Privacy Policy

• Account data — your email address, created when you register. Display name if you choose to set one.
• Asset records — brand, model, reference number, category, production year, and an optional photo you upload. Serial numbers are stored but never included in the public passport or any public API response.
• Spatial event data — a cryptographic commitment (SHA-256 hash) of your location at the time of each event. Raw GPS coordinates are processed entirely in your browser and are never transmitted to our servers. We store either the coordinates of a registered location (when you verify near one) or a city-level centroid (when you are not near a registered location). We never store your precise location.
• Receipt hashes — if you attach a receipt to an event, your browser computes a SHA-256 hash of the file. Only the hash is stored; the file itself is never uploaded.
• Blockchain anchors — event payload hashes anchored on the Polygon blockchain are permanent and public. They contain only a cryptographic hash with no personal data.
• Credit transactions — records of credits purchased, used, and refunded, including Stripe session IDs for payment reconciliation.
• Usage data — standard server logs (IP address, browser type, timestamp) retained by our hosting provider. We also run first-party, privacy-respecting analytics that record only which pages are visited (path only, no query strings) and referrer hostname. No cookies, user IDs, or IP addresses are stored in our analytics.

• Providing the VAZANTIS service — registering assets, logging events, generating certificates, processing transfers.
• AI auto-fill (optional, explicit) — when you use the "Look up" feature during asset registration, the product URL you provide (fetched server-side) or the text description you type is sent to an AI model to pre-fill watch specification fields. This is triggered only when you explicitly press "Look up". Your serial number, private notes, account identity, and asset ID are never included. Results are cached by VAZANTIS so the same query is not re-sent to the AI on repeat lookups.
• Processing payments through Stripe (we never store card details).
• Sending transactional emails (registration confirmation, event and transfer notifications).
• Preventing fraud and enforcing our Terms of Service.
• Complying with legal obligations.
• Aggregated and anonymised analytics — we may derive and use aggregated, anonymised insights from platform activity (for example, service frequency trends or asset category distributions). Such data cannot identify any individual user and is not personal data under GDPR.

Legal basis under GDPR: performance of a contract (providing the service you sign up for) and our legitimate interests in preventing fraud and improving security. Payment processing is additionally covered by legal obligation.

We share your data only with processors necessary to operate the service:

• Supabase — database and authentication infrastructure.
• Google — optional sign-in via Google OAuth. If you choose "Continue with Google", Google shares your name and email address with us to create or identify your account. Google's own privacy policy applies to that interaction.
• Vercel — hosting and content delivery, and cookie-less Web Analytics (aggregate page views and real-user page load performance; no cookies, no personal identifiers).
• Stripe — payment processing. Stripe's own privacy policy applies to data you enter on Stripe's checkout pages.
• Resend — transactional email delivery.
• Alchemy / Polygon — blockchain RPC and public ledger for event anchoring. Anchored hashes are permanently public on-chain.
• OpenStreetMap Nominatim — reverse geocoding to determine city-level location. Only used when you are not near a registered location; city coordinates are sent, not your exact position.
• OpenAI — AI model provider used for the optional watch auto-fill feature. When you explicitly trigger "Look up", either the content of a product page URL (fetched server-side) or a text description you type is sent to OpenAI's API to extract watch specifications. No personal data, serial numbers, or account identifiers are included in these requests. OpenAI's own privacy policy and data processing terms apply. VAZANTIS caches results so the same input is not re-processed on subsequent lookups.
• Google Tag Manager — used to load advertising and marketing measurement tags, only if you accept in the cookie banner. Currently this is Google Ads conversion tracking (e.g. whether a visit from an ad led to a sign-up); other tags may be added here over time as our marketing needs change, and this notice is kept current when that happens. No account data, asset data, or other personal information from your use of VAZANTIS is shared with these tags — only that a conversion or ad-related event occurred. You can withdraw consent at any time by clearing your cookies and choosing “Reject” the next time the banner appears. Google's own privacy policy applies to its processing of this data.

We do not sell your personal data to third parties.

Supabase Auth sets session cookies (prefixedsb-) to keep you signed in. These are strictly necessary for the service to function and do not require your consent under GDPR.

If we are running an advertising campaign, we may ask for your consent to set cookies for advertising and marketing measurement (delivered via Google Tag Manager) — these are never set until you actively accept them in the cookie banner, and you can decline or withdraw consent at any time. Stripe may set cookies during checkout on Stripe's own pages; those are governed by Stripe's privacy policy.

• Account and asset data is retained for as long as your account is active.
• Credit purchase records are retained by our payment processor (Stripe) in accordance with financial regulations. Our internal credit ledger entries are deleted when your account is permanently purged.
• Blockchain anchors are permanent — once recorded on the Polygon network they cannot be deleted, though they contain no personal data.
• Server logs are retained by Vercel for up to 30 days.
• When you delete your account, your personal data (account details, private notes, asset nicknames, and free-text event descriptions) is permanently erased within 30 days. Provenance records — the factual event history of the physical asset (event type, date, location, trust scores, photos of the item) — are retained with all personal identifiers removed. These records describe the physical object, not you personally, and are not subject to the right of erasure under GDPR. They may be claimed by a future owner of the same physical item.

You have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — correct inaccurate data (you can update your display name from your profile page).
• Erasure — request deletion of your account and associated personal data. Blockchain hashes cannot be erased but contain no personal data. Credit transaction records may be retained for legal compliance.
• Portability — receive your data in a machine-readable format.
• Restriction — request that we limit processing of your data in certain circumstances.
• Objection — object to processing based on legitimate interests.

To exercise any of these rights, email privacy@vazantis.com. We will respond within 30 days. You also have the right to lodge a complaint with your national data protection authority.

We may update this policy as the service evolves. Material changes will be communicated by email to registered users. Continued use of the service after changes constitutes acceptance.