Privacy Policy (Draft)Privacy Policy (Draft)

草稿 — 尚未經律師審核，不構成正式條款 / 草稿 — 尚未经律师审核，不构成正式条款 / DRAFT — not yet reviewed by counsel; not binding

This is a working draft (version 0.1-draft). It describes how the OpenVPT software currently handles personal information so that counsel can review it. Text in [BRACKETS] is a placeholder that still has to be filled in. Until a final version is published, this draft creates no rights or obligations.

This Privacy Policy explains how [COMPANY LEGAL NAME] ("OpenVPT", "we", "us") collects, uses, shares and protects personal information when you use the OpenVPT website, its API and related services (together, the "Service"). OpenVPT is a marketplace for digital goods (source code, SaaS licences, websites, e-books, courses, design assets and digital services) where payments in USDC on the Base blockchain are held by a 2-of-3 multisig escrow smart contract and disputes are decided through platform arbitration.

Effective date: [EFFECTIVE DATE]. Version: 0.1-draft.

1. Who we are#

2. Summary#

• We collect what we need to run accounts, orders, escrow, delivery, disputes and support: mainly your e-mail address, your wallet addresses, what you list and buy, and what you write on the platform.
• We never receive your wallet's private key or recovery phrase. Your wallet signs transactions and messages on your own device.
• Payments and settlements happen on a public blockchain. Those records are public and permanent; nobody, including us, can delete or change them.
• We do not sell personal information and do not use advertising or analytics cookies today.
• Passwords are stored only as argon2id hashes; two-factor secrets and licence keys are encrypted; the contact form keeps only a salted hash of your IP address.
• Most data is currently kept without an automatic deletion schedule. Retention periods have not been defined yet (see section 9).
• To access, correct or delete your information, contact us through /contact?topic=legal.

3. Information we collect#

The tables below list what the Service stores today. "Visibility" says who can see the information inside the Service.

3.1 Account#

3.2 Two-factor authentication (2FA)#

If you turn on 2FA, we store the time-based one-time password (TOTP) secret encrypted with AES-256-GCM and a flag saying 2FA is enabled. 2FA is optional today.

3.3 Identity verification (KYC)#

Selling requires a verified identity status. Today the Service stores only a status value (none, pending, verified or rejected). The Service does not currently collect identity documents, selfies or other verification data, and no identity verification provider is integrated yet. We plan to use a third-party identity verification provider for sellers. Before that happens, we will update this policy to describe the data involved. [KYC PROVIDER AND DATA CATEGORIES — TO BE ADDED]

3.4 Wallets#

We never ask for or store private keys or recovery phrases.

3.5 Listings#

Title, description, category, price, payment token, network, platform fee rate, delivery type, delivery and inspection periods, image links you provide, review status, and (if a listing is rejected) the reason and the reviewer. Active listings are public.

Saved listings (favourites): if you save a listing, we store which listing you saved and when. Only you can see your saved listings; removing one deletes the record.

3.6 Orders and payments#

Buyer and seller account IDs, the wallet addresses used to pay and to receive funds, amount, fee, token, network, order status and its history (who or what triggered each change, and why), deadlines, timestamps, blockchain transaction hashes, the settlement split, and any cancellation request. We also read escrow events from the public blockchain and store them to keep order status in sync.

3.7 Deliveries#

When someone opens a delivery, we record an access log entry (see 3.13).

3.8 Disputes and evidence#

The reason for the dispute, text, links and files submitted as evidence (with file name and SHA-256 fingerprint), the assigned arbitrator, the ruling and its reasoning. Opening evidence files is logged.

3.9 Order chat#

Messages exchanged inside an order and their read status. Our systems scan each message automatically for contact details and off-platform payment signals (e-mail addresses, phone numbers, Telegram, WhatsApp, WeChat, external payment links, off-platform payment requests) and store the resulting risk flags with the message. Flagged messages are not blocked; the sender sees a warning. Administrators can read order chats (for example when handling a dispute or a safety issue). Arbitrators cannot access order chats in the current software; this may change, and we will update this policy if it does.

3.10 Reviews#

After an order ends, each party can leave one review: a rating from 1 to 5 and an optional comment. Reviews are public on the reviewed user's profile.

3.11 Notifications#

In-app notifications (type, title, text, related data, read status). Most notifications are also sent to your e-mail address.

