Privacy Policy

1. Information involved in your visit

• Request information. Your browser sends network and request information to retrieve pages and assets. This includes your IP address, the requested URL and browser headers, which can include browser details, language and a referring page, depending on your settings. The hosting infrastructure receives this information to deliver the response.
• Browser preferences. The site remembers your light/dark choice and your explicit choice about contact-form protection. The privacy banner appears when no valid choice is saved; closing it does not give consent. Acceptance and rejection are remembered for 180 days across browser sessions in local storage, which you can clear through site-data controls. The storage table explains these entries and their persistence.
• Information you send. The web contact form requires your name, email address, subject and message to handle your enquiry. It sends these details by email to the contact team, using your address for replies; it accepts no attachments and sends no automatic reply. If you contact us directly by email, your correspondence also includes email delivery information and anything you choose to attach. Providing information is voluntary; without a reply address and enough context, it may not be possible to answer.
• Form security. A short-lived first-party cookie and verification token protect form submissions. The server uses a keyed representation of your IP address, attempt counts and expiry times to limit abuse, and records used submission identifiers to prevent replay. This technical store does not contain your message, email address or name.
• Optional Google reCAPTCHA. If you allow contact-form protection and submit the form, your browser connects to Google for a risk assessment. Google receives network, browser and interaction information and can set cookies. Our server checks the resulting token, score, action, hostname and timestamp before sending your message. You can reject this connection and use the email address shown next to the form instead.

You do not need to provide identity documents or wallet credentials to browse Supra Core.

2. Purposes and legal bases

For the website activities described here, the relevant purposes and bases under the General Data Protection Regulation (GDPR) are:

• Delivering and operating the website: processing the technical information needed to respond to requests serves the legitimate interest in providing a usable website (Article 6(1)(f)).
• Answering general enquiries: using the information you choose to send serves the legitimate interest in responding to your communication (Article 6(1)(f)). Where you specifically request steps towards a contract, Article 6(1)(b) applies to the information necessary for those steps.
• Protecting contact requests: first-party verification and attempt limits serve the legitimate interest in preventing abusive or forged requests (Article 6(1)(f)). The optional connection to Google reCAPTCHA is enabled by your separate consent (Article 6(1)(a)); refusing it does not prevent email contact.
• Responding to data-protection requests: processing necessary to meet applicable data-protection obligations is based on Article 6(1)(c).

Access to information on your device is also subject to the rules on cookies and similar technologies; a GDPR legal basis does not by itself remove a consent requirement under those rules. Reading this notice, scrolling or continuing to browse does not constitute consent.

3. Recipients and external resources

Website delivery involves the hosting infrastructure. Email correspondence involves the mail services used by you and TCP Labs, as well as the people handling your enquiry. These are separate from the settings stored locally in your browser.

Google receives requests when you use the contact form with reCAPTCHA enabled. The browser loads Google's protection resources and our server submits the verification token to Google; the server does not include your message or email address in that verification request. See the Google Privacy Policy and Google Terms of Service. Shared page styles no longer request Google Fonts.

Links to documentation, social profiles and other websites take you to services with their own privacy practices. A link is not an embedded social widget. Once you follow it, the destination receives your request and its own notice applies. Avoid putting private information in URLs or public comments.

4. International processing

External services can process request or correspondence data outside the European Economic Area. In particular, Google describes international processing in its Privacy Policy. Browser display settings stored locally are distinct from the information sent with an external resource request.

Transfers subject to the GDPR require an applicable transfer basis, such as an adequacy decision or appropriate safeguards. For information about recipients, processing locations and safeguards relevant to your interaction with TCP Labs, contact info@supra-core.app.

5. Retention

The criteria used to determine retention periods include the time needed to deliver or investigate a website request, resolve correspondence and any follow-up, meet applicable legal obligations, or establish, exercise or defend legal claims.

Form verification cookies and tokens expire after 30 minutes. Attempt counters apply to fixed one-hour windows; replay identifiers remain valid for 30 minutes. Expired entries in the local protection store are removed on a subsequent contact request, not by a scheduled deletion job. These technical limits do not determine retention of correspondence, mail-provider data or hosting records.

Browser preferences follow the persistence described in the Cookie Policy; deleting them does not delete correspondence or information held by an external provider. Provider retention is separate from browser storage. You can ask about the retention applicable to your information using the contact above.

Language preference

The supra_language cookie remembers your language choice for one year across the public site and workspace. It is a first-party preference cookie, not an authentication or tracking cookie. It uses Path=/, HttpOnly and SameSite=Lax, and Secure on HTTPS. You can change the language using the selector or remove this cookie in your browser; English is the default.

6. Security and safe contact

No internet transmission or storage system can be guaranteed risk-free. When contacting TCP Labs, share only what is needed to explain your request. Do not send passwords, API keys, private keys, seed phrases, payment-card details or sensitive identity documents in an ordinary email. A privacy enquiry does not require access to your wallet.

7. Your rights

Subject to the conditions of applicable data-protection law, you can request access to your personal data, correction, erasure or restriction of processing. You can object to processing based on legitimate interests on grounds relating to your particular situation. Portability applies where its legal conditions are met, including processing by automated means based on consent or a contract.

If processing is based on consent, you can withdraw it without affecting the lawfulness of processing