Effective as of: October 9, 2026.
This Privacy Policy describes how Courtyard, Inc. (“Company,” “we”, “us” or “our”) and our affiliates handle personal information that we collect through our digital properties that link to this Privacy Policy, including our website (collectively, the “Service”), as well as through social media, our marketing activities and live events.
This Privacy Policy also provides details of your rights under the EU and UK General Data Protection Regulation (together the “GDPR”).
For the purposes of the GDPR, Courtyard, Inc is the “controller” of your personal information as it is described in this Privacy Policy, which means we make decisions about what your information is used for and how it is processed.
We recommend you read this Privacy Policy together with our Cookie Notice and Terms of Use.
If you have any questions, please contact us using the details in the “How to contact us” section below.
Personal information we collect
When we refer to “personal information” we mean information which relates to an identified or identifiable individual (i.e. a natural person). We may collect and process your personal information:
(a) directly from you, for example when you use our Services,
(b) from third parties (for example, from public sources like public blockchains and private third parties like payment providers), and
(c) automatically, such as from the device(s) you use to access the websites.
Information you provide to us directly. Personal information you may provide to us through the Service or otherwise includes:
Identity and Contact data, such as your first and last name, date of birth, salutation, email address, billing and mailing address, and phone number.
Demographic data, such as your city, state, country of residence, postal code and age.
Profile data, such as the wallet address and username or password used to establish an online account on the Service, links to your profiles on social networks, and any other information that you add to your account profile.
Communications that we exchange with you, including when you contact us through the Service, our customer support platform, social media, or otherwise.
Transactional data, such as blockchain transaction history and information relating to, or needed to, complete your specific NFT purchases or sales on or through the Service.
Interests, preferences and affiliations, such as user preference records, collection value history, and quest and campaign progress that reflect what a user collects and engages with.
Marketing and communications preferences, including any consents you have given us. We also hold notification settings.
Engagement with the Company, such as your loyalty points balances and redemptions, results of quest progress events, raffle entries and winners, referral relationships, responses to our onboarding survey and other customer surveys.
Listings and marketplace content, such as marketplace asks, bids and auction bids placed by users.
Other user-generated content, such as profile pictures, photos, images, music, videos, comments, questions, messages, works of authorship, and other content or information that you generate, transmit, or otherwise make available on the Service, as well as associated metadata. Metadata includes information on how, when, where and by whom a piece of content was collected and how that content has been formatted or edited. Metadata also includes information that users can add or can have added to their content, such as keywords, geographical or location information, and other similar data.
Financial data, such as your virtual currency or wallet accounts, stored value accounts, royalties, fees, sales prices, sell-through data, and associated details.
Other data not specifically listed here, which we will use as described in this Privacy Policy or as otherwise disclosed at the time of collection.
Third-party sources. We may collect personal information from other sources such as:
Authentication and wallet providers, such as Privy, which provides us with your email, phone, wallet address and linked social login identifiers.
Identity verification providers, such as Persona, which provides us with a hashed identity reference and identity verification results. In some cases, they will also give us underlying identity data (full name, date of birth, residential address, email address and selfie metadata).
Fraud and risk data providers, such as IPQualityScore which returns risk scoring on email addresses and phone numbers, and Fingerprint, which returns device identifiers and suspicion scores.
Payment providers, such as Stripe and Coinflow, which provides us with your transaction and payment status data.
Public sources, such as government agencies, public records, social media platforms, public blockchain(s), and other publicly available sources which may provide us with identity, contact, profile and demographic data.
Data providers, such as information services and data licensors that provide demographic and other information.
Our affiliate partners, such as our affiliate network provider and publishers, influencers, and promoters who participate in our paid affiliate programs. These partners may provide us with device and online activity data as described below.
Marketing and analytics partners, such as joint marketing partners and event co-sponsors which may provide us with identity, contact and demographic data as well as device and online activity data as described below.
Third-party services, such as third-party services that you use to log into, or otherwise link to, your Service account. This data may include your username, profile picture and other information associated with your account on that third-party service that is made available to us based on your account settings on that service.
Automatic data collection. We , our service providers, and our business partners may automatically log information about you including:
Device data, such as your computer’s or mobile device’s operating system type and version, manufacturer and model, browser type, screen resolution, RAM and disk size, CPU usage, device type (e.g., phone, tablet), IP address, unique identifiers (including identifiers used for advertising purposes), language settings, mobile device carrier, radio/network information (e.g., Wi-Fi, LTE, 3G), and general location information such as city, state or geographic area.
