1. Data Controller
Lumen-Labs, an association governed by Articles 60 et seq. of the Swiss Civil Code, with its registered seat in Geneva, Switzerland (the "Association," "we," "us," or "our"), is the data controller responsible for the processing of your personal data when you use the Carpe Diem Protocol (the "Protocol").
Address: c/o ExpertFid & Audit SA, Rue du Rhône 80, 1204 Genève, Switzerland
Contact: info@lumen-labs.ch
2. Scope
This Privacy Policy applies to all personal data processed through the Protocol, including its smart contracts, operator backend, frontend interfaces, and related services. It should be read in conjunction with the Terms of Use and the Risk Disclosure.
This Privacy Policy is issued pursuant to the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR"), the Swiss Federal Act on Data Protection (revised, in force since 1 September 2023, "nLPD"), and applicable cantonal and international data protection laws.
3. Personal Data We Process
| Data category | Examples | Purpose |
|---|---|---|
| Wallet address | Ethereum address (0x...) | Authentication, credit balance, deposits, API keys, on-chain settlement |
| Pseudonymized wallet hash | HMAC-SHA256 digest | Usage records, billing statistics, country evidence for VAT |
| Email address (email accounts only) | The address you sign in with | Sign-in codes and links, account notices, linking a partner application, support |
| Account address (email accounts only) | An address derived from your email, with no private key | Internal identifier for your credits and API keys |
| Session data | Session token (JWT), renewal token (stored hashed), device label, disclaimer consent flag | Authentication, signing out of all devices |
| Card purchase records | Stripe event and Checkout identifiers, pack, amount, card country, refund or dispute status | Crediting purchases, refunds, accounting and VAT |
| Partner application data (if you use one, e.g. Sub Rosa) | Your identifier at the partner, the email the partner confirmed, device identifier and name | Issuing API keys to your devices, revoking them |
| Sign-in with your Carpe Diem account (if you use it to sign in to an application, e.g. Sub Rosa) | An identifier for you that is specific to each application, the pending sign-in request (the application, its return address, the email address you entered), and, with each sign-in code, a keyed hash of your network address prefix (never the address itself). If the address you sign in with has no Carpe Diem account yet, signing in creates one: you are asked to accept the Terms of Use and this Privacy Policy first, and we record the date and the version of the texts you accepted | Signing you in to that application; opening your account; limiting code guessing and the blocking of your sign-in by others |
| AI inference requests and responses | Text, image, audio and video requests | Service delivery; processed in transit and not stored by the Operator, except a short-lived cache: a generated image you share by link (1 hour, readable by anyone holding the link) and a generated video until you download it (10 minutes) |
| Voice samples (voice cloning only) | The audio sample you upload | Creating a cloned voice; relayed to Venice.ai through a provider's Venice account, not stored by the Operator. Venice.ai keeps it 7 days at an unlisted address that does not require authentication; the Operator keeps that address inside the TEE and never shows it to anyone |
| Cloned-voice records (voice cloning only) | The handle we give you, the provider key the voice lives on, your wallet, the date you confirmed the speaker's consent (when given through the API; this confirmation is becoming mandatory) | Speaking the voice only for your account, until it expires |
| Usage events | Tokens consumed, model, cost, timestamp | Billing, dynamic pricing, analytics |
| Country | Two-letter country code, per day | Geo-restrictions, sanctions compliance, VAT location evidence |
| IP address | IPv4/IPv6 | Rate limiting and geo-restriction, looked up inside the TEE and, for the website and its geo-restriction, by the website server; visitor counting, kept only as a daily keyed hash; referral claims, kept as a keyed hash together with a hash of your browser's user agent. The Operator does not write IP addresses to its logs. The website server keeps them shortened in its access logs, and in full for about a day only to block abusive scanners automatically (see Section 7) |
| Points and referrals | Weekly points, streak, rank, referral codes | Protocol participation tracking |
We do not collect: names, postal addresses, phone numbers, government-issued identifiers or KYC documents. For card payments, your card details and billing address are collected and processed by our payment processor (Stripe), not by us.
