Privacy Policy

1. Who We Are

This Privacy Policy explains what personal data Andamio collects when you use our website, our app at app.andamio.io, our developer API and our community Discord, why we use it, who we share it with, how long we keep it, and the rights you have.

The controller of your personal data is Andamio, a corporation registered in the State of Wyoming, USA (filing number 2023-001360650), 2232 Dell Range Blvd, Suite 245, Cheyenne, WY 82009, USA. You can reach us about your data at privacy@andamio.io.

If you use Andamio through another organisation, such as an employer, a school or a club running a programme on our platform, that organisation may also be responsible for your data, or responsible instead of us. Section 8 explains what that means for your requests. Fans using the Barça Vision Lab also receive a privacy notice from FC Barcelona.

2. Information We Collect

Your account

• Your email address, and whether you have verified it
• Your wallet address and your access-token alias (your on-chain username)
• Your name and profile image, on older accounts where you gave them
• The date you accepted our terms, and the date you last signed in
• If you sign in with Google, Discord or X: our wallet provider, UTXOS, uses that sign-in to create and open your wallet

Your courses and contributions

• Courses and content you create or contribute to
• Your progress, and the courses and tasks you commit to
• The work you submit as evidence for assignments and tasks
• Credentials you earn, which are recorded on the Cardano blockchain (see section 8, "Erasure, and what we cannot delete")

If you are a customer or use our API

• Your email address, plan and API keys (we store keys only in hashed form)
• Billing records: your Stripe customer and subscription identifiers and the status of your plan. Your card details go to Stripe and never reach us

When you contact us or meet with us

• Your name, email address and what you write to us
• Notes or recordings of calls you have with us, where we tell you a call is being recorded or noted

In our community Discord

• Your Discord username, ID, roles and messages in our server
• Moderation records kept by our moderation bot
• If you link your account through our Discord bot: the link between your Discord ID and your alias, and the sign-in token the bot uses
• If a moderator withholds a role from you: a record of that, with the reason and who set it

Logs

• Request logs, which can include your IP address, wallet address and alias, used to run and secure the service
• A record of each sign-in and each failed sign-in attempt

What we do not collect

We do not run analytics or advertising trackers on our website or app. We keep request logs, including the page and your IP address, for 30 days, and build no record of your browsing beyond that. We do not carry out identity checks (KYC). We do not send marketing or promotional email.

3. Why We Use It, and Our Legal Basis

• To provide your account, courses, credentials and API access — because it is necessary to provide the service you signed up for (contract).
• To provide our service to customer organisations — the accounts of their learners rest on contract; the details of their administrators rest on our legitimate interest in running the service the organisation pays for.
• To bill customers — contract, and our legitimate interest in meeting our tax and accounting obligations.
• To run, secure and fix the service, and to investigate incidents — our legitimate interest in keeping the service available and secure. We keep these logs short, in the EU where we can, and limited to the people who operate the service.
• To run our community Discord — our legitimate interest in supporting the people who use Andamio.
• To answer your messages and keep records of our correspondence and meetings — our legitimate interest, or contract where you are a customer.
• To handle your data requests and record any data breach — legal obligation under the GDPR.
• To serve our website — our legitimate interest in serving and securing it.

Where we rely on legitimate interests, you can object, and we will stop unless we have compelling grounds to continue. See section 8.

4. Who We Share It With

We share personal data with the service providers we need to run Andamio. Most act only on our instructions, under data processing terms. Some, including Stripe, Discord and MEE6, also use data for their own purposes under their own privacy policies:

• Google (Google Cloud and Google Workspace): hosting, databases, logs, email and documents. Google's Gemini service currently helps us sort system alerts, which can include log text
• UTXOS (Singapore): your embedded wallet, social sign-in, and paying the network fees for your transactions
• Blockfrost (Five Binaries OÜ, Estonia): access to the Cardano blockchain
• Twilio SendGrid: sending verification and sign-in emails
• Stripe: payments and billing
• Discord, MEE6 and Railway: our community server, its moderation bot, and hosting for our own Discord bot
• GitHub: our internal tracking of data requests, which uses a reference number rather than your name
• YouTube (Google): videos embedded in lessons. When a lesson page with a video loads, your browser connects to YouTube, which receives your IP address. We use YouTube's privacy-enhanced mode (youtube-nocookie.com)

The Cardano blockchain is public. Records written to it, such as your alias, your wallet address and your credentials, can be read by anyone.

