Privacy Notice

1. Identity and address of the data controller

“Nirium Protocol” (the “Project”) is the commercial name under which its founders operate; they are responsible for processing the personal data you provide. To date the Project does not operate under an incorporated legal entity. Contact: niriumprotocol@gmail.com.

Controller’s address: pending publication in this notice; meanwhile, any communication is handled at the email above.

2. Personal data we process

Depending on the service you use, we process:

• API keys: your Stellar wallet’s public address, the name you give the key, and the key itself stored only as a hash.
• Payouts on mainnet: the client’s legal name, RFC (Mexican tax ID) and legal representative’s name, and for each run the recipients’ addresses, amounts, asset and transaction hash.
• Access requests and contact: the data you send us to request access or write to us (for example company, RFC, representative’s name, email and phone).
• Treasury: vault addresses and their Manager addresses, to show you your vaults.
• Audit Trail: the hash you anchor and, in record mode, the JSON you send (up to 8 KB), which is published on IPFS for anyone with the CID. Do not put personal data in a record.
• Technical data: the IP address of each request, used at that moment for rate limiting and to apply jurisdiction restrictions; our hosting providers keep request logs for a limited time. We also measure visits in aggregate (see section 7).

We do not process sensitive or biometric personal data, and we do not custody funds: the software is non-custodial and every transaction is signed by the client.

3. Purposes of processing

We use the data for these purposes, all necessary for the service you request, so they do not require separate consent:

• Issuing and verifying your API keys and authenticating you.
• Building, broadcasting and recording the Payouts runs you sign.
• Identifying the Payouts client on mainnet, in case that activity is subject to Mexico’s anti-money-laundering law (LFPIORPI).
• Handling your access requests and replying to your messages.
• Rate limiting, abuse prevention and applying the restricted-jurisdictions policy.
• Measuring, in aggregate, how many visits the site gets, to improve it.

4. Processors and transfers

We do not sell your data. These providers (processors), which may be located outside Mexico, process it on our behalf and only to run the service: Supabase (database), Fly.io (agent servers), Vercel (site hosting and visit measurement), and Pinata and Filebase (IPFS storage).

Some third-party services process your data as independent controllers, under their own notices: Pollar, if you sign in with email or Google; Etherfuse, which runs its own KYC if you contract CETES with them; and your wallet provider. Nirium does not receive your sign-in data or your KYC.

Public by nature: wallet addresses and transactions on Stellar are public, and what is anchored on IPFS is available to anyone with the CID. Nirium cannot delete or change that information once it is on the network or on IPFS.

5. Options to limit use or disclosure

You can ask us to limit the use or disclosure of your data by writing to niriumprotocol@gmail.com. You can also revoke your API keys at any time at nirium.xyz/keys.

6. ARCO rights and how to exercise them

You have the right to know what data we hold about you (Access), to have it corrected (Rectification), to have it deleted from our records (Cancellation), and to object to its use for specific purposes (Opposition). To exercise them, write to niriumprotocol@gmail.com with your name, the right you want to exercise and the data it concerns, and attach proof of your identity or your representative’s.

We will send our answer within 20 business days of receiving the request and, if it is granted, carry it out within the following 15 business days; both periods can be extended once by the same length when the case justifies it (article 31 of Mexico’s Federal Law on the Protection of Personal Data Held by Private Parties, published in the Diario Oficial de la Federación on March 20, 2025 and in force from the following day). The competent authority is the Secretaría Anticorrupción y Buen Gobierno.

Cancellation cannot reach what is already public on Stellar or IPFS (see section 4), because Nirium does not control it.

7. Cookies, local storage and measurement

We use one technical session cookie, only while you manage your API keys at nirium.xyz/keys; one other technical cookie is set only for the Project’s administrators, never for visitors. The site stores preferences such as language, network and theme, and drafts you create, in your browser’s local storage; that information does not leave your browser. We measure visits with Vercel Analytics, which counts page views in aggregate without cookies. We do not use advertising cookies or pixels.

8. Changes to this notice

This notice may change because of new legal requirements, changes to our services or other reasons. We will publish each version on this same page, with its update date at the top.