Rogues Ink — Privacy Policy

Closed-beta notice. Rogues Ink is currently offered in a closed beta to verified holders of Rogues NFT collection assets. This Privacy Policy was prepared by the operator with AI research assistance and has not been reviewed by external legal counsel. It will be reviewed by counsel before any public-web or open-registration launch of Rogues Ink. The choice to operate under operator-prepared documents during the closed beta is a deliberate, documented decision (see ADR 0013).

This Privacy Policy applies to Rogues Ink, an AI image generation service operated by Rogues NFT Inc. ("Rogues NFT," "we," "us," or "our"). It explains what personal data we process when you use Rogues Ink, why we process it, how long we keep it, and what rights you have over it.

Rogues Ink is not a website with user accounts. It is a Discord bot. The personal data we process is limited to what is necessary to deliver that bot service to verified holders of Rogues NFT collection assets and to maintain evidence of your acceptance of our Holder Terms of Use. We do not run a marketing list, we do not deploy advertising cookies, and we do not sell or share your data for advertising purposes. This Privacy Policy is structured to reflect that narrow, service-specific footprint.

If you are a resident of Brazil, please also read §2 — LGPD-Specific Notice. If you are a resident of the European Union, the United Kingdom, or the European Economic Area, please also read §3 — GDPR / UK / EEA Notice. The rights described in §2 and §3 are additional to, and do not replace, the rights and protections described in §1.

1. Main Privacy Policy

1.1 Who we are

The controller of your personal data for the purposes of this Privacy Policy is:

Rogues NFT Inc., a British Virgin Islands business company.
Operational notice address: contact@roguesnft.com

All privacy inquiries, requests to exercise data subject rights, and complaints should be directed to the operational notice address.

1.2 Scope of this Privacy Policy

This Privacy Policy covers personal data we process in connection with:

1. eligibility verification of holders of Rogues NFT collection assets on the Solana blockchain;
2. operation of the Rogues Ink Discord bot, including delivery of commands, generation of images, and delivery of those images back to you;
3. recording your acceptance of our Holder Terms of Use; and
4. operation of the Carrots staking-rewards ledger as it interacts with Rogues Ink usage.

This Privacy Policy does not cover personal data processed by Discord, Inc. in operating the Discord platform itself, nor personal data processed by your wallet provider, nor on-chain personal data publicly visible on the Solana blockchain. Those are governed by their own respective privacy policies and by the inherent properties of public blockchains.

1.3 What personal data we process

We process the following categories of personal data:

1. Discord user identifiers. Numeric Discord user IDs of holders who interact with the Rogues Ink bot. Discord user IDs are pseudonymous identifiers assigned by Discord; they are not your name or contact information, but they can be used to identify you within the Discord platform.
2. Wallet addresses. Solana wallet addresses associated with your Discord account via Rogues NFT's holder verification process. Wallet addresses are public on the Solana blockchain.
3. Generation prompts and outputs. The text prompts you submit to the Rogues Ink bot and the AI-generated images produced in response. Prompts and outputs are processed by Replicate, Inc. for inference; outputs are delivered to you through Discord.
4. Vote records. Records of any 👍/👎 votes you submit on Rogues Ink generations, used to calibrate the service.
5. Terms acceptance state. A record reflecting that you accepted the Rogues Ink Holder Terms of Use, including: the timestamp of acceptance (accepted_at); the version hash of the Terms accepted (terms_version_hash); the timestamp of your most recent interaction with the bot (last_active_at); and, if you revoke your acceptance, the timestamp of revocation (revoked_at).
6. Carrots ledger state. Records of Carrots balances and Carrots-denominated transactions associated with your wallet. The Carrots ledger is operated by Rogues NFT through api.roguesnft.com.

We do not knowingly collect: real-world names; postal or email addresses (other than the support email if you choose to write to us); telephone numbers; payment-card or banking information; identity-document information; biometric data; geolocation data; or browsing histories outside of the Rogues Ink Discord service.

