Waitlist
When you join, Entangleverse Inc. (part of VX Encryption, a North South Industries company) collects your email address for one purpose: to tell you when sign-up opens. We do not sell it, share it for advertising, or send it to any third-party CRM. We keep it until you ask to be removed or until sign-up opens, whichever comes first. To be removed at any time, email consumer@northsouthindustries.io. The rest of this Privacy Policy gives the details and your rights.
1. Who we are
Entangleverse is Entangleverse Inc. (part of VX Encryption, a North South Industries company). Contact: consumer@northsouthindustries.io.
2. Privacy by design (with one important qualification)
The Entangleverse website (entangleverse.com) never receives your private vault, private keys, seed, or biometrics, and its API rejects those fields. Your keys and vault are generated and held on your device.
Biometrics are different, and are covered by the Biometric Notice, which we will publish before any biometric feature is offered. Our node software computes biometric templates on your device, and a sealed biometric reference package and a derived seed may be transmitted to and stored in our back-end under a seal the operator may be able to open. For that reason we do not claim that biometrics never leave your device; the Biometric Notice will describe exactly what happens.
3. What we collect
Waitlist (now): your email address, the consent version you accepted, the time you joined, and a keyed hash of your IP address. It is used only to tell you when sign-up opens. You can be removed by the link in our email or by emailing consumer@northsouthindustries.io.
Account sign-up (when it opens):
- your email address;
- a 6-digit email verification code (valid about 15 minutes, stored only as a hash);
- a TOTP authenticator secret (encrypted at rest with AES-256-GCM);
- a session cookie (30-day, HttpOnly; this is the only cookie; no analytics or ad trackers);
- a one-time node download link (valid 24 hours).
Node registration: your node's public address (vxp), a device public key, and a device name. The website API does not receive your private vault, private keys, seed, or biometrics, and rejects those fields. Biometric processing, and any back-end storage of a sealed reference package or seed, are described in the Biometric Notice, which we will publish before any biometric feature is offered.
Payments: made through Stripe Checkout (USD) for prepaid credits. We store your Stripe customer id, checkout session id, and a credits ledger. Card data stays with Stripe.
Email: sent over SMTP.
Server logs: our web server keeps standard access logs (IP address, time, page, user agent) for security and troubleshooting, retained for 30 days.
4. Why we process it, and legal bases (GDPR / UK GDPR)
Providing your account, the node, and platform services: performance of a contract. Verification and security (email code, TOTP, logs): legitimate interests. Payments and credits: contract and legal obligation. Waitlist and announcement email: consent.
5. Cookies
We use a single strictly necessary session cookie (30-day, HttpOnly). We use no analytics or advertising cookies or trackers, so no cookie consent banner is required for the cookie we use.
6. Sharing and subprocessors
We do not sell your personal data or share it for advertising. We use Stripe (payments), the hosting provider that runs the Entangleverse server, and our transactional email provider. We may disclose data to comply with law or in a merger, with notice where required.
7. International transfers
We process personal data in the United States. If you use Entangleverse from outside the United States, your information is processed in the United States. Where we transfer personal data from the European Economic Area or the United Kingdom, we rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum.
8. Retention
Waitlist entries: until you ask to be removed or sign-up opens, whichever comes first. Account data: for the life of your account and up to 90 days after it is closed, unless a longer period is required by law. Session records: until the session expires. Server logs: 30 days. Billing records: as required by tax law, typically seven years.
9. Your rights
You may request access, correction, or deletion of the data we hold, and withdraw consent, by emailing consumer@northsouthindustries.io. Depending on where you live, you may have rights under the GDPR, UK GDPR, or CCPA/CPRA. We cannot access or delete data that only ever existed on your device and that we never received. For biometric data, see the Biometric Notice: to the extent a sealed reference package or seed is stored in our back-end, you may request its deletion and withdraw consent.
10. Children, security, and changes
Entangleverse is not directed to children under 16, and we do not knowingly collect their data. We protect data with encryption of authenticator secrets, HttpOnly session cookies, and a design that keeps your keys on your device. We will post updates here with a new date. Contact: consumer@northsouthindustries.io.
Effective date: on publication.