Privacy Notice

1. Who we are

Mertl Luxury GmbH, a company registered in Austria (VAT number ATU76373979), trading as WalletOrigin, is the data controller for the personal data described in this notice. Our address is Seyringer Straße 5 / 256, 1210 Vienna, Austria. For any privacy question or rights request, email contact@mertl-luxury.com. You do not need an account to contact us.

2. Personal data we collect

• Account data: email address, login credentials (hashed), display name.
• Verification data: domain names, wallet addresses, DNS TXT records, chains, signed messages, cryptographic signatures and verification timestamps you submit.
• Support messages: content of messages you send us.
• Usage and telemetry: API request counts, feature usage, error logs.
• Device / network: IP address, user agent, approximate location derived from IP.
• Cookies and local storage: essential authentication/session storage and your consent preference; optional Google Analytics identifiers and usage data only if you accept.

3. How we use your data and legal basis

• Account creation and providing the Service — legal basis: performance of contract.
• Security, fraud prevention, abuse detection — legal basis: legitimate interests.
• Customer support — legal basis: performance of contract / legitimate interests.
• Optional Google Analytics — legal basis: consent (Article 6(1)(a) GDPR). Google Analytics is not loaded before you accept, and you can withdraw consent in Cookie settings.
• Operational diagnostics — legal basis: legitimate interests (Article 6(1)(f) GDPR) in keeping the Service reliable and secure; separate from optional visitor analytics.
• Compliance with law — legal basis: legal obligation.
• Marketing communications — legal basis: consent, where required.

4. Who we share data with

• Stripe — our payment processor. When you buy a subscription, Stripe collects and processes your billing information (name, billing address, payment method, tax data) for payment processing, subscription management, invoicing, and tax compliance. See Stripe's privacy notice.
• Lovable Cloud / Supabase — hosting, database, authentication and related service infrastructure. These providers process account and verification data to operate the Service.
• Google Analytics (Google) — optional website analytics, loaded only after your consent. It processes visit, page, device and interaction information to help us understand usage. Advertising storage and Google signals are not enabled by our integration. See Google’s privacy policy.
• Professional advisers — legal, accounting, and audit advisers where relevant.
• Authorities — where required by law, court order, or legitimate legal process.

When you enable public listing, your verified domain-to-wallet mappings, signed messages, signatures and DNS verification records are intentionally public through checks and proof pages. Private account data is not included.

5. International transfers

Data may be transferred outside the EEA to our service providers, including Google and Stripe. Where such transfers occur, we rely on appropriate safeguards such as Standard Contractual Clauses (SCCs) or an adequacy decision.

6. Data retention

We keep account and verification data for as long as your account exists plus a reasonable period afterwards for legal, audit, and dispute-resolution purposes. Data no longer needed is deleted or anonymised. To request account deletion or information about applicable retention periods, email contact@mertl-luxury.com. Records required by law, including billing records, may need to be retained. Your cookie choice is stored for 180 days; optional analytics identifiers are removed from this site when you reject analytics, but withdrawal does not erase data already collected by Google.

7. Your rights

You have the following rights, subject to legal exceptions: access, rectification, erasure, restriction, portability, objection, and withdrawal of consent, under Articles 15–22 GDPR. Withdrawal does not affect the lawfulness of processing before withdrawal. You may lodge a complaint with the Austrian supervisory authority, the Datenschutzbehörde (Austrian Data Protection Authority), or your competent EU supervisory authority. We respond to rights requests within one month, subject to permitted extensions under the GDPR.

8. Security

We use appropriate technical and organisational measures to protect your data, including encryption in transit, access controls, secure credential storage, and audit logging. No system is perfectly secure; you are responsible for keeping your credentials confidential.

9. Cookies

Essential cookies and browser storage authenticate signed-in users, secure sessions and remember your consent choice. They stay available whether you accept or reject analytics. Google Analytics and its cookies (such as _ga and _ga_*) are optional and are not loaded or set by this site until you select Accept. Accept and Reject are offered with equal prominence.

Use Cookie settings in the footer to review or change your choice anytime. Rejecting stops optional analytics and removes accessible Google Analytics cookies for this site; if analytics was already loaded, the page reloads to unload it. Your choice is remembered for 180 days in this browser, after which we ask again. Browser privacy settings can also clear stored choices.

10. Changes

We may update this notice from time to time. Material changes will be communicated by email or in-app notice.

11. Contact

To exercise your rights or for any privacy question, email contact@mertl-luxury.com or write to Mertl Luxury GmbH, Seyringer Straße 5 / 256, 1210 Vienna, Austria. No account or sign-in is required.