Privacy Policy

DataExpansed LLC ("Company", "ChainChum", "we", "us" or "our") operates the ChainChum marketplace at chainchum.app ("Service"). This Privacy Policy explains what information we collect, how we use it, who we share it with and how, how we protect it, and your rights regarding your data. By using the Service, you agree to the practices described below.

#1. Information We Collect

#1.1 Information you provide

• Account information: email address, the name and profile picture from your sign-in method, your display name and handle, and authentication credentials (managed by our authentication provider).
• Age confirmation: the time you confirmed you are 18 or older, the version of the Terms you accepted and the network (IP) address you confirmed from.
• Shop and listings (sellers): shop name and details, location, shipping profiles, listings, photos and the files you sell as digital downloads.
• Art Vault: the photos and notes you keep privately.
• Classes (teachers and parents): a teacher's class names, schedule and place, the numbered codes printed for each class, and the photos of children's drawings a teacher takes after a lesson. A parent who joins with a code gives us the time they joined, the consent they gave and the code they joined with. We never ask for a child's name, face or birth date (see section 12).
• Orders: what you bought or sold, the shipping name and address, the billing country and postal code needed for sales tax, and order history.
• Support messages: what you write to us and our replies.
• Payment information: card and wallet details go directly to our payment processor and never reach our servers. Sellers give the payment processor their identity and bank details to receive payouts; we see only whether that setup is complete.

#1.2 Information collected automatically

• Log data: IP address, browser type, pages requested, access timestamps and error logs (collected by the application monitoring built into our cloud hosting platform).
• Download activity: when and how many times a purchased file is downloaded.
• Push subscriptions: if you turn on notifications, the browser's push endpoint for your device.
• Analytics (Google Analytics, with your consent; see section 10): the pages you view, given as the page's type rather than its address on account, studio and class pages, the actions you take on them (such as starting a checkout or joining a class), your device and browser type, an approximate location derived from your IP address, and a random identifier stored in a cookie. We do not send your name, email, shop, orders, codes or any child's drawing to Google Analytics, and admin pages send nothing.
• Session replays and heatmaps (Microsoft Clarity, with the same consent; see section 10): on public pages only (the home page, Explore, listings, shops, certificates, guides and help), how the page is used: clicks, taps, scrolling and mouse movement, and a reconstruction of the page with all text masked, so what you type or read is never sent. Clarity never runs on account, studio, Vault, class, order, sign-in or admin pages, and it receives no name, email, user id or any child's drawing.

We remove location and camera details from photos before they are shown.

#1.3 Information derived from your data

• Screening results: whether a listing photo was flagged as possibly AI-generated, and the reviewer's decision.
• Certificates: a fingerprint (content hash) of a work's details and photos, recorded when the work is sold.

#2. How We Use Your Information

We use your information to:

• create and run your account, shop, Vault and listings;
• process orders, payments, sales tax, refunds and seller payouts, and deliver digital downloads;
• send emails and notifications about your orders and account (receipts, shipping, payouts, sign-in codes), and, unless you turn them off, a reminder when something you started is unfinished (see section 11);
• show each parent the drawings from their own child's class, and nobody else;
• understand which pages help and where people get stuck, using Google Analytics and Microsoft Clarity where you allow it (section 10);
• issue and verify certificates of authenticity;
• keep the marketplace safe: screening photos for AI-generated images, and detecting and preventing fraud, abuse and security threats;
• respond to your questions and support requests;
• comply with legal, tax and accounting obligations and enforce our Terms of Service.

We do not sell your personal information. We do not share your data with advertisers or data brokers, and we do not send marketing email.

#3. AI Data Processing

ChainChum uses third-party AI services in three places:

• Listing suggestions: only when a seller asks, the listing's photos and details are sent to our AI provider to suggest a title, tags and description. Nothing is published until the seller accepts it.
• AI-image screening: listing photos are checked by an image-screening provider for signs of AI generation.
• Class photo check: each photo a teacher uploads is checked by our AI provider for a person's face, a written name or anything else that could identify a child, before any parent sees it. What it flags goes to the teacher, and if the teacher asks, to a ChainChum staff member. The result is stored with the photo; the check never guesses who a child is.

What is sent is the listing's or class photo and details, not your email, address, orders or payment details. Your Art Vault is never sent to AI providers. Our AI providers do not use this data to train AI models and retain it only for a limited period under their API data-usage policies.

#4. Who We Share Information With

The other side of your order. When you buy a physical work, the seller sees your name, the shipping address and what you bought, so they can ship it. Sellers do not see your email address or payment details. Buyers see a seller's shop name, profile and location as shown on the shop page.

