Version 1.2 — February 14, 2026
The data controller is identified in the Impressum.
NANOGATE is designed with privacy in mind. We do not use cookies, tracking tools, or analytics. We collect only the minimum data necessary to provide the service.
We store your Internet Computer Principal ID to allocate and manage your credits. This data is stored permanently in stable memory on the Internet Computer Protocol (ICP) infrastructure.
Legal basis: Contract fulfillment (Art. 6(1)(b) GDPR)
When you purchase credits or make a donation, we store:
This data allows us to verify your payments and provide you with a purchase and donation history. Note: We do not store the Nano addresses or transaction data from RPC requests you make through the gateway (e.g., checking balances or sending transactions) - those are processed and forwarded without logging.
Legal basis: Contract fulfillment (Art. 6(1)(b) GDPR)
We maintain records of your credit usage, including which RPC actions were called, how many credits were charged, your credit balance before and after, which node was used, response time, and when. This internal transaction history helps you track your credit spending.
If you transfer credits to or receive credits from another user, we store a record of that transfer in a permanent, append-only log. This includes the Principal IDs of both parties, the amount, the timestamp, and any optional note you provide.
Legal basis: Contract fulfillment (Art. 6(1)(b) GDPR)
To protect the service from misuse, we track the number of cancelled and expired orders associated with your Principal ID. If abuse thresholds are exceeded, your account may be temporarily blocked. Blocking records include the abuse count, the timestamp, and the reason.
Legal basis: Legitimate interest (Art. 6(1)(f) GDPR)
If you register a private Nano node, we store the node URL, any API key you provide, and your authentication header configuration. This data is linked to your Principal ID and stored in stable memory.
Legal basis: Contract fulfillment (Art. 6(1)(b) GDPR)
If you delegate canisters to use your credits, we store the canister IDs, spending limits, and usage statistics (credits used, last activity) linked to your Principal ID.
Legal basis: Contract fulfillment (Art. 6(1)(b) GDPR)
The gateway maintains a temporary log of system events (up to 5,000 entries in a circular buffer). Each log entry includes a timestamp, event level, the action performed, a description, and the caller's Principal ID. These logs are stored in volatile memory and may be lost during canister upgrades. They are only accessible to the service administrator and are used for debugging and monitoring.
Legal basis: Legitimate interest (Art. 6(1)(f) GDPR)
When you create a purchase order or a donation, a Proof-of-Work challenge may be issued. The challenge data, including your Principal ID, is stored temporarily in volatile memory for up to 5 minutes. It is automatically deleted after use or expiration.
Legal basis: Legitimate interest (Art. 6(1)(f) GDPR) - spam prevention
During purchases and donations, minimal session data is temporarily stored in your browser's local storage to allow resumption after page refresh. This data is automatically removed once the transaction completes.
Legal basis: Contract fulfillment (Art. 6(1)(b) GDPR)
To protect the service from overload and ensure fair usage, we temporarily track per-user request counts and timestamps in volatile memory. This data is linked to your Principal ID and is used solely for enforcing rate limits. It is not persisted to stable memory and may be lost during canister upgrades.
Legal basis: Legitimate interest (Art. 6(1)(f) GDPR) - service protection
We collect aggregated, non-personal usage statistics such as total request counts, success rates, and hourly/daily request volumes. To calculate unique user counts, Principal IDs are temporarily held in volatile memory but are not included in the stored aggregates. The persisted metrics do not contain Principal IDs or other personal identifiers and are used solely for service monitoring and capacity planning.
If you contact us via email or phone, your email address or phone number and message content are stored to process your inquiry.
Legal basis: Legitimate interest (Art. 6(1)(f) GDPR)
Your data is stored on the Internet Computer Protocol (ICP), a decentralized blockchain infrastructure. ICP nodes are operated globally by independent node providers. For more information about ICP's infrastructure, visit https://internetcomputer.org.
Note on blockchain storage: Due to the technical nature of blockchain infrastructure, certain data stored on the Internet Computer Protocol may not be fully erasable. Where deletion is technically impossible, this constitutes an exception under Art. 17(3) GDPR. In such cases, we will restrict the processing of your data to the extent technically feasible.
Under the GDPR, you have the following rights:
To exercise your rights, contact us at: info@nanogate.run
Please note that as a small, independently operated service, processing your request may take some time. We will respond as soon as reasonably possible.
Data is stored on the ICP network, which operates globally through decentralized node providers. This may involve data transfers outside the European Economic Area (EEA). The decentralized nature of blockchain technology means data is replicated across multiple nodes for integrity and availability.
These transfers are necessary for the performance of the contract between you and us (Art. 49(1)(b) GDPR), as the service inherently relies on the decentralized ICP infrastructure. Using a blockchain-based service requires data replication across globally distributed nodes, and there is no equivalent centralized alternative that would provide the same functionality.
We implement appropriate technical measures to protect your data, including cryptographic security provided by the ICP infrastructure. However, no system is completely secure. You are responsible for safeguarding your own private keys and credentials.
NANOGATE interacts with:
We do not share personal data (such as your Principal ID) with advertising networks, analytics providers, or node operators. However, Nano-specific request data (addresses, block hashes, transaction details) is inherently visible to the node processing your request. This applies equally to any Nano RPC request, whether made through NANOGATE or directly to a node.
We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated revision date.
For privacy-related questions or to exercise your rights:
Email: info@nanogate.run