Privacy Policy

Last updated: August 2026  ·  Version: Draft 1.2  ·  Applicable law: UK GDPR / Data Protection Act 2018

1. Who We Are

This privacy policy applies to worldwide-emporium.net and associated pages, operated as part of the Non Fungible Utilities Network (the "NFU Network" or "we"). The platform is currently operated by an individual in the United Kingdom. A formal legal entity is in the process of being established.

For data protection purposes, the operator is the data controller for waitlist registration data.

Contact: [email protected]

2. What Data We Collect and Why

3. The Marketplace — No Personal Data Required

The NFU Network marketplace is designed to operate without collecting personal information. To buy, sell, browse, or hold NFU positions, you need only an XRPL-compatible wallet (Xaman, Crossmark, or similar). The wallet connection is handled entirely by the wallet application — we receive a wallet address only, which is a pseudonymous public identifier on the XRP Ledger, not a name or contact detail.

Item metadata (photographs, descriptions, condition records) uploaded to IPFS via the platform is stored immutably on the IPFS network. Once pinned, it is publicly accessible by its content hash and cannot be deleted. Do not upload personal information as part of item metadata.

4. No Registration Required

This platform has no sign-up, waitlist, or registration process of any kind. To use the marketplace — browse, buy, sell, list an item, or claim a node position — you need only an XRPL-compatible wallet (Xaman or equivalent). No email address, name, or contact detail is collected at any point.

Community engagement and feedback takes place via X (formerly Twitter) and direct messages. No personal data is collected through those channels by the platform operator.

If you wish to contact the platform operator directly, you may do so at [email protected]. Any personal data included in such a message (your name, email address) is used solely to respond to your enquiry and is not retained beyond that purpose.

5. Wallet Addresses

XRPL wallet addresses are public identifiers — they are visible to anyone on the XRP Ledger by design. We display wallet addresses in the context of NFU ownership (e.g. "This NFU is owned by rXXXX…") as a feature of the blockchain's public nature, not as a disclosure of personal data.

Under UK GDPR, a public pseudonymous identifier may or may not constitute personal data depending on the context and whether it can be linked back to an identified individual. We treat wallet addresses with appropriate care and do not attempt to link them to personal identities.

6. Local Storage and Session Data

The platform makes extensive use of your browser's localStorage to cache NFT data, your selected network, and UI preferences. This data:

• Lives entirely in your own browser
• Is never transmitted to our servers
• Can be cleared at any time via your browser settings
• Does not constitute personal data processing on our part

We do not use session cookies for tracking purposes. See Section 11 for the cookies policy.

7. Lawful Basis

Because this platform collects no personal data in the ordinary course of its operation, no lawful basis for data processing is required for routine platform use.

Where personal data is processed incidentally, the lawful basis is:

• Legitimate interests (Article 6(1)(f)) — for the incidental display of public XRPL wallet addresses in the context of NFU ownership records. Wallet addresses are public blockchain identifiers by design; displaying them is necessary for the operation of a transparent provenance system and does not override data subject interests.
• Legitimate interests (Article 6(1)(f)) — for the processing of personal data included in direct enquiry emails, where responding to a contact request is the legitimate interest and the data is not retained beyond that purpose.

8. How Long We Keep Your Data

The platform does not retain personal data from routine use. Wallet addresses displayed in NFU ownership records are public blockchain data — they exist on the XRP Ledger permanently by the nature of the ledger and are not under our control to delete.

Personal data included in direct enquiry emails is retained only for as long as necessary to respond to the enquiry, and no longer than 12 months thereafter.

9. Who We Share Data With

We do not sell, rent, or trade your personal data to any third party.

The following third-party services process data incidentally in the operation of the platform:

• Cloudflare Pages — hosts the public-facing site. Cloudflare may collect aggregate, anonymised traffic data. See Cloudflare's privacy policy at cloudflare.com/privacypolicy.
• Filebase / IPFS — stores item metadata uploaded by users. Once uploaded to IPFS, content is publicly accessible by its content hash.
• Shared hosting provider (readergroup.co.uk) — hosts the waitlist endpoint and admin backend. Data is stored in the UK.
• Google Fonts — the platform loads fonts from Google Fonts. Google may log the request IP. To avoid this, fonts can be self-hosted.

We may also share limited data with third parties in these circumstances:

• Legal obligation — where required by law, court order, or at the request of a law enforcement or regulatory authority.
• Content moderation — where we receive a valid notice under our Terms of Use's content-moderation and admin-burn provisions, we may share limited information (such as an NFT ID and associated wallet address) with the requesting party as necessary to process the request.

No personal data is knowingly transferred to the United States or outside the UK/EEA beyond what is described above. Cloudflare and Google operate global infrastructure; their data handling is governed by their respective privacy policies and standard contractual arrangements.

10. Your Rights under UK GDPR

As a UK data subject you have the following rights in relation to personal data we hold about you:

To exercise any of these rights, contact [email protected]. We will respond within one calendar month. There is no charge for reasonable requests.

If you are unhappy with how we handle your request, you have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.

11. Cookies

The platform does not use tracking cookies, advertising cookies, or analytics cookies.

The platform uses browser localStorage (not cookies) to store cached data and preferences client-side. This is not subject to the same consent requirements as cookies under PECR in the same way, as it does not transmit data back to a server.

Third-party services (Cloudflare, Google Fonts) may set their own cookies as described in their respective privacy policies. We do not control those cookies.

12. Children

The platform is not directed at children under 13, and we do not knowingly collect personal data from children. If you believe a child has submitted data via the waitlist, please contact us for immediate deletion.

13. Changes to This Policy

We may update this privacy policy from time to time. The date of last update appears at the top of this page. Material changes will be communicated via a notice on the site. Continued use of the platform after an update constitutes acceptance of the revised policy.

14. Contact and Complaints

Data protection enquiries: [email protected]

To complain to the UK regulator: Information Commissioner's Office, ico.org.uk, 0303 123 1113.