Privacy Policy

The Wall of the Million is a public digital artwork and social experiment built one tile at a time. This Privacy Policy explains what personal information we collect, why we use it, how it is handled, and what choices you have when you interact with the Service.

The “Service” includes the Wall of the Million website, its tiles, tile pages, purchasing functionality, accounts or sign-in features, and related content and functionality.

By using the Service or purchasing a tile, you acknowledge that your information will be handled as described in this Privacy Policy.

The Wall of the Million is operated by:

Controller: XXXXX

Privacy contact: XXXXX

Support: XXXXX

Address: XXXXX

For purposes of applicable data protection law, the Controller is responsible for personal data processed through the Service.

The information we collect depends on how you interact with the Wall.

Information you choose to provide

When purchasing or managing a tile, this may include:

• your email address;
• the name displayed on your tile;
• an optional title or message;
• an optional link;
• your chosen tile colors and gradient;
• your chosen emoji;
• information contained in a report or removal request;
• messages you send to support; and
• information relating to your purchase.

You may use a nickname or handle instead of your real name. Please do not put personal information into your tile that you do not want to make public.

Information generated by a purchase

We also keep records needed to operate the transaction and the Wall, such as:

• the tile number assigned to you;
• purchase date and time;
• price paid;
• payment status;
• number of tiles purchased; and
• information needed to associate tiles purchased using the same email address.

We do not receive or store your complete payment-card number. Payment information is processed by our payment provider.

Technical information

When you visit the Service, certain technical information may be processed automatically, such as:

• IP address;
• approximate country derived from IP address;
• browser and device information;
• operating system;
• language and regional settings;
• referring page;
• pages and features accessed;
• dates and times of activity;
• technical, error and performance information; and
• information used to protect the Service against fraud, abuse and automated attacks.

The Wall is intentionally public.

When you purchase a tile, the following information may appear publicly on the Wall, on the individual tile page, or in related representations of the project:

• tile number;
• name displayed on the tile;
• optional title or message;
• optional link;
• colors and gradient;
• emoji;
• purchase date;
• price paid;
• current tile price, where applicable;
• Wall of Fame information; and
• historical or archived representations of the Wall.

Your email address is not displayed publicly.

Your country may be used to produce aggregate statistics about participation, but is not displayed alongside your individual tile.

Public tile information may also appear in screenshots, timelapses, social posts, articles, project archives, downloadable tile images and other materials documenting or promoting the Wall.

Once information has been made public, other people may copy, screenshot, index, archive or redistribute it. We cannot guarantee that a third party will remove a copy after it has been shared.

We use information collected through the Service to:

• process purchases and provide the tile you purchased;
• assign and permanently record tile numbers;
• display tiles and their associated information on the Wall;
• provide individual tile pages;
• allow you to access or manage tiles associated with your email address;
• send purchase confirmations, receipts and necessary service messages;
• operate the Wall of Fame and other project features;
• respond to support requests and reports;
• review or remove inappropriate content;
• prevent fraud, abuse, spam and payment abuse;
• maintain the security and reliability of the Service;
• understand how the Service is being used and improve it;
• maintain historical records of the project;
• comply with applicable legal requirements; and
• protect our rights and the rights of users and third parties.

Where permitted by applicable law, we may also send occasional announcements about the project.

The legal basis for processing depends on what we are doing with the information.

Where necessary to provide the Service or complete a purchase, we may process information because it is necessary to perform our agreement with you.

We may also process information where we have a legitimate interest in operating, securing, improving and documenting the Service, preventing abuse, maintaining the integrity of the Wall, resolving disputes and preserving the project’s historical record, provided those interests do not override applicable rights.

Some processing may be carried out because we are legally required to do so.

Where applicable law requires consent, we will ask for it before carrying out the relevant processing. You can withdraw consent where consent is the legal basis for processing.

Purchases are processed through our payment provider.

We receive information necessary to confirm and administer the transaction, but we do not store your complete payment-card details.

Our payment provider may independently process personal data for payment processing, fraud prevention, security, refunds, chargebacks and its own legal obligations. Its handling of your information is governed by its own privacy terms.

Where the Service uses email-based sign-in or access links, we may send a one-time link to the email address associated with your purchase.

The link allows you to access or manage the relevant tiles without requiring us to store a conventional account password.

You are responsible for keeping access to your email account secure.

We may use third-party providers to operate parts of the Service, including providers for:

• payment processing;
• hosting and databases;
• file and image storage;
• content delivery;
• email delivery;
• analytics and performance monitoring;
• security and fraud prevention; and
• technical support.

These providers receive information only as necessary for the services they provide to us.

