[Name, location]: sending your approved payments to the Solana network.

Some providers are based outside the EEA. Transfers to the USA rely on the EU-US Data Privacy Framework where the provider is certified, otherwise on the EU Standard Contractual Clauses. Transfers to the UK rely on the EU adequacy decision. [Confirm per provider.]

7. How long we keep data

  • Account, profile, friends and chats: while your account exists. When you delete it, within [30] days.
  • Payment records and safety signals: [period, e.g. 5 years after the account ends] where the law requires us to keep them.
  • Security logs: [period, e.g. 30 days].
  • Support and complaints: [period, e.g. 3 years after the case is closed].

Data on the public ledger can't be deleted by anyone.

8. Your rights

You have the right to access, correct and delete your data, to restrict processing, to data portability, and to object to processing based on our legitimate interests. Where you gave consent, you can withdraw it at any time. To use your rights, email [hello@your-domain].

You can also complain to a data protection authority, for example [name of the competent authority for your company's seat].

9. Cookies

Mintoo uses only cookies and similar storage that are needed to keep you signed in and secure (§ 25 (2) TDDDG). We don't use analytics or advertising cookies. [Update if that changes.]