Privacy Policy

Last updated: 27 September 2026
Version: 2026-09-27-v1

1. Controller and contact

ONEMONUMENT
miint.studio mateusz ignaczak
NIP: 7322201096
ul. Andrzeja 21
95-100 Zgierz
Poland

Phone: +48 517 557 860
Website: onemonument.world

General: hello@onemonument.world
Legal: legal@onemonument.world
Privacy: privacy@onemonument.world
Moderation: moderation@onemonument.world
Appeals: appeal@onemonument.world

miint.studio mateusz ignaczak is the controller of personal data processed to operate ONEMONUMENT. Contact privacy@onemonument.world for privacy requests.

2. What we process

• Orders and payments: order ID, Unit quantity, base price/currency and verified total when available, status, timestamps, Stripe Checkout Session and PaymentIntent references, payment/refund/dispute state, and email supplied through Stripe. If you use FOUNDATION, Stripe collects a payment method through a no-charge SetupIntent before any discounted order. We retrieve its card fingerprint from Stripe on the server and store only a keyed hash, the promo code and completion time in D1 after the Piece is published. A short-lived reservation of that hash and order reference is kept in the Cloudflare coordinator while a discounted paid Checkout is unfinished; it is released if the payment session expires. Different wallet token fingerprints may count as different methods. Stripe may save the payment method to the Checkout Customer for this verification and later paid checkout; ONEMONUMENT does not initiate future automatic charges. Our application does not store full card numbers or security codes. Stripe hosts the payment and card setup forms and processes card and billing/tax data; we receive payment/setup objects for verification, but do not copy full billing/card details or the raw card fingerprint into our order database.
• Publication: your uploaded image, optional label and URL, image hash and storage keys, Piece ID/number and placement. Images are cropped/compressed in the browser before upload and validated and stripped of supported metadata by the backend. Our application upload limit is 500,000 bytes, accepting JPEG, PNG and WebP only. The original file selected for editing stays in your browser; the optimized crop is uploaded.
• Contract evidence: accepted document versions, acceptance timestamp recorded by the server, explicit Terms/Content Policy acceptance, immediate-performance request, withdrawal acknowledgement and the consent text/version.
• Moderation and support: reports (Piece, reason/category, time, status and a hash of a random browser identifier), moderation decisions, reason codes, evidence, appeal/support correspondence and email delivery records. Reports do not contain an application-stored IP address or user-agent fingerprint.
• Technical and security data: Cloudflare processes network requests, IP addresses and browser/request information to deliver and protect the service. The application uses the connecting IP transiently as a rate-limit key. It does not store IP addresses or user-agent/device profiles in D1. Structured application logs contain event types and order/session/event/Piece IDs, counts and error categories, not email addresses, request bodies, card data or secret tokens. Platform-generated request logs can contain request URL and technical metadata.

3. Purposes and legal bases

We process order, content and payment data to perform the contract and steps you request before it (GDPR Article 6(1)(b)), including publication, payment verification and recovery/reconciliation. We process records needed for tax/accounting and other legal duties under Article 6(1)(c). Moderation, reporting, appeals, security, abuse prevention, operational support and legal claims are based on legitimate interests under Article 6(1)(f), subject to your rights. Where a particular processing activity is based on consent, Article 6(1)(a) applies and you may withdraw it. The checkout request for immediate performance is a consumer-contract request, not blanket consent to marketing or unrelated data processing.

4. Public content

Your published image, optional label, URL, Piece/order reference, Unit count, date and placement are publicly accessible. Do not upload personal information you do not have the right to publish. Others may copy public content. Disabling it replaces the public image and link; it cannot recall copies already downloaded by others.

