// DATA PROTECTION & PRIVACY

Privacy Policy

Last Updated: October 2026 GDPR Compliance: Regulation (EU) 2016/679 Data Controller: DOFAMINE

Data Minimization: Dofamine never asks merchants or their users for private keys, seed phrases or banking credentials.

01. Data Controller & Scope

This Privacy Policy explains how DOFAMINE ("Dofamine", "we", "us") collects, safeguards, and processes operational and technical data when merchants and partners interact with our settlement infrastructure, APIs, and website.

Contact for Data Protection: [email protected] / [email protected].

02. Categories of Information We Process

We process only the data needed to provide the Services:

Applications from this website: company or project name, contact email or Telegram handle, expected volume, website, and the IP address and browser user agent of the submission, used to process the application and prevent abuse.
Merchant Onboarding Information: Corporate name, operating website, jurisdiction, designated business email, authorized Telegram contact handle, and the documents required for business verification (KYB).
Technical Network Telemetry: Public blockchain transaction hashes (TXIDs), public deposit vault addresses, gas execution metrics, API latency benchmarks, and webhook delivery status codes.
Server Diagnostic Logs: Source IP addresses, timestamped endpoint requests, and HTTP user-agent headers processed for rate limiting, DDoS mitigation, and firewall protection.

Private Keys: Dofamine never asks merchants or their users for private keys or mnemonic phrases.

03. Legal Bases for Processing (GDPR Art. 6)

We process data exclusively under recognized lawful bases:

Contractual Performance (Art. 6(1)(b)): To configure merchant API credentials, process payments, send payment notifications and calculate partner markups.
Legitimate Interests (Art. 6(1)(f)): To maintain protocol uptime, prevent abusive traffic, identify illicit network attacks, and protect infrastructure security.
Legal Compliance (Art. 6(1)(c)): To comply with mandatory statutory accounting, anti-sanctions screenings, and regulatory inquiries.

04. Cookies & Local Storage

This website sets no tracking, profiling or advertising cookies and loads no third-party trackers. To understand how the site is used, our own server counts page views and clicks on the main buttons, together with the referring site and campaign tags of the link you followed; nothing is stored in your browser for this, and server logs are kept for 30 days. Session storage keeps one key (dofamine-perf) with the animation quality level chosen for your device.

05. Data Retention & Security Architecture

Storage: Our servers are located in data centres in Finland and Germany. Some service providers we use (for example, email delivery) may process data outside the EU.

Encryption: Data in transit is encrypted with TLS (HTTPS).

Retention: Operational server logs are kept only as long as needed for security and diagnostics, and are then deleted.

06. Data Subject Rights (GDPR / Global)

Under GDPR and international privacy regulations, merchant representatives have the right to request:

Access to the corporate contact data we hold about your organization.
Rectification of inaccurate or outdated contact information.
Erasure of corporate contact profiles upon termination of the merchant agreement (subject to statutory audit retention obligations).
Restriction or objection to processing where applicable.

To exercise any of these rights, contact our Data Protection Officer at [email protected].

07. Changes to This Policy

We may update this Privacy Policy from time to time to reflect evolving technical capabilities or regulatory standards. Material updates will be posted on this page with an updated revision date.