1) Who this applies to

• Viewers (browse, unlock content, send tips)
• Creators (upload content, set prices, receive on-chain payments)
• Visitors (public pages, support)

Hypha is 18+ only. By creating an account, you confirm you are at least 18 years old (or the age of legal capacity in your country, if higher).

2) Who is the controller

• Controller: Hypha Technologies Ltd is the data controller for all personal data processed in connection with the Service.
• We do not currently act as a processor on behalf of creators.
• ICO Registration: Hypha Technologies Ltd is registered with the UK Information Commissioner’s Office (ICO) under registration number ZC029469. You can verify our registration at ico.org.uk.

3) What we collect (categories of data)

• Account & profile: email, hashed password, display name, profile/channel info, avatar/brand assets.
• Usage & device: IP address, device/OS/browser, language, timestamps, session IDs, page/video views, playback events, error logs.
• Transactions: on-chain transaction metadata related to content unlocks and tips, and data associated with connecting a Wallet (e.g. transaction signatures, timestamps, amounts, sender/recipient public addresses, wallet public addresses, and wallet-connection timestamps).
• Identity verification: handled by authorized third-party verification providers. We do not store identity documents; we receive verification status and limited metadata needed to enable monetisation features, prevent abuse, and comply with legal obligations.
• Content & communications: videos, thumbnails, titles, descriptions, and messages you send us (support, abuse reports).
• Sources of data: primarily from you and your devices. We also receive data from our providers (e.g. verification status), and from other users where necessary for abuse reports or rights claims.

4) Please avoid special-category data

Do not include special-category data (e.g., health, race, political views, religious beliefs, biometrics, sex life/sexual orientation) in uploads or messages. If you publish such information in public areas (e.g., titles, descriptions, profiles), you make it manifestly public. We will remove it from Hypha on request where feasible, but we cannot control copies others have made.

5) Why we use your data & legal bases (UK/EU GDPR)

6) Cookies & similar technologies

We use cookies and similar technologies as described in our Cookie Policy.

• Strictly necessary cookies for sign-in and core functionality.
• Preference/functionality cookies (e.g., language, UI settings) where needed.
• Analytics: We run first-party, self-hosted analytics with no cookies, no device identifiers, and only aggregate, non-identifying metrics.

7) International transfers

We store and process personal data in the UK and EU only. Routine data flows may occur between the UK and EEA. We currently host the Service on dedicated servers at OVHcloud in UK/EU data centres.

We do not currently transfer personal data to countries outside the UK/EU. If this changes, we will implement appropriate safeguards and update this Policy. Safeguards may include:

• EU Standard Contractual Clauses (SCCs)
• UK International Data Transfer Agreement (IDTA) / UK Addendum
• Supplementary technical and organisational measures and transfer risk assessments

8) Who we share data with (recipients)

We share personal data only as needed to run the Service and meet legal duties:

• Hosting & infrastructure: the Service is hosted and served from our own infrastructure located in UK/EU data centres, operated by Hypha for content delivery.
• Identity verification providers: third-party services that perform identity and age verification for creators. For these activities, such providers act as independent controllers under their own privacy notices.
• Blockchain networks: public blockchain infrastructure (e.g. Solana) where transaction data is recorded publicly. Blockchain data is processed independently by network participants and is not controlled by Hypha.
• Email & support tools: for ticketing and service communications.
• Analytics: our own self-hosted platform for aggregated, cookieless usage metrics.
• Law enforcement, regulators, and rights-holders: where required by law or to handle legal claims.

9) Public information you disclose

• Your display name and profile are visible when you publish.
• Removing public data from Hypha does not remove third-party copies.
• Reports you submit may be shared as needed for investigations.

10) Security

We apply appropriate technical and organisational measures, including:

• TLS/HTTPS for all connections
• Encryption at rest for stored data
• Role-based access & least-privilege admin controls
• Logging/monitoring and regular patching

No online service is perfectly secure. Keep your credentials confidential and contact support@hypha.tv if you suspect unauthorised access.

11) Retention periods

• Account data: while active; deleted or anonymised within 30–90 days after closure.
• Transaction records: up to 7 years (accounting/tax).
• Access logs: up to 12 months.
• Content: until removed; backups may persist temporarily.

12) Video fingerprinting (duplicate detection)

13) Your rights (UK/EU)

You may have the right to access, rectify, erase, restrict, object, and data portability, and to withdraw consent where processing relies on consent. You can object to processing based on our legitimate interests (including related processing for security/abuse prevention); we will honour your objection unless we have compelling legitimate grounds or the processing is required by law.

14) Transactions & identity verification

Hypha does not process fiat payments, store user balances, or custody funds. Content unlocks and tips occur on public blockchains via user wallets. Identity verification for creators is handled by third-party providers acting as independent controllers.

15) Automated decision-making & profiling

We use automated systems for video fingerprinting (duplicate detection), daily upload limits, and rate limiting to protect platform integrity. These do not produce legal or similarly significant effects. If this affects you, contact support@hypha.tv for human review.

16) Data-breach notification

If a personal-data breach is likely to result in a risk to your rights and freedoms, we will notify you without undue delay and, where required, notify the relevant supervisory authority within 72 hours.

17) Children

Hypha is for users 18+. We do not knowingly collect data from minors. If we learn an account is under 18, we'll suspend it and delete or anonymise personal data within 30 days, except where we must retain certain records by law. We require age self-certification at sign-up and may implement additional age-assurance measures where required by law or for platform integrity. Contact support@hypha.tv if you believe a minor has an account.

18) Changes to this Policy

We may update this Policy. For material changes, we'll give at least 30 days' notice by email and/or in-product, unless changes are required by law or necessary for security or safety or to fix obvious errors (those may be immediate). The effective date appears at the top. We keep prior versions for reference. Continued use after the effective date means you accept the update.