Privacy Policy

1. How to contact us

If you have any question about this policy or about how we handle your data, email us at support@onchainmind.io or contact us through our contact page.

2. Information we collect

Information you give us

When you create an account, start a trial, subscribe to a paid plan or sign up to our newsletter, we collect your name, email address and billing details. When you join the newsletter we also note which of our pages you joined from (for example our YouTube, X or advertising sign-up pages). If you contact us, we keep a record of that correspondence.

If you use the Studio's Journal, favourites or collections while signed in, we store them on our servers so they stay in step across your devices. They are kept under an anonymous identifier derived from your account, not under your name or email address.

Payments are handled by our payment processor. We never see or store your full card number.

Information we collect automatically

When you use the Platform we collect limited technical information, including your IP address, browser and device type, and the pages you visit. We use this to keep the Platform secure, to make sure it works properly, and to understand in aggregate how it is used.

If you allow advertising cookies (see section 8), we also record how you reached us: the campaign tags in the link you followed, the website that referred you, and the click identifier Meta adds when you arrive from one of our ads on Facebook or Instagram. We use this to measure which of our ads and links bring people to On-Chain Mind.

Information we do not collect

We do not collect special category data, and we do not sell your personal information.

3. How we use your information, and our lawful basis

Under UK data protection law we must have a lawful basis for each use of your personal information. Ours are as follows:

• Providing your account and subscription, including giving you access to the Platform, managing your plan and taking payment. Lawful basis: performance of a contract with you.
• Service and transactional emails, such as receipts, renewal and trial notices, billing problems, security alerts and material changes to our terms. Lawful basis: performance of a contract, and legal obligation where we are required to notify you.
• Sending our newsletter and market analysis. Lawful basis: your consent, or our legitimate interests in marketing similar services to existing customers, where you have not opted out.
• Support and responding to your enquiries. Lawful basis: legitimate interests in running our business and helping our users.
• Keeping the Platform secure and preventing fraud or abuse, including detecting shared or automated access. Lawful basis: legitimate interests in protecting our business and our subscribers.
• Understanding how the Platform is used, in aggregate, so we can improve it. Lawful basis: legitimate interests in improving our service.
• Measuring and improving our advertising on Meta (Facebook, Instagram and Threads), as described in sections 5 and 8. Lawful basis: your consent where the law requires it, which includes visitors in the United Kingdom, the European Union and the European Economic Area, who are asked before anything runs. Elsewhere, our legitimate interests in knowing which of our advertising works; you can opt out at any time.
• Meeting our accounting, tax and other legal obligations. Lawful basis: legal obligation.

Where we rely on legitimate interests, we have considered whether those interests are outweighed by your rights, and we have concluded they are not. You can object to this processing at any time, as set out in section 8.

4. Marketing and how to opt out

You can stop receiving our newsletter and any marketing email at any time by clicking the unsubscribe link at the bottom of any such email, or by changing your preferences in your account. We will action this promptly.

Opting out of marketing does not stop service and transactional emails, which we need to send you while you hold an account or a subscription.

5. Who we share your information with

We do not sell, rent or trade your personal information.

We share it only with service providers who help us run the business, and only so far as they need it. They act on our instructions under a written contract and may not use your data for their own purposes. These include:

• Our subscription, account and email platform, which manages accounts, billing records and email delivery.
• Our payment processor, which handles card payments and holds your card details on our behalf.
• Our website and application hosting providers.
• Our privacy-focused analytics provider, which measures aggregate site usage without cookies.
• Meta (Meta Platforms Ireland Limited, and Meta Platforms, Inc.), only if you allow advertising cookies or, outside the UK, EU and EEA, have not opted out. See below.
• Our accountants and professional advisers, where necessary.

What we share with Meta, and why

We advertise on Meta's platforms. To learn which of our ads bring people who go on to read our newsletter or become members, and so that Meta shows our ads to people likely to find them useful, we use the Meta Pixel on our website and Meta's Conversions API from our servers. When one of these happens, we tell Meta that it happened:

• you visit a page of our website;
• you join our newsletter;
• you create a free account;
• you start an upgrade to a paid plan;
• you make the first payment of a subscription, with the plan, the amount paid and our estimate of what a subscription on that plan is typically worth.

With each of these we send the address of the page, your IP address, your browser type, Meta's cookie identifiers and, where we have them, your email address and an identifier for your account. Your email address and account identifier are hashed (turned into a scrambled code) before they are sent to Meta; Meta compares the code with its own records but cannot read the address from it. We do not send your name, your card details, or anything you write in the Studio.

For collecting this information and sending it to Meta, we and Meta Platforms Ireland Limited are joint controllers. What Meta then does with it, including using it to show and improve ads, is set out in Meta's Privacy Policy, and you can exercise your rights over Meta's own use with Meta directly. You can manage the ads Meta shows you in your Facebook or Instagram ad settings.

If you live in a US state with a consumer privacy law, such as California, sending this information to Meta may count as "sharing" for advertising. You can opt out at any time with Cookie settings at the bottom of every page, and we treat a Global Privacy Control signal from your browser as an opt-out automatically.

