Privacy Notice
Version 2026-10-21
Pre-launch legal notice: Draft for legal review. Launch markets, the Australian governing state and a real contact email must be configured before launch.
Who is responsible
Into My Wallet is responsible for the personal information described here. A real privacy contact channel will be published before launch.
Information we collect
We collect the photo you upload; the card name and instructions you enter; your email address; your public Solana wallet address; order, payment-status and delivery records; and your IP address, browser information and security events. If you save free previews by email, we temporarily store that email, the uploaded-photo reference, campaign and your separate marketing choice so we can send a secure resume link. If you allow tracking, we also collect and store campaign parameters and Meta browser identifiers. Stripe processes payment details and does not give us your full card number.
Why we use it
We use this information to provide and save previews, send the requested transactional resume link, take and fulfil an order, deliver files and blockchain collectibles, communicate about the order, provide support and refunds, secure the service, prevent abuse, and keep required business records. We use contact details for product news or offers only where you separately opt in. Advertising measurement is also used only where permitted and consented to. The appropriate legal basis can vary by location and must be confirmed during legal review.
International providers and processing
Into My Wallet operates from Australia and uses Vercel for hosting and private file storage, Neon for database hosting, Stripe for international payments, Replicate for artwork and animation, Vercel AI Gateway and its routed model provider for photo analysis and card text, and an email provider when enabled. These providers may process or store information in countries other than Australia or where you live. The safeguards and disclosures required for launch markets must be confirmed during legal review. Before a photo is sent to an AI service, we re-encode it to remove metadata such as GPS and camera details.
What becomes public
When a collectible is minted, the finished artwork or animation, generic collectible metadata, transaction records and receiving wallet address are published through Solana and public permanent storage. Anyone may view and copy them. We cannot edit or erase those public records. The original photo and email address are not intentionally published.
Retention
An abandoned preview-resume record and its secure link expire after 14 days; if no order uses that photo, its abandoned private preview media is then scheduled for deletion. Original uploads, cached analysis, previews and private working files for orders are scheduled for deletion 30 days after delivery. Abuse-limit records are deleted after 2 days. Order, consent, payment and support records are kept only as long as reasonably needed for fulfilment, disputes, accounting and legal obligations. The final public blockchain and permanent-storage records do not expire.
Security
We use private storage for source photos, token-protected order links, access controls and data minimisation. No online service can guarantee absolute security. Never send us a wallet seed phrase or private key; we only need a public receiving address.
Children and other people
Do not upload a photo unless you have authority and all necessary permissions from identifiable people in it. A parent or legal guardian should make decisions about a child's photo. Because the finished art is public and permanent, avoid any image you would not want publicly associated with the receiving wallet.
Your rights
Your rights depend on the laws that apply where you live and may include access, correction, deletion, restriction, objection, portability or a complaint to a regulator. You may withdraw consent where processing relies on consent. Australian law and any mandatory privacy rights in your country are not limited by this notice. We can act on information we control privately, but cannot remove data already written to a public blockchain or permanent storage.
Advertising measurement and tracking
If Meta Pixel is configured, we ask before loading it. If you choose “Allow tracking”, Meta receives browser and interaction data to measure visits and purchases, and we may send a matching purchase event through Meta’s Conversions API. Choosing “No thanks” does not affect the service, and no Meta purchase event is sent. You can reopen “Tracking choices” in the footer at any time. Withdrawing stops future Meta tracking on this device; it does not retrieve data already sent.
Meta tracking: not chosen.
Privacy contact
A real privacy contact channel must be configured before production launch.