4. Pseudonymization
Usage records and the daily country evidence identify you only by an HMAC-SHA256 of your wallet address, computed with a secret key held exclusively within the Operator's Trusted Execution Environment (TEE). This constitutes pseudonymization — not anonymization — within the meaning of GDPR Recital 26 and nLPD Art. 5(a). The GDPR and nLPD apply to pseudonymized data.
Other Operator records keep your wallet address itself, because it is needed to credit deposits, settle on-chain and authenticate you: credit balances, API keys, payment records, points, referrals and sessions. Email accounts keep the email address itself, inside the TEE, so that sign-in codes can be sent.
The HMAC key is protected as a critical security asset. If the key were compromised, pseudonymization would become reversible.
On-chain data (deposits, settlements, payments made from a wallet) is recorded on the Base L2 blockchain using the original wallet address. Blockchain transactions are publicly and permanently visible and cannot be deleted or modified after recording.
5. Legal Bases for Processing
| Processing activity | Legal basis (GDPR) | Legal basis (nLPD) |
|---|---|---|
| Wallet authentication and session management | Art. 6(1)(b) — performance of contract | Art. 31(1) — contractual necessity |
| Email account management and sign-in emails | Art. 6(1)(b) — performance of contract | Art. 31(1) — contractual necessity |
| AI inference request proxying | Art. 6(1)(b) — performance of contract | Art. 31(1) — contractual necessity |
| Routing a request to a third-party inference market | Art. 6(1)(b) — performance of contract | Art. 31(1) — contractual necessity |
| Billing and usage tracking | Art. 6(1)(b) — performance of contract | Art. 31(1) — contractual necessity |
| Card payment processing, refunds and disputes | Art. 6(1)(b) — performance of contract | Art. 31(1) — contractual necessity |
| Accounting records and VAT location evidence | Art. 6(1)(c) — legal obligation | Art. 31(1) — justified by law |
| On-chain settlement | Art. 6(1)(b) — performance of contract | Art. 31(1) — contractual necessity |
| Partner application key issuance and revocation | Art. 6(1)(b) — performance of contract | Art. 31(1) — contractual necessity |
| Signing in to an application with your Carpe Diem account, and opening an account at the first sign-in (with the record of the texts you accepted) | Art. 6(1)(b) — performance of contract | Art. 31(1) — contractual necessity |
| Voice cloning (the uploader confirms the voice is theirs, or that its speaker agreed) | Art. 6(1)(b) — performance of contract | Art. 31(1) — contractual necessity |
| Points system and leaderboard | Art. 6(1)(f) — legitimate interest | Art. 31(1) — legitimate interest |
| Rate limiting, geo-restriction and sanctions screening | Art. 6(1)(f) — legitimate interest (security); Art. 6(1)(c) — legal obligation (sanctions) | Art. 31(1) — legitimate interest |
| Visitor counting | Art. 6(1)(f) — legitimate interest | Art. 31(1) — legitimate interest |
Where we rely on legitimate interest (Art. 6(1)(f)), our interest is in maintaining the security, integrity, and fair operation of the Protocol. You have the right to object to processing based on legitimate interest (see Section 9).