1.4 Why we process it and the lawful basis for doing so

We process the personal data described in §1.3 for the following purposes:

1. To deliver the Rogues Ink service. We process Discord user IDs, wallet addresses, generation prompts, and generation outputs in order to verify your eligibility, generate the images you request, and deliver those images to you. Lawful basis: performance of a contract with you (the Rogues Ink Holder Terms of Use), and our legitimate interest in operating the service.
2. To record and re-verify your acceptance of the Holder Terms of Use. We process Terms acceptance state in order to establish that you have agreed to the Holder Terms, and to re-collect acceptance if we materially update those Terms. Lawful basis: our legitimate interest in the establishment, exercise, and defense of legal claims arising out of your use of Rogues Ink, and performance of a contract with you.
3. To operate the Carrots staking-rewards ledger as it interacts with Rogues Ink. When you spend Carrots to access Rogues Ink features, we read and decrement your Carrots balance through api.roguesnft.com. Lawful basis: performance of a contract with you, and our legitimate interest in operating the staking-rewards program.
4. To respond to abuse, fraud, and safety issues. We may review records of bot interactions in response to specific reports of abuse, fraud, intellectual-property infringement, or other safety issues. Lawful basis: our legitimate interest in operating a safe and lawful service, and compliance with legal obligations applicable to us.
5. To comply with applicable law. Where we are required by law to retain, disclose, or otherwise process personal data, we do so. Lawful basis: compliance with legal obligations applicable to us.

We do not process personal data for marketing or advertising purposes, we do not sell personal data, and we do not share personal data with third parties for their own marketing or advertising purposes.

1.5 Who we share personal data with (processors and infrastructure providers)

We share the personal data described in §1.3 only with the processors and infrastructure providers necessary to operate the Rogues Ink service. As of the effective date of this Privacy Policy, those are:

1. Supabase, Inc. — primary database hosting in the United States (us-west-1 region). Stores the terms_acceptance records, the Ink balance ledger, image generation history, and vote records. Supabase processes this data under its terms of service and standard data processing addendum.
2. Railway Corp. — Discord bot runtime hosting in the United States (us-west2 region). The Railway runtime is ephemeral and does not persistently store user data; environment variables (containing credentials for the providers listed in this section) are managed by Railway.
3. Replicate, Inc. — AI inference hosting in the United States. Generation prompts and outputs pass through Replicate's infrastructure during the generation step. Replicate processes this data under its terms of service.
4. Discord, Inc. — the chat platform through which you interact with the Rogues Ink bot. All interactions with the bot transit Discord. Discord processes this data under its own privacy policy and terms.
5. Carrots API (api.roguesnft.com) — operated by Rogues NFT Inc., the authoritative ledger for the Carrots staking-rewards balance. Internal to the Rogues NFT operation.

We may update the list of processors from time to time as the operational infrastructure changes. If we add a new processor that processes personal data described in this Privacy Policy in a materially different manner, we will update this Privacy Policy and treat that update as a material change under §1.11.

We may also disclose personal data: (i) to legal counsel, accountants, auditors, and other professional advisors under obligations of confidentiality, where necessary for the establishment, exercise, or defense of legal claims; (ii) to law enforcement, regulators, or other public authorities where required by applicable law; and (iii) to any successor in interest in connection with a corporate transaction (merger, acquisition, or sale of assets), subject to confidentiality protections at least as protective as those in this Privacy Policy.

1.6 How long we keep personal data (retention)

We retain personal data only for as long as it serves the purpose for which it was collected, subject to the following:

1. Terms acceptance state and last-activity timestamps: retained for six (6) years from the most recent last_active_at timestamp. This retention period is anchored on the contract statute of limitations applicable to Rogues NFT Inc. under the BVI Limitation Act 1961, and is necessary for the establishment, exercise, and defense of legal claims arising out of your use of Rogues Ink (see §1.7).
2. Generation prompts and outputs: retained in the Supabase generation-history table for the operational lifetime of the service, used to support features such as regeneration, voting calibration, and abuse review. If you wish your generation history to be purged, see §1.7 and §1.12.
3. Carrots ledger records: retained per the operational requirements of the Carrots staking-rewards program.

After the applicable retention period expires, personal data is either deleted or fully and irreversibly anonymized.

1.7 Revocation and the limits of the right to erasure

You can revoke your acceptance of the Holder Terms of Use at any time by running the /revoke-terms slash command in the Rogues Ink Discord interface (or by emailing contact@roguesnft.com). When you revoke:

1. we set the revoked_at timestamp on your terms_acceptance record;
2. your access to the Rogues Ink bot ends; and
3. the terms_acceptance record itself is retained for the period described in §1.6(a) — that is, six years from your last activity — because that record is evidence of the contractual relationship between you and Rogues NFT Inc. and is necessary for the establishment, exercise, and defense of legal claims under §1.4(b).

This means revocation is not the same as full erasure. Under the GDPR (Article 17(3)(e)) and LGPD (Article 16, II), a controller is permitted to retain personal data after a data subject's request for erasure where that retention is necessary for the establishment, exercise, or defense of legal claims. Rogues NFT Inc. relies on those exceptions to retain the terms_acceptance record (and only that record) during the six-year statute-of-limitations window. We retain only the minimum fields necessary for that purpose; we do not retain your generation history or other data tied to your Discord ID under this basis.

