Privacy Policy — Trinity

Effective / last updated: August 8, 2026.

Who we are. This Policy is issued by Trinity Intelligence Network [ENTITY FORM — CONFIRM], operating trinitycommand.io and related network services (the "Services"). Registered address: [REGISTERED ADDRESS — CONFIRM], Kaneohe, HI 96744, United States. Questions or requests: privacy@trinitycommand.io.

1. What this Policy covers

This Policy applies to personal information we process when you visit trinitycommand.io, create an account, connect a Solana wallet, buy a product, submit a form, chat with us, or otherwise use the Services. It applies to visitors and customers worldwide. Where the law of your location — for example, California (CCPA/CPRA) or the EU/UK (GDPR) — grants you specific rights, the relevant section below governs.

Third-party sites and services we link to (for example, Phantom wallet, OBELIQ, Celestial University, Solana explorers, and payment processors) have their own privacy policies. This Policy does not cover them.

2. What we collect and why

We collect only what the Services need to function. For EU/UK users, the GDPR legal basis is shown for each category.

Account

Data: email address; linked wallet address and the time it was verified (wallet_verified_at).
Why: create and secure your account; verify you own the wallet; gate access to account features.
Legal basis: contract; legitimate interests (account security).

Wallet authentication

Data: one-time sign-in nonces and your Sign-In-With-Solana (SIWS) signatures.
Why: prove wallet ownership without ever touching your private keys; prevent spoofing.
Legal basis: contract; legitimate interests (fraud prevention).

Technical and usage

Data: IP address (stored on sessions, activity events, and chat messages); pages visited; timestamps; device and browser information.
Why: run and secure the site, rate-limit abuse, keep audit logs, understand usage.
Legal basis: legitimate interests; legal obligation (security and records).

Chat

Data: messages you send us and the associated IP address and timestamp.
Why: respond to you and provide support.
Legal basis: contract; legitimate interests.

Leads and enquiries

Data: name, postal address, email, and phone number you submit through enquiry or build-request forms.
Why: respond to your enquiry; scope and deliver requested builds and services.
Legal basis: consent; steps prior to a contract.

Payments

Data: payment metadata from Stripe (for example product, amount, status, card last-4). We do not store full card numbers; Stripe handles card data as a PCI-DSS processor.
Why: take payment, prevent fraud, issue receipts, handle refunds.
Legal basis: contract; legal obligation (tax and accounting).

Cookies

Data: trinity_session (login) and trinity_visitor (visit tracking) — see Section 4.
Why: keep you logged in; basic first-party analytics.
Legal basis: legitimate interests (essential); consent (non-essential).

We do not intentionally collect special-category or sensitive data (health, biometrics, precise geolocation, government IDs). Please do not send it to us through forms or chat.

3. Where the data comes from

Directly from you — when you register, submit a form, chat, or buy.
Automatically — IP address, cookies, and usage data collected as you use the site.
From the Solana blockchain — your public wallet address and related public on-chain data, which we may read to verify wallet ownership and account entitlements.
From our processors — payment status and metadata from Stripe; email delivery and engagement data from our email provider.

4. Cookies and tracking

trinity_session — keeps you logged in after wallet or email authentication. Strictly necessary. Lasts for the session or until logout or expiry.
trinity_visitor — first-party visit tracking (live visitor counts, basic analytics). Analytics. Up to 12 months.

Strictly necessary cookies are always on because the site cannot function without them. For EU/UK visitors, non-essential cookies (the visitor/analytics cookie) are set only after you consent via our banner; you can withdraw consent anytime. You can also block or delete cookies in your browser, though the site may not work fully without the session cookie.

5. How we share it

We do not sell your personal information for money. We share it only with service providers ("processors") who help us run the Services, under contracts that limit them to our instructions:

Stripe — payment processing (card and billing data).
Resend — our email provider, for transactional and marketing email delivery.
Railway — our hosting and infrastructure provider, for running the application and database.
Analytics — first-party only. We do not use third-party analytics or advertising pixels (no Google Analytics, Meta Pixel, or similar trackers).
Legal and safety — to comply with law, enforce our Terms, or protect rights, property, or safety.
Business transfer — in a merger, acquisition, or asset sale, subject to this Policy.

Whether analytics or ad cookies count as a "sale" or "share" under California law is fact-dependent. If we ever add ad-tech that qualifies, we will honor opt-outs and update this Policy. See Section 9.

6. Wallets and the blockchain

On-chain wallet activity is read from the Solana public blockchain. On-chain transactions and wallet addresses are public, global, and permanent — we cannot edit or delete them, and neither can you. When you connect a wallet, others may be able to associate that address with your on-chain activity. We never receive, request, or store your private keys or seed phrase.