6. Data Recipients and International Transfers
We share personal data with the following categories of recipients:
| Recipient | Location | Role | Data shared | Safeguard |
|---|---|---|---|---|
| Venice.ai | United States | Independent provider, not our processor: the Association has no data processing agreement with Venice.ai. AI inference for every request served by the Protocol's own network, sent through providers' Venice.ai accounts and processed under Venice.ai's own terms and privacy policy | Prompts, model parameters; voice samples, kept 7 days for voice cloning | No safeguard under Art. 46 GDPR / Art. 16 nLPD (no Standard Contractual Clauses). The transfer is necessary to perform the contract with you, since Venice.ai runs the inference you request (Art. 49(1)(b) GDPR / Art. 17(1)(b)(1) nLPD) |
| Third-party inference markets (Surplus, AntSeed, OpenRouter, Chutes, Engy, and Venice.ai on the Association's own account) | Various, including the United States, China, decentralized compute providers, and countries a market does not state | Independent providers, used only by the best-price router (the /router endpoints, which the website's Studio uses) when a market serves a request more cheaply or when the Protocol's own network cannot | The routed request (prompt and parameters), sent with the Association's own credentials, not with your wallet, email or IP address unless they appear in your prompt. These markets may see and keep the requests they serve, under their own policies: Chutes runs on independent GPU operators, and OpenRouter forwards each request to the model's maker. Engy keeps nothing of the requests served on its zero-data-retention models, which run on its own GPUs; its other models (today qwen3.6-35b-a3b) run on public, permissionless miners. A model marked Private is only routed to a market that keeps nothing of it | Each market's own policy |
| Stripe | Ireland and United States | Payment processor for card purchases | Card details, billing address and email entered at checkout, amount, pack, and your account's address (your wallet address for a wallet account, an internal address for an email account) | Stripe's data processing terms |
| Phala Cloud | United States (region US-WEST-1) | Infrastructure — Operator hosting in a hardware TEE (Intel TDX) | All Operator data | Encrypted inside the TEE, out of reach of the host |
| Hetzner Online GmbH | Germany (EU) | Infrastructure — the website, its payment pages, and the entry point of the API: requests to carpe-diem.xyz/api/operator are decrypted there and relayed to the Operator, without being stored | IP address, browser metadata, and API requests in transit (prompts, API keys, voice samples) | Adequate jurisdiction (EU) |
| Infomaniak Network SA | Switzerland | Email delivery (sign-in codes, account notices) | Email address, message content | Adequate jurisdiction (CH) |
| Cloudflare, Inc. | United States | DNS; forwarding of emails sent to @carpe-diem.xyz | Correspondence you send us | Cloudflare's data processing terms |
| Partner applications (e.g. Sub Rosa) | Partner's own location | Independent controllers for their own users | Only the fact that an API key was issued to your device; never the key itself. When you sign in to an application with your Carpe Diem account: your email address, the fact that it is verified, the time and method of sign-in, and an identifier specific to that application | N/A |
| Telegram | Various | Delivery of the Association's internal operational alerts | Masked identifiers only (wallets shortened to 0x1234…abcd, masked emails); never request content | Telegram's own terms |
| LI.FI, WalletConnect/Reown, Pimlico, CoinGecko, public Base RPC providers | Various | Services your browser contacts directly for cross-chain deposits, wallet connection, your prepaid smart account, token prices and blockchain reads | Wallet address, IP address | Their own policies |
| Base L2 / Ethereum | Decentralized | Public blockchain | Wallet address, transaction amounts | N/A — public by design |
Our internal operational alerts carry no request content; the wallet addresses and emails they mention are masked.
We do not sell personal data. We do not share personal data with third parties for advertising or marketing purposes. To keep a request inside the Protocol's own network, use the /v1 endpoints (except the x402 pay-per-request endpoints under /v1/x402/, which may be routed to a market), or send forceMarket: "carpe" to the /router endpoints.