3.12 Contact form#

Topic, optional name, e-mail address, subject, message, language, your account ID if you were signed in, the browser's user-agent string (cut to 300 characters) and a salted SHA-256 hash of your IP address (never the IP address itself). Submissions that our anti-spam checks treat as automated (a hidden field was filled in, or the form was sent within 3 seconds) are not stored as messages; we keep only a log entry with the reason, topic, language and the IP hash.

3.13 Security and technical records#

3.14 Cookies and browser storage#

We use a small number of cookies and browser storage entries that the Service needs to work. We do not use advertising or analytics cookies today. Full details: Cookie Policy.

We also read your browser's language setting (the Accept-Language header) to choose a language on your first visit.

3.15 Information we do not collect#

We do not collect wallet private keys or recovery phrases, payment card or bank details, government ID numbers (currently), or precise location.

4. How we collect information#

• From you: when you register, link a wallet, create listings, place orders, deliver, chat, open disputes, write reviews or contact us.
• Automatically: IP address, user-agent and similar request data (section 3.13), and browser storage (section 3.14).
• From public blockchains: escrow contract events on Base, such as funding and settlement.
• From other users: your counterparty's messages, evidence and reviews may contain information about you.
• From our staff: listing review decisions, dispute assignments and rulings, and account suspension reasons.

5. How we use information#

We do not use your information for targeted advertising, and we do not currently send marketing e-mails. Chat risk flags are automated but only produce warnings and records for review; they do not by themselves block you or decide a dispute.

6. How information is shared#

6.1 With other users and the public#

• Public: your display name, reputation score, whether your identity is verified, when you joined, your active listings and reviews about you.
• Your counterparty in an order: order details, the wallet addresses used, chat messages, deliveries, dispute evidence, settlement signatures.
• Arbitrators and administrators: the information needed to review listings, handle disputes, answer support requests and keep the platform safe.

6.2 With service providers#

We use service providers that process data for us. Only the providers below are used or configured in the current software; the named companies are placeholders until contracts are in place.

6.3 Third parties your browser contacts directly#

These parties handle data under their own privacy policies.

6.4 Other disclosures#

We may disclose information: to comply with law, a court order or a lawful government request; to protect the rights, property or safety of users, the public or OpenVPT; in connection with a merger, acquisition or sale of assets [NOTICE COMMITMENT — COUNSEL TO CONFIRM]; or with your consent.

6.5 No sale of personal information#

We do not sell personal information and do not share it for cross-context behavioural advertising. [COUNSEL TO CONFIRM UNDER APPLICABLE STATE LAW]

6.6 Services we may use in the future#

Our product plan includes the following. None of them is integrated today; we will update this policy before we start using them:

• an identity verification (KYC) provider for sellers;
• blockchain analytics for sanctions (OFAC) screening of wallet addresses;
• error monitoring and operational analytics tools.

7. Blockchain data is public and permanent#

When an order is paid or settled, the escrow contract on the Base network records, publicly and permanently:

• the buyer's and seller's wallet addresses;
• the token (USDC, issued by Circle), the amount and the fee;
• an order identifier derived from our internal order ID;
• the settlement split between seller, buyer and platform;
• transaction hashes and times.

Please keep in mind:

• Blockchain records cannot be changed or deleted by us, by you or by anyone else. A deletion request to OpenVPT does not remove on-chain data.
• Anyone can view the history of a wallet address. If your address can be linked to you (for example, through your own public activity), your transactions may be linked to you as well.
• Blockchain transactions are irreversible. Circle, the USDC issuer, and the Base network operate under their own terms; we do not send your account information to them.

8. Your choices#

• Browser storage: you can clear cookies and local storage in your browser. Signing out removes the stored tokens from that browser.
• 2FA: you can turn on two-factor authentication in your account.
• Wallet connection: you can disconnect your wallet from our site in your wallet software.
• E-mail: the Service currently sends transactional e-mails only, and there are no e-mail preference settings yet. [EMAIL PREFERENCES — TO BE DEFINED]

9. Retention#

We have not yet defined retention periods. This section describes what the software does today. We will set retention periods and update this policy. [RETENTION SCHEDULE — TO BE DEFINED]

Even after retention periods are set, we may keep some information longer where needed for legal obligations, disputes, fraud prevention or to enforce our terms.