Organisations you learn through. When you use Andamio through an organisation, it can see your progress and the work you submit in its courses. For the Barça Vision Lab, FC Barcelona receives the answers you give in the onboarding quiz and when you completed it, and whether you have registered and connected a wallet.

Legal Requirements

We may disclose your information if required by law or in response to valid requests by public authorities (e.g., court orders or government agencies).

Business Transfers

If Andamio is involved in a merger, acquisition, or asset sale, your information may be transferred. We will provide notice before your personal information is transferred and becomes subject to a different privacy policy.

5. International Transfers

The platform is hosted on Google Cloud in the EU (Netherlands). Some of the providers listed in section 4 are established outside the European Economic Area, mainly in the United States, and UTXOS is in Singapore. Some of our monitoring tools also run in Google Cloud's US region.

Where personal data goes to a country without an EU adequacy decision, we rely on the European Commission's Standard Contractual Clauses, and for US providers certified under it, the EU-U.S. Data Privacy Framework (with the UK Extension and the Swiss-U.S. framework for UK and Swiss data). You can ask us at privacy@andamio.io for the safeguard relied on for a particular transfer.

6. How Long We Keep It

• Your account: deleted after 2 years without a successful sign-in
• Work you submit: 90 days from its last update, or longer while a request or dispute about it is open
• Sessions and sign-in tokens: 90 days
• Request logs: 30 days
• Records of sign-ins and failed sign-ins: 3 years
• Discord bot: the sign-in token for 90 days; the link between your Discord ID and alias while you are in our server, and deleted when you leave or after 2 years without activity; a record that a moderator withheld a role, on the same rule
• Accounts of a customer organisation's administrators: deleted within 30 days of their access ending
• Billing records: 7 years
• Correspondence with customers: the length of the agreement plus 6 years
• Meeting recordings and transcripts: 12 months, unless kept as a record of a decision
• Records of data requests: 3 years after the request is closed
• Records written to the blockchain: permanent; they cannot be deleted by anyone

When a programme run for an organisation closes, its course records and submitted work are deleted within 90 days. Your account stays on the 2-year rule, because you may use it elsewhere on Andamio. You can ask us to delete your data sooner at any time.

7. Data Security

We protect your data with encryption in transit and at rest, restricted access for the people who operate the service, and hashed storage of sign-in links, tokens and API keys. No method of transmission over the Internet or electronic storage is 100% secure, and we cannot guarantee absolute security. If a breach puts your rights at high risk, we will tell you.

8. Your Rights

If we hold personal data about you, you have the right to:

• Access it — get confirmation of whether we process your data, a copy of it, and information about how and why we use it
• Receive it in portable form — for data you provided to us that we process by automated means on the basis of consent or a contract, receive it in a structured, commonly used, machine-readable format
• Correct it — have inaccurate data rectified and incomplete data completed
• Erase it — have your data deleted, subject to the limits described below
• Restrict or object to processing — including withdrawing consent at any time, which does not affect the lawfulness of processing before withdrawal
• Complain — lodge a complaint with a data protection supervisory authority, and seek a judicial remedy

How to make a request

Email privacy@andamio.io. Tell us what you would like us to do: access, a copy of your data, correction, erasure, or an objection. You do not need to use any particular form of words, cite any law, or explain why.

You can also write to our Data Protection Officer at dpo@andamio.io. A request sent to either address reaches us and starts the clock. You are not required to use a particular channel.

What happens next

• We acknowledge your request, normally within two working days, and tell you what we will do next.
• We may ask you to confirm your identity. We ask only for what is proportionate, usually confirming control of the email address or account the data relates to. We do not ask for identity documents unless there is a specific reason, and where we do see one we record only that verification took place and delete the document.
• We may ask you to clarify what you are looking for if we hold a large amount of data, but only to help us find it, never as a condition of accepting the request.
• We carry out the request and tell you what we did.

How long it takes

We respond within one month of receiving your request. That is the deadline the law sets, and it is the deadline we work to. We may extend it by up to two further months where a request is particularly complex, or where you have made a number of requests. If we need to do that, we will tell you within the first month and explain why. Asking you to verify your identity does not stop the clock: the month runs from when your request reaches us.