We may also disclose information:

• where required by law or a valid legal process;
• to professional advisers such as lawyers or accountants;
• where necessary to investigate fraud, abuse or security incidents;
• to protect our rights, users or the public; or
• as part of a sale, merger, investment, restructuring or transfer of the Service.

We do not sell personal data as a commercial data product.

A tile may contain a link chosen by its owner.

We do not control the websites or services reached through those links and are not responsible for their content, security or privacy practices.

If you visit a third-party website through a tile, that website may collect information about you under its own policies.

We aim to keep tracking on the Service limited.

We may use strictly necessary cookies or local storage to keep the Service functioning, remember temporary state, support sign-in and checkout, and protect against abuse.

We may also use limited analytics, performance or error-monitoring technologies where permitted by applicable law.

We do not use the Service to sell advertising profiles or to run third-party behavioural advertising or retargeting campaigns.

Where consent is legally required for a particular technology, we will request it before using that technology.

Different information needs to be retained for different periods.

Information forming part of the public Wall may remain available for as long as the Wall or an associated archive exists. This is an intentional part of the project’s design.

Transaction and accounting information may need to be retained for the period required by applicable tax, accounting or other legal requirements (typically up to 10 years following the transaction date).

Email addresses associated with purchases may be retained for as long as necessary to provide access to purchased tiles and to meet legal or legitimate operational requirements.

Support requests, reports and moderation records are retained for as long as reasonably necessary to deal with the relevant matter and protect the Service.

Security and fraud-prevention information may be retained for as long as reasonably necessary to investigate and prevent abuse or security incidents.

Third-party providers may retain information according to their own legal and contractual obligations.

Because the Wall is designed as a permanent public record, purchasing a tile does not give you an unconditional right to change or remove every aspect of the historical record.

However, you may request that the name displayed on your tile be removed or anonymised.

You can make a request through our Report and Feedback page or by contacting XXXXX.

We may ask for information sufficient to verify that you are the person associated with the tile.

We will respond and act upon verified requests within 30 days.

Removing or anonymising publicly displayed information does not necessarily mean that copies already made by other people, search engines, archives, screenshots or third-party websites can be removed.

A request to remove public information does not automatically cancel or refund a completed purchase. Any refund rights are governed by applicable law and our Terms.

Depending on where you live and which laws apply, you may have rights concerning your personal data, including rights to:

• obtain access to personal data we hold about you;
• correct inaccurate information;
• request deletion in certain circumstances;
• restrict certain processing;
• object to certain processing;
• receive certain information in a portable format;
• withdraw consent where consent is the legal basis; and
• lodge a complaint with the relevant data-protection authority.

These rights are subject to legal limitations and exceptions.

To exercise a right, contact us at XXXXX. We may need to verify your identity before responding.

Some of our service providers may process information in countries other than the country in which you live.

Where applicable law restricts international transfers, we will use an appropriate legal mechanism for the transfer, such as an adequacy decision, approved contractual safeguards or another mechanism permitted by law.

You may contact us if you would like further information about the safeguards applicable to an international transfer concerning your personal data.

The Service is not directed at children under 13.

If you are under the age at which you can legally consent to the processing of personal data in your jurisdiction, you should use the Service only with the involvement or permission of a parent or legal guardian where required by law.

If you believe that a child has submitted personal information to us inappropriately, please contact us.

We use reasonable technical and organisational measures designed to protect information against unauthorised access, loss, misuse, alteration and disclosure.

These measures may include encrypted connections, access controls and restrictions on access to stored information.

No internet service can guarantee absolute security.

We may use automated systems to help identify fraud, spam, abusive behaviour, suspicious payments, security threats or content requiring moderation.

Our payment and security providers may also use automated fraud-detection systems.

We do not intend to use solely automated decision-making that produces legal or similarly significant effects on you without appropriate safeguards where such safeguards are required by law.

Anti-Spam Protection (Cloudflare Turnstile)

To protect the site's forms and guestbook from spam and automated bot submissions, we use Cloudflare Turnstile in invisible mode. The service analyzes certain technical characteristics of your browser and connection to verify the legitimacy of the request, without tracking the user's personal identity. Data processing by this service is governed by the Cloudflare Turnstile Privacy Addendum.

We may update this Privacy Policy as the Service develops or as legal requirements change.

When we make significant changes, we will take reasonable steps to make the updated policy noticeable, including updating the date shown at the top and, where appropriate, displaying a notice through the Service.

If you have questions about this Privacy Policy, want to exercise a data-protection right, or want to report a privacy concern, contact:

XXXXX

Privacy: XXXXX

Support: XXXXX

Address: XXXXX