10. Security#

Measures in place today:

• Passwords hashed with argon2id; sign-in is designed to take about the same time whether or not the account exists.
• Optional TOTP two-factor authentication; the TOTP secret is encrypted with AES-256-GCM.
• License keys delivered through the platform are encrypted with AES-256-GCM.
• Short-lived access tokens (15 minutes by default); refresh tokens are rotated and stored only as hashes, and reuse of an old refresh token revokes the whole session family.
• Rate limits on sign-in, registration, 2FA, token refresh and the contact form; temporary lockout after repeated failed sign-ins.
• The contact form stores only a salted hash of your IP address.
• Delivery and evidence files are downloaded only through short-lived signed links, and delivered files are fingerprinted with SHA-256.
• Role-based access control for arbitrator and administrator functions, and an audit log of sensitive actions.
• Non-custodial escrow: funds sit in a smart contract, and the platform cannot move them alone.

No system is completely secure. Sign-in tokens are kept in your browser's local storage, so keep your device and browser safe, turn on 2FA, and never share your recovery phrase with anyone, including people claiming to be OpenVPT staff. If we learn of a security incident affecting your personal information, we will notify you as required by law. [BREACH NOTIFICATION PROCESS]

11. Your rights#

Depending on where you live, you may have the right to:

• know and access the personal information we hold about you;
• correct inaccurate information;
• delete your information;
• receive a copy in a portable format;
• object to or restrict certain processing, and withdraw consent where processing is based on consent;
• appeal our decision on your request [APPEAL PROCESS];
• not be discriminated against for exercising these rights.

How to make a request: there are no self-service tools for these requests yet. Send your request through the contact form with the topic "Legal" at /contact?topic=legal, or e-mail [LEGAL CONTACT EMAIL]. Please write from, or mention, the e-mail address of your account. We will verify your identity before acting, for example by confirming control of that e-mail address, and respond within [RESPONSE PERIOD]. An authorised agent may make a request on your behalf where the law allows, with proof of authorisation.

Limits: we cannot delete on-chain records (section 7). We may need to keep some records, such as orders, disputes and audit logs, for legal obligations, open disputes, fraud prevention, or because they also concern another user. In those cases we may restrict or de-identify the information instead of deleting it. [DELETION / DE-IDENTIFICATION PROCEDURE — TO BE DEFINED]

12. U.S. state privacy rights (including California)#

[PLACEHOLDER — COUNSEL TO CONFIRM WHETHER THE CCPA/CPRA AND OTHER STATE PRIVACY LAWS APPLY, AND TO COMPLETE THIS SECTION.]

For reference, the categories of personal information described in section 3 map approximately as follows:

• Sources, purposes and recipients: sections 4 to 6.
• Sale / sharing: section 6.5. [GLOBAL PRIVACY CONTROL HANDLING — COUNSEL TO CONFIRM]
• Retention: section 9.
• Sensitive personal information is used only to provide and secure the Service. [COUNSEL TO CONFIRM "LIMIT USE" NOTICE]
• Other U.S. states: [STATE-SPECIFIC DISCLOSURES]

13. International users and data transfers#

[PLACEHOLDER — COUNSEL TO COMPLETE.] The Service is operated from the United States, and information is processed in the United States and in any other countries where our service providers operate. [LOCATIONS OF PROCESSING] If we serve users in the European Economic Area, the United Kingdom or other regions with data transfer rules, we will describe the transfer mechanism here. [TRANSFER MECHANISM] The Service may not be available in every U.S. state or country. [SERVICE AVAILABILITY / RESTRICTED JURISDICTIONS]

14. Children#

The Service is not directed to children. You must be at least [MINIMUM AGE] years old to use it. We do not knowingly collect personal information from children under 13. If you believe a child has given us personal information, contact us at /contact?topic=legal and we will delete it where required.

15. Changes to this policy#

We may update this policy. The version and "updated" date at the top show the current version. We will notify you of material changes by [NOTICE METHOD, e.g. e-mail or in-app notice] before they take effect where required by law.

16. Contact us#

• Contact form (topic "Legal"): /contact?topic=legal
• E-mail: [LEGAL CONTACT EMAIL]
• Mail: [COMPANY LEGAL NAME], [BUSINESS ADDRESS]

Notes for counsel / 給律師的待確認事項#

These notes are for the reviewing lawyer and will be removed from the published version.

