1. Controller and scope
Tidy Money LLC, identified at the top of this page, is the controller for the processing carried out by this store and its support service. Privacy contact: sato@cuvex.io. This information concerns cuvex.io, orders, support, partners and communications; it does not claim that every app or blockchain function involves the same processing.
The store does not need your seed phrases, private keys, device passwords, PINs or secret cryptograms. Do not provide them. If we receive them accidentally, we will restrict access and assess their deletion and the necessary measures; we do not promise to detect every secret entered automatically.
2. Data, purposes and legal bases
| Processing | Main data | Purpose and basis where the GDPR applies |
|---|---|---|
| Purchase and delivery | Name, email, phone number, address, products, amounts and payment references | Perform the contract and manage delivery, warranty and returns; tax and legal obligations |
| BTC or USDC payment | Invoice/order reference, public addresses, transaction ID, network, amounts, status and timestamped exchange quotes | Execute and verify payment, reconcile and refund; legal obligations and legitimate interest in fraud prevention. We do not request seeds or private keys |
| Order access | Email, single-use verification link, temporary session | Protect and provide the requested access; performance of the service and legitimate interest in security |
| Support | Enquiry, authorised files, model, version and order reference where appropriate | Respond to the request, contract or legitimate interest in support; sensitive categories are not requested |
| Security | Limited logs of administrative access, events, errors and abuse controls | Legitimate interest in protecting services and people; applicable legal obligations |
| Email marketing | Email, language, preferences and evidence of permission | Consent or a documented legal exception where applicable; imports without evidence do not enable marketing on this platform |
| Optional analytics | Random identifier, session, page, events and approximate country | Consent where necessary; understand use and conversion. Without consent, we do not attempt to reconstruct visitors through fingerprinting |
| Optional advertising | Advertising/click identifiers, purchase event, amount, currency and technical reference for deduplication | Consent for measurement and advertising where applicable; we do not send names or emails to the implemented advertising module |
| Partners | Partner identity and contact details, code, attributed sales, adjustments and commissions | Contract and accounting; reports without buyer names, emails, phone numbers or addresses |
Required information is identified in the form. Refusing optional marketing, advertising or analytics does not prevent purchase. An incorrect delivery address or phone number may prevent shipment; we will request only information proportionate to the purpose.
3. Providers and recipients
We use AWS for infrastructure, storage and protection; configured email providers, such as AWS SES or OVH/Zimbra, for communications; FedEx for shipping; and, when enabled, OpenAI for answers based on approved information. BTC payments use our configured BTCPay Server instance; optional USDC payments use Cuvex SCP. Google and Meta receive optional events only when enabled and appropriately authorized. YouTube receives a connection when you open a video.
Providers may be processors or independent controllers depending on their services. We limit access and apply required contracts and safeguards. Authorities, advisers, insurers or incident specialists may receive necessary data on a lawful basis. Partners receive limited reconciliation references and commission information, not the customer database or wallet access. Market-data providers receive server-side requests about assets and currencies, not customer names, emails, shipping addresses or order contents; they may process the server IP and API account information.
Public addresses, amounts, identifiers and transaction data may be visible and replicated globally on a blockchain. They are pseudonymous and can be linked to individuals; we do not promise anonymity. We keep the necessary connection between a payment and an order off-chain. Do not put names, emails, postal addresses or secrets in public transaction fields.
Operating our own node does not make these records private or enable deletion from the network. We honor data-protection rights for processing under our control and limit retention as required by law; we do not promise to erase copies of a public blockchain held by third parties. Contract and accounting information remains off-chain under access controls. Each processing purpose and its safeguards must support applicable rights; irreversibility is not a general waiver of those rights.
4. AI support and incoming email
The assistant identifies itself as AI. The enquiry and relevant extracts of approved documentation are sent to the AI provider if enabled. The system does not give it unrestricted access to the database or private ChatGPT projects. Documents must be expressly imported and approved.
