Privacy Policy

Who we are

1.1The controller of your personal data is GRANDMONTS DIGITAL ASSETS s.r.o., with its registered seat at Horova 1622/30, Žabovřesky, 616 00 Brno, Czech Republic, identification number 29762324, operating under the trading name JamOnBread. You can reach us at hello@jamonbread.io.

1.2JamOnBread is a marketplace for digital items on the Cardano blockchain. We do not hold custody of your assets and we do not execute transfers; those happen on the blockchain between you and your counterparty.

What we collect

2.1Your wallet address and stake address. These are recorded when you connect a wallet, and they are how your account is identified. They are pseudonymous rather than anonymous: activity on a public blockchain can often be linked to a person, so we treat them as personal data.

2.2Profile information you choose to supply. A display name, biography, avatar and banner image, and links to social accounts such as X, Discord, Telegram or a website. All of these are optional, all are public, and you can change or remove them at any time.

2.3Your IP address. Processed transiently to apply rate limits and protect the service from abuse. It is not used to build a profile of you.

2.4The country you registered as an affiliate from. If, and only if, you register for the affiliate program, we look up the country associated with your internet connection and store the two-letter country code (for example, CZ) on your affiliate record. This is because the affiliate program is not offered in certain countries (Terms, clause 14.9). The lookup happens on our own servers against a local database, IP Geolocation by DB-IP, used under the Creative Commons Attribution 4.0 International licence. We store the country code and nothing else: your IP address is not saved with your affiliate record, is not logged alongside it, and there is no field it could go in. If the lookup cannot be completed, no country is stored. Using any other part of the site triggers no country lookup at all.

2.5We do not collect an email address. The application has no field for one and stores none, so we cannot email you and do not send marketing.

2.6First-party usage events.To understand where the product loses people, we record a small set of events on our own servers: that a browsing session started, that a page type was viewed, that a wallet connected or failed to connect, that a trading window was opened, that a transaction was submitted, settled, or failed, that a visit arrived through a referral link, and which collection a visitor viewed. For page views we record only the page's template, such as "a collection page", never the full address of the page, so which specific item or profile you looked at is not stored. Collections are public listings, so we do separately record which collection a visitor viewed, by its on-chain policy id, to rank the most visited collections; no item, profile, wallet, or handle is recorded this way. Each event stores the event name, the time, a random session identifier, and a few product facts such as the kind of action, the wallet brand, a transaction hash, a referral code, or the short reason a step failed (for example, that a wallet connection was declined). The session identifier is created in your browser's session storage, is not a cookie, is not derived from anything about you or your device, and is discarded when you close your browser. These events never include your IP address, and they are never shared with or collected by any third party.

2.7Google Analytics, only with your consent.With your consent we use Google Analytics 4. Without your consent it does not run and nothing is sent to Google. When it is on, we send only the page template described in 2.6 (such as "a collection page"), never a wallet address, an item, a profile, or a referral code, and advertising signals stay off. The first-party events in 2.6 stay in our own database whether or not you consent. There is no advertising pixel and no third-party profiling.

Cookies

3.1A session cookie, set when you sign in with your wallet. It keeps you signed in and nothing else. This is strictly necessary for a service you have asked for, so it is set without consent.

3.2A referral cookie (jam_ref), set only if you arrive through an affiliate link. It stores that affiliate's code so any commission can be attributed correctly. It is not strictly necessary, so we ask before setting it, and declining changes nothing about how the site works for you.

3.3A consent cookie (jam_consent), which records your choice about Google Analytics so we do not ask on every visit. It is strictly necessary to honour that choice, so it is set as soon as you choose, and it holds nothing but the choice.

3.4Google Analytics cookies (_ga and _ga_<id>), set by Google only if you accept analytics. They last about two years and let Google count returning visitors. Declining, or choosing Cookie settings in the footer and declining, stops analytics and clears them. Apart from the cookies listed in this section we set no others. Wallet extensions and other third-party software you use with the site are governed by their own policies, not this one.

Why we may process this, and on what basis

4.1To provide the service you have requested: keeping you signed in, showing your profile, and building transactions you choose to sign. The basis is performance of a contract.

4.2To keep the service available and secure, including rate limiting. The basis is our legitimate interest in preventing abuse.

4.3To attribute affiliate commission, where you arrived via a referral link. The basis is your consent, which you may withdraw at any time by clearing the cookie.

4.4To determine whether the affiliate program may lawfully be offered to you, where you ask to register for it. The basis is compliance with a legal obligation, and our legitimate interest in not offering a service in a country where we are not permitted to. Only the resolved country code is kept.

4.5To understand how the product is used, using the first-party events described in 2.6. The basis is our legitimate interest in improving a service we operate. The events are engineered to carry as little as possible: no IP address, no identifier that survives your browser session, and nothing collected by third parties. You can object to this processing as described in section 7.

4.6To comply with legal obligations where one applies to us.

4.7To measure how the product is used through Google Analytics, where you have accepted it. The basis is your consent, under Article 6(1)(a) GDPR. You may withdraw it at any time, as easily as you gave it, by choosing Cookie settings in the footer and declining, which stops analytics and clears the Google cookies.

Who else sees it

5.1The blockchain. Anything you sign is published to the Cardano network, which is public and permanent. We cannot alter or delete it, and neither can you. This is the most important thing to understand about privacy on this site.

5.2Infrastructure providers we use to display the site: an image delivery service for NFT media, public IPFS gateways, and blockchain data providers. They receive only what is needed to serve a request.

5.3Your wallet provider, which is software you chose and which operates under its own privacy policy. We never receive your private keys or seed phrase.

5.4We do not sell personal data, and we do not share it for advertising.

5.5Google, if and only if you accept analytics. Google Ireland Limited and Google LLC act as our processor for Google Analytics. Data may be transferred to the United States under the EU to US Data Privacy Framework and the European Commission's standard contractual clauses. Google receives only the page templates and product facts described in 2.6, never your wallet address, and every advertising signal stays off, so nothing here is used to build an advertising profile of you. That is why 5.4 stays true even with analytics on.

How long we keep it

6.1Profile information is kept while your account exists. Removing it from your profile removes it from the site.

6.2IP addresses used for rate limiting are short-lived and are not retained as a log of your browsing.

6.3The affiliate registration country code is kept for as long as the affiliate record exists, because it is the record of why the registration was accepted. It is a single two-letter code, and the IP address it was derived from is not kept at all.

6.4Usage events (2.6) are kept only as long as they are useful for the analysis they were collected for, and are pruned periodically. Because the session identifier is random and short-lived, an old event row cannot be traced back to you.

6.5Blockchain records are permanent and outside our control, as described above.

6.6Google Analytics data, where you accepted it, is kept by Google for the period set on the property and then deleted on Google's side. The consent cookie lasts about a year or until you change your choice; the Google cookies last about two years or until you withdraw consent, whichever comes first.

Your rights

7.1Under the GDPR you may request access to your personal data, correction of it, erasure of it, restriction of processing, portability, and you may object to processing based on legitimate interests. Write to hello@jamonbread.io and we will respond.

7.2These rights apply to data we hold. They cannot apply to the public blockchain, which no one is able to edit or erase.

7.3If you believe we have handled your data improperly you may complain to the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů).

Changes

8.1If this policy changes we will update the date shown at the top of this page.