Privacy notice

Who is responsible

Marcus Bransbury is the data controller for this site (postal details on the terms of sale). For anything in this notice, email contact@tlenft.com.

What we collect

• The website and/or X handle you type in. This is public identity data you give us directly, and it is published — see below.
• A public profile image, logo or favicon associated with that X handle or website. We automatically retrieve and cache one image for your listing. If neither can be found, we generate a monogram instead.
• Purchase records: the amount, the time, the payment status and Stripe’s reference for the payment. We do not store your name, email address or any card details in our database.
• Your payment details go directly to Stripe, our payment processor. We never see your card number. Stripe holds your email address so it can send you a receipt, and holds it as its own controller under its privacy policy.
• Anything you send through the contact form — your email address and your message, kept only until the matter is dealt with.
• Standard server logs kept by our hosting provider, which include IP addresses. These are used to keep the site running and to investigate abuse.
• Anonymous usage counts. How many people view each page, roughly where in the world they are, what kind of device they are on, and which of a handful of actions they take — starting a purchase, finishing one, using a share button.
• Outbound click records: which numbered owner link was followed, whether it was a website or X link, where on this site it was clicked, and the time. We publish totals. We do not add an IP address, browser identifier or the visitor’s destination URL to that record.

Those counts come from Vercel Web Analytics. It sets no cookies and stores nothing on your device: visitors are counted using a hash derived from the request, which Vercel discards after 24 hours. It cannot identify you, and it cannot follow you to any other site. Before anything is recorded we strip X handles and payment references out of the web address, so the page you were on is all that is ever counted. See how Vercel handles it.

We use no advertising or tracking cookies. Nothing on this site profiles you or makes automated decisions about you.

Why, and on what legal basis

• To carry out your purchase — taking payment, transferring ownership, showing you as owner. Legal basis: performance of our contract with you.
• To publish The Bloodline and click totals — the running record of who has owned it, their public image and links, and the traffic those links have received. Legal basis: performance of our contract and our legitimate interest in the site working as described, which you are told about before you buy.
• To keep the site secure and prevent fraud. Legal basis: our legitimate interests.
• To see how the site is used — anonymous, aggregated counts only, never anything tied to a person. Legal basis: our legitimate interest in knowing whether the thing works.
• To keep financial records. Legal basis: our legal obligations (tax records are kept for six years).

Your public identity travels

The website or handle you enter, and the public profile image or logo we resolve from it, are displayed on the site, included in The Bloodline, and may be included in the deed, receipt and social-card images the site generates. Those pages and images are meant to be shared, and can be reposted, cached by social networks and search engines, and saved by other people.

We can remove or replace your identity and links on our site and stop generating new images with them. We cannot claw back copies that other people already hold or have posted. Please bear that in mind before submitting anything.

Who we share it with

Only the suppliers that make the site work: our hosting provider, our database provider, Stripe, and Unavatar, which receives only the public X handle or website domain needed to resolve an image — never payment details, email addresses or visitor data. Some of them process data outside the UK; where they do, transfers are covered by the UK “International Data Transfer Agreement” or an adequacy decision. We do not sell your data or share it for marketing.

How long we keep it

• Purchase records: six years from the end of the relevant tax year, because HMRC requires it.
• Public identities, cached public images, owner pages and outbound click records in The Bloodline: indefinitely, unless you ask us to remove identifying information.
• Server logs: as long as our hosting provider retains them.

Your rights

Under UK GDPR you can ask us to:

• tell you what we hold about you, and give you a copy;
• correct anything that is wrong;
• erase your public identity, cached image and links from the site — we will replace them with “[removed]” in The Bloodline and stop generating images naming you. We keep the underlying payment and aggregated click records where we are legally required to;
• restrict or object to how we use it;
• receive it in a portable format.

Email contact@tlenft.com. We will reply within 5 working days and act within one month.

If you are not happy with how we have handled it, you can complain to the Information Commissioner’s Office at ico.org.uk, or call 0303 123 1113. We would appreciate the chance to fix it first.

Children

This site is not intended for anyone under 18 and we do not knowingly collect data from children. If a child’s identity has ended up on the site, email us and we will remove it.

Changes

If we change this notice we will update the date at the top. See also our terms of sale.