1. Who we are
GetSmart Token is operated by Digital Financial Aid Corporation, a Florida 501(c)(3) non-profit organisation ("we", "us", or "our"). Our registered address is in the State of Florida, United States. You can contact us at hello@getstoken.org.
2. What data we collect
We collect only the minimum data required to provide our services:
- Account data — when you sign in with Coinbase OAuth we receive your Coinbase user ID, public wallet address, and optionally your email address.
- Course data — none. The “Agents & Assets” course is open on this website with no enrolment, no sign-up and no account. We do not know who has taken it.
- Blockchain data — token balances, credential award transactions, and on-chain activity are inherently public on the Base network.
- Communication data — emails you send us directly.
We do not use cookies of any kind — analytics, advertising, or functional. We do not use tracking pixels, fingerprinting, or any third-party tracking technology on this website.
3. How we use your data
- To create and manage your GetSmart Token account.
- To issue blockchain-verified credentials and $GETS token rewards.
- To respond to messages you send us about the course.
- To process donations and sponsorships (via Stripe — see Section 6).
- To respond to your enquiries and provide support.
- To comply with legal obligations.
We will never sell, rent, or share your personal data with third parties for marketing purposes.
3a. The CitiZen terminal and AI processing
Four of the ten course missions (1, 3, 8 and 10) let you talk to a CitiZen over the internet. What you type is sent to Google’s Gemini API to generate the reply, and is handled under Google’s API terms. Our endpoint is a stateless pass‑through: we write no prompt or reply to storage, and we keep no record of who sent what.
Mission 5 is different. The model is downloaded into your browser and runs on your own device with the network switched off, so nothing you type in that mission leaves your machine at all.
The remaining five missions (2, 4, 6, 7 and 9) use no AI, so nothing is sent anywhere. Please do not type personal information about yourself or anyone else into the terminal.
4. Legal basis for processing (GDPR)
If you are located in the European Economic Area (EEA) or the United Kingdom, we process your personal data on the following legal bases under the General Data Protection Regulation (GDPR):
- Contract — processing necessary to provide the services you have signed up for.
- Legitimate interests — fraud prevention, security, and improving our services.
- Legal obligation — complying with applicable laws and regulations.
- Consent — where we explicitly ask for your consent (e.g. marketing emails), which you may withdraw at any time.
5. Your rights (GDPR & CCPA)
Depending on your location, you have the right to:
- Access — request a copy of the personal data we hold about you.
- Rectification — ask us to correct inaccurate data.
- Erasure — ask us to delete your personal data ("right to be forgotten"), subject to our legal obligations.
- Portability — receive your data in a machine-readable format.
- Objection — object to processing based on legitimate interests.
- Restriction — ask us to restrict processing in certain circumstances.
- Withdraw consent — where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing.
Please note: on-chain credential data on the Base network is immutable by design and cannot be erased. We can, however, delete all off-chain data associated with your account.
To exercise any of these rights, email hello@getstoken.org. We will respond within 30 days.
6. Third-party services
- Coinbase OAuth — used for authentication. Coinbase's own privacy policy applies to data held on their platform.
- Stripe — used to process Pioneer Sponsor payments. Stripe's privacy policy applies to payment data. We do not store your card details.
- Base Network (Coinbase) — a public Layer-2 blockchain. Transactions are permanently public.
- Cloudflare Pages — used to host this website. Cloudflare may process technical request data (IP address, user-agent) per their privacy policy.
7. Cookies & tracking
We do not use cookies. This website does not set any cookies — not analytics cookies, advertising cookies, or session cookies. There is no cookie banner because there is nothing to consent to.
8. Data retention
We retain personal data for as long as your account is active or as needed to provide services. If you close your account, we delete off-chain personal data within 90 days, except where retention is required by law (e.g. financial records are retained for 7 years).
9. International transfers
Our servers are primarily located in the United States. If you are in the EEA or UK, your data may be transferred to and processed in the US. Where required, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission for such transfers.
10. Children's privacy
Our course is open to everyone and has no age minimum. Taking it requires no account and collects no personal data, so a child can learn from it without us knowing anything about them.
A GetSmart Token account is a separate step, needed only to claim badges and tokens. Anyone under 18 must have a parent or guardian approve that account before it is created, and before any badge or token is issued to them. Where local law sets a lower threshold for consent to data processing, the under-18 requirement above still applies, because the account also holds digital assets. Parents and guardians may contact us at any time to review or delete their child's data.
11. Changes to this policy
We may update this policy from time to time. We will notify registered users by email of any material changes and update the effective date at the top of this page.
12. Contact & supervisory authority
For privacy questions, contact us at hello@getstoken.org.
If you are in the EEA and believe we have not adequately addressed your concerns, you have the right to lodge a complaint with your local data protection authority (DPA).