Privacy Policy

1. Who we are

1.1 This privacy policy explains how mallow labs L.L.C-FZ, which operates mallow.art, and mallow labs LLC, which provides the mallow wallet (together, "mallow", "we", "us", "our") collect, use, share and protect personal data when you use https://www.mallow.art, https://wallet.mallow.art, the mallow wallet app, the mallow API, and the related services described in our terms (together, the "Services").

1.2 mallow labs L.L.C-FZ is a free zone company registered in the Meydan Free Zone, Dubai, United Arab Emirates, with its registered address at The Meydan Hotel, Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, U.A.E 9305. mallow labs LLC is a Wyoming limited liability company with its registered address at 30 N Gould St Ste R, Sheridan, WY 82801, USA.

1.3 The mallow wallet runs on the same systems as mallow.art, and your mallow profile is shared between them. mallow labs L.L.C-FZ and mallow labs LLC are jointly responsible for your personal data. You can contact either company about your data at [email protected].

1.4 We handle personal data in line with the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) and, where they apply to you, the UK and EU General Data Protection Regulation.

2. What we collect

2.1 Wallet and blockchain data. You use the Services by connecting a self-custody wallet. We receive your public wallet address and read public blockchain data linked to it, such as the NFTs and tokens it holds and its transaction history. We never receive your private keys or seed phrase.

2.2 Profile information. If you create a profile, we collect what you choose to add, such as your username, display name, bio, profile images, social links, linked wallet addresses and curations. Your profile is public.

2.3 Email address. An email address is optional. If you add one, we use it to send the alerts you choose. You can separately opt in to marketing emails.

2.4 Content you publish. This includes artworks and their metadata, descriptions, Exclusive Content, Talkboard posts and comments.

2.5 Delivery details. If you buy a listing that includes a physical item, or order from the mallow store, and choose to give us delivery details, we collect the details you provide, including your full name, street address, city, country and email address, and, where provided, your state, postal code and phone number.

2.6 API key holders. We do not require additional personal information to apply for an API key. If you contact us by email or Discord, we receive the messages and contact details you use, as described in clause 2.7.

2.7 Communications. If you contact us, we keep your messages and the contact details you use.

2.8 Information collected automatically. When you use the Services, we and our analytics providers collect information about your device and how you use the Services, including your IP address, approximate location derived from your IP address, browser and device type, operating system, pages and features used, referring URLs, and the date and time of your visit. We do not use browser or device fingerprinting.

2.9 Compliance information. To comply with sanctions laws and protect the Services, we screen wallet addresses against sanctions lists using Chainalysis and may use your IP address to determine your location. We keep records of the results.

2.10 Wallet app. If you use the mallow wallet app, we also collect a device token so we can send the push notifications you choose, and app usage data through our analytics tools. If you choose optional social sign-in, authentication is handled by MetaMask Embedded Wallets (Web3Auth) and your chosen sign-in provider. The App uses the resulting public wallet addresses to connect to the Services. Your seed phrase and private keys stay on your device and are never sent to us.

2.11 We do not ask for, and you should not give us, government identification numbers, payment card details or sensitive personal data such as health information.

3. How we use your data

3.1 We use personal data for the purposes below. Where data protection laws such as the UAE Personal Data Protection Law or the UK or EU General Data Protection Regulation (GDPR) apply, we rely on the legal basis shown for each purpose.

3.2 We do not sell your personal data, and we do not use it to make decisions that have legal or similarly significant effects on you based solely on automated processing, other than automatically blocking access from restricted locations or sanctioned wallets as described in our terms and conditions.

3.3 Blockchain data is public and permanent. Wallet addresses, transactions, NFTs and their metadata are recorded on public blockchains and, for artwork files, on public storage networks such as IPFS. Anyone can see this information, and neither we nor you can change or delete it. This policy covers the data we hold; it cannot change what is already recorded on a blockchain.

4. Who we share your data with

4.1 Service providers. We use providers who process personal data on our behalf and only on our instructions, including:

• (a) website hosting and databases: Hetzner, with our API server in Germany and our utility server in Helsinki, Finland, and Cloudflare for website hosting and delivery;
• (b) blockchain access and indexing: Helius, Alchemy, Infura, publicnode.com and TzKT;
• (c) analytics: Mixpanel, Google Analytics and Cloudflare Web Analytics;
• (d) email: Brevo, for alerts and, if you opt in, marketing emails;
• (e) sanctions screening: Chainalysis;
• (f) storage of artwork files and metadata: IPFS, pinned through Filebase;
• (g) token swaps in the wallet app: Jupiter;
• (h) push notifications: Firebase;
• (i) optional social sign-in: MetaMask Embedded Wallets (Web3Auth); and
• (j) video: Mux. We also run GlitchTip on our utility server for error diagnostics.

4.2 Between mallow companies. mallow labs L.L.C-FZ and mallow labs LLC share personal data with each other as needed to provide the Services, including your shared profile.

4.3 Sellers of physical items. If you choose to give delivery details for a physical item, we send them to the seller by email so they can deliver it. The seller is responsible for how they use and protect those details.

