Privacy Policy

1. Introduction

At Depollute NOW!, we are committed to protecting your privacy and personal data. This Privacy Policy explains how we collect, use, store, and share your information when you use our platform.

We comply with the General Data Protection Regulation (GDPR), California Consumer Privacy Act (CCPA), and other applicable privacy laws. Your privacy is a fundamental right, and we take it seriously.

2. Information We Collect

2.1 Information You Provide

• Account Information: Name, email address, password (encrypted), profile photo
• Profile Data: Bio, location, social media links, Human Design information
• Referral Information: Referral code, upline/downline relationships
• Environmental Impact: Quest check-ins, journal entries, impact attestations
• Marketplace Data: Shipping address, payment information (processed by Stripe)
• Communications: Messages, posts, comments, support tickets

2.2 Automatically Collected Information

• Usage Data: Pages visited, features used, time spent, interactions
• Device Information: Browser type, operating system, IP address, device ID
• Cookies: Session cookies, preference cookies, analytics cookies
• Location Data: General location (city/country) based on IP address

2.3 WhatsApp Messaging Data

If you interact with us via WhatsApp Business (number: +60 11-2366 4351), we collect and store:

• Phone number: Used to identify and resume your onboarding journey across sessions
• Message content: Inbound text messages you send us, used to drive the onboarding journey and infer your Human Design type and preferred path
• Journey state: Your current step, chosen path (activist, earner, both, explorer), inferred Human Design type, and conversation timestamps
• Window timestamps: Time of last message, used to manage the WhatsApp 24-hour service window and send re-engagement emails

WhatsApp conversation data is processed by Meta Platforms Ireland Ltd under their WhatsApp Privacy Policy. We act as an independent data controller for the journey data stored in our own systems. To request deletion of your WhatsApp data, see our Data Deletion page.

2.4 Information from Third Parties

• Corsair Connect: Account linking data for business users
• Social Media: Public profile information if you connect social accounts
• Payment Processors: Transaction confirmations from Stripe

3. How We Use Your Information

We use your information for the following purposes:

3.1 Platform Operations

• Create and manage your account
• Process DNOW token distributions based on verified impact
• Calculate and distribute affiliate commissions
• Enable quest enrollment and tracking
• Facilitate marketplace transactions
• Provide customer support

3.2 Community Features

• Display your profile to other users
• Show your posts, comments, and reactions in the community feed
• Enable direct messaging between users
• Create leaderboards and achievement badges

3.3 AI & Personalization

• Generate personalized quest recommendations
• Infer Human Design type based on behavioral signals
• Provide AI-powered content moderation
• Translate content into 16 languages
• Verify environmental impact claims

3.4 Analytics & Improvements

• Analyze platform usage and performance
• Improve features and user experience
• Detect and prevent fraud or abuse
• Ensure platform security

3.5 Communications

• Send transactional emails (verification, password reset, receipts)
• Notify you of quest milestones and achievements
• Alert you to commission earnings
• Share platform updates and new features (you can opt out)

4. Legal Basis for Processing (GDPR)

For users in the European Union, we process your data based on:

• Contract: Processing necessary to provide our services (account management, tokens, quests)
• Consent: You explicitly consent to data processing (e.g., marketing emails, AI personalization)
• Legitimate Interest: Fraud prevention, analytics, platform improvements
• Legal Obligation: Compliance with tax laws, anti-money laundering regulations

5. How We Share Your Information

We do not sell your personal data. We share information only in the following circumstances:

5.1 With Other Users

• Your public profile (name, bio, avatar) is visible to all users
• Posts, comments, and reactions are visible in the community feed
• Quest journal entries are visible based on your privacy settings
• Your upline sponsor can see your basic activity status

5.2 With Service Providers

• Stripe: Payment processing (they have their own privacy policy)
• Vercel: Hosting and infrastructure
• Supabase: Database storage (encrypted)
• NVIDIA NIM: AI services (embeddings, translation, moderation)
• Nodemailer/SMTP: Email delivery

5.3 For Legal Reasons

We may disclose information if required by law, court order, or government request, or to protect our rights, safety, or property.

6. Data Retention

We retain your data for as long as necessary to provide our services:

• Account Data: Until you request deletion (or 2 years of inactivity)
• Transaction Records: 7 years for tax/legal compliance
• Blockchain Attestations: Permanent (nature of blockchain for assets like CSR tokens minted on Ethereum by Corsair)
• Quest Journals: Until you delete them or close your account
• Analytics Data: Aggregated and anonymized after 90 days

7. Your Privacy Rights

You have the following rights regarding your personal data:

7.1 Access & Portability

• Request a copy of all data we hold about you
• Download your data in a machine-readable format (JSON)
• Access your data anytime through your dashboard

7.2 Correction & Update

• Update your profile information in account settings
• Request correction of inaccurate data

7.3 Deletion & Erasure

• Request full account deletion (GDPR "Right to be Forgotten")
• Delete individual posts, comments, or quest entries
• Note: Blockchain data (such as CSR plastic credits minted on the Ethereum blockchain by Corsair) cannot be deleted due to the immutable nature of the blockchain. Other platform database records (quest journals, user profiles, off-chain DNOW seeds) can be fully deleted upon request.

7.4 Consent Withdrawal

• Opt out of marketing emails anytime
• Disable AI personalization in settings
• Manage cookie preferences through the consent banner

7.5 Object & Restrict

• Object to processing for marketing or analytics
• Request restricted processing in certain circumstances

To exercise any of these rights, contact us at [email protected] or use the account settings in your dashboard.

8. Cookies & Tracking

We use cookies and similar technologies to provide, protect, and improve our services:

8.1 Essential Cookies

Required for platform operation (authentication, security, preferences). You cannot disable these.

8.2 Analytics Cookies

Help us understand how users interact with the platform (page views, clicks, time spent). You can opt out.

8.3 Personalization Cookies

Remember your preferences (language, theme, quest types). You can opt out.

Manage cookie preferences through the consent banner or your account settings.

9. Data Security

We implement industry-standard security measures to protect your data:

• Encryption: Data encrypted in transit (TLS/SSL) and at rest (AES-256)
• Password Hashing: Bcrypt with salt (cannot be reversed)
• Access Control: Role-based permissions, least privilege principle
• Secure Infrastructure: Hosted on Vercel with SOC 2 compliance
• Regular Audits: Security testing and vulnerability scanning
• Incident Response: Procedures for data breach notification

However, no system is 100% secure. Use strong passwords, enable 2FA (when available), and never share your credentials.

10. International Data Transfers

Depollute NOW! is a global platform. Your data may be transferred to and processed in countries outside your own, including the United States. We ensure adequate protection through:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Adequacy decisions where applicable
• Service providers with GDPR compliance certifications

11. Children's Privacy

Depollute NOW! is not intended for users under 18. We do not knowingly collect data from children. If you believe a child has created an account, please contact us immediately at [email protected].

12. Changes to This Policy

We may update this Privacy Policy periodically. Changes will be posted on this page with an updated "Last Updated" date. Significant changes will be communicated via email or platform notification.

13. Contact Us

For privacy questions, data requests, or to exercise your rights, contact:

EU residents may also lodge a complaint with their local supervisory authority.