zkLicensing — Privacy Policy

1. Controller

[Company], Business ID [ID], [ADDRESS]. Contact: [privacy@zklicensing.com]. We have not appointed a Data Protection Officer; the contact above handles all privacy matters.

2. The short version

zkLicensing is built so that buyers need no account, no email, and no name — a license is bought with a crypto wallet and proven with cryptography. What little we process, and why, is listed below. Vendors, by contrast, must be identified businesses; we process their registration data because the law requires sellers to be identifiable and invoiceable.

3. What we process, why, and for how long

3.1 Vendors (registered businesses)

Data	Purpose	Legal basis	Retention
Legal name, address, country, email	Registration, listing, contract administration, consumer-law trader disclosure	Contract (GDPR Art. 6(1)(b)); legal obligation (6(1)(c))	Duration of the relationship + statutory limitation periods
VAT ID + VIES validation log, business-status evidence	Correct invoicing (reverse charge), EC sales listings	Legal obligation	[JURISDICTION] bookkeeping / VAT rules: 6–10 years
Fee invoices, payment records incl. MINA/fiat valuation at transaction time	Accounting, tax	Legal obligation	6–10 years
Sanctions-screening result	Compliance with EU restrictive measures	Legal obligation	Duration of relationship + 5 years
Terms-acceptance records (version, hash, timestamp)	Evidence of contract	Contract; legitimate interest	Relationship + limitation period

3.2 Buyers (license purchasers)

We hold no buyer accounts and no buyer identity data. The following limited processing occurs:

Public blockchain data. Purchases, renewals, refunds, and migrations are transactions on the public Mina blockchain. Your wallet address, the license hash, amounts, and timestamps are recorded on-chain by the protocol itself — publicly, permanently, and outside anyone's ability to erase (see Section 5). We index this public data to operate the service (proving, verification, dashboards).
Buyer country / VAT evidence. Where the buyer's country must be recorded for VAT (EU OSS rules require the seller to hold such evidence), that is the vendor's responsibility and is captured by the vendor's own checkout, not by this platform. We do not collect, store, or process buyer-country data. Retention, legal basis, and controller status for that record sit entirely with the vendor.
Device/session tokens. If a vendor uses per-device seat management, short-lived ownership tokens (validity ≤ 7 days) and an in-memory session record exist while a seat is active. These identify a license and a device-session — not a person — and are not persisted beyond their lifetime.
No tracking. We do not build buyer profiles, run advertising, or link wallet addresses to identities. Verification of a license reveals to the vendor's application only that a valid license exists.

3.3 Website visitors

The site uses only strictly necessary cookies/local storage (e.g., wallet-connection state); no analytics or advertising cookies.

4. Recipients

Hosting and infrastructure providers in the EEA ([PROVIDER]); the vendor whose product you buy (license events surfaced to their own dashboard); auditors and authorities where legally required. We do not sell personal data.

5. Blockchain data and your GDPR rights — the honest part

Data written to the Mina blockchain (wallet addresses, license hashes, transaction events) is replicated across a public, decentralized network. Neither zkLicensing nor any vendor can rectify or erase it. We minimize what goes on-chain: no names, no contact data — only pseudonymous keys and hashes. If you wish to avoid long-term linkability, use a dedicated wallet address for purchases.

For data we control off-chain, you have the usual GDPR rights: access, rectification, erasure, restriction, portability, and objection — subject to statutory retention duties (e.g., we cannot delete invoice records the law obliges us to keep). Contact [privacy@zklicensing.com]. You may lodge a complaint with the [JURISDICTION] data protection supervisory authority or your local supervisory authority.

6. International transfers

Primary processing occurs in the EEA. Where a processor operates outside the EEA, transfers rely on adequacy decisions or Standard Contractual Clauses.

7. Security

Offline signing keys for platform manifests; no buyer secrets ever transmitted to or stored by our servers (ownership passphrases never leave your device); TLS on all endpoints; access-controlled, logged administration; smart-contract circuit with published verification-key attestations.

8. Changes

Material changes are announced on the site and, for vendors, by email with 30 days' notice. Each version carries a number, date, and document hash.