Privacy Policy

1. Responsible party and scope

LoveMedia Foundation NPC, company registration number 2024/122569/08, is the responsible party or data controller for XMR.gives. Our address is Unit 1 Raddical Park, 3 Gourly Rd, Ballito, 4399, South Africa. This policy applies to the website, account dashboards, support forms, pool gateways, reward ledger, raffle records, and operational communications.

Use Support for privacy requests and mark the category "Privacy or data request". Do not send wallet seeds or private keys.

2. Information we collect

• Account data: name, email address, password hash, account role, referral relationship, communication preferences, account dates, and security tokens.
• Wallet and payment data: Monero account wallet, XMR or BTC withdrawal destination, internal balances, requested and delivered amounts, conversion fee and net value, request status, adjustments, transaction references, and prize evidence. We never request wallet seed phrases or private keys.
• Mining data: worker identifier, selected route, connection and activity times, accepted share keys, accepted difficulty, session duration, ticket records, and derived hashrate estimates.
• Raffle data: program and round entries, ticket numbers, eligibility duration, result and audit references, masked public wallet result, and communication delivery state.
• Support data: name, email, category, subject, message, submission time, a one-way network-address hash used for abuse prevention, and email-delivery status.
• Technical and status data: internet protocol address in short-lived server logs, browser or miner protocol metadata, request time, requested route, response status, diagnostics, security events, listener availability, aggregate hashrate, connection totals, latency, incidents, maintenance, and report samples.
• Cookie data: authentication session and cookie preference values described in our Cookie Policy.

3. Sources and purposes

We collect information directly from registration, wallet and withdrawal requests, support requests, and admin-authorised records; automatically from browser and miner connections; and from payment providers, the Monero or Bitcoin network, or the authorised external audit process when reconciling a payout or result.

We use it to create and secure accounts; map work to participants; calculate difficulty-weighted entitlements; apply published allocations; administer balances and payouts; issue and display tickets; verify eligibility; record externally supplied results; send opted-in announcements and required service messages; respond to support; prevent abuse; maintain backups; meet accounting, consumer, competition, sanctions, anti-money-laundering, tax, and legal obligations; and establish or defend legal claims.

4. Legal bases

Where the GDPR applies, we process core account, mining, ledger, payout, and support data because it is necessary to perform a contract or take requested pre-contract steps. We process records required by law under a legal obligation. We use proportionate logs, fraud controls, service diagnostics, aggregate status reporting, and claim records for legitimate interests in operating and protecting the service. We use consent for optional raffle marketing, incident, maintenance, and monthly-report emails and any future non-essential cookie category. You may withdraw consent without affecting earlier lawful processing.

Under South Africa's Protection of Personal Information Act (POPIA), we process information with your consent, to conclude or perform the service agreement, to comply with law, to protect legitimate interests, and for our legitimate operational interests where those bases apply. We do not sell personal information.

5. Sharing and processors

We disclose only what is reasonably necessary to infrastructure and hosting providers; authenticated email providers; technical contractors under confidentiality; payment, wallet, or exchange providers used for a payout; LoveMedia's authorised audit and prize-administration personnel; professional advisers, insurers, and auditors; and courts, regulators, law enforcement, or tax authorities where lawfully required.

Public winner announcements display only the first four and last four characters of a wallet. The Mini network leaderboard independently aggregates publicly observable sharechain work and masks each payout address the same way; it does not use XMR.gives emails, workers, balances, or account IDs. The account leaderboard preference excludes a registered wallet from account-derived XMR.gives rankings but cannot alter public network records. A winner email may include the winner's full registered wallet. Other miners do not receive it. We do not disclose password hashes, private security tokens, support content, emails, account IDs, worker names, balances, or full leaderboard wallets publicly.

Globalping receives the public pool hostname, public Stratum port, requested geographic region, and measurement options to perform independent availability checks. It does not receive miner account data from XMR.gives. Probe location, network, reachability, latency, and time are published on the status page.

6. International transfers

The service is operated from South Africa. Some email, infrastructure, payment, or support providers may process information in another country. Where POPIA or the GDPR requires safeguards, we use an adequacy mechanism, binding legal obligation, appropriate contractual protection, or another permitted transfer basis. Contact support for information about the safeguards relevant to your data.

7. Retention

We keep personal information only while needed for the stated purpose, dispute handling, security, backup restoration, and legal retention. Current operational targets are:

• Website access logs rotate daily and are normally retained for 14 days.
• One-minute operational status samples are normally retained for up to 400 days; individual external probe results are normally retained for 90 days. Published incident, maintenance, uptime, and monthly aggregate records may remain longer as service history.
• Support requests and their delivered outbox copy are normally retained for up to 24 months after submission unless a dispute or legal duty requires longer.
• Account and active mining records are retained while the account operates and then restricted or deleted when no longer needed, subject to payment, tax, fraud, and claim requirements.
• Competition rules, entries, winners, oversight, prizes, and related records are retained for at least the legally required period, including at least three years where South African promotional-competition rules apply.
• Ledger, payout, tax, and transaction records may be retained for the applicable statutory accounting and claim period.
• Backups expire through the documented backup cycle; a deleted item may remain inaccessible in a backup until that backup expires.

8. Your rights

Depending on the law that applies, you may ask to be informed about processing; access personal information; correct an inaccurate record; delete information; restrict processing; object to certain processing; receive portable data; withdraw consent; or complain to a supervisory authority. These rights can be limited where records must be retained for law, payments, security, another person's rights, or legal claims.

Submit a request through Support. We may verify identity and wallet or account control before disclosing or changing data. South African users may complain to the Information Regulator, and EEA users may complain to the supervisory authority in their country. You may unsubscribe from raffle marketing in the dashboard or with the link in each announcement. Dashboard → Status alerts controls account-derived ranking visibility and each service-email category.

9. Security

We use HTTPS for the website, signed HTTP-only session cookies, password hashing, role checks on server actions, input validation, protected configuration files, restricted administration, durable mail queues, unique transaction and ticket controls, and host-level logging and backups. Stratum mining connections are currently plain TCP and should not be treated as confidential transport.

No system is perfectly secure. If we confirm a security compromise involving personal information, we will contain and assess it and notify affected people and regulators where law requires.

10. Automated processing

The platform automatically validates worker identities, records accepted work, estimates hashrate, calculates difficulty-weighted reward portions, applies published route allocations, and checks time-and-ticket eligibility. These calculations are rule-based and can be reviewed through support. The platform does not select raffle winners; authorised external audit personnel supply the random result for recording. We do not use personal information for behavioural advertising or automated credit scoring.

11. Children and external sites

The service is for adults aged 18 or older and is not directed to children. If we learn that a child registered, we will suspend the account and handle the information and any balance according to law. Links to external wallets, exchanges, regulators, or documentation are governed by those providers' policies.

12. Changes and contact

We may update this policy when processing, providers, or law changes. Material changes will receive a new effective date and any notice or consent required by law. Contact LoveMedia Foundation NPC through xmr.gives/support or at the physical address above.