Online activity data, such as pages or screens you viewed, how long you spent on a page or screen, the website you visited before browsing to the Service, navigation paths between pages or screens, information about your activity on a page or screen, access times and duration of access, and whether you have opened our emails or clicked links within them. This may include session recording data such as user identifiers and behaviour events like pages viewed (with URLs), clicks, taps, scrolling, navigation paths, form interactions, errors encountered and related session context.
Location data when you authorize the Service to access your device’s location.
Cookies and similar technologies. Some of the automatic collection described above is facilitated by the following technologies:
Cookies, which are small text files that websites store on user devices and that allow web servers to record users’ web browsing activities and remember their submissions, preferences, and login status as they navigate a site. Cookies used on our sites include both “session cookies” that are deleted when a session ends, “persistent cookies” that remain longer, “first party” cookies that we place and “third party” cookies that our third-party business partners and service providers place.
Local storage technologies, like HTML5 and Flash, that provide cookie-equivalent functionality but can store larger amounts of data on your device outside of your browser in connection with specific applications.
Web beacons, also known as pixel tags or clear GIFs, which are used to demonstrate that a webpage or email address was accessed or opened, or that certain content was viewed or clicked.
Software development kits. An SDK is third-party computer code that we may incorporate into our applications that may be used for a variety of purposes, including to provide us with analytics regarding the use of our applications, to integrate with social media, add features or functionality to our app, or to facilitate online advertising.
Data about others. We may offer features that help users invite their friends or contacts to use the Service, and we may collect contact details (such as email and IP address) about these invitees so we can deliver their invitations. Please do not refer someone to us or share their contact details with us unless you have their permission to do so.
How we use your personal information
We collect and process personal information for the purposes listed below. Under European and other applicable data protection law, we will rely on the legal bases listed in the table below (see "Legal basis relied upon for this processing").
Purpose for processing personal information | Personal information processed for this purpose | Legal basis relied upon for this processing |
To provide, operate and administer the Service (Operating the marketplace, creating and maintaining accounts, user profiles, activity history, enabling core features, facilitating user-initiated invitations/referrals, remembering logged-in devices, order fulfilment, customer support and communicating with you about the Service including by sending service, security and administrative messages, and responding to support requests) | Identity and Contact data, Demographic data, Profile data, Communications that we exchange with you, Transactional data, Interests, preferences and affiliations, Engagement with the Company, Listings and marketplace content, Other user-generated content, Financial data, Device data, Online activity data | Contract, where necessary to provide the Service requested by the user |
To secure, protect and prevent misuse of the Service (Security features, device recognition, fraud prevention, abuse detection, referral anti-abuse checks, bot detection, investigation of suspicious activity, and maintaining the integrity of the Service) | Identity and Contact data, Demographic data, Profile data, Transactional data, Engagement with the Company, Listings and marketplace content, Other user-generated content, Device data, Online activity data | Our legitimate interests to protect the Service, users and business from fraud, abuse, security incidents and misuse |
To improve and personalize the Service and communications (understanding user needs and interests, analyzing usage, improving the Service and business, personalizing the user experience, personalizing service communications, and developing new or improved features) | Identity and Contact data, Demographic data, Profile data, Transactional data, Interests, preferences and affiliations, Marketing and communications preferences, Engagement with the Company, Listings and marketplace content, Other user-generated content, Device data, Online activity data, Location data | Our legitimate interests to improve and personalize the Service Where personalization occurs based on cookies or similar technologies, your prior consent |
Analytics (using cookies and similar technologies to help us understand user activity on the Service, including which pages are most and least visited and how visitors move around the Service, as well as user interactions with our emails) | Identity and Contact data, Demographic data, Profile data, Interests, preferences and affiliations, Device data, Online activity data | Your prior consent |
To carry out Research and Development, including using research to analyze and improve the Service and our business | Identity and Contact data, Demographic data, Profile data, Transactional data, Interests, preferences and affiliations, Engagement with the Company, Listings and marketplace content, Other user-generated content | Our legitimate interests to carry out research and development to improve and personalize the Service |
For direct marketing, advertising and audience building | Identity and Contact data, Demographic data, Profile data, Communications that we exchange with you, Interests, preferences and affiliations, Marketing and communications preferences, Engagement with the Company, Listings and marketplace content, Device data, Online activity data, Location data | Your prior consent |
