Privacy Policy

De Leville Atelier ("De Leville", "we", "us", "our") operates the Digital Soul platform at . We are the data controller for personal data processed through this platform.

Contact: privacy@deleville.co

We collect the following categories of personal data:

• Identity data: your name, as provided when claiming a Digital Soul or registering for loyalty experiences.
• Contact data: your email address, used to deliver your Digital Soul claim link and loyalty communications.
• Transaction data: records of loyalty experiences, check-ins, points balances, and tier status.
• Location data: approximate location (city-level) recorded when you use the check-in feature, if you consent.
• Technical data: IP address, browser type, and device information collected automatically via server logs.
• Usage data: pages visited, features used, time spent, collected via analytics tools.
• Communications: your message and inquiry content when you submit a brand demo request.

We do not collect payment card numbers, government IDs, or sensitive personal data as defined under GDPR Article 9.

We process your personal data for the following purposes and legal bases:

Digital Soul loyalty events (check-ins, experience logs, tier upgrades) are recorded on the Polygon blockchain via NFT metadata. Blockchain records are immutable by design — they cannot be deleted or altered once confirmed.

To minimise on-chain personal data: soul NFTs use pseudonymous token IDs on-chain. Your name and email are stored in our off-chain database (Supabase) only. If you exercise your right to erasure, we delete your name and email from our database. The pseudonymous on-chain record of loyalty events remains, but cannot be linked back to you without our off-chain data.

We share your data only with:

• Crossmint — NFT minting infrastructure (Polygon). Receives token metadata on mint.
• Supabase — Database hosting (EU region when available). Processes loyalty data and claim tokens.
• Resend — Transactional and marketing email delivery. Receives your email address and email content.
• Vercel — Platform hosting. Processes IP addresses via server logs.

We do not sell your personal data. We do not share with third-party advertisers.

• Active loyalty profiles: retained while your Digital Soul is active.
• Claim tokens: deleted after use or expiry (7 days).
• Marketing email suppression list: retained indefinitely to honour unsubscribe requests.
• Brand inquiries: retained for 24 months.
• Server logs: retained for 90 days.

Depending on your location, you have the following rights regarding your personal data:

• Right of access: request a copy of data we hold about you.
• Right to rectification: correct inaccurate data.
• Right to erasure: request deletion of your data. We will delete off-chain data within 30 days. On-chain pseudonymous records cannot be deleted.
• Right to restrict processing: limit how we use your data.
• Right to data portability: receive your data in machine-readable format.
• Right to object: object to processing based on legitimate interest or for marketing purposes.
• Right to withdraw consent: withdraw consent for marketing emails at any time via the unsubscribe link in any email.
• CCPA: California residents have the right to know, delete, and opt-out of the sale of personal information. We do not sell personal information.

To exercise any right, email privacy@deleville.co. We will respond within 30 days.

We use the following cookies:

• Strictly necessary: admin_session — admin authentication (session cookie). No consent required.
• Analytics: PostHog, Vercel Analytics — track usage patterns to improve the platform. Set only after you consent via the cookie banner.

You can manage cookie preferences via the consent banner or your browser settings.

Our service providers (Crossmint, Supabase, Resend, Vercel) may process data outside the EU/EEA. Where this occurs, we rely on Standard Contractual Clauses (SCCs) or adequacy decisions as the transfer mechanism.

We may update this Privacy Policy. The "Last updated" date at the top reflects the most recent revision. Continued use of the platform after changes constitutes acceptance of the revised policy.

For privacy-related questions: privacy@deleville.co

You have the right to lodge a complaint with a supervisory authority. In Belgium: Gegevensbeschermingsautoriteit (GBA).