vAPI Genesis Goose Eggs Privacy Notice

This Privacy Notice applies only to the vAPI Genesis Goose Egg application, selection, notices, and mint. It stands on its own and describes the campaign data flow from wallet connection through any completed mint. It is presented as a notice, not bundled into acceptance of the Official Rules or Campaign Terms. In the Safety step, one campaign-documents checkbox records those acceptances and, separately, acknowledgement that this Notice was read. That acknowledgement is not consent to data processing or marketing. Marketing consent for the email qualification route remains separate.

The controller is Echelon Finance Ltd, a corporation incorporated in the Republic of the Marshall Islands (registration no. 127117), operating vAPI Network for this campaign (the "Controller"). Its registered office is Trust Company Complex, Ajeltake Road, Ajeltake Island, Majuro, Marshall Islands MH96960. Campaign, legal, and privacy enquiries may be sent to [email protected].

Depending on the route and campaign stage, the Controller processes:

Data comes directly from the applicant, the connected wallet and authentication session, X when that route is authorized, the email and anti-abuse providers, the Controller's systems, and public Base records. The Controller does not purchase an applicant list for this campaign.

Campaign data is used to:

Where a legal basis is required, the Controller relies on steps requested before entering the campaign agreement and performance of that agreement for application and mint administration; legitimate interests for service security, abuse prevention, campaign integrity, troubleshooting, and legal claims; compliance with legal obligations for sanctions, tax, accounting, and lawful requests; and consent for marketing email.

An applicant may withdraw marketing consent at any time. That withdrawal does not cancel email qualification already completed or stop transactional campaign notices that are necessary to administer an application.

When an applicant chooses X, the applicant authorizes the campaign to request the configured Follow, Like, and Repost actions for the connected X account. The campaign records whether each action succeeded at that time. Continued following, liking, or reposting is not monitored for campaign eligibility.

OAuth state and PKCE protect the authorization flow. X access and refresh tokens are encrypted while needed and deleted after all three actions complete. X receives and processes information under its own terms and privacy practices.

When an applicant chooses email, the campaign records the email address, OTP challenge, verification outcome, consent version, and a cryptographic hash of the marketing-consent copy presented. OTP values are stored as hashes, expire after ten minutes, and have a limited number of verification attempts.

The verification-code email is the only campaign email without the safety word because the applicant creates it in the next step. The application receipt includes the word in its body and no action link. Applicants should ignore unexpected email and open vapinetwork.ai themselves.

Marketing consent starts unchecked and is requested separately from the campaign-document acceptances. The email qualification route currently requires that consent; applicants may instead use the X route without giving marketing consent. No campaign-marketing sender is enabled for the application-only launch. Unsubscribing after email verification does not remove an otherwise valid application.

Turnstile is validated by the server before email or X provider spending. BotD, a hidden honeypot, signed flow timing, rate-limit history, network and identity pseudonyms, and related request signals contribute to a rules-based assessment. BotD is a signal, not proof that a person is human, and the campaign does not create a persistent browser fingerprint.

An assessment returns allow, review, deny, or paused with a stable reason code. Suspicious activity may be quarantined before a paid provider call and reviewed by an authorized operator. Unresolved and rejected applications are excluded from the eligible draw snapshot; an approved application may continue. Applicants may contact the Controller to request the review available under applicable law.

After applications close, eligible applications are scored automatically using a locked allocation and a future finalized Base block hash. The applications with the lowest deterministic scores are selected. This process is a random draw, not behavioral profiling, but the result determines whether the connected wallet may mint.

The Controller retains the snapshot digest, entropy block, method, and audit record so the draw can be reproduced. The Official Rules describe the selection process; an applicant may contact the Controller to request any review available under applicable law.

Campaign data is available only to authorized Controller personnel and service providers that need it for the purposes above. Providers may include Supabase and PostgreSQL infrastructure, Redis, Cloudflare Turnstile, X, Postmark, wallet and authentication providers, Railway or other hosting and logging infrastructure, Base RPC providers, and professional legal, security, audit, tax, or compliance advisers.

Postmark receives the safety word in plaintext only when rendering and delivering a post-verification application receipt. The recipient's mailbox may retain that message. The word must therefore be treated only as a recognition phrase, not as a secret or authentication factor.

The Controller may disclose data when required by law, to protect applicants or campaign integrity, in connection with a lawful organizational transaction, or with the applicant's direction. The Controller does not sell campaign applicant data.

If the campaign or vAPI Network business is transferred to a successor, relevant campaign data may transfer with it. Echelon Finance Ltd remains the Controller until a controller transfer takes legal effect. If the controller changes, this Notice will identify the successor, effective date, jurisdiction, registration and contact details, and applicants will receive any notice or choice required by applicable law.

The Controller is established in the Republic of the Marshall Islands, and the Controller and its providers may process campaign data outside the applicant's country. Those locations may have different privacy laws. Where applicable law requires a transfer mechanism, the Controller uses an adequacy decision, approved contractual clauses, or another lawful mechanism and supplementary safeguard appropriate to the transfer. An applicant may request information about the applicable safeguard at the contact address above.

Different campaign records are kept for different periods. OTPs become unusable after ten minutes. Temporary X tokens are deleted after the required actions complete. Safety words stay encrypted at rest in campaign storage; the encrypted email retry payload is cleared after terminal delivery, while Postmark and the recipient's mailbox may retain the delivered word. Public blockchain records remain available through the network.

Incomplete application and short-lived security records are deleted or anonymized when no longer needed for the active campaign and abuse-prevention window. Submitted application, qualification, consent, legal-acceptance, selection, delivery, and mint audit records are retained for the campaign, any mint right, and the applicable tax, accounting, limitation, dispute, and enforcement periods, then deleted or anonymized where possible. The Controller reviews those criteria periodically. Public blockchain records cannot be deleted by the Controller.

A wallet address, contract interaction, token ownership, price transfer, transaction hash, and token ID recorded on Base are public and may be copied by others. The Controller cannot erase, reverse, or make a confirmed public blockchain record private. Applicants should not use a wallet address that they do not want publicly associated with a mint.

The campaign uses measures including SIWE wallet authentication, access controls, encryption of safety words and temporary tokens, hashed OTPs, purpose-bound cryptography, rate limits, bot challenges, short-lived OAuth state, and private no-store application responses.

No service or transmission is perfectly secure. Applicants must protect their wallet, email, X account, device, and recovery material. A matching safety word is necessary in post-verification campaign email but is not proof that a message is genuine. It is not authentication and must never replace opening the official domain independently or checking transaction details on the site.

Depending on applicable law, an applicant may have rights to request access, correction, deletion, restriction, objection, portability, consent withdrawal, or a review of certain automated processing, and may complain to a competent privacy authority. Rights may be limited where data must be retained for security, legal claims, compliance, or the integrity of public blockchain records.

To make a privacy request, email [email protected]. The Controller may request proportionate evidence of wallet ownership or email control before acting. The Controller will never ask for a seed phrase, private key, or safety word to process a privacy request.

The campaign is for adults aged 18 or older and is not directed to children. A material change to an active Privacy Notice will be published with a new version and any additional notice or consent required by law.

This is the Privacy Notice in force for the published version shown above. A material change will be published with a new version and any additional notice or consent required by law.