7. Data Retention
| Data type | Retention period | Storage |
|---|---|---|
| Email address and partner links | Until you delete your account. An email account with no sign-in and no request for 24 months is closed and its email address erased (see below) | Operator database inside the TEE, encrypted at rest |
| Balance and API keys | As long as the account exists. When it is deleted, the balance is set to zero and every key is revoked; revoked keys stay in the usage history, without their names | Operator database inside the TEE, encrypted at rest |
| Card purchase records (with the card country) | As long as the account exists, since your balance is computed from them; then 10 years after the account is deleted, without your email address | Operator database inside the TEE, encrypted at rest |
| Usage events | As long as the account exists: your balance is computed from your deposits minus your usage, and your points from your usage. Then 10 years after the account is deleted, identified only by the pseudonymized hash | Operator database inside the TEE |
| Country evidence (country per day) | 10 years, then deleted | Operator database inside the TEE |
| Account deletion record (account address, date, forfeited balance) | The account address is erased 10 years after the deletion. The date and the forfeited amount are kept without it, so that the accounts stay complete | Operator database inside the TEE |
| Partner application identifier of a deleted account (the partner, your identifier there, the deletion date, the devices whose keys were revoked; no email address) | 10 years after the deletion, so that the partner application cannot open a new Carpe Diem account in your name without asking you, nor reuse an old sign-in. The deletion date is erased earlier if you choose, in that application, to open a new account | Operator database inside the TEE |
| Sign-in with your Carpe Diem account: pending sign-in requests and sign-in codes (with the keyed hash of your network address prefix) | Requests last 10 minutes and are deleted when they expire, at the latest within the hour; codes for an application last 60 seconds and are deleted between one and two hours after they expire. Both are deleted at once when the account is deleted. Sign-in codes sent by email are deleted one day after they expire | Operator database inside the TEE |
| Identifier given to an application you sign in to with your Carpe Diem account | Until your account is deleted, by you or because it was inactive (see below). Signing in again afterwards opens a new account, and the application receives a new identifier: it no longer recognises you as the same person | Operator database inside the TEE |
| Acceptance of the Terms of Use and of this Privacy Policy (date and version of the texts), when recorded at your first sign-in from an application | As long as the account exists | Operator database inside the TEE |
| Partner key issuance log (partner, your identifier there, device, date) | Used only to limit how many keys can be issued per day. Entries older than one day are deleted when the account is deleted, the rest within two days | Operator database inside the TEE |
| Requests served by a third-party market through the best-price router (account address, market, model, amount billed, settlement transaction) | As long as the account exists; then 10 years after the deletion, for accounting, after which the address is erased. The payment authorization you signed for such a request (x402 rail) is erased once it has been settled, and at the latest when the account is deleted | Operator database inside the TEE |
| Prepaid account (the smart account linked to your wallet or to an API key) and prepaid charges (amount, settlement transaction) | The link is deleted when the account is deleted. Charges are kept 10 years after the deletion, for accounting, then their address and smart account are erased | Operator database inside the TEE |
| Pending x402 session (account address, the payment authorization you signed, amount owed) | Until the amount owed is collected, then deleted. Deleted at once when the account is deleted if nothing is owed; otherwise once it is collected | Operator database inside the TEE |
| Credit migrations (account address, destination, amount, transaction) | As long as the account exists; then 10 years after the deletion, for accounting, after which the addresses are erased | Operator database inside the TEE |
| Video and music generation jobs (account address, job, amount) | Until billed, then one day. Billed jobs are deleted at once when the account is deleted; an account cannot be deleted while a job is still running | Operator, inside the TEE |
| Points and referrals | As long as the account exists; erased when it is deleted. If someone invited you, the invitation stays without your address, so they keep the points already earned. Points already published on the blockchain stay there | Operator database inside the TEE; Base L2 for published points |
| Anti-abuse flags (a card purchase block, a referral blacklist entry) | Kept after the account is deleted, so that deleting it does not lift them | Operator database inside the TEE |
| Sign-in codes and links | 10 minutes; deleted within a day of expiry, or at once when the account is deleted | Operator database (stored hashed) |
| Checkout tickets (email, pack) | 15 minutes; deleted within a day of expiry, or at once when the account is deleted | Operator database |