Service providers. We use a small set of third-party service providers to operate ChainChum, disclosed here by category. Each processes only the minimum data necessary for its purpose, acts on our instructions as a service provider, and may not use your data for its own purposes:

Service	Purpose	Data shared
Authentication provider	Sign-in, sessions, account security	Email, name, profile picture, sign-in tokens
Payment processor (PCI DSS Level 1)	Payments, sales tax, fraud screening, refunds, seller payouts	Order amounts, billing and shipping address, payment method (card data never touches our servers); sellers' identity and bank details
Cloud hosting provider (United States)	Hosting, databases, file storage, application monitoring	All Service data, encrypted as described in section 6; error traces
Email delivery provider	Sending our emails	Email address, email content
AI provider	Listing suggestions, only when a seller asks; the class photo check	Listing photos and details; class photos
Image-screening provider	Checking listing photos for AI-generated images	Listing photos
Analytics provider (Google Analytics), only with your consent	Measuring which pages help and where people get stuck	Page types, actions, device and browser type, approximate location, a random cookie identifier
Session replay and heatmap provider (Microsoft Clarity), only with your consent, public pages only	Seeing where a page confuses people, to fix it	Clicks, taps and scrolling, the page layout with all text masked, device and browser type, approximate location, a random cookie identifier

You may request the current list of providers and the data each receives at any time via chainchum@dataexpansed.com.

Teachers and parents. A teacher sees which numbered codes in their class have been joined, never a parent's email. A parent sees only their own child's drawings, the class name and the teacher's shop name. A class drawing is never public, never listed for sale and never shown in search.

The public. Published listings, shop pages and certificate pages are public by design. Certificates may record a fingerprint of the work on a public blockchain; that record contains no personal information.

Authorities and others when the law requires it, or to protect the rights, property or safety of our users, the public or ChainChum.

A buyer of our business, if ChainChum is sold or merged, under this policy.

AI assistants. ChainChum offers read-only tools, built on the Model Context Protocol ("MCP"), that let AI assistants search public listings and verify certificates. They return only information that is already public on the Service, never your account, orders or Vault.

#5. How Information Is Disclosed

• To sellers, through their Studio sales page while they are signed in, and only for their own orders.
• To service providers, over encrypted (TLS) connections to their published APIs, limited to what each needs for its task.
• To authorities, only in response to a valid legal request, and only what the request requires.

We never publish or share your email address, payment details or Vault.

#6. Data Security

We take the security of your data seriously and implement multiple layers of protection:

• Encryption at rest: all data is encrypted at the database and storage level.
• Encryption in transit: all connections use TLS (HTTPS). Database connections require SSL.
• Payment security: payment processing is handled entirely by our payment processor (PCI DSS Level 1 certified). We never store, process or transmit card numbers.
• Access controls: every request is checked on our servers, so you can see and change only your own account, listings, orders and files. Purchased files are private and delivered only through short-lived download links issued to the buyer. Our services reach the database and storage with managed identities and the least access they need; secrets live in a key vault, not in code, and logs mask tokens and personal details.
• HTTP security headers: HSTS, Content Security Policy, X-Content-Type-Options, X-Frame-Options and Referrer-Policy headers are enforced.

No system is perfectly secure. If a breach affects your personal information, we will tell you and the authorities as the law requires.

#7. Data Retention

• Account data: retained while your account exists. When you close your account we delete your profile, shop, listings, Vault and photos; copies in backups are removed within 90 days.
• Order and tax records: retained for as long as tax law requires (usually seven years), including after account closure. Certificates for works you sold remain valid for their buyers, with your name replaced by former owner, account deleted.
• Class drawings: kept until the parent or the teacher deletes them, the parent leaves the class, or 30 days after the teacher closes the class (parents are told and can download them first). A photo nobody tags with a code is deleted after 14 days.
• Analytics: Google Analytics keeps event data for 14 months, then deletes it. Microsoft Clarity keeps session replays for 30 days (longer only for a replay we mark as a favourite to fix a problem) and heatmap data for up to 13 months.
• Logs: retained for up to 90 days.
• Payment records: retained by our payment processor under its retention policy and applicable tax and accounting laws.

#8. Your Privacy Rights (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) give you specific rights regarding your personal information.

#Categories of personal information we collect

• Identifiers: name, email address, IP address.
• Commercial information: orders, purchases and sales.
• Geolocation-adjacent information: shipping addresses, and a seller's shop location.
• Internet or electronic activity: log data, download activity and, with your consent, analytics about the pages you view.
• Characteristics: your confirmation that you are 18 or older (we do not collect your birth date).

#Your rights

• Right to know: you may request the categories and specific pieces of personal information we have collected about you.
• Right to delete: you may close your account from Me › Close my account or ask us to delete your information.
• Right to correct: you may correct your details in Me, or ask us to.
• Right to portability: you may download everything we hold about you from Me › Download my data, at no charge.
• Right to opt out of sale or sharing: we do not sell or share your personal information for cross-context behavioral advertising.
• Right to non-discrimination: we will not discriminate against you for exercising any of these rights.

