Privacy policy
What we collect, why, and who else sees it.
Who is responsible
[OPERATING COMPANY], [STREET AND NUMBER], [POSTCODE] [CITY], Germany. Contact: hello@dubem.io.
What we collect
Only what the service actually needs:
- Your account — email address, a hashed password, and your name if you give one. We never store your password itself.
- Your sessions — an identifier, your IP address and browser user-agent, so you stay signed in and we can spot abuse.
- Your orders — what you bought, when, the amount, and the blockchain transaction that delivered it.
- Your vault — the blockchain address created for you.
- Page visits — path, referrer and country, kept on our own servers. We use no third-party analytics, no advertising trackers and no tracking cookies.
- Support messages — anything you send us through the contact form.
Cookies
Two, both strictly necessary and neither used for tracking: one keeps you signed in, one protects forms against cross-site request forgery. Because they are strictly necessary, no consent banner is required — and we do not show one.
Why we are allowed to
- Performing our contract with you (Art. 6(1)(b) GDPR) — account, orders, delivery, support.
- Legitimate interests (Art. 6(1)(f) GDPR) — keeping the service secure and preventing fraud.
- Legal obligation (Art. 6(1)(c) GDPR) — commercial and tax record-keeping.
Who else processes your data
These providers act on our instructions:
| Provider | Purpose | What they see | Where |
|---|---|---|---|
| Wert | Card payment processing | Name, email, payment details, purchase amount | EU |
| Crossmint | Custodial wallet for your collectibles | Email address | USA |
| Resend | Transactional email (confirmations, resets) | Email address | EU |
| Railway | Application hosting | IP address, request logs | EU |
| Neon | Database hosting | All account and order data | EU |
| Cloudflare | DNS, and a bot check on the contact form | IP address | Global |
Where a provider is outside the EU, transfers rely on the European Commission's standard contractual clauses.
Something we cannot undo
Blockchains are public and permanent. Once a collectible is transferred to your vault, that transaction — the address, the item and the time — is recorded on a public network by design. Neither we nor anyone else can delete or alter it. Deleting your dubem account does not and cannot remove it.
How long we keep things
- Account data: while your account exists, then deleted.
- Orders and invoices: up to 10 years, as German commercial and tax law requires.
- Sessions: expire after 14 days and are swept automatically.
- Support messages: 2 years.
Your rights
You can ask for a copy of your data, correction, deletion, restriction, or a portable export, and you can object to processing based on legitimate interests. Email hello@dubem.io. You may also complain to a data protection authority.
Last updated 11 August 2026.