If you believe a portion of your data should be erased that does not fall within the legal-claim-defense exception, please write to contact@roguesnft.com and we will consider the request under §1.12 and (depending on your residency) §2 or §3.

1.8 How we protect personal data

We use industry-standard technical and organizational measures to protect personal data against unauthorized access, alteration, disclosure, or destruction. These include access controls on Supabase and Carrots API credentials, segregation of production secrets in Railway-managed environment variables, and the use of only reputable third-party processors with their own published security postures.

No system is perfectly secure. If we become aware of a personal-data breach that creates a material risk to your rights or interests, we will notify you in the manner required by applicable law.

1.9 International transfers

Rogues NFT Inc. is incorporated in the British Virgin Islands. Our principal infrastructure providers — Supabase, Railway, Replicate, and Discord — are located in the United States, and the personal data described in §1.3 is processed in the United States.

If you are located outside the United States, your personal data will be transferred to and processed in the United States. The legal basis for those transfers is described in §2.4 (for residents of Brazil under the LGPD) and §3.6 (for residents of the EU, UK, and EEA under the GDPR and UK GDPR).

1.10 Children

Rogues Ink is not intended for use by children, and the Holder Terms of Use require that you be of the age of majority in your jurisdiction. We do not knowingly process personal data of children. If we become aware that we have inadvertently processed personal data of a child, we will delete it.

1.11 Changes to this Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes — including, without limitation, changes to the categories of personal data we process, the purposes for which we process it, the processors with which we share it, or the retention periods that apply — we will:

1. update the "Last updated" date at the top of this Privacy Policy;
2. issue a new version of this Privacy Policy; and
3. notify holders through the Rogues NFT Discord server.

Where the changes also affect the Holder Terms of Use, the Rogues Ink bot will require you to re-accept the updated Terms via the /accept-terms slash command before you can continue to use the bot.

1.12 How to contact us and exercise your rights

For any privacy inquiry — including any request to exercise the rights described in this Privacy Policy or in §2 or §3 — please write to:

Rogues NFT Inc.
Email: contact@roguesnft.com

To help us locate and respond to your request, please include in your message your Discord user ID, the wallet address associated with your Rogues Ink usage (if applicable), and a clear description of what you are requesting.

We will acknowledge receipt of your request and respond within the timeframes required by applicable law (in particular, 15 days under the LGPD; without undue delay and in any event within one month under the GDPR — extendable by two further months for complex requests). If we are unable to act on your request, we will explain why.

2. LGPD-Specific Notice

This section applies if you are a resident of Brazil or otherwise have your personal data processed in connection with the offer of services to individuals located in Brazil. It is supplemental to §1 and describes the rights and protections that apply to you under the Lei Geral de Proteção de Dados Pessoais (Federal Law No. 13.709/2018, "LGPD").

2.1 Application

The LGPD applies to the processing of personal data:

1. carried out within Brazilian territory;
2. where the processing activity is aimed at offering or supplying goods or services to individuals located in Brazil; or
3. where the personal data being processed has been collected in Brazil.

Rogues NFT Inc. is a BVI company, but the operator is based in São Paulo and Brazilian holders are part of the Rogues Ink audience. We therefore treat the LGPD as applicable to processing of personal data of Brazilian residents and we apply this section accordingly.

2.2 Controller and Article 41 contact

The controller of your personal data for LGPD purposes is Rogues NFT Inc., as described in §1.1.

For purposes of LGPD Article 41 ("the controller shall appoint a person in charge of personal data processing"), the contact for personal-data inquiries is contact@roguesnft.com. Inquiries received at that address are routed to the operator for handling.

2.3 Your rights under LGPD Article 18

Under LGPD Article 18, you have the right to obtain from the controller, at any time and upon request:

1. Confirmation of the existence of processing. A confirmation that we are processing your personal data.
2. Access to the data. A copy of the personal data we hold about you.
3. Correction of incomplete, inaccurate, or outdated data. Correction of any incomplete, inaccurate, or outdated personal data.
4. Anonymization, blocking, or deletion of unnecessary or excessive data, or of data processed in non-compliance with the LGPD. Subject to the legal-claim-defense exception in LGPD Article 16, II (see §1.7).
5. Portability of the data to another service or product provider. Subject to commercial and industrial secrecy and to compliance with regulations.
6. Deletion of personal data processed with your consent. Where consent was the lawful basis for the processing, subject to the exceptions in LGPD Article 16. Note that our processing under §1.4(a), (b), and (c) is not based on consent; it is based on contract performance and legitimate interest. The deletion right in this sub-paragraph applies only to processing based on consent.
7. Information about public and private entities with which we have shared the data.
8. Information about the possibility of refusing consent and the consequences of such refusal. Where consent is the basis of processing.
9. Revocation of consent. Where consent is the basis of processing. As noted in §1.7, our processing of terms_acceptance data is based on legitimate interest in legal-claim defense, not consent; revocation under §1.7 ends our processing for future use of the service but does not delete the historical acceptance record.