Legal compliance (to comply with applicable laws including KYC/AML check requirements, lawful requests, and legal process, such as to respond to subpoenas or requests from government authorities) | Identity and Contact data, Demographic data, Profile data, Communications that we exchange with you, Transactional data, Engagement with the Company, Listings and marketplace content, Other user-generated content, Financial data, Device data, Online activity data, Location data | To comply with our legal obligations |
Protection, enforcement and abuse prevention (to protect our, your or others’ rights, privacy, safety or property; make or defend legal claims; audit our internal processes for compliance with legal, contractual or policy requirements; enforce our Terms and Conditions; and prevent, identify, investigate and deter fraudulent, harmful, unauthorised, unethical or illegal activity, including through fraud prevention, risk scoring, platform abuse detection, chargeback protection, payment blocking, cyberattack detection and identity theft prevention) | Identity and Contact data, Demographic data, Profile data, Communications that we exchange with you, Transactional data, Engagement with the Company, Listings and marketplace content, Other user-generated content, Financial data, Device data, Online activity data, Location data | Our legitimate interests in protecting the Service, our users and our business; maintaining security and integrity; enforcing our terms; auditing compliance; preventing and investigating fraud, abuse and misuse; and establishing, exercising or defending legal rights. |
How we share your personal information
We may share your personal information with the following parties and as otherwise described in this Privacy Policy or at the time of collection.
Affiliates. Our corporate parent, subsidiaries, and affiliates, for purposes consistent with this Privacy Policy.
Service providers. Third parties that provide services on our behalf or help us operate the Service or our business (such as hosting, information technology and tooling providers like Typeform, fraud and security providers such as IPQualityScore, identity verification providers such as Persona, customer support such as Intercom and Anthropic, email delivery providers, order fulfilment and logistics providers like Shippo, marketing and audience building platforms including Meta and Google, consumer research and website analytics including Segment and PostHog).
Cryptocurrency or payment platforms. Any information collected necessary to process an NFT purchase (such as authentication information and your wallet address) is collected and processed directly by cryptocurrency or payment platforms such as Privy, Stripe, and Coinflow. Please review the privacy policies for the relevant cryptocurrency or payment platform to learn how they may use your payment information.
Linked third-party services. If you log into the Service with another third-party service, we may share your personal information with that third-party service. The third party’s use of the shared information will be governed by its privacy policy and the settings associated with your account with the third-party service.
Professional advisors. Professional advisors, such as lawyers, auditors, bankers and insurers, where necessary in the course of the professional services that they render to us.
Authorities and others. Law enforcement, government authorities, and private parties, as we believe in good faith to be necessary or appropriate for the compliance and protection purposes described above.
Business transferees. Acquirers and other relevant participants in business transactions (or negotiations of or due diligence for such transactions) involving a corporate divestiture, merger, consolidation, acquisition, reorganization, sale or other disposition of all or any portion of the business or assets of, or equity interests in, Company or our affiliates (including, in connection with a bankruptcy or similar proceedings).
Other users and the public. Your profile and other user-generated content (except for private messages) are visible to other users of the Service and the public. For example, other users of the Service or the public may have access to your information if you chose to make your profile or other personal information available to them through the Service, such as when you provide comments, reviews, survey responses, share NFTs, interact other users, or share other content. This information can be seen, collected and used by others, including being cached, copied, screen captured or stored elsewhere by others (e.g., search engines), and we are not responsible for any such use of this information.
How long do we keep your personal information?
We will only keep your personal information for as long as we need it to achieve the purposes for which we collected it, to comply with our legal and regulatory obligations, to exercise our legal rights, and to protect ourselves from legal claims. This period will vary depending on the nature of your interactions with us.
If we no longer need this personal information for the purposes set out in this Policy, we will delete it or anonymize it so that nobody can identify you from the information.
Your choices
Access or update your information. If you have registered for an account with us through the Service, you may review and update certain account information by logging into the account.
Opt-out of marketing communications. You may opt-out of marketing-related emails by following the opt-out or unsubscribe instructions at the bottom of the email, or by contacting us using the details below. Please note that if you choose to opt-out of marketing-related emails, you may continue to receive service-related and other non-marketing emails.
