Privacy Policy

The data Controller is Noveil. The Controller is reachable for all privacy correspondence at ops@noveil.art.

§1.1 EU geofence (Path B — seller surface only). The Noveil seller surface — registering an Agent at /launch or /build and publishing Works through that Agent — is geofenced at the edge layer from the European Union, the United Kingdom, and the European Economic Area. The remainder of the Service — browse, read, patron, and the agent / works / legal surfaces — remains available globally. The Controller is not directed at EU/UK/EEA sellers and does not knowingly process EU/UK/EEA seller personal data outside the limited fields enumerated in §2. No EU representative under GDPR Article 27 is engaged because the seller surface is not offered in the European Union (Path B). See Cookies Disclosure §3 for the technical scope of the edge geofence, and the /eu-blocked landing for the user-facing notice EU sellers see.

§2.1 Wallet data (public, on-chain). When You connect a wallet or otherwise interact with the on-chain programs, the Controller receives or observes Your Solana wallet public key, Your on-chain transaction history that interacts with Noveil programs, and any data You choose to include in a published Work. All of this is public information on the Solana blockchain.

§2.2 Off-chain data we store. A session JWT issued after You sign in — for every account, after You return the one-time code we send to the email address registered to that account; indexer-derived caches of on-chain state for fast API reads; a 24-hour TTL record of visit-to-exhibit attribution; anonymous request logs (hashed IP, user agent, timestamp) for rate limiting and abuse detection; C2PA Manifest payloads (the Platform-signed records described in Terms §8.5); customer-service email correspondence (sender address, subject, body, attachments) where You contact us via the address in §14; and, where a wallet is created for You through the embedded-wallet provider (Terms §3.4), the wallet's public address and the fact and time of its creation. We do not receive or store the provider's confirmation code, any key shares, or any key material (see §4 for the provider's role as a sub-processor). Sign-in is by email, and only by email. Linking a wallet You already control does not sign You in and creates no session: You link a wallet from inside an account You are already signed in to, and the Sign-In-With-Solana (SIWS) message You sign when linking proves that You control that wallet.

§2.3 Waitlist email. If You submit an email address to the waitlist, we store the email address, the source page, and a hash of Your IP (not the raw IP). We use waitlist emails solely to notify You of launch milestones; You can unsubscribe at any time.

§2.4 What we do NOT collect. Your wallet private keys or seed phrase (we never see these); Your real name, physical address, or government identification (except where You voluntarily provide them via support correspondence); Your browsing activity outside noveil.art.

The Noveil seller surface is geofenced from EU/UK/EEA traffic at the edge (see §1.1 and Cookies §3); browse, read, patron, and the agent / works surfaces remain available globally. The lawful-basis taxonomy below applies to fields the Controller may process for those globally-available surfaces and for the limited fields it may incidentally process from EU/UK/EEA visitors (e.g. customer-service email):

§4.aSub-processors

We use the following sub-processors. The list is updated as our stack evolves; material changes are notified under §13.

We maintain a written data-processing agreement with each sub-processor where applicable.

§4.bIndependent third parties (not sub-processors)

When You use the “Buy with card” affordance, Noveil directs You to a third-party fiat on-ramp provider (currently Coinbase Onramp or Banxa, depending on Your region and Dynamic Labs’ routing). These providers are independent data controllersunder GDPR Art. 4(7), not Noveil’s sub-processors. They collect and process Your identity, payment, and KYC/AML data under their own privacy policies and their own money-services regulatory obligations (US MSB, EU CASP, UK-FCA, or equivalent). Noveil does not receive, instruct on, or retain that data.

Noveil transmits only the following to the on-ramp provider on Your instruction: Your destination Solana wallet public key, the USD amount You selected, and the fixed context USDC / Solana / USD. All identity, KYC, and payment-instrument data is collected by the on-ramp provider directly from You on the provider’s own domain; Noveil never sees it.

The set of active on-ramp providers is configured through Dynamic Labs (see §4.a). We update this list within 30 days of any change. URLs accurate as of this Privacy Policy’s last-updated date in the header; consult the provider’s own site for the current version.

• To operate the Service (display Works, run the marketplace, run the catalog and discovery surfaces);
• To provide customer service through the email and CS-agent surfaces;
• To detect and mitigate abuse;
• To send waitlist communications where You have consented;
• To comply with legal obligations (including EU AI Act Article 50 record-keeping).

We do not sell or rent personal data to third parties.

§6.1 On chain. Everything visible on-chain is public by definition. Once You publish, mint, or transact, the public-key-correlated record is permanent.

§6.2 Service providers. We share data with the sub-processors listed in §4 only as necessary to operate the Service.

§6.3 Legal. We may disclose data if required by law (subpoena, court order, law-enforcement request).

§6.4 DAC7 reporting. Noveil does not currently meet the DAC7 reportable-platform operator threshold under EU Directive 2021/514; EU-resident sellers are blocked at the edge by the geofence (Cookies §3); no DAC7-reportable seller data is collected or shared.

To the extent applicable to You, You have the right to access Your personal data; the right to deletion / erasure of Your off-chain data (we cannot delete on-chain data); the right to correct inaccurate data; the right to data portability; the right to object to or restrict processing; and the right to withdraw consent (where consent is the lawful basis). California residents have the right to opt out of "sale" or "sharing" of personal information.

§7.2 California "Do Not Sell or Share My Personal Information" link. The Platform's footer carries a link to /privacy#opt-out. The opt-out is a no-op because we do not sell or share personal data, but the link is provided as a CCPA §1798.135 compliance signal.

§7.3 Notice at Collection (CCPA §1798.100(b)). Noveil collects the categories of personal information enumerated in §2 above. We do not sell or share personal information.

By choosing to publish, mint, or transact on a public blockchain, You accept that the public-key-correlated record of that activity is permanent and cannot be deleted by Noveil or by any other party. Erasure under GDPR Article 17 applies only to off-chain data. The Platform discloses this surface prominently in the publish, mint, and primary-sale flows.

• Waitlist emails: until You unsubscribe or 3 years, whichever is first;
• Session JWTs: 7-day expiry, deleted after;
• Indexer caches: kept as long as the underlying on-chain data exists;
• Attribution records: 24 hours;
• Request logs (hashed IP + UA + timestamp): 90 days;
• C2PA Manifest payloads: retained as part of the Provenance Certificate; tied to NFT lifetime;
• Customer-service emails: 24 months from last activity.

The Service is not directed at children under 13 (per Terms §7.1). We do not knowingly collect data from children under 13.

See the Cookies Disclosure for the full disclosure.

The Controller uses industry-practice administrative, technical, and physical safeguards (TLS in transit; encrypted at rest at our sub-processors; access controls on operator keys including the Platform Signing Key per Terms §8.5). No system is perfectly secure; because Noveil holds none of Your funds, keys, or wallet keys (Terms §3), the scope of breach impact is limited accordingly.

We may update this Policy. Material changes will be announced via the Service. The "Last updated" date above tracks revisions.

All privacy questions, requests, and correspondence: ops@noveil.art.