Privacy Policy

This page explains what personal data Worlds Got Latent collects when you browse the registry, claim or steal a record, or write to us, and what we do with it. The rules for using the service are in the Terms.

Who is responsible

The operator of Worlds Got Latent is responsible for data processing on this site. Contact for all privacy matters: anshul915saini@gmail.com.

What we collect

• Holder name or handle, optional link. Public by design: shown in the registry and on the certificate.
• Record titles and holder statements. Public by design. Statements are optional.
• Email address. For the confirmation link, certificate, receipt, private edit link and theft notices. Nominees' emails for the invitation to accept, yours for the receipt. Never shown publicly.
• Stripe payment identifiers, amount and date. Card details go to Stripe, never to us (Stripe's privacy notice).
• Purchase evidence. IP address, browser user agent, consent and confirmation times, kept for payment disputes.
• Rate-limiting data. A salted, irreversible hash of your IP on checkouts, declined cards, reports and Registrar rulings.
• Technical request data processed by our host, Vercel, to serve and secure the site.
• Reports, unsubscribe list and correspondence. Your report reason and optional email, the unsubscribe list, and anything you write to us.

Why we use it

• Contract (Art. 6(1)(b) GDPR): entering your record, issuing the certificate, taking payment, sending the confirmation, nomination, receipt and theft notices, and letting you edit your name or link.
• Legitimate interests (Art. 6(1)(f)): running a public registry, preventing fraud and abuse, rate limiting, defending payment disputes, moderating titles and statements, and sending occasional reminders about records you hold or have lost. Every reminder has a one-click unsubscribe.
• Legal obligation (Art. 6(1)(c)): keeping payment records for tax and accounting law.

We do not ask for consent for anything, because we do not do anything that needs it: no tracking cookies, no marketing lists, no profiling.

Public by design

Titles, holder names and links, holder statements, prices, dates, and the full theft history are public and indexable by search engines. They stay on the record page after you lose a record. Do not enter anything you would not want public. Nominations are not public unless the nominee accepts within 7 days; declined or expired nominations are refunded. The Registry is a public record. That is the point.

Who we share it with

• Stripe Payments Europe Ltd., Ireland: payments, refunds and dispute handling.
• Resend Inc., USA: sending our emails.
• Vercel Inc., USA, and our database host: hosting and storage.
• OpenAI (OpenAI Ireland Ltd. / OpenAI, L.L.C., USA): the text of proposed titles and holder statements is sent to OpenAI's API to check for duplicates and disallowed content. No email address, name or payment data goes with it. API inputs are not used for training.

We never sell personal data. Processors outside the EEA are covered by the EU standard contractual clauses and, where applicable, the EU–US Data Privacy Framework.

How long we keep it

• Registry entries (title, holder name, link, statement, theft history) persist for as long as the record exists. That is the product.
• Emails are kept while you hold a record or appear in its history, so we can notify you, and then for the accounting period of the purchase.
• Payment identifiers are kept for the statutory retention period, currently ten years under German tax law.
• Purchase evidence (IP, user agent) is deleted 180 days after purchase, or when a dispute closes. Declined-card records are deleted after 30 days. IP hashes on Registrar rulings are removed after 90 days.
• Everything else is deleted on a valid erasure request, except what the law requires us to keep.

Your rights

You can ask for access to your data, correction, deletion, a copy in a portable format, restriction of processing, and you can object to processing based on legitimate interests. Write to anshul915saini@gmail.com. Public record content can be removed on request; removing a record you hold means giving it up.