Privacy Policy.

4.1 Who is responsible for your information

Numa Verse, LLC ([Wyoming address]) and Algostake (Pty) Ltd ([South African address], 2025/569869/07) jointly decide how your information is used to sell and run the membership and the shop. Under a written agreement between them:

• The Seller leads orders, payments, refunds, tax and accounting records, and South African compliance;
• The Owner leads the website, the members' area, the Scroll, sign-in, security and the technology providers;
• Both cooperate on rights requests, incidents, transfers and retention.

You can exercise your rights against either company at support@numaverse.org, and their arrangement never limits those rights. Where one company uses information only for its own legal duties, it alone is responsible for that use.

• Information Officer (POPIA): [name], registered with the Information Regulator, at [contact].
• PAIA manual: at [link].
• EU representative: [name and address, if required].
• UK representative: [name and address, if required].

4.2 What we collect

If you do not give required information, we cannot complete that purchase or service.

4.3 Why we use it, and on what legal basis

We do not sell your information, share it for cross-context advertising, or use it for profiling.

4.4 Information that may reveal religious beliefs

We never ask about your faith, and we do not build profiles of anyone's beliefs. Some things you choose to share, such as the wording of a Scroll line, may reveal religious or philosophical beliefs. Publishing a line on the public Scroll therefore needs a separate, unticked consent:

"I explicitly consent to my Scroll line, including anything it reveals about religious or philosophical beliefs, being shown on the public Scroll. I understand anyone may see, copy or index it, and I can withdraw this consent and have it removed from public view at any time."

This consent covers you only. It does not authorise publishing information about another living person (Terms of Sale, 1.7).

4.5 Who we share it with

We also share information where the law requires it, and with professional advisers bound by confidentiality. The full list of providers and their subprocessors is at [link].

4.6 International transfers

Your information is processed in South Africa, the United States and Ireland. Transfers are protected as follows:

• Out of the EU: [the EU-US Data Privacy Framework where a provider is certified, otherwise the EU Standard Contractual Clauses, including between the Owner and the Seller].
• Out of the UK: [the UK Addendum or International Data Transfer Agreement].
• Out of South Africa: a ground under section 72 of POPIA, including binding agreements that give protection substantially similar to POPIA.

You can ask for a copy of these safeguards at support@numaverse.org.

4.7 How long we keep it

Sign-in links work once and expire after 30 minutes.

4.8 Your rights

Depending on where you live, you can ask us to give you a copy of your information or a portable copy, correct it, delete it, or restrict how we use it. You can also object to uses based on legitimate interests, withdraw consent at any time, and learn who receives it. We make no automated decisions with legal or similarly significant effects.

Email support@numaverse.org. We verify your identity proportionately, reply within one month under GDPR and POPIA (or the period your law sets), explain any extension or refusal, and never treat you worse for using a right. Some records we must keep by law, and we restrict them to that purpose.

You can complain to a regulator:

• in South Africa, the Information Regulator (https://inforegulator.org.za);
• in the UK, the Information Commissioner's Office (https://ico.org.uk);
• in the EU, the data protection authority where you live or work.

4.9 Children

The website, accounts and purchases are for adults aged 18 and over. We do not accept the names of living children on the Scroll or knowingly collect children's information. If you think we hold a child's information, tell us and we delete it. Before any child profiles are offered with family access, we will publish a children's notice and put parental consent, age checks and deletion controls in place.

4.10 Security

The site uses encryption in transit, sign-in by single-use link instead of passwords, and access to member data only for the people who need it. If a breach affects your information, we tell you and the regulator as the law requires.

4.11 Additional information for US residents

Where a state privacy law applies to us, you may request access, correction, deletion and a portable copy, and appeal a refusal through [method]. We do not sell or share personal information for targeted advertising, and we honour Global Privacy Control signals where the law requires. The categories, sources, purposes, recipients and retention periods are in 4.2 to 4.7. [Counsel to confirm which state laws apply.]

4.12 Changes

We update this policy when what we do changes. The effective date shows the latest version, and we email members before any significant change takes effect.