> ## Documentation Index
> Fetch the complete documentation index at: https://docs.usmewe.com/llms.txt
> Use this file to discover all available pages before exploring further.

# GDPR Compliance

> How usmewe handles personal data under GDPR

# GDPR Compliance

usmewe is committed to protecting user privacy and complying with the General Data Protection Regulation (GDPR).

## Overview

<Note>
  usmewe processes minimal personal data. Most protocol data is on-chain and pseudonymous.
</Note>

## Data We Collect

### On-Chain Data (Public)

| Data                | Purpose            | Storage         |
| ------------------- | ------------------ | --------------- |
| Wallet addresses    | Protocol operation | BASE blockchain |
| Transaction history | Protocol operation | BASE blockchain |
| Trust Score         | Protocol operation | BASE blockchain |
| Loan records        | Protocol operation | BASE blockchain |

<Info>
  On-chain data is pseudonymous. We don't link wallet addresses to real identities unless you provide that information.
</Info>

### Off-Chain Data

| Data            | Purpose                    | Storage   | Retention      |
| --------------- | -------------------------- | --------- | -------------- |
| Email address   | Notifications              | Supabase  | Until deletion |
| Profile name    | Social features            | Supabase  | Until deletion |
| Device tokens   | Push notifications         | Supabase  | Until deletion |
| IP address      | Security, abuse prevention | Logs      | 30 days        |
| Usage analytics | Product improvement        | Plausible | Anonymized     |

## Your Rights

Under GDPR, you have the following rights:

<CardGroup cols={2}>
  <Card title="Access" icon="eye">
    Request a copy of your personal data
  </Card>

  <Card title="Rectification" icon="pen">
    Correct inaccurate personal data
  </Card>

  <Card title="Erasure" icon="trash">
    Request deletion of your data
  </Card>

  <Card title="Portability" icon="download">
    Export your data in a readable format
  </Card>

  <Card title="Restriction" icon="pause">
    Limit how we process your data
  </Card>

  <Card title="Objection" icon="hand">
    Object to certain processing
  </Card>
</CardGroup>

## Exercising Your Rights

### Data Export

Export your off-chain data:

```bash theme={null}
curl -X GET "https://api.usmewe.com/v1/users/me/export" \
  -H "Authorization: Bearer YOUR_TOKEN"
```

Response includes:

* Profile information
* Notification preferences
* Activity history (off-chain)

### Account Deletion

Request account deletion:

1. Go to **Settings** > **Privacy** > **Delete Account**
2. Confirm your decision
3. We'll process within 30 days

<Warning>
  On-chain data (wallet transactions, Trust Score history) cannot be deleted from the blockchain. Only off-chain data linked to your account will be removed.
</Warning>

### Data Correction

Update your information:

```bash theme={null}
curl -X PATCH "https://api.usmewe.com/v1/users/me" \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"displayName": "New Name"}'
```

## Legal Basis for Processing

| Processing          | Legal Basis          |
| ------------------- | -------------------- |
| Protocol operation  | Contract performance |
| Security measures   | Legitimate interest  |
| Email notifications | Consent              |
| Analytics           | Legitimate interest  |
| Marketing           | Consent              |

## Data Protection Measures

<AccordionGroup>
  <Accordion title="Encryption" icon="lock">
    * TLS 1.3 for all connections
    * AES-256 encryption at rest
    * End-to-end encryption for sensitive data
  </Accordion>

  <Accordion title="Access Control" icon="key">
    * Role-based access control
    * Principle of least privilege
    * Regular access audits
  </Accordion>

  <Accordion title="Data Minimization" icon="minimize">
    * Collect only necessary data
    * Automatic deletion after retention period
    * Anonymization where possible
  </Accordion>

  <Accordion title="Security Testing" icon="shield">
    * Regular penetration testing
    * Bug bounty program
    * Continuous monitoring
  </Accordion>
</AccordionGroup>

## International Transfers

Data may be transferred to:

| Region        | Safeguard                    |
| ------------- | ---------------------------- |
| United States | Standard Contractual Clauses |
| EU            | No transfer needed           |

## Data Processors

We use the following third-party processors:

| Processor | Purpose        | Location           |
| --------- | -------------- | ------------------ |
| Supabase  | Database, auth | USA (EU available) |
| Railway   | Hosting        | USA                |
| Plausible | Analytics      | EU                 |

All processors are bound by Data Processing Agreements (DPAs).

## Cookies

usmewe uses minimal cookies:

| Cookie        | Purpose        | Duration | Type       |
| ------------- | -------------- | -------- | ---------- |
| `session`     | Authentication | Session  | Essential  |
| `preferences` | User settings  | 1 year   | Functional |

<Note>
  We don't use tracking or advertising cookies.
</Note>

## Governance and Privacy

Governance proposals affecting user data must:

1. Include privacy impact assessment
2. Pass with 60% majority (higher threshold)
3. Allow 30-day opt-out period

## Data Breach Notification

In case of a data breach:

1. We'll notify affected users within 72 hours
2. Report to relevant supervisory authorities
3. Document the incident and remediation

## Contact

For GDPR-related inquiries:

* **Email**: [privacy@usmewe.com](mailto:privacy@usmewe.com)
* **DPO**: [dpo@usmewe.com](mailto:dpo@usmewe.com)
* **Address**: \[Company Address]

## Updates to This Policy

We may update this policy. Significant changes will be:

* Announced via email
* Posted in-app
* Subject to 30-day notice period

Last updated: January 2025

<Card title="Privacy Policy" icon="file-lines" href="#">
  Full privacy policy
</Card>