4.4 Third-party marketplaces. When you view or buy a listing from Magic Eden, OpenSea or objkt through the Services, or follow a link to one, public wallet addresses and transaction details may be shared with that marketplace when needed to complete a transaction. Viewing a listing through mallow does not itself send your profile or delivery details to that marketplace. If you follow a link to its website, it may receive your IP address, browser information and any information you give it Raffles are run using the Famous Foxes raffle program. These are independent companies with their own privacy policies.

4.5 Other users and the public. Your profile, published content and on-chain activity are visible to everyone.

4.6 Legal and safety. We may share personal data where we reasonably believe it is required by law, regulation or a court or government request, including sanctions and financial crime authorities, or to protect the rights, property or safety of mallow labs L.L.C-FZ, our users or others, or to enforce our terms and conditions.

4.7 Business transfers. If mallow labs L.L.C-FZ is involved in a merger, acquisition or sale of assets, personal data may be transferred as part of that transaction. We will tell you before your data becomes subject to a different privacy policy.

5. International transfers

5.1 Our providers may process personal data outside the country where you live, including in the United States. Where the law requires it, we put appropriate safeguards in place for these transfers, such as standard contractual clauses approved by the relevant authorities.

6. How long we keep your data

6.1 We keep personal data only for as long as we need it for the purposes in section 3:

• (a) information you add to your profile, such as your name, bio, images and social links: until you delete your profile or remove that information; public wallet addresses, artwork records, curations and transaction history are retained so the marketplace can continue to work;
• (b) email address: until you remove it or delete your account; marketing preferences until you unsubscribe;
• (c) delivery details: removed from our order database by the hourly cleanup once a physical-art or merchandise order is more than two days old; unpaid orders are removed once they are more than one hour old. If you choose to save delivery details in your browser, that local copy remains until you remove it or clear your browser storage;
• (d) server logs containing IP addresses: according to our server log rotation policy; nginx access logs are rotated daily with 14 rotated logs retained, and application logs are rotated when they reach 100 MB with seven rotated logs retained;
• (e) analytics data: Mixpanel analytics data is retained indefinitely; other analytics data is retained according to the relevant provider's retention settings; and
• (f) accounting and tax records, including records of the fees we earn: seven years, as required by UAE tax law; and sanctions-screening results, takedown notices and other information we need to comply with the law or resolve disputes: for as long as necessary for that purpose, and generally no longer than seven years.

6.2 When we no longer need personal data, we delete or anonymize it.

7. Cookies and analytics

7.1 We use cookies and similar technologies to keep the Services working and, with your consent where required, for analytics through Mixpanel, Google Analytics, Cloudflare Web Analytics and Mux, and for error diagnostics through our self-hosted GlitchTip service. You can manage your choices through our cookie consent manager and your browser settings. More detail is in our Cookie Policy (https://mallow.art/cookies).

8. Your rights

8.1 Depending on where you live, you may have the right to:

• (a) access the personal data we hold about you and receive a copy;
• (b) correct inaccurate data;
• (c) have your data deleted;
• (d) restrict or object to how we use your data, including objecting to processing based on our legitimate interests;
• (e) receive your data in a portable format;
• (f) withdraw your consent at any time, where we rely on it, without affecting processing that took place before you withdrew it; and
• (g) complain to a data protection authority, such as the UAE Data Office, the UK Information Commissioner's Office or your local authority in the European Union.

8.2 To exercise your rights, email [email protected]. We may ask you to verify that you control the relevant wallet, for example by signing a message, before acting on your request. We aim to respond within one month.

8.3 These rights do not apply to information recorded on a blockchain or public storage network, which we cannot change or delete (see clause 3.3).

9. Deleting your account

9.1 You can delete your profile on mallow.art under Edit profile → Delete profile, in the mallow wallet app under Settings → Security & Privacy, or by emailing [email protected]. Because profiles are shared, deleting your profile removes your profile from both mallow.art and the mallow wallet.

9.2 Deletion removes the information you added to your profile, including your username, display name, bio, profile images, social links and email address, and removes the device tokens used for push notifications. We retain the underlying wallet-address record, artwork records, curations, transaction history and historical analytics, as well as information we must keep under clause 6.1(f). Deletion does not affect your wallet, your assets or anything recorded on a blockchain.

10. Marketing emails

10.1 We only send marketing emails if you opt in. Every marketing email includes an unsubscribe link, and you can also unsubscribe by emailing [email protected]. Alerts you have chosen to receive are separate from marketing and can be managed in your notification settings.

11. Security

11.1 We use reasonable technical and organizational measures to protect personal data, including encryption in transit and access controls that limit access to people who need it. No system is completely secure, and we cannot guarantee the security of information sent over the internet.

11.2 Delivery details for physical items are sent to sellers by email. Only provide them if you are comfortable doing so; you can instead arrange delivery directly with the seller.

11.3 We will never ask for your private keys or seed phrase. Anyone who does is not acting for mallow.

12. Children

12.1 The Services are only for people aged 18 or over. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, contact [email protected] and we will delete it.

13. Changes to this policy

13.1 We may update this policy from time to time. We will post the new version with an updated date and, for material changes, give reasonable notice through the Services.

14. Contact

14.1 For questions about this policy or your personal data, contact:

mallow labs L.L.C-FZ

The Meydan Hotel, Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, U.A.E 9305

mallow labs LLC

30 N Gould St Ste R, Sheridan, WY 82801, USA

[email protected]