DRAFT — Requires legal review before publication. Last updated: March 2026.
This Privacy Policy explains how [ENTITY NAME] ("FM", "we", "us") collects, uses, stores, and protects personal data in connection with the FM Coin community platform. We are committed to processing your data in compliance with the GDPR (EU 2016/679) and the Belgian Data Protection Act of 30 July 2018.
On-chain data (Base blockchain):
Wallet address, FM Coin balance, display name, city, location sharing preference, reward points, event registrations, and event details. On-chain data is public, permanent, and cannot be deleted.
Off-chain data:
Chat messages (stored in PostgreSQL), wallet signatures for authentication (session-only, never persisted), and analytics data (only with your consent via the cookie banner).
Data we do NOT collect:
GPS coordinates, email addresses (unless provided for support), phone numbers, government IDs (unless KYC is legally required), browsing history, device fingerprints, or social media accounts.
| Processing | Basis |
|---|---|
| Profile data | Contractual necessity — Art. 6(1)(b) |
| Chat messages | Contractual necessity — Art. 6(1)(b) |
| Location sharing | Explicit consent — Art. 6(1)(a) |
| Analytics cookies | Explicit consent — Art. 6(1)(a) |
| Transaction records | Legal obligation — Art. 6(1)(c) |
You have the right to: access your data (Art. 15), rectify it (Art. 16), erase off-chain data (Art. 17), restrict processing (Art. 18), data portability (Art. 20), object to processing (Art. 21), and withdraw consent (Art. 7). On-chain data cannot be erased due to blockchain immutability — your profile can be deactivated but historical records persist.
To exercise your rights, contact [DPO/PRIVACY EMAIL]. We will respond within 30 days. You may also lodge a complaint with the Belgian supervisory authority (APD/GBA).
| Data | Retention |
|---|---|
| On-chain data | Permanent (blockchain immutability) |
| Chat messages | Until deleted or 24 months inactivity |
| Event metadata | 90 days after event date |
| Auth signatures | Session only |
We use Google Analytics with anonymized IP addresses to understand platform usage. Analytics cookies are only loaded after you explicitly consent via the cookie banner. If you reject cookies, no analytics data is collected. You can change your preference at any time by clearing your browser's local storage.
Data Protection contact: [DPO/PRIVACY EMAIL]
Entity: [ENTITY NAME], [ADDRESS]
Belgian supervisory authority: APD/GBA — www.dataprotectionauthority.be
The full privacy policy is available at docs/legal/privacy-policy.md. This page is a summary for your convenience.