7. How long we keep it

Account data — for as long as your account is active, then up to [RETENTION PERIOD — CONFIRM, e.g. 24 months] after closure, unless a longer period is required by law.
Payment records — retained as required by tax and accounting law (commonly [TAX RETENTION — CONFIRM, e.g. 7 years]).
Logs, sessions, IP, chat — kept for security and troubleshooting, typically [LOG RETENTION — CONFIRM, e.g. 12 months], then deleted or anonymized.
Leads — kept while we pursue your enquiry and for a reasonable follow-up window, then deleted on request or after [LEAD RETENTION — CONFIRM].
On-chain data — cannot be deleted (see Section 6).

8. Your California (CCPA / CPRA) rights

If you are a California resident, the California Consumer Privacy Act as amended by the CPRA (Cal. Civ. Code §§ 1798.100 et seq.) gives you the right to:

Know / access — the categories and specific pieces of personal information we collected, the sources, purposes, and who we shared it with.
Delete — request deletion of personal information we hold about you (subject to legal exceptions).
Correct — request correction of inaccurate personal information.
Opt out of sale/sharing — see Section 9.
Limit sensitive information — we do not use sensitive personal information for purposes requiring a limit-right offer.
Non-discrimination — we will not deny service, charge different prices, or give lesser quality because you exercised a right.

How to exercise: email privacy@trinitycommand.io with your request. We will verify your identity (for wallet-linked accounts, we may ask you to sign a message from the wallet on file) and respond within the statutory timeframe (generally 45 days, extendable once). You may use an authorized agent.

Categories collected in the last 12 months: identifiers (email, IP, wallet address, cookie IDs); customer records and commercial information (purchases, payment metadata); internet/network activity (pages, chat, logs); and, for lead forms, name, postal address, email, and phone. We collect these for the purposes described in Section 2.

9. Do Not Sell or Share, and GPC

We do not sell your personal information for monetary consideration, and we do not "share" it for cross-context behavioral advertising as those terms are defined under Cal. Civ. Code § 1798.140. Because of that, there is currently nothing to opt out of. If this ever changes, we will post a clear "Do Not Sell or Share My Personal Information" link and honor requests.

Global Privacy Control (GPC). We recognize opt-out preference signals such as GPC. Under the CCPA regulations (11 CCR § 7025), when your browser or extension sends a valid GPC signal, we treat it as a request to opt out of any sale/sharing for that browser, automatically. To use GPC, enable it in a supported browser or install a GPC-enabled extension. Learn more at globalprivacycontrol.org.

10. Your EU / UK (GDPR) rights

If you are in the EEA or UK, the General Data Protection Regulation (EU) 2016/679 and the UK GDPR apply. Our legal bases for processing are listed in Section 2 (principally Article 6: contract, legitimate interests, consent, and legal obligation). You have the right to:

Access a copy of your personal data.
Rectification of inaccurate data.
Erasure ("right to be forgotten"), subject to exceptions.
Restriction and objection to processing based on legitimate interests or direct marketing.
Data portability — receive your data in a portable format.
Withdraw consent at any time, without affecting prior processing.
Lodge a complaint with your supervisory authority.

International transfers. We are based in the United States, so using the Services involves transferring your data to the U.S. Where required, we rely on appropriate safeguards [TRANSFER MECHANISM — CONFIRM, e.g. Standard Contractual Clauses]. EU/UK representative: [ART. 27 REPRESENTATIVE — CONFIRM or state not appointed]. To exercise any right, email privacy@trinitycommand.io.

11. Email and marketing

If you opt in (or are an existing customer), we may send marketing email about the network. Every marketing email includes a working unsubscribe link and our postal address, and we honor opt-outs promptly (within ten business days, consistent with the CAN-SPAM Act, 15 U.S.C. § 7704). You can also unsubscribe anytime by emailing privacy@trinitycommand.io. Transactional messages (receipts, security, account notices) are not marketing and may still be sent.

12. Children

The Services are for adults. They are not directed to children, and we do not knowingly collect personal information from anyone under 18 (or the age of majority where you live; under 16 at minimum for EU/UK). If you believe a minor gave us data, contact us and we will delete it.

13. Security

We use technical and organizational measures — encryption in transit (HTTPS), access controls, rate limiting, structured audit logging with secret redaction, and server-side authorization — to protect your data. No system is perfectly secure. If a breach affects your personal information, we will notify you and regulators as required by applicable law, including Hawaii's breach-notification statute (HRS § 487N) and, where applicable, the GDPR's 72-hour authority-notification rule.

14. Changes and contact

We may update this Policy as the Services or the law change. We will revise the "last updated" date above and, for material changes, provide a more prominent notice. Continued use after an update means you accept the revised Policy.

Data controller:
Trinity Intelligence Network [ENTITY FORM — CONFIRM]
[REGISTERED / POSTAL ADDRESS — CONFIRM], Kaneohe, HI 96744, USA
privacy@trinitycommand.io