| Sessions | At most 30 days; deleted within a day of expiry, or at once when the account is deleted | Operator database (renewal tokens stored hashed) |
| Voice samples | Not stored by the Operator; kept 7 days by Venice.ai, then deleted. It cannot be deleted earlier, by you or by us | Venice.ai |
| Cloned-voice records | Until the voice expires (7 days) | Operator database inside the TEE |
| Visitor counting | Daily keyed hash of the IP address, deleted after a few days; only daily totals are kept | Operator database |
| Generated media shared by link, or awaiting download | Images shared by link: 1 hour. Videos: 10 minutes | Operator, inside the TEE |
| Referral claim audit | Keyed hashes of the IP address and the browser's user agent, with the referred wallet, as long as the referral exists | Operator database |
| Operator logs | Technical events, without IP addresses, request contents, query strings or keys; they may contain wallet addresses. Held by the hosting platform, read by the Association | Phala Cloud |
| Website access logs (shortened IP address — IPv4 without its last byte, IPv6 reduced to its first 32 bits —, requested URL without query string, country, browser) | 7 days | Hetzner |
| Website security log (full IP address, requested URL and status, used only to block abusive scanners automatically) | About one day; addresses that were blocked are kept 7 days | Hetzner |
| Encrypted backups | Overwritten at each backup cycle; AES-256-GCM encrypted | Persistent disk (encrypted) |
| On-chain transactions | Permanent — immutable blockchain record. The Operator also keeps a copy of each deposit it credited, so that no deposit is ever credited twice | Base L2 / Ethereum; Operator database |
Deleting your account. You can delete your account yourself, at any time, from your dashboard. You do not need to write to us. You confirm with a code sent to your email address (email account) or with a signature from your wallet (wallet account). The deletion takes effect at once:
- your email address, sign-in codes and links, sessions, partner links, the identifiers given to applications you signed in to with your Carpe Diem account, and checkout tickets are erased;
- every API key is revoked, including the keys a partner application (for example Sub Rosa) obtained for your devices. That application cannot open a new Carpe Diem account in your name afterwards unless you choose to, in the application: for this we keep its identifier for you, without your email address;
- your remaining credits are forfeited: they are not refundable (see the Terms of Use, Section 18). The forfeited amount is recorded;
- your points and referrals are erased: your referral code, the people you invited and the points you earned from them. If someone invited you, the invitation stays without your address, so they keep the points already earned. Points already published on the blockchain stay there;
- card purchase records, usage history and country evidence are kept for 10 years for accounting and VAT, without your email address, then deleted. Settlement records of routed requests, prepaid charges and credit migrations are kept as long, then lose your address; your prepaid account link, settled payment authorizations and finished video or music jobs are erased at once.
The deletion cannot be undone. Signing in again later with the same wallet or the same email address opens a new, empty account: the forfeited credits never come back. A wallet that provides Venice keys must remove them on the Provide page first, and requests still running, such as a video, must finish first. Data recorded on the blockchain cannot be deleted. Stripe and partner applications such as Sub Rosa keep their own records, under their own terms: your account at a partner application is not deleted with your Carpe Diem account.
Inactive email accounts. An email account with no sign-in and no request for 24 months is closed in the same way. If it still holds credits, it is closed only after a notice sent to its email address at least 30 days before. Signing in or making a request during that time keeps it open. Signing in to an application with your Carpe Diem account counts as a sign-in. Once the account is closed, the identifiers given to applications are erased with it: signing in to one of them again opens a new Carpe Diem account and gives that application a new identifier.
8. Cookies and Local Storage
The Protocol does not use cookies for tracking, analytics, or advertising. It uses one functional cookie and browser storage:
| Key | Storage type | Purpose |
|---|---|---|
Session token (carpe_session_token) | Cookie (first-party, secure) and localStorage | Authentication persistence |
Renewal token (carpe_refresh_token) | localStorage | Keeping an email account signed in (at most 30 days) |
Email account (carpe_email_account) | localStorage | Showing which email account is signed in |
Disclaimer and Studio consent (carpe_disclaimer_v1, carpe.studio.consent.v1) | localStorage | Pre-connection disclosure acceptance |
| Studio settings, conversations, job and receipt lists | localStorage | Keeping your Studio work on your device; never sent to us except as requests you make |
| Generated media | IndexedDB | Keeping your generated images, audio and video on your device |
| Referral code, prepaid account | localStorage | Completing a referral; finding your prepaid account |
No third-party tracking scripts, analytics pixels, or fingerprinting technologies are employed. Fonts are served from our own server.