#"Do Not Sell or Share My Personal Information"

ChainChum does not sell your personal information and does not share it with third parties for cross-context behavioral advertising. We have no financial incentive programs that involve selling consumer data.

#Global Privacy Control (GPC)

We honor the Global Privacy Control signal. If your browser sends it, Google Analytics and Microsoft Clarity do not load unless you choose otherwise on ChainChum itself, and we treat it as an opt-out of any sale or sharing (we do neither).

#How to exercise your rights

Email chainchum@dataexpansed.com or use Me (data download, account closure). We will respond to verifiable requests within 45 days.

#9. Additional State Privacy Rights

Residents of Connecticut, Virginia, Colorado, Utah, Texas, Oregon, Montana, Delaware, New Jersey, New Hampshire, Maryland and Minnesota may have additional privacy rights under their respective state laws. These generally include the right to access, delete, correct and port your data, and the right to opt out of targeted advertising (which ChainChum does not engage in). To exercise them, contact chainchum@dataexpansed.com.

#10. Cookies and Tracking

ChainChum uses a minimal set of cookies and local storage. These are necessary for the Service to work:

• Authentication cookies: set by our authentication provider to keep you signed in (strictly necessary).

• Preferences: a cookie that remembers your theme (strictly necessary for the experience).

• Checkout: our payment processor sets cookies on its checkout page to prevent fraud (strictly necessary).

• Region: a cookie that says only whether you are in the United States (cc_region, one day), so we know whether to ask before analytics load.

• Joining a class: while you join, the code from the slip is kept in a cookie for up to a day so it never appears in a web address.

Analytics cookies (optional). With your consent we use Google Analytics, which sets the _ga and _ga_<id> cookies (up to two years) to count visits. In the United States they are on unless you choose Decline; everywhere else they load only after you choose Accept. A Global Privacy Control signal counts as Decline. You can change your choice at any time with Cookie preferences at the bottom of every page. Google Analytics runs with IP anonymisation, with Google signals and ad personalisation off, and it never receives a user id.

With the same consent, Microsoft Clarity sets the _clck (one year) and _clsk (one day) cookies to tell one visit from another, and Microsoft may set its MUID cookie on its own domain. It runs on public pages only, masks all text, and has advertising storage turned off. Choosing Decline stops it at once and removes its cookies from ChainChum.

We do not use advertising cookies or retargeting pixels, and we do not engage in cross-site tracking.

#11. Email Communications

We send transactional emails: sign-in codes, order receipts, shipping and delivery updates, download notices, payout notices, class notices to parents and support replies. These are necessary to run your account and orders and cannot be unsubscribed from. We may also send a reminder when something you started is unfinished (a shop without payouts, a draft listing, a checkout you left), at most one every three days; each has a one-click unsubscribe link, and you can turn them off in Me › Notifications. They never show other works or promotions. We do not send marketing email. If you join the waitlist on chainchum.app, we keep your email address with our email provider (Resend) to tell you when ChainChum opens and to send occasional progress notes before then; each of those emails has an unsubscribe link, and you can ask us to delete the address at any time. Every email identifies DataExpansed LLC as the sender and includes our physical mailing address.

#12. Children's Privacy

ChainChum is not directed to individuals under the age of 18. We do not knowingly collect personal information from minors, and we do not allow a child's name, face or birth date in listings. Classes are the one place children's work appears: a teacher photographs drawings after a lesson, and each drawing goes only to the parent who joined with that child's code. The photo is checked for faces and names first, the teacher is told to photograph the drawing only, and a drawing with a written name can never be made public. A parent can delete any drawing, or leave the class, at any time. If we learn that we have collected personal information from a child under 18, we will promptly delete it. If you believe a minor has provided us with personal information, please contact chainchum@dataexpansed.com.

#13. International Users

ChainChum is operated from the United States. If you access the Service from outside the United States, your data is transferred to, stored and processed in the United States, which may have data protection laws that differ from those in your country. By using the Service, you consent to that transfer.

Wherever you live, we honor requests to access, correct, delete or export your personal information as described in sections 8 and 9. Depending on where you live (for example the European Union or the United Kingdom), you may also have the right to restrict processing and to complain to a data protection authority.

#14. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or a prominent notice within the Service at least 14 days before the changes take effect. The "Last updated" date at the top of this page reflects the most recent revision.

#15. Contact Us

If you have questions about this Privacy Policy or wish to exercise your privacy rights, please contact us at:

ChainChum c/o DataExpansed LLC, 6 Landmark Square, 4th Floor, Stamford, CT 06901, USA

Email: chainchum@dataexpansed.com · Customer support