This notice supplements our Privacy Policy and applies to California residents under the California Consumer Privacy Act as amended by the California Privacy Rights Act (collectively, "CCPA").
1. Categories of personal information we collect
- Identifiers (name, email, wallet addresses, IP).
- Customer records (payment metadata, KYC identifiers).
- Commercial information (purchase and staking history).
- Internet activity (device, browser, referrer, cookie IDs).
- Geolocation (approximate, IP-derived).
- Sensitive PI: government ID, biometric identifiers for KYC/liveness, and account credentials — used only to provide the service and meet legal obligations, not for inferring characteristics.
- Inferences (risk score, engagement score).
2. Sources
You, your devices, KYC vendors, blockchain networks, and analytics providers.
3. Purposes
Operate and secure the platform; comply with KYC/AML and sanctions law; prevent fraud; personalize content; measure performance; communicate with you.
4. Disclosures & sales
We do not sell personal information for money. We may "share" limited identifiers with analytics and advertising partners for cross-context behavioral advertising unless you opt out. Use the "Do Not Sell or Share My Personal Information" link in the footer or the Cookie settings control.
5. Your rights
- Right to know what we collect, use, disclose, and share.
- Right to delete (subject to legal retention obligations).
- Right to correct inaccurate PI.
- Right to portability.
- Right to opt out of sale/sharing.
- Right to limit use of sensitive PI to service-necessary purposes.
- Right to non-discrimination for exercising your rights.
6. How to exercise your rights
Submit a request through our Data Subject Access Request page or email privacy@mettaprotocol.app. We respond within 45 days (extendable once by 45 days). We honor authorized-agent requests with signed permission and identity verification.
7. Global Privacy Control (GPC)
We recognize the GPC signal as a valid opt-out of sale/sharing on the browser transmitting it.
8. Retention
We retain PI only as long as necessary for the disclosed purpose or as required by law (e.g. AML records for 5+ years). See our Privacy Policy for per-category schedules.
9. Children
The platform is not directed to children under 16. We do not knowingly sell or share PI of anyone under 16 without opt-in consent.
10. Contact
Metta Protocol Foundation — Privacy Team, privacy@mettaprotocol.app.