For order-related answers, we first verify access to the email. The model receives a limited status summary where appropriate, not credentials or authority to execute payments, refunds or changes. Incoming email may generate a draft for human review. An email's “From” field is not by itself considered proof of identity.
The API is requested with response storage disabled where the provider allows it. This does not imply absolute zero retention: the provider's abuse controls, logs and agreements may apply. We do not use this support to make solely automated decisions with legal or similarly significant effects on the buyer. You may request human intervention.
5. Historical data and change of entity
Importing data from a previous store requires checking its origin, the lawfulness of the transfer and information obligations. It does not automatically make a former buyer a Tidy Money LLC subscriber. Unsubscribes and suppressions are retained, and evidence of consent is documented where it is to be relied upon. A new incompatible purpose will require the corresponding legal basis.
6. International transfers
Hosting resources in an AWS region does not guarantee that all access or processing remains there. The controller and certain providers may operate from the United States or other countries. Where the GDPR or another transfer rule applies, we will use a valid mechanism: an adequacy decision applicable to the entity and service, standard contractual clauses or another legal safeguard, with assessments and supplementary measures where appropriate.
Participation by Tidy Money LLC or any provider in an adequacy framework is not presumed. You may request information on the safeguards applied and an accessible copy of relevant safeguards, while protecting legitimate confidential information.
7. Retention and minimisation
Verification links expire after 20 minutes and verified order access after 30 minutes. The store session has an operational duration of one hour from its last renewal and normally ends when the browser is closed. The durations of optional preferences and analytics identifiers are detailed in the cookies policy.
The initial configuration retains analytics events for up to 90 days and anonymises the content of closed enquiries after 365 days, unless there is a documented need or legal retention requirement. The controller must approve and apply a schedule for orders, invoicing, warranties, disputes and logs in accordance with each jurisdiction; they will not be retained indefinitely by default without a purpose. Backups have limited cycles and restricted access; a restoration must reapply unsubscribes and suppressions.
Deletion may be delayed or limited where there are justified retention obligations, claims or security grounds. Data retained for those reasons will be limited to those purposes. Minimal suppression lists are maintained to avoid sending campaigns to people who have unsubscribed.
8. Rights and choices
Depending on applicable law, you may access, rectify, erase, restrict, object, request portability or withdraw consent. Use the rights form or sato@cuvex.io. We will verify identity proportionately before disclosing or changing data; do not request or send unnecessary documents or secrets.
You may withdraw from marketing through any marketing email and change analytics or advertising choices in the footer. If a law such as the CCPA/CPRA applies, we will respect the relevant rights and signals, including Global Privacy Control for advertising. The categories of data “sale” or “sharing” may have a broader legal meaning than charging for a list. We do not presume an exemption without assessing the legal criteria. We do not discriminate unlawfully for exercising rights.
You may complain to the competent data protection authority, including the authority of your habitual residence in the EU where appropriate, or another competent authority. You do not have to exhaust an internal complaint procedure where the law does not require it.
9. Security, minors and changes
We apply role-based access controls, MFA for the manager in production, encryption in transit and at rest, operation logging, upload validation and incident management. No control guarantees zero risk. We will assess and communicate incidents where required by law, distinguishing commercial data from keys that the store must not receive.
The store is not specifically directed at minors and does not knowingly request children's data for marketing. If you believe a minor's information has been received improperly, contact the controller.
Future versions will identify their date. We will communicate material changes and obtain necessary permissions before new uses that require them. Publishing a policy does not replace those permissions.
If the corporate mailbox is connected, its configured provider, including OVH or Zimbra where applicable, processes mail under its agreements. SMTP/IMAP access is limited to configured functions and folders over protected connections. Support drafts require human review before sending; an email sender alone does not verify identity for order access. These connections are optional.
Payments and scope of this version
New orders have a USD reference price. BTC is accepted through BTCPay Server and, only when enabled, native USDC on Solana through Cuvex SCP. Card payments are not offered. The sales terms govern exchange quotes and refunds. This version does not retrospectively change contracts or rights arising from earlier purchases.