1. Raw IP addresses. The contact form stores only a salted hash of the IP, but the audit log (audit_logs.ip), session records (refresh_tokens.ip) and the auth rate-limit cache keys store or use raw IP addresses. Please advise whether to hash these as well and how long to keep them.
2. No retention jobs. Apart from short-lived cache counters and lazy cleanup of SIWE challenges and idempotency records, nothing is deleted automatically. A retention schedule is needed for every table in section 9.
3. No self-service deletion or export. Rights requests are handled manually. Order, delivery, dispute and review records reference the user without cascading deletion, so full deletion of a user with order history is not possible as built; a de-identification procedure needs to be defined.
4. Sign-out is local only. Signing out clears the tokens in the browser; the refresh token stays valid on the server until it expires (30 days by default). Consider whether the security section needs to say more.
5. KYC. Today only a status value is stored. The product plan names a third-party KYC provider for sellers. If it uses biometric checks, Illinois BIPA, Texas CUBI, Washington law and similar laws may apply; the policy must be updated before launch. Confirm that the dev-only KYC_BYPASS flag is off in production.
6. OFAC / sanctions screening of wallet addresses is planned but not implemented; confirm disclosure wording and whether screening is required before launch.
7. Money transmission and escrow licensing. Confirm the analysis of the non-custodial 2-of-3 multisig design (FinCEN guidance, state money transmitter laws), New York (BitLicense; the plan blocks New York users in the MVP), California DFAL and California escrow agent rules, and whether any financial privacy rules (for example GLBA) could apply.
8. CCPA/CPRA and other state laws. Confirm applicability thresholds, the notice at collection, sensitive personal information (account credentials), "sale"/"sharing" analysis (Google Fonts, WalletConnect, image hosts), Global Privacy Control, and the other state laws that may apply.
9. GDPR / UK GDPR and other countries. The Service is offered in Traditional Chinese, Simplified Chinese and English. Decide the service area; if users in the EEA, UK, Taiwan, mainland China or elsewhere are served, local laws (GDPR, Taiwan PDPA, PRC PIPL and others) may apply, including legal bases, representatives and transfer mechanisms.
10. Children and minimum age. Registration does not ask for age today. Set [MINIMUM AGE] and decide whether an age gate is needed (COPPA, state laws).
11. Google Fonts are loaded from Google's servers on every page, which sends visitors' IP addresses to Google. Consider self-hosting the fonts.
12. Chat monitoring. Messages are scanned automatically for contact details and payment links, and staff can read chats in disputes. Confirm the disclosure and any consent needed (ECPA and state communications laws). Today administrators can read all order chats through the chat API; arbitrator access is planned (SPEC P2-12). Administrators and the arbitrator of a disputed order can also see decrypted licence keys and download delivery files. Consider an internal access policy.
13. Blockchain permanence conflicts with deletion rights; confirm the disclosure in section 7 is adequate.
14. E-mail. Only transactional e-mails are sent today and there is no opt-out; confirm CAN-SPAM position before any marketing e-mail.
15. Listing images are loaded from seller-provided external URLs, which exposes viewers' IP addresses to those hosts.
16. DMCA. A §512 designated agent must be registered with the U.S. Copyright Office ([DMCA AGENT NAME/ADDRESS]); takedown notices and counter-notices contain personal data that may be passed to the other party. Cross-reference in the Terms.
17. Tax reporting. Future tax reporting obligations for the marketplace (for example Form 1099 information returns) may require collecting taxpayer information; this policy would need an update.
18. Arbitration clause. The dispute resolution and arbitration terms belong in the Terms of Service; confirm enforceability and any interaction with privacy claims.
19. Breach notification. Define the incident response and notification process under state breach notification laws.
20. Encryption at rest. Only TOTP secrets and licence keys are encrypted by the application. Delivery and evidence files are not encrypted by the application; whether they are encrypted at rest depends on the storage provider's configuration. The draft deliberately does not claim file encryption; confirm before any such statement is made.
21. Placeholders to fill: [COMPANY LEGAL NAME], [ENTITY TYPE], [STATE OF INCORPORATION], [BUSINESS ADDRESS], [LEGAL CONTACT EMAIL], [EFFECTIVE DATE], [MINIMUM AGE], [RESPONSE PERIOD], the provider names in section 6.2, and the other bracketed items above.