5. Services and recipients

Cloudflare provides hosting, D1 database, R2 image storage, CDN/cache, coordination, delivery, abuse prevention and traffic rate limiting. When you begin Add Piece, Cloudflare Turnstile helps distinguish legitimate users from automated traffic; it is not shown for ordinary WORLD or EXPLORE viewing. For security, bot prevention, abuse prevention and protection against infrastructure overload, Cloudflare may process your IP address, browser and device information, timestamps and other technical security signals. This processing is based on our legitimate interest in protecting the service (GDPR Article 6(1)(f)). Cloudflare acts as an infrastructure and security provider and may participate in international processing subject to its applicable data protection safeguards. Stripe provides hosted checkout, payment, fraud and tax functionality and may act as an independent controller for its own purposes. OVHcloud provides our contact mailbox and aliases. Resend is integrated for transactional confirmations and moderation emails; while delivery is disabled, emails remain in our outbox. Once activated, Resend receives the recipient email and necessary message content/delivery identifiers. We do not use it for newsletters.

The scene serves its fonts (DM Mono and Space Grotesk) from ONEMONUMENT's own static assets, delivered by Cloudflare. No third-party font service receives font requests or associated visitor data. We do not load analytics or advertising pixels. Turnstile is used for security, not marketing profiles.

Authorised personnel and providers receive data as needed; authorities or professional advisers may receive data where legally required or necessary for claims. Some providers process data outside the EEA. Applicable transfers use recognised safeguards such as adequacy decisions or standard contractual clauses, as appropriate. Contact us for information about relevant safeguards.

6. Retention

We retain Piece/content and placement records for the operation of the service. FOUNDATION promo redemption hashes are retained while the promotion operates to prevent reuse; abandoned payment-method reservations are released when the checkout expires. Orders, payment references and consent evidence are retained for applicable accounting/tax obligations and the periods needed to establish, exercise or defend claims; an erasure request does not override legal retention duties. Disabled originals are kept privately where needed for moderation, appeals, security or legal evidence. Reports, moderation history, correspondence and outbox records are reviewed for continued necessity and retained through resolution and any relevant legal-claim period.

The current backend has no automatic age-based deletion for orders, reports, moderation history or attached content; retention reviews and erasure requests require operator action. We do not promise an automatic deletion deadline that is not implemented. Published images have protective storage locks, so removal requests require assessment of the relevant retention restriction. Unreferenced orphan uploads become eligible for conservative cleanup after 31 days; referenced images are not deleted by that process. Cloudflare Workers logs on the current Free plan are retained for up to 3 days; native D1 recovery history is available for 7 days. Provider payment and mail records may also be subject to their own legal/security retention.

Aggregate page counter

The public VIEWS counter increments for each request to the main Monument page, including refreshes. It stores only one aggregate number, not individual visit records. It does not identify unique visitors or collect IP addresses, user-agent data, cookies or visitor identifiers. It uses no browser storage, analytics platform or external counting service.

7. Cookies and browser storage

The application sets no analytics/marketing cookies and has no advertising tracking. It uses necessary browser storage: sessionStorage holds an order access token for returning from payment; localStorage holds a random report-deduplication identifier created when you report content (until cleared). To prevent loss on refresh/back, IndexedDB stores your in-progress purchase draft, source image and optimized crop locally; drafts are removed on completion/explicit close and discarded after 24 hours when next accessed. Acceptance checkboxes reset after reload. Storage can be cleared in browser settings, but doing so may remove a draft or the ability to resume an order in that browser. Our legacy prototype's localStorage purchase data is not used for production purchases.

Hosting/security and Stripe's separate checkout may use technically necessary storage for their services. There is no optional analytics or marketing storage in this application requiring a cookie banner. No such tracking is enabled by accepting our terms.

8. Your rights

Subject to applicable conditions, you may request access, rectification, erasure, restriction, portability, or object to processing based on legitimate interests. You may withdraw consent where consent is the legal basis without affecting earlier lawful processing. The product's restriction on editing published content does not remove statutory data-protection rights: contact us rather than attempting to replace a Piece. We may need proportionate information to verify a request. Necessary order/content data is required to provide the service; without it we cannot complete publication.

You may complain to the President of the Personal Data Protection Office (Prezes UODO) in Poland or your competent supervisory authority. We do not use automated decision-making with legal or similarly significant effects to decide moderation outcomes; reports are reviewed by people.