Privacy Policy

Sienna Creations LLC (“Sienna,” “Company,” “we,” “us,” or “our”) respects your privacy. This Privacy Policy (“Policy”) describes how we collect, use, share, and protect personal information when you access or use the Sienna platform (the “Platform”), including all related websites, applications, tools, features, and services (collectively, the “Services”).

This Policy is meant to give you a clear picture of our data practices so you can make informed decisions. This Policy is incorporated into and forms part of our Terms of Service. By accessing or using the Platform, you acknowledge that you have read and understand this Policy. Where we rely on consent as a legal basis for processing, we will obtain your consent separately.

We may update this Policy from time to time. If we make material changes, we will provide notice through the Platform or by other reasonable means. Your continued use of the Platform following any changes constitutes your acknowledgment of the revised Policy.

Information You Provide to Us

We collect information that you provide directly when you create an account, use the Platform, or communicate with us, including:

• Account Information. When you create an account, you connect an Ethereum-compatible Digital Wallet and provide your full name. You may be required to affirmatively confirm that you are at least eighteen (18) years of age. You may also provide a username or display name.
• Profile Information. After registration, you may choose to provide additional information such as social media handles and biographical details during onboarding or through your account settings.
• User Content. Any content you upload or create on the Platform, including images, videos, audio files, HTML code, and written text.
• Communications. Information you provide when you contact us for support or otherwise communicate with us.

Information We Collect Automatically

When you access or use the Platform, we automatically collect certain information, including:

• Device and Usage Information. Your IP address, browser type, operating system, referring URLs, pages viewed, links clicked, and other usage data.
• Cookies and Similar Technologies. We use cookies and similar technologies for login and session management. We also use analytics technologies (such as Google Analytics) to understand how Users interact with the Platform. Google Analytics may use cookies or similar identifiers to collect usage data. For more information, see Section 12 (Cookies and Similar Technologies).

On-Chain Data

When you connect a Digital Wallet to the Platform, we access and aggregate publicly available On-Chain Data associated with your wallet address(es), including NFT ownership records, transaction histories, and other blockchain data. This data is publicly available on the Ethereum blockchain and other supported blockchains. You may also connect additional wallet addresses, and we will access On-Chain Data associated with those wallets.

Information from Third-Party Services

If and when additional login integrations are offered (such as Google, X/Twitter, or Instagram authentication), we may receive certain information from those services, such as your name, email address, profile information, and other data authorized by you and the applicable third-party service. These integrations are not currently available and will be subject to updated disclosures when launched.

We use the information we collect for the following purposes:

• Providing and Operating the Platform. To create and manage your account, authenticate your identity via Digital Wallet, provide the Services, facilitate Subscription billing through our payment processor (currently Stripe), and deliver customer support.
• Displaying Content and On-Chain Data.To aggregate, index, and display NFT collections, On-Chain Data, and User Content as part of the Platform’s core functionality, including on Public Portfolio Pages.
• Improving the Platform. To analyze usage patterns (including via Google Analytics), diagnose technical issues, and develop new features and functionality.
• Communications. To send you service-related notices, account confirmations, security alerts, and other administrative messages. We do not currently send marketing or promotional emails.
• Security and Fraud Prevention. To protect the security of the Platform and our Users, detect and prevent fraud and abuse, and enforce our Terms of Service.
• Compliance. To comply with applicable laws and regulations, respond to legal process, and cooperate with law enforcement and regulatory authorities.

We do not sell your personal information and do not share it with third parties for their own marketing purposes. We do disclose personal information to operational service providers as necessary to provide the Platform, as described below:

• Service Providers and Processors. We share information with third-party vendors and service providers that perform services on our behalf, including cloud hosting and infrastructure (Amazon Web Services), payment processing (Stripe), usage analytics (Google Analytics), blockchain data aggregation and indexing (Alchemy, OpenSea, Etherscan), and authentication services (if and when implemented). These providers are contractually obligated to use your information only to provide services to us and in accordance with this Policy.
• Legal Obligations. We may disclose your information if required to do so by law, regulation, legal process, or governmental request, or if we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others, investigate fraud, or respond to a government request.
• Business Transfers. In connection with any merger, acquisition, reorganization, sale of assets, or bankruptcy, your information may be transferred as part of that transaction. We will notify you of any such change in ownership or control of your personal information.
• With Your Consent. We may share your information with third parties when you have given us your explicit consent to do so.
• Publicly Displayed Information. Information that you choose to make publicly available through the Platform (including your Public Portfolio Pages, username, and associated Content) will be accessible to other Users and the general public. Public Portfolio Pages may also load content directly from Third-Party Services (e.g., embedded X/Twitter content), which may result in data flows directly to those services when users view your pages.