9. Your Rights
Under the GDPR (Articles 15–22) and the nLPD (Articles 25–29), you have the following rights:
| Right | Description |
|---|---|
| Access (Art. 15 GDPR / Art. 25 nLPD) | Request a copy of your personal data |
| Rectification (Art. 16 GDPR / Art. 32(1) nLPD) | Request correction of inaccurate data |
| Erasure (Art. 17 GDPR / Art. 32(2)(c) nLPD) | Delete your account yourself, with immediate effect, from your dashboard (see Section 7), or ask us to delete your data. Records we must keep by law are kept for the periods in Section 7 |
| Restriction (Art. 18 GDPR) | Request limitation of processing |
| Portability (Art. 20 GDPR / Art. 28 nLPD) | Receive your data in a structured, machine-readable format |
| Objection (Art. 21 GDPR / Art. 32(2)(b) nLPD) | Object to processing based on legitimate interest |
Important limitation: Data recorded on a public blockchain cannot be modified, deleted, or made private. Exercising the right to erasure applies only to off-chain data held by the Operator.
How to exercise your rights: To delete your account, use the button on your dashboard: no request to us is needed. For any other request, contact us at info@lumen-labs.ch. We will verify your identity by requesting a signed message from your wallet address or, for an email account, a code sent to your email address. We will respond within 30 days (GDPR) or as soon as possible (nLPD).
10. Data Security
We implement the following technical and organizational measures to protect your personal data:
- Hardware isolation — the Operator runs in a Trusted Execution Environment (Intel TDX) on Phala Cloud
- Encryption at rest — the Operator database and its backups (AES-256-GCM)
- Pseudonymization of usage records (HMAC-SHA256)
- Hashed secrets — sign-in codes, sign-in links, renewal tokens and API keys are stored only as hashes
- Redacted logs — request bodies, query strings, authorization headers and IP addresses are never written to the Operator's logs
- Access control — role-based access (OPERATOR_ROLE, GUARDIAN_ROLE, DEFAULT_ADMIN_ROLE)
- Rate limiting — per-wallet and per-IP request throttling
- Geo-restriction — IP-based blocking of restricted jurisdictions, looked up inside the TEE and by the website server
- Sanctions screening — wallet-level OFAC SDN screening
11. Automated Decision-Making
The Protocol uses automated processing for the following purposes:
- Dynamic pricing — request cost is calculated algorithmically based on utilization
- Provider and market routing — requests are routed to providers, and by the best-price router to third-party markets, based on price, capacity and performance
- Access and purchase checks — requests and purchases from restricted countries or sanctioned wallets are refused; card purchases are subject to limits, in particular for new accounts
- Points allocation — weekly points are distributed based on a formula incorporating usage and streak
These automated processes do not produce legal effects or similarly significantly affect you within the meaning of Art. 22 GDPR. You may contact us to request human review of any automated decision.
12. Children
The Protocol is not directed at individuals under 18 years of age. We do not knowingly process personal data of minors. If we become aware that we have collected data from a minor, we will take steps to delete it.
13. Supervisory Authorities
If you believe that our processing of your personal data infringes applicable data protection law, you have the right to lodge a complaint with:
- Switzerland: Federal Data Protection and Information Commissioner (FDPIC / PFPDT), Feldeggweg 1, 3003 Bern — www.edoeb.admin.ch
- European Union: The supervisory authority of the EU/EEA member state in which you reside or work, or in which the alleged infringement took place
14. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated through the Protocol's frontend or documentation. The "Last updated" date at the top of this document indicates the most recent revision.
Continued use of the Protocol after any update constitutes acceptance of the revised Privacy Policy.
15. Contact
For any questions, requests, or complaints regarding this Privacy Policy or the processing of your personal data:
Lumen-Labs, c/o ExpertFid & Audit SA, Rue du Rhône 80, 1204 Genève, Switzerland
Email: info@lumen-labs.ch