Privacy Policy.

1Data controller

The controller within the meaning of Art. 4(7) GDPR is:

Hagbard Interactive Studio UG (haftungsbeschränkt)
Schulstraße 13
64750 Lützelbach
Germany
Email: ben@hagbard.studio
Register: Amtsgericht Darmstadt HRB 109379

2A note on the blockchain

Tyros is a non-custodial platform built on public blockchains. Your wallet address, the collections you deploy, and the transactions you sign (mints, listings, sales, transfers) are recorded on-chain by design — they are public, permanent, and outside our control. We cannot alter or delete on-chain data. This policy covers the data we process off-chain; it does not and cannot govern the public ledgers themselves.

3What data we process

The exact set depends on how you use Tyros.

• Wallet address — your public blockchain address, used to identify your account, show your inventory, and attribute activity. We never access your private keys or seed phrase.
• Contact details — if you provide them (for example an email for a paid launch, creator support, or notifications), your email address and the content of your messages.
• Creator & collection data — collection details, uploaded or AI-generated artwork, prompts, metadata, and configuration you submit when launching or managing a collection.
• Technical & security data — IP address (used transiently for rate-limiting and abuse prevention, not stored long-term), user-agent, and basic device/browser metadata.
• Usage analytics — pages and features used and errors encountered, in the minimum detail needed to fix bugs and improve the product.

4Purposes & legal bases (Art. 6 GDPR)

• Operating the platform — accounts, launches, minting, the marketplace, and creator tools. Basis: Art. 6(1)(b) GDPR (contract / pre-contractual measures).
• Security & abuse prevention — rate-limiting, fraud and abuse detection, protecting users and the service. Basis: Art. 6(1)(f) GDPR (legitimate interest in a secure platform).
• Analytics & product improvement — understanding usage to fix and build. Basis: Art. 6(1)(f) GDPR (legitimate interest); minimum data only.
• Communication & support — answering your messages and notifying you about launches or your account. Basis: Art. 6(1)(b) and (f) GDPR, or Art. 6(1)(a) (consent) where you opt into notifications.
• Legal & compliance obligations — including tax, accounting, and AML/sanctions duties (see Section 8). Basis: Art. 6(1)(c) GDPR.

5Recipients & processors (Art. 28 GDPR)

We use third-party service providers to run Tyros. Processors act only on our instructions and under data-processing agreements.

• Supabase — primary database and authentication backend;
• Upstash — Redis-based rate-limiting and caching;
• Hosting & infrastructure providers — application hosting, CDN, and edge delivery;
• AI image generation (OpenAI, Replicate, xAI) — when you use AI art, only your prompt and generated/uploaded artwork are shared; never your private keys;
• Pinata / IPFS — decentralised storage for collection artwork and metadata (note: content stored on IPFS is public and may be replicated across the network);
• Blockchain RPC providers — used to read and broadcast on-chain data; wallet addresses and transactions are inherently public on-chain;
• Email provider — for transactional and, where you opt in, notification email.

We do not sell your personal data, and we do not share it with third parties for their own advertising.

6International transfers

Some processors are based outside the European Economic Area. Where that is the case we rely on appropriate safeguards under Art. 44 et seq. GDPR — typically the European Commission’s Standard Contractual Clauses, an adequacy decision, or the EU-US Data Privacy Framework where applicable.

7Retention

We keep account and platform data for as long as your account is in use, so you can return to it. You can request deletion of the off-chain data we hold at any time (see Section 9). Technical logs (IP addresses, request metadata) are kept only as long as needed for the security purposes in Section 4 — typically no more than 30 days, unless retained for an active incident investigation or where the law requires longer retention (for example tax records). On-chain data cannot be deleted (see Section 2).

8AML & sanctions

Where the law requires, we process data to meet anti-money-laundering and sanctions obligations, including under the German Money Laundering Act (Geldwäschegesetz, GwG) and relevant EU frameworks. This may include screening against sanctions lists and reporting to competent authorities. Basis: Art. 6(1)(c) GDPR and Art. 6(1)(f) GDPR.

9Your rights

Subject to the conditions in the GDPR, you have the rights to:

• Access (Art. 15) — a copy of the data we hold about you;
• Rectification (Art. 16) — correction of inaccurate data;
• Erasure (Art. 17) — deletion of the off-chain data we hold;
• Restriction (Art. 18) — restrict processing in certain cases;
• Portability (Art. 20) — your data in a machine-readable format;
• Object (Art. 21) — object to processing based on legitimate interest, including analytics;
• Withdraw consent (Art. 7(3)) — with effect for the future;
• Complain (Art. 77) — to a supervisory authority, e.g. in Germany the data protection authority of the federal state where you reside.

To exercise a right, email ben@hagbard.studio. For a wallet-identified account we may ask you to sign a message with that wallet to verify control. Note that we cannot erase or alter data written to a public blockchain.

10Cookies & local storage

Tyros uses browser local storage and strictly-necessary cookies to keep you signed in and to remember interface preferences. These are required for the platform to function and live on your device. We do not set third-party advertising or cross-site tracking cookies.

11Children

Tyros is not directed at anyone under 18. If you are under 18, do not use the platform. If we learn we have collected personal data from a minor without a lawful basis, we will delete it.

12Changes

We may update this policy from time to time. The “Last updated” date above reflects the latest version, and material changes will be announced on the platform.

13Contact

Hagbard Interactive Studio UG (haftungsbeschränkt)
Schulstraße 13, 64750 Lützelbach, Germany
Email: ben@hagbard.studio