We may also disclose information where we are required to do so by law, by a regulator, or by a court, or where necessary to establish, exercise or defend legal claims.

6. International transfers

Some of our service providers are based outside the United Kingdom, including in the United States and the European Economic Area. This means your personal information may be transferred to, stored in, or accessed from those countries.

Where we transfer personal information outside the UK, we make sure an appropriate safeguard is in place. Depending on the provider, we rely on:

• a UK adequacy decision, where the country or certification scheme has been approved by the UK Government, including the UK Extension to the EU-US Data Privacy Framework; or
• the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment.

You can ask us for more detail about the safeguards that apply to a particular transfer.

7. How long we keep your information

• Account information: for as long as your account is open, and for up to 24 months after it is closed, so that you can return without losing your history and so we can deal with any query or dispute.
• Billing and transaction records: for 6 years from the end of the relevant financial year, because we are required to keep them for accounting and tax purposes.
• Marketing preferences and consent records: until you withdraw consent, and for a reasonable period afterwards so we can evidence that you opted out.
• Support correspondence: for up to 24 months after your query is resolved.
• Aggregate analytics: retained in a form that does not identify you.
• How a member reached us (the campaign tags and Meta identifiers of the visit that brought you, and your latest IP address and browser type): for up to 400 days after your last visit, stored against a hashed copy of your email address, so we can work out what our advertising costs per customer.
• Information sent to Meta: Meta keeps it under its own policy.

Where we no longer need your information, we delete it or anonymise it.

8. Cookies, analytics and advertising

Strictly necessary

Our subscription platform stores a sign-in token in your browser so that you can sign in and stay signed in to the members' area. This is essential to a service you have asked for and cannot be switched off without breaking it. We also remember your cookie choice in your browser, so we don't ask you on every visit.

Analytics

For site measurement we use a privacy-focused analytics provider that does not use cookies, does not collect personal information, does not fingerprint your device and does not track you across other websites. The Studio also counts how its features are used, such as which dashboards are opened, without any identifier. Statistics are aggregated and cannot be used to identify you. We honour Do Not Track and Global Privacy Control signals for these counts.

Advertising

We use the Meta Pixel to measure our advertising on Facebook, Instagram and Threads (see section 5). When it runs, Meta sets two cookies on our site: _fbp, which identifies your browser to Meta, and _fbc, which records the ad you clicked, if any. Both last up to 90 days. We also keep, in your browser, a note of the campaign tags and referring website of your visit, so that a later sign-up can be credited to the right ad or link.

• In the United Kingdom, the European Union and the European Economic Area, nothing from Meta loads and nothing is stored for advertising until you choose Accept in the box we show you. Decline is always offered alongside it. We work out whether to ask from your device's time zone, and we ask whenever it cannot be told.
• Elsewhere, the Pixel runs unless your browser sends a Global Privacy Control or Do Not Track signal, in which case it never runs.
• You can change your choice at any time with Cookie settings at the bottom of every page. If you decline, Meta's cookies and our note of how you reached us are deleted from your browser, and nothing further is sent to Meta.

You can also block or delete cookies in your browser settings, but if you block the essential sign-in storage you will not be able to sign in.

9. Your rights

Under UK data protection law you have the right to:

• Be informed about how we use your data, which is the purpose of this policy.
• Access the personal information we hold about you.
• Rectification, to have inaccurate information corrected.
• Erasure, to have your information deleted in certain circumstances.
• Restriction, to limit how we use your information in certain circumstances.
• Data portability, to receive the information you gave us in a portable format.
• Object to processing based on our legitimate interests, and to object to direct marketing at any time.
• Withdraw consent at any time, where we rely on consent, including for advertising cookies through Cookie settings at the bottom of every page. This does not affect anything we did before you withdrew it.

To exercise any of these rights, email us at support@onchainmind.io or contact us through our contact page. We will respond within one month. Exercising your rights is free, and we will not treat you differently for doing so.

If you are outside the United Kingdom, you may have equivalent or additional rights under your own local data protection law, and this policy does not restrict them.

10. Automated decision-making

We do not make decisions about you that produce legal or similarly significant effects using automated processing alone, and we do not carry out profiling of that kind.

11. How to complain

If you are unhappy with how we have handled your personal information, please tell us first so we can put it right.

You also have the right to complain to the Information Commissioner's Office, the UK supervisory authority for data protection, at ico.org.uk/make-a-complaint or on 0303 123 1113. If you are based elsewhere, you may complain to your own national data protection authority.

12. Security

We use appropriate technical and organisational measures to protect your personal information, including encryption in transit, access controls, and choosing reputable providers who maintain recognised security standards.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a breach occurs that is likely to result in a high risk to your rights, we will notify you and the Information Commissioner's Office as required by law.

13. Children

The Platform is not intended for anyone under the age of 18 and we do not knowingly collect information from children. If you believe a child has given us their personal information, contact us and we will delete it.

14. Changes to this policy

We may update this policy from time to time. We will post the updated version on this page and change the date below. Where a change is material, we will tell you by email.