Privacy Policy
Last updated: 9 November 2026
This Privacy Policy explains what personal data Lokie Labs collects when you use rillaz.art, including its internal paths (such as /heatmap, /rillarun, /buy, /avatars, /travel and /twindexer), together the “Site”. We collect as little as we can: you can browse the Site without an account, and we never ask for your private keys or payment card details.
RILLAZ is an IP of Lokie Labs. This policy covers the Site specifically and sits alongside the Lokie Labs Privacy Policy, which applies to everything this page does not cover. If the two differ on something the Site does, this page prevails for the Site.
1. Who is responsible for your data
Lokie Labs, S.L. (N.I.F. B13930714), Alcobendas (Madrid), Spain, is the data controller. Contact: contact@lokielabs.com.
2. What we collect, why, and on what legal basis
| When you… | We process | Why (GDPR legal basis) |
|---|---|---|
| Visit any page | IP address, browser and device type, pages requested and time, in our hosting provider's server logs | To deliver the Site and keep it secure (legitimate interest, Art. 6(1)(f)) |
| Connect and sign in with your wallet | Your public wallet address and a signed sign-in message, kept in a session cookie | To log you in and show what your NFTs unlock (performance of the service you request, Art. 6(1)(b)) |
| Use holder features (avatars, concierge, RILLA RUN) | The RILLAZ and RILLAZ DEPIX tokens held by your wallet, read from the public ApeChain blockchain | To verify ownership before giving access (Art. 6(1)(b)) |
| Place a pin on the Heatmap or post in its chat | Wallet address, the country and city you choose, your handle, an optional X/Twitter link, the NFT you pin with, and your messages | To run the community map and chat (Art. 6(1)(b)). Pins and messages are public to everyone who visits the Heatmap |
| Play RILLA RUN | Wallet address, the RILLAZ you play with, game-session data and scores | To run the game, prevent cheating and record scores on-chain (Art. 6(1)(b) and 6(1)(f)) |
| Buy an NFT on the Buy page | Wallet address and the listing you choose, sent to OpenSea to prepare the purchase | To build the transaction you then sign in your own wallet (Art. 6(1)(b)) |
| Contact the travel concierge | Name, email, optional Telegram/X handle, optional WhatsApp number, your message, wallet address and the tokens it holds | To pass your request to Travel With Gaston, who answers you directly, by email or, if you add your number, on WhatsApp (Art. 6(1)(b)) |
| Enter a raffle | Wallet address, the RILLAZ, DEPIX, Albarra Seeds and Origin cards it holds and how long it has held them, its marketplace purchases and sales during the raffle (from OpenSea), an optional or required Solana wallet for prizes, and, if you add one, the link to your post on X with its handle | To count tickets, run a verifiable draw and deliver prizes (Art. 6(1)(b)). The leaderboard and published results are public: wallet address, primary ENS name if the wallet has one, a title, tickets and any prize won. Solana wallets are never published |
| Download or share a gif on Media and Fun | A one-way hash of your IP address, kept for up to 6 hours, so one visitor counts once | To keep honest view, download and share counters (legitimate interest, Art. 6(1)(f)) |
We do not sell your data, use it for advertising or build marketing profiles, and we make no automated decisions about you that have legal or similarly significant effects.
3. Public blockchain data
Wallet addresses, token ownership and transactions (including RILLA RUN scores and purchases) are recorded on ApeChain, a public blockchain. That data is public by design, is not controlled by us and cannot be changed or deleted by anyone, including us.
4. Who receives data (processors and third parties)
We share only what each service needs to work:
- Vercel (hosting, server logs, United States)
- Supabase (database for Heatmap pins and chat, and private storage for avatar files)
- Upstash (short-lived game sessions, rate limits and caches)
- Alchemy and ApeChain RPC providers (reading blockchain data; your browser also connects to them when you use wallet features)
- OpenSea and OSWiki (listings, prices and preparing purchases; OpenSea sale events for raffle sweeps)
- ApeScan (ApeChain explorer data, such as how long a wallet has held its NFTs)
- X (checking that a raffle post exists and is public) and Ethereum RPC providers (reading primary ENS names)
- WalletConnect / Reown and your wallet provider (when you connect a wallet)
- Resend (delivering concierge emails) and Travel With Gaston, the recipient of concierge requests
- IPFS gateways and our own image server (nft.rillaz.art), to display NFT images
Some of these providers are located in or process data in the United States. Where data leaves the European Economic Area, the transfer relies on the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses.
5. How long we keep it
- Sign-in session cookie: up to 7 days, or until you disconnect.
- RILLA RUN game sessions: 30 minutes; records of which DEPIX you used in a competition: 31 days. Scores you record on-chain stay on the blockchain.
- Heatmap pins and chat messages: until you remove your pin (which also removes your messages) or ask us to delete them.
- Concierge requests, including any WhatsApp number: as long as needed to handle your request, in the recipients' inboxes and chats.
- Raffle entries and results: kept so past draws stay verifiable. Solana wallets are deleted on request once prizes are delivered.
- Gif counter hashes: 1 to 6 hours. The counters themselves hold no personal data.
- Server logs: according to our hosting provider's retention, typically a few days to a few weeks.
6. Cookies and local storage
We use only strictly necessary storage, so we don't show a cookie banner:
- rillaz_session (first-party cookie, HTTP-only): keeps you signed in with your wallet. Set only when you start signing in.
- Wallet connection data in your browser's local storage, written by the wallet-connection libraries so your wallet stays connected between pages.
We use no analytics, advertising or tracking cookies, pixels or scripts. Our fonts are served from our own domain, not from Google. If we ever add optional cookies, we will ask for your consent first.
7. Use of artificial intelligence
We use AI-assisted tools, such as AI coding assistants, to help design, write and maintain the Site's software. These tools work on our source code. We do not feed your personal data into AI models, and no AI system makes decisions about you.
8. Your rights
You can ask to access, correct, delete, restrict or port your personal data, or object to its processing, by emailing contact@lokielabs.com. We may ask you to prove you control the wallet concerned, for example by signing a message. You also have the right to complain to the Spanish Data Protection Agency (aepd.es).
9. Minors
In line with Article 8 of the GDPR and Article 7 of the LOPDGDD, only people over 14 may use the Site and consent to the processing of their personal data. Under 14, the consent of a parent or guardian is required.
10. Security
We protect data with encrypted connections (HTTPS), HTTP-only signed session cookies, access controls on our database and storage, and restricted administrative access. No system is perfectly secure; if a breach affects your data, we will notify you and the authorities as the law requires.
11. Changes
We may update this policy. We will change the date at the top, and for significant changes we will announce them on the Site or our social channels.
12. Contact
Questions about privacy: contact@lokielabs.com. See also the Lokie Labs Privacy Policy and the privacy policy of albarra.world for that platform.