Privacy Policy

DIRU operates the platform with registered presence in Spain. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use the Platform. The data controller for personal data processed through the Platform is DIRU.

We collect the following categories of data: Identity data: phone number stored as a cryptographic hash and never in plain text, display name consisting of first name and initial only. Device data: device fingerprint, operating system, app version. In the full protocol, hardware attestation tokens from iOS DeviceCheck and Android Play Integrity. Location data: GPS coordinates at the moment of a verified action claim. Location is used solely for verification purposes and is not stored beyond the audit record of the claim. Behavioral data: action claims, scan timestamps, venue interactions, redemption events. Technical data: IP address, session tokens, error logs. Marketing data: email engagement data including open rates and unsubscribe status, retained only while you remain subscribed and deleted within 30 days of unsubscribe.

We use your data to: 1. Verify real-world actions through the Proof of Act protocol 2. Maintain your wallet and transaction history 3. Detect and prevent fraud, manipulation, and abuse 4. Generate aggregate behavioral intelligence for merchants through DIRU Terminal. No raw personal data is shared 5. Send transactional and where consented marketing communications 6. Comply with legal obligations 7. Improve the Platform and verify protocol integrity

The Proof of Act protocol uses automated AI-based systems to approve or reject your action claims in real time without human involvement in the default path. This constitutes automated decision making under GDPR Article 22. These decisions directly affect your ability to earn DIRU. You have the right to request human review of any rejected claim by contacting info@diru.io within 14 days of the rejection. We will review your case and respond within 10 business days.

We process your data on the following legal bases under the General Data Protection Regulation: 1. Contract performance: processing necessary to provide the Platform services you have signed up for 2. Legitimate interests: fraud detection, security, and protocol integrity 3. Legal obligation: compliance with applicable law 4. Consent: where required and explicitly given, including for marketing communications

We do not sell your personal data. We do not share raw personal data with merchants. Merchants receive only aggregate campaign performance data through DIRU Terminal. We may share data with: 1. Service providers who support platform operations including hosting, analytics, and error tracking, under strict data processing agreements 2. Law enforcement or regulatory authorities where required by law 3. Acquiring entities in the event of a merger or acquisition, subject to equivalent privacy protections

If you participate in a business-funded campaign through DIRU Campaigns, the business funding that campaign receives only aggregate performance data. They do not receive your personal data, contact details, or individual transaction history. You may opt out of specific campaigns at any time through the Platform without affecting your account or wallet.

Action claim records are retained for the duration required by applicable law and for audit integrity purposes. Wallet and account data is retained for as long as your account is active. Upon account deletion, personal identifiers are removed within 30 days. Marketing data is deleted within 30 days of unsubscribe. Anonymized aggregate data may be retained indefinitely as it cannot be linked back to you.

If you are located in the European Union or Spain, you have the following rights: 1. Right of access: request a copy of the personal data we hold about you 2. Right to rectification: request correction of inaccurate data 3. Right to erasure: request deletion of your personal data, subject to legal retention requirements 4. Right to restriction: request that we limit how we process your data 5. Right to data portability: receive your data in a structured, machine-readable format 6. Right to object: object to processing based on legitimate interests 7. Right to withdraw consent: where processing is based on consent 8. Right to human review: request human review of any automated decision that affects you To exercise any of these rights, contact us at info@diru.io. We will respond within 30 days. You also have the right to lodge a complaint with the Spanish Data Protection Authority, the Agencia Española de Protección de Datos, at www.aepd.es.

We implement technical and organizational measures to protect your data, including cryptographic hashing of phone numbers, encrypted data transmission, access controls, and structured audit logging. No system is completely secure. In the event of a data breach affecting your rights, we will notify you and the relevant supervisory authority within 72 hours of becoming aware of the breach, in accordance with GDPR Article 33.

Your data may be processed in Spain. Where data is transferred outside the European Economic Area, we ensure appropriate safeguards are in place in accordance with GDPR requirements, including standard contractual clauses where applicable.

The Platform uses essential cookies for authentication and session management. We do not use advertising cookies or third party tracking for marketing purposes. Analytics are conducted using privacy-respecting tools where data remains under our control. You can manage cookie preferences through your browser settings. Disabling essential cookies may affect the functionality of the Platform.

You may opt out of marketing and promotional emails at any time by clicking the unsubscribe link in any email we send or by contacting us at info@diru.io. We will process your request within 5 business days. Marketing data is deleted within 30 days of unsubscribe. Unsubscribing from marketing does not affect transactional emails related to your account and verified actions.

You may request deletion of your account and all associated personal data at any time by contacting info@diru.io. We will process your request within 30 days. Some data may be retained beyond this period where required by law or for audit integrity purposes, in which case we will inform you. Anonymized aggregate data derived from your activity may be retained indefinitely as it cannot be linked back to you.

The Platform is not directed at anyone under the age of 13. We do not knowingly collect personal data from children under 13 without verifiable parental consent. Users between 13 and 18 must have obtained consent from a parent or legal guardian before using the Platform. If you believe a child under 13 has provided us with personal data without consent, contact us at info@diru.io and we will delete it promptly.

The Platform may contain links to external websites or services. DIRU is not responsible for the privacy practices or content of those external sites. We encourage you to review the privacy policies of any third party sites you visit.

We may update this Privacy Policy from time to time. We will notify you of material changes through the Platform and by email where possible. The date at the top of this page reflects the most recent update. A version history is maintained and available upon request.

If you believe we have not handled your personal data in accordance with applicable law, you have the right to lodge a complaint with the Spanish Data Protection Authority: Agencia Española de Protección de Datos at www.aepd.es.

For privacy inquiries: info@diru.io For legal matters: info@diru.io For general inquiries: info@diru.io