Fees

Requests are free. In the rare case where a request is manifestly unfounded or excessive, for example repetitive requests for the same information, we may charge a reasonable fee based on our administrative cost, or decline to act. If we do either, we will explain why, and you can complain to a supervisory authority or seek a judicial remedy. If you ask for additional copies of data we have already provided, we may charge a reasonable fee for those copies.

What you receive

For access requests: a copy of your personal data, together with information about the purposes of processing, the categories of data, who we share it with, how long we keep it, where it came from, and your rights. If you request electronically, we respond electronically in a commonly used format unless you ask otherwise.

For portability requests: the data you provided to us, in a structured, commonly used, machine-readable format. We provide JSON, and will use another common format on request where we reasonably can. Access and portability are not the same and cover different data: portability covers only data you provided, processed automatically, on the basis of consent or a contract. If you want everything we hold, ask for access.

Erasure, and what we cannot delete

When you ask us to erase your data, we delete the personal records we hold about you across our systems, including your account, your authentication records, your profile and settings, your memberships, and any work or evidence you submitted.

Data recorded on a public blockchain cannot be deleted by us or by anyone else. That is a property of the technology, not a choice we make when you ask. Where your use of Andamio has caused information to be written to the Cardano blockchain, that record is permanent and publicly readable. Specifically, the following are written to the blockchain and are permanent:

• Your on-chain identifier (your alias) and wallet address, and the transactions linking them to credentials you earned
• Any credential you were issued: the record that it was issued, and to which alias
• Any text you typed into a submission description. When you commit to or submit an assignment or a task, the short description you write is placed on the blockchain exactly as you typed it. If you put your name, or anything else about yourself, into that text, it is permanent and public. Please do not put personal information into those fields.

What we do when you ask for erasure: we delete the off-chain data that links the on-chain record to you as an identifiable person. Once we have done that, the on-chain record no longer relates to an identifiable individual as far as our own systems are concerned. If someone else independently holds information linking that on-chain identifier to you, our deletion cannot reach it. Where you use Andamio through another organisation, that organisation may hold such a link, and you may need to make a request to them as well. We will tell you if we know this to be the case.

We also keep, and will tell you we have kept:

• Security and audit logs, for a defined period, to keep the service secure and to investigate incidents. These are access-restricted and are not used for any other purpose.
• A record that your request was made and what we did, which is how we demonstrate we complied.
• Financial and tax records where the law requires us to keep them.

We will never refuse to erase your data because you owe us money or have an active subscription.

If you use Andamio through another organisation

Where you access Andamio through another organisation, for example an employer, a school, or a partner running a programme on our platform, that organisation may be responsible for your data alongside us, or instead of us. Send your request to us anyway. We will not turn you away or tell you to go elsewhere. We will acknowledge it, act on whatever is ours to act on, and forward it to the other organisation and tell you we have done so. You are entitled to exercise your rights against either of us.

Complaints

If you are unhappy with how we handled your request, please tell us; we would rather fix it. You also have the right to lodge a complaint with a data protection supervisory authority in the EU member state where you live, work, or where you believe the problem occurred, and to seek a judicial remedy.

9. Children's Privacy

Our services are not intended for children under the age of 18. We do not knowingly collect personal information from anyone under 18. If we become aware that we have collected personal information from a child under 18, we will take steps to remove that information.

10. Data Protection Officer

We have appointed a Data Protection Officer (DPO). You can contact our DPO with any question or concern about your data.

11. Our Representative in the EU, the UK and Switzerland

Andamio is established in the United States. Under Article 27 of the GDPR, and the equivalent UK and Swiss laws, we have appointed DataRep as our representative. You and the supervisory authorities can contact DataRep about any matter relating to how we process your personal data. DataRep is separate from our Data Protection Officer.

Please address post to "DataRep", not to Andamio, so that it reaches them.

DataRep is also our legal representative under Article 13 of the EU Digital Services Act, registered in Ireland. For matters under the Digital Services Act, contact DataRep at digitalrequest@datarep.com, with "Andamio" in the subject line, through the same web form, by post to DataRep, 77 Camden Street Lower, Dublin, D02 XE80, Ireland, or by phone on +353 1 919 8899.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will post the new version on this page with a new version number and date, and if a change materially affects how we use your data, we will also tell you by email if we have your address.

13. Contact Us