Privacy policy
What we collect, why, and who else sees it.
Who is responsible
Jubbly Online Limited (company number 17563871), 51 Lavenham Road, Grimsby, DN33 3HJ, United Kingdom, is the controller of your personal data. Contact: hello@dubem.io.
What we collect
Only what the service actually needs:
- Your account — email address, a hashed password, and your name if you give one. We never store your password itself.
- Your sessions — an identifier, your IP address and browser user-agent, so you stay signed in and we can spot abuse.
- Your orders — what you bought, when, the amount, and the blockchain transaction that delivered it.
- Your vault — the blockchain address created for you.
- Page visits — path, referrer and country, kept on our own servers. We use no third-party analytics, no advertising trackers and no tracking cookies.
- Support messages — anything you send us through the contact form.
Cookies
Two, both strictly necessary and neither used for tracking: one keeps you signed in, one protects forms against cross-site request forgery. Because they are strictly necessary, no consent banner is required — and we do not show one.
Why we are allowed to
- Performing our contract with you (Art. 6(1)(b) UK GDPR / EU GDPR) — account, orders, delivery, support.
- Legitimate interests (Art. 6(1)(f) UK GDPR / EU GDPR) — keeping the service secure and preventing fraud.
- Legal obligation (Art. 6(1)(c) UK GDPR / EU GDPR) — commercial and tax record-keeping.
Who else processes your data
These providers act on our instructions:
| Provider | Purpose | What they see | Where |
|---|---|---|---|
| Wert | Card payment processing | Name, email, payment details, purchase amount | EU |
| Crossmint | Custodial wallet for your collectibles | Email address | USA |
| Resend | Transactional email (confirmations, resets) | Email address | EU |
| Railway | Application hosting | IP address, request logs | EU |
| Neon | Database hosting | All account and order data | EU |
| Cloudflare | DNS, and a bot check on the contact form | IP address | Global |
Where a provider is outside the UK or the EU, transfers rely on an adequacy decision or on standard contractual clauses (with the UK Addendum for UK transfers).
Something we cannot undo
Blockchains are public and permanent. Once a collectible is transferred to your vault, that transaction — the address, the item and the time — is recorded on a public network by design. Neither we nor anyone else can delete or alter it. Deleting your dubem account does not and cannot remove it.
How long we keep things
- Account data: while your account exists, then deleted.
- Orders and invoices: 6 years after the end of the financial year they belong to, as UK company and tax law requires.
- Sessions: expire after 14 days and are swept automatically.
- Support messages: 2 years.
Your rights
You can ask for a copy of your data, correction, deletion, restriction, or a portable export, and you can object to processing based on legitimate interests. Email hello@dubem.io. You may also complain to the UK Information Commissioner's Office (ico.org.uk), or, if you live in the EU, to the data protection authority where you live.
Last updated 5 November 2026.