The Platform integrates with the following categories of third-party services:

• Cloud Infrastructure. Amazon Web Services (AWS) for data hosting and storage.
• Payment Processing. Stripe, Inc. for Subscription billing and payment processing.
• Blockchain Data Providers. OpenSea, Alchemy, and Etherscan for NFT indexing, on-chain data aggregation, and wallet/address lookups.
• Analytics. Google Analytics for understanding how Users interact with the Platform.
• Social Media. X/Twitter for embedded content on Public Portfolio Pages.
• Internal Operations. YouTrack and Trigger.dev are used for internal project management and automation. These tools support our operations and may receive limited personal information about Users (such as names and wallet addresses) in connection with support tickets, debugging, and operational activities.

Additional integrations (such as Google login, Instagram, and additional payment processors) may be introduced in the future and will be disclosed in an updated version of this Policy.

Each of these services has its own privacy policy and terms, which we encourage you to review. We are not responsible for their privacy practices.

We retain your personal information for as long as your account is active or as needed to provide the Services, comply with our legal obligations, resolve disputes, and enforce our agreements. If you close your account or request deletion of your data, we will delete or anonymize your personal information within a commercially reasonable period (generally within thirty (30) days of a verified request), except to the extent that retention is required by applicable law or for legitimate business purposes. Publicly displayed Content may persist in cached or archived form for a limited period after deletion. Additionally, certain information may be retained in backup systems or server logs for a limited period beyond the stated deletion timeline in accordance with our standard retention practices.

Please note that On-Chain Data recorded on the blockchain cannot be modified or deleted by the Company or any other party. Deletion of your account will not affect data stored on the blockchain.

We use commercially reasonable administrative, technical, and physical safeguards designed to protect your personal information from unauthorized access, use, alteration, and disclosure, including encryption in transit and role-based access controls. However, no method of transmission over the Internet or method of electronic storage is completely secure, and we cannot guarantee the absolute security of your information. You are responsible for maintaining the security of your Digital Wallet and account credentials. The Company is not responsible for security breaches affecting third-party wallet providers, blockchain networks, or other external services.

In the event of a data breach affecting your personal information, we will notify you as required by applicable law.

The Platform is operated from the United States, and your information is stored on servers located in the United States (via AWS). If you are accessing the Platform from outside the United States, please be aware that your information will be transferred to, stored in, and processed in the United States, where data protection laws may differ from those in your country of residence.

Where required by applicable law, we will implement appropriate safeguards to ensure an adequate level of protection for your personal information in connection with international transfers, including Standard Contractual Clauses approved by the European Commission (and equivalent mechanisms for the UK and Switzerland) or other lawful transfer mechanisms.

General Rights

Depending on your location, you may have certain rights with respect to your personal information. These rights may vary by jurisdiction and may be subject to legal exceptions. Available rights may include:

• Access. The right to request access to the personal information we hold about you.
• Correction. The right to request correction of inaccurate or incomplete personal information.
• Deletion. The right to request deletion of your personal information, subject to certain exceptions.
• Portability. The right to receive a copy of your personal information in a structured, commonly used, and machine-readable format.
• Restriction. The right to restrict processing in certain circumstances.
• Objection. The right to object to the processing of your personal information for certain purposes.
• Withdrawal of Consent. Where processing is based on consent, the right to withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

To exercise any of these rights, please contact us at legal@sienna.art. We will respond to your request within the time period required by applicable law. We may ask you to verify your identity before processing your request.