To exercise any of these rights, please write to contact@roguesnft.com. We will respond within 15 days of receipt, in line with the timeframe set by the ANPD under LGPD Article 19.

2.4 International transfers (LGPD Article 33)

The personal data described in §1.3 is transferred to and processed in the United States by the processors listed in §1.5. Under LGPD Article 33, international transfers are permitted on a number of bases. Rogues NFT Inc. relies on Article 33, IX — controller's legitimate interest with adequate safeguards via contractual clauses. The processors in §1.5 operate under their standard data processing addenda, which incorporate contractual safeguards consistent with the LGPD's transfer requirements.

As of the effective date of this Privacy Policy, the ANPD has not issued a formal adequacy decision applicable to the United States. We will update this section if the ANPD's position changes.

2.5 How to complain to the ANPD

If you believe that our processing of your personal data violates the LGPD, you have the right to file a complaint with the Autoridade Nacional de Proteção de Dados (ANPD):

Autoridade Nacional de Proteção de Dados (ANPD)
Esplanada dos Ministérios, Bloco C, 7º Andar
Brasília — DF, 70297-400, Brazil
Website: https://www.gov.br/anpd/

We ask that, before filing a complaint with the ANPD, you give us the opportunity to address your concern directly by writing to contact@roguesnft.com. This is not a condition of your right to complain to the ANPD; it is simply an offer to resolve the issue first.

3. GDPR / UK / EEA Notice

This section applies if you are a resident of the European Union, the United Kingdom, Iceland, Liechtenstein, or Norway, or otherwise have your personal data processed in connection with the offer of services to individuals located in the European Economic Area or the United Kingdom. It is supplemental to §1 and describes the rights and protections that apply to you under Regulation (EU) 2016/679 ("GDPR") and the equivalent United Kingdom legislation ("UK GDPR").

3.1 Application

The GDPR applies to the processing of personal data of individuals located in the European Union where the processing relates to the offering of goods or services to those individuals or to the monitoring of their behavior in the EU. The UK GDPR applies on the same basis to individuals located in the United Kingdom.

Rogues NFT Inc. is established in the British Virgin Islands and operates the Rogues Ink service through a Discord bot accessible globally. We treat the GDPR and UK GDPR as applicable to processing of personal data of EU and UK residents who use Rogues Ink, and we apply this section accordingly.

3.2 Controller for EU and UK purposes

The controller of your personal data for GDPR and UK GDPR purposes is Rogues NFT Inc., as described in §1.1. Rogues NFT Inc. has not appointed an EU representative under GDPR Article 27 as of the effective date of this Privacy Policy; the closed-beta scale of the service and the categories of personal data processed do not, in the controller's assessment, require such appointment at this time.

3.3 Lawful bases declared

For each processing activity described in §1.4, the GDPR lawful basis is:

We do not rely on consent (Article 6(1)(a)) as the lawful basis for any of the processing described in §1.4. We do not process special categories of personal data under Article 9.

Our legitimate-interest assessment for Article 6(1)(f), in summary: (i) the legitimate interest in defending legal claims is real and important to a small operator without insurance against the indemnification exposure in the Holder Terms; (ii) the data retained is the minimum necessary (a single row keyed by Discord user ID, with no profiling, no enrichment, and no marketing use); (iii) the interests, rights, and freedoms of data subjects are not overridden because the retention is bounded by a defined legal-claims window and the right to lodge a complaint with a supervisory authority remains available throughout.

3.4 Your rights under GDPR Articles 15–22 and 7(3)

Under the GDPR, you have the following rights with respect to your personal data:

1. Right of access (Article 15). You can ask us to confirm whether we process personal data about you, and to provide you with a copy of that data and the information required by Article 15.
2. Right to rectification (Article 16). You can ask us to correct inaccurate or incomplete personal data about you.
3. Right to erasure / "right to be forgotten" (Article 17). You can ask us to delete personal data about you, subject to the exceptions in Article 17(3). In particular, Article 17(3)(e) permits us to retain personal data where it is necessary for the establishment, exercise, or defense of legal claims (see §3.5).
4. Right to restriction of processing (Article 18). You can ask us to restrict our processing of personal data about you in the circumstances described in Article 18(1).
5. Right to data portability (Article 20). Where the processing is based on contract performance (Article 6(1)(b)) and carried out by automated means, you can ask us to provide your personal data to you in a structured, commonly used, machine-readable format.
6. Right to object (Article 21). You can object to processing of personal data about you that is based on legitimate interest (Article 6(1)(f)). Where you object, we will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or unless the processing is necessary for the establishment, exercise, or defense of legal claims.
7. Rights related to automated decision-making (Article 22). We do not subject you to decisions based solely on automated processing that produce legal or similarly significant effects on you. Generation of an image in response to your prompt is not such a decision.
8. Right to withdraw consent (Article 7(3)). Where processing is based on your consent, you can withdraw it at any time. We do not rely on consent as the lawful basis for the processing described in §1.4.

To exercise any of these rights, please write to contact@roguesnft.com. We will respond without undue delay, and in any event within one month of receipt of your request, in line with GDPR Article 12(3). That period may be extended by two further months where necessary, taking into account the complexity and number of the requests; if it is so extended, we will inform you within one month of receipt of your request, together with the reasons for the delay.

3.5 Retention and the Article 17(3)(e) exception explained

GDPR Article 17(3)(e) provides that the right to erasure does not apply to the extent that processing is necessary "for the establishment, exercise or defence of legal claims." Rogues NFT Inc. relies on this exception to retain the terms_acceptance record (and only that record) for six years from the most recent last_active_at timestamp, in line with the contract statute of limitations applicable to Rogues NFT Inc. under the BVI Limitation Act 1961.

The reason we rely on this exception is that the terms_acceptance record is the operational evidence that you accepted the Holder Terms of Use, including the prohibited-uses restrictions, the indemnification, the limitation of liability, and (importantly) the no-competitive-training restriction that flows down from the FLUX.1 [dev] license. If a holder were to misuse a Rogues Ink output in a way that gave rise to a claim against Rogues NFT Inc. — for example, a claim by Black Forest Labs, Inc., or by Replicate, Inc., or by a third party whose rights were violated by the holder — the terms_acceptance record is the contractual evidence we would rely on to defend or to pursue that claim. The six-year retention period matches the period during which a contract claim can be brought under BVI law.

We retain only the minimum fields necessary for that purpose: Discord user ID, accepted-at timestamp, Terms version hash, last-active timestamp, and (if revoked) revocation timestamp. We do not retain your generation prompts, generation outputs, or any other Rogues Ink data tied to your Discord ID under the Article 17(3)(e) basis. Those other categories of data are governed by §1.6(b) and §1.6(c).

If you believe the Article 17(3)(e) exception is being applied too broadly, please write to contact@roguesnft.com so we can address your specific concern; and please note your right to complain to a supervisory authority under §3.7.

3.6 International transfers (Chapter V)

The personal data described in §1.3 is transferred to and processed in the United States by the processors listed in §1.5. Rogues NFT Inc. relies on the following Chapter V transfer mechanisms, applied in the following order of priority for each processor:

1. EU–U.S. Data Privacy Framework adequacy decision (Article 45 GDPR) — where the recipient processor is self-certified under the EU–U.S. Data Privacy Framework at the time of the transfer.
2. Standard Contractual Clauses under Article 46(2)(c) GDPR — incorporated into the data processing addenda of the processors listed in §1.5, as the fallback transfer mechanism where Data Privacy Framework certification is not available or has lapsed.

A copy of the Standard Contractual Clauses in force, or other information about the transfer mechanism applied to a specific processor, is available on request to contact@roguesnft.com.

3.7 How to complain to a supervisory authority

If you believe that our processing of your personal data violates the GDPR or UK GDPR, you have the right to lodge a complaint with a supervisory authority — in particular, with the supervisory authority of the EU state of your habitual residence, your place of work, or the place of the alleged infringement. A list of EU supervisory authorities is available at:

https://edpb.europa.eu/about-edpb/about-edpb/members_en

For United Kingdom residents, the supervisory authority is the Information Commissioner's Office:

Information Commissioner's Office (ICO)
Wycliffe House, Water Lane
Wilmslow, Cheshire, SK9 5AF, United Kingdom
Website: https://ico.org.uk/

We ask that, before lodging a complaint with a supervisory authority, you give us the opportunity to address your concern directly by writing to contact@roguesnft.com. This is not a condition of your right to lodge a complaint; it is simply an offer to try to resolve the issue first.