Privacy Policy

1. Who we are

This Privacy Policy explains how [Aligner, Inc.], a Delaware corporation (Aligner, we, us), handles personal data when you use aligner.network and the services described in our Terms of Service (the Service).

Aligner is the controller of the personal data described here. Where an organization uploads personal data about its own people into requests or reviews, we may act as its processor under our Data Processing Addendum.

2. Scope

The Service is for businesses and the independent professionals they engage. You must be at least 18 and act for a business purpose.

This policy covers account holders, members of organizations, contributors, people named in requests or reviews, and visitors to our public pages. It applies under the EU and UK General Data Protection Regulations (GDPR), Türkiye's Law No. 6698 on the Protection of Personal Data (KVKK) and applicable US state privacy laws.

3. Data we collect

Data you give us

• Account data: email address, name, handle and password or sign-in method.
• Profile data: headline, capabilities, languages, availability, links and anything you add to your public profile.
• Organization data: organization name, members, roles, funding wallet and workspace and dispute contacts.
• Work data: requests, offers, applications, submissions, evidence and work samples, reviews, revisions and dispute statements.
• Payout and tax data: tax forms (W-9 or W-8BEN) and, for contributors resident in the EU, the information DAC7 requires: tax identification number, address and date of birth.
• Support data: messages you send us and the details needed to answer them.

Data from sign-in providers and wallets

• GitHub and Google: we request basic profile and email scopes only. We do not read your repositories, files, contacts or calendar.
• Solana wallets (Phantom, Solflare): your public address, proven by a signed message. We never receive your private key or seed phrase.
• Your wallet stays hidden on your profile until you choose to show it. Anything recorded on the Solana blockchain is public and visible to anyone, independently of us.

Data from verification and screening providers

• Personhood and identity checks: the provider tells us whether a check passed and which method it used. Identity documents and biometrics stay with the provider; we never receive them.
• Sanctions screening: risk results for wallet addresses before funding and payout. See Sanctions and Compliance.

Data collected automatically

• Technical data needed to run the Service: IP address, device and browser type, and security logs.
• Aggregate usage measurement through cookieless analytics. We use no advertising pixels and no cross-site tracking. See the Cookie Notice.

4. How we use data and our legal bases

Where KVKK applies, we rely on the corresponding conditions in Articles 5 and 6 of KVKK, and on explicit consent where KVKK requires it.

5. Matching and automated decisions

Matching runs on published rules: capability, availability, eligibility requirements set by the team and your discovery setting. It does not use artificial intelligence or profiling to predict your behavior.

We do not make decisions based solely on automated processing that produce legal or similarly significant effects on you. A team always decides whom to engage. See how ranking works in Reporting and DSA information.

You can switch off discovery at any time in Settings. Records you already share with a team stay with that team.

When you submit a delivery, several AI models read it (the report, the evidence and attached pictures and PDFs) against the accepted terms, and their majority is shown as an advisory note to the team reviewing it. The note never approves, rejects or pays anything; the team decides, and in a dispute an operator does. Only that team and our operators see the note. The models run through OpenRouter, routed only to providers that do not keep prompts for training. To prove later what was reviewed, we record a salted fingerprint (hash) of the delivery and of the result on the Solana blockchain. The fingerprint reveals nothing about the work, and the delivery itself is never published.

6. Who sees your data

• The public: your public profile, track record and Work Proofs, and only the fields you choose to show.
• Teams you work with: your profile, your submissions and whether a required verification check passed.
• Organization members: requests, reviews and payments of their organization, according to their role.
• Our operators: what they need to review evidence, resolve disputes and keep the platform safe.
• Service providers: the sub-processors listed on Sub-processors, under contract.
• Authorities: tax authorities (including under DAC7 in [EU Member State of DAC7 registration]), regulators or courts when the law requires it.
• A successor: a buyer or successor in a merger or acquisition, under this policy.

We do not sell personal data, and we do not share it for cross-context behavioral advertising.

7. Work Proofs and the blockchain

When paid work completes, we issue a Work Proof: a non-transferable token on Solana. The token holds only a cryptographic hash. It contains no name, handle, amount or request text.

The record that links a hash to you and to the work is kept offchain by us. If you ask us to erase your data, we delete that record, so the onchain hash no longer points to you. We cannot remove the hash itself from the blockchain.

You can burn a Work Proof you hold, and we can revoke one for fraud. See Verification and Work Proofs.

8. How long we keep data

Retention periods are draft values for counsel review.

9. International transfers

We are based in the United States, and our providers may process data in other countries. When we transfer personal data out of the EEA, the UK or Türkiye, we use a recognised safeguard:

• the European Commission's Standard Contractual Clauses (SCCs), or the EU–US Data Privacy Framework where the recipient is certified;
• the UK International Data Transfer Addendum (IDTA) for UK data;
• the standard contracts published by Türkiye's Personal Data Protection Authority, notified to the Authority within five business days of signature, for data from Türkiye.

You can ask for a copy of the relevant safeguard at [privacy@aligner.network].

10. Your rights

EU and UK (GDPR)

You have the right to access, rectify and erase your data, to restrict or object to processing, to data portability, and to withdraw consent at any time. You may complain to your local supervisory authority.

Türkiye (KVKK Article 11)

You may learn whether your data is processed, request information about it, learn its purpose and whether it is used accordingly, know the third parties it is transferred to in Türkiye or abroad, request correction or deletion, request that third parties be notified of corrections or deletions, object to a result arising solely from automated analysis, and claim compensation for damage from unlawful processing. You may also complain to the Personal Data Protection Board.

United States

Depending on your state, you may have the right to know, access, correct and delete your data, and to opt out of sale, sharing or targeted advertising. We do not sell or share data for those purposes. We will not discriminate against you for using your rights.

How to use your rights

Email [privacy@aligner.network] or use the settings in your account. We may need to verify your identity. We answer within one month (GDPR), 30 days (KVKK) or 45 days (US state law), and tell you if we need more time where the law allows it.

11. Security

We use encryption in transit, access controls, least-privilege operator access and logging. We never hold your wallet's private keys.

If a personal data breach is likely to put you at risk, we notify the competent authority within 72 hours where the law requires it, and we tell you without undue delay.

12. Age requirement

The Service is not for anyone under 18. If we learn that we hold data about someone under 18, we delete it.

13. Changes to this policy

We will tell you about material changes by email or in the Service at least 15 days before they take effect. The version and effective date at the top of this page always show which policy applies.

Version history

1. Version 1.0 (draft)[Publication date]First draft for counsel review.