Rights of Users in the European Economic Area, United Kingdom, and Switzerland

If you are located in the European Economic Area (“EEA”), the United Kingdom (“UK”), or Switzerland, the following additional provisions apply.

Legal Basis for Processing. We process your personal information on the following legal bases:

• Contract. Processing is necessary for the performance of our contract with you (i.e., the Terms of Service), including to create and manage your account, provide the Services, and process Subscriptions.
• Legitimate Interests. Processing is necessary for our legitimate interests, including improving the Platform, ensuring security, preventing fraud, performing internal analytics and logging, and enforcing our Terms, provided those interests are not overridden by your rights.
• Consent. Where you have given explicit consent to the processing of your personal information for a specific purpose (such as connecting optional third-party accounts, if and when offered).
• Legal Obligation. Processing is necessary to comply with a legal obligation to which we are subject.

Data Transfers. Your personal information may be transferred to and processed in the United States and other countries outside the EEA, UK, or Switzerland. Where such transfers occur, we rely on Standard Contractual Clauses approved by the European Commission (and equivalent mechanisms for the UK and Switzerland) or other lawful transfer mechanisms to ensure an adequate level of protection.

EU/UK Representative. Where required by applicable law, the Company will appoint a representative in the European Union and/or the United Kingdom. Contact details for any such representative will be provided in an updated version of this Policy or upon request at legal@sienna.art. [EU/UK Representative: To be designated.]

Right to Lodge a Complaint. You have the right to lodge a complaint with a supervisory authority in the country in which you reside if you believe that our processing of your personal information violates applicable data protection law.

Rights of California Residents

If you are a California resident, you may have additional rights under the California Consumer Privacy Act (“CCPA”), as amended by the California Privacy Rights Act (“CPRA”).

Categories of Personal Information Collected. The following table summarizes the categories of personal information we have collected in the preceding twelve (12) months:

Your California Rights. As a California resident, you have the right to:

• Right to Know. Request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources, the business purposes for collecting the information, and the categories of third parties with whom we share the information.
• Right to Delete. Request the deletion of personal information we have collected from you, subject to certain exceptions.
• Right to Correct. Request the correction of inaccurate personal information.
• Right to Non-Discrimination. Not receive discriminatory treatment for exercising your privacy rights.

How to Submit a Request. You may submit a request by emailing us at legal@sienna.art. You may also designate an authorized agent to submit a request on your behalf by providing written authorization. We may require you to verify your identity before processing your request.

We Do Not Sell or Share Personal Information. We do not “sell” or “share” (as those terms are defined under the CCPA/CPRA) your personal information for cross-context behavioral advertising purposes. We do not collect sensitive personal information as defined under the CCPA/CPRA.

The Platform is not directed to, and is not intended for use by, anyone under the age of eighteen (18). We do not knowingly collect personal information from anyone under eighteen (18). If we learn that we have collected personal information from anyone under eighteen (18), we will promptly delete it. If you believe that someone under eighteen (18) has provided us with personal information, please contact us at legal@sienna.art.

Some web browsers transmit “Do Not Track” or similar signals (including Global Privacy Control) to websites. Because there is no uniform industry standard for recognizing or honoring such signals, the Platform does not currently respond to Do Not Track signals. We will continue to monitor developments in this area and may update our practices accordingly. To the extent required by applicable law, we will treat Global Privacy Control (GPC) signals as valid opt-out requests.

Authentication Cookies. We use cookies and similar technologies for login and session management. These cookies are necessary for the operation of the Platform and cannot be disabled without impairing functionality.

Analytics Technologies. We use Google Analytics to understand how Users interact with the Platform. Google Analytics may set cookies or use similar identifiers to collect aggregated usage data. You may opt out of Google Analytics by installing the Google Analytics Opt-Out Browser Add-on (available at tools.google.com/dlpage/gaoptout) or by adjusting your browser settings to reject analytics cookies.

We do not use advertising, behavioral tracking, or third-party marketing cookies. Where required by applicable law (including the EU ePrivacy Directive), we will obtain your consent before using non-essential cookies or similar technologies.

If you have questions about this Privacy Policy, wish to exercise your privacy rights, or have a complaint about our data practices, please contact us at: