DRAFT — Requires legal review before publication. Last updated: March 2026.
This Privacy Policy explains how [ENTITY NAME] ("FM", "we", "us") collects, uses, stores, and protects personal data in connection with the FM Coin community platform. We are committed to processing your data in compliance with the GDPR (EU 2016/679) and the Belgian Data Protection Act of 30 July 2018.
On-chain data (Base blockchain):
Wallet address, FM Coin balance, display name, city, location sharing preference, reward points, event registrations, and event details. On-chain data is public, permanent, and cannot be deleted.
Off-chain data:
Chat messages (stored in PostgreSQL), wallet signatures for authentication (session-only, never persisted), and analytics data (only with your consent via the cookie banner).
Data we do NOT collect:
GPS coordinates, email addresses (unless provided for support), phone numbers, government IDs (unless KYC is legally required), browsing history, device fingerprints, or social media accounts.
| Processing | Basis |
|---|---|
| Profile data | Contractual necessity — Art. 6(1)(b) |
| Chat messages | Contractual necessity — Art. 6(1)(b) |
| Location sharing | Explicit consent — Art. 6(1)(a) |
| Analytics cookies | Explicit consent — Art. 6(1)(a) |
| Transaction records | Legal obligation — Art. 6(1)(c) |
You have the right to: access your data (Art. 15), rectify it (Art. 16), erase off-chain data (Art. 17), restrict processing (Art. 18), data portability (Art. 20), object to processing (Art. 21), and withdraw consent (Art. 7). On-chain data cannot be erased due to blockchain immutability — your profile can be deactivated but historical records persist.
To exercise your rights, contact [DPO/PRIVACY EMAIL]. We will respond within 30 days. You may also lodge a complaint with the Belgian supervisory authority (APD/GBA).
| Data | Retention |
|---|---|
| On-chain data | Permanent (blockchain immutability) |
| Chat messages | Until deleted or 24 months inactivity |
| Event metadata | 90 days after event date |
| Auth signatures | Session only |
Consent is collected through the Silktide Consent Manager, an open-source banner, and is split by purpose. Essential storage keeps the site working — your language choice and the record of this decision itself — and cannot be switched off. Analytics is a separate, optional category that is off until you turn it on.
If you accept analytics, we load Google Analytics 4 with IP anonymisation, Google signals disabled and ad personalisation disabled; we use it only to see which pages are read. If you reject it, no analytics script is loaded at all and no analytics data is collected. You can change or withdraw your choice at any time through the "Cookie preferences" link in the footer, which reopens the same panel (GDPR Art. 7(3)).
Data Protection contact: [DPO/PRIVACY EMAIL]
Entity: [ENTITY NAME], [ADDRESS]
Belgian supervisory authority: APD/GBA — www.dataprotectionauthority.be
The full privacy policy is available at docs/legal/privacy-policy.md. This page is a summary for your convenience.