Do Not Track. Some Internet browsers may be configured to send “Do Not Track” signals to the online services that you visit. We currently do not respond to “Do Not Track” or similar signals. To find out more about “Do Not Track,” please visit http://www.allaboutdnt.com.
Declining to provide information. We need to collect personal information to provide certain services. If you do not provide the information we identify as required or mandatory, we may not be able to provide those services.
Linked third-party platforms. If you choose to connect to the Service through another third-party platform, you may be able to use your settings in your account with that platform to limit the information we receive from it. If you revoke our ability to access information from a third-party platform, that choice will not apply to information that we have already received from that third party.
Other Sites and Services
The Service may contain links to websites, mobile applications, and other online services operated by third parties. In addition, our content may be integrated into web pages or other online services that are not associated with us. These links and integrations are not an endorsement of, or representation that we are affiliated with, any third party. We do not control websites, mobile applications or online services operated by third parties, and we are not responsible for their actions. We encourage you to read the privacy policies of the other websites, mobile applications and online services you use.
Your rights
Under the GDPR, you have the right to:
ask us for a copy of your personal information;
to correct, delete, or restrict (stop any active) use of your personal information;
in certain cases to obtain the personal information you provide to us in a structured, machine readable format; and
to object to the use of your personal information in some circumstances (in particular, when we don’t have to use the data to meet a contractual or other legal requirement, or when we are using the data to send you marketing emails).
Where you have given us your consent to use your personal information, you can revoke that consent at any time. If you do, we will promptly stop using your personal information, unless we collected it for a different purpose (for example, the information is necessary to comply with a legal obligation) supported by another lawful basis. If you decide to revoke your consent, this will not affect the lawfulness of our actions before you made that decision.
Any request to exercise one of these rights will be assessed by us on a case-by-case basis. There may be circumstances in which we are not legally required to comply with your request or the right may be limited, for example, if answering your request would reveal personal information about another person or if you ask us to delete information which we are required by law to keep or have important legitimate interests to keep.
You also have the right to complain to your local data protection authority about how we process your personal information.
To exercise any of these rights, or to make a complaint to us, you can get in touch using the details set out in the “How to contact us” section below.
Automated decision-making
We and our service providers may use automated or partly automated tools to help us operate, protect and secure the Service, including to detect and prevent fraud, payment abuse, chargebacks, unauthorised activity, platform abuse, cyberattacks, identity theft and other harmful or illegal activity.
In some cases, these automated tools may result in a decision to approve, decline, block, pause or restrict a payment, transaction or other use of the Service. For example, we may automatically decline or block transactions that appear fraudulent, unauthorised or likely to result in a chargeback, or restrict account activity that appears to involve platform abuse or misuse.
Where a decision is based solely on automated processing and produces legal effects or similarly significant effects, we provide the safeguards required by applicable law. These may include the right to request human intervention, express your point of view, provide additional information and challenge the decision. You can request review of an automated decision by contacting us using the details set out in the “How to contact us” section below.
Security
We employ a number of technical, organizational and physical safeguards designed to protect the personal information we collect. However, security risk is inherent in all internet and information technologies and we cannot guarantee the security of your personal information.
International data transfer
We are headquartered in the United States and may use service providers that operate in other countries including the United States, Brazil and the Philippines. Your personal information may be transferred to the United States or other locations where privacy laws may not be as protective as those in your state, province, or country. Where this is the case, we take steps to ensure your personal information is protected, including by entering into contracts that have been approved by the relevant authorities (such as “standard contractual clauses” or an “international data transfer agreement”). If you want to learn more about this, or to get a copy of the transfer mechanism that we use, please reach out using the details given in the “How to contact us” section below.
Children
The Service is not intended for use by anyone under 18 years of age. If you are a parent or guardian of a child from whom you believe we have collected personal information in a manner prohibited by law, please contact us. If we learn that we have collected personal information through the Service from a child without the consent of the child’s parent or guardian as required by law, we will comply with applicable legal requirements to delete the information.
Changes to this Privacy Policy
We reserve the right to modify this Privacy Policy at any time. If we make material changes to this Privacy Policy, we will notify you by updating the date of this Privacy Policy and posting it on the Service or other appropriate means. Any modifications to this Privacy Policy will be effective upon our posting the modified version (or as otherwise indicated at the time of posting). In all cases, your use of the Service after the effective date of any modified Privacy Policy indicates your acceptance of the modified Privacy Policy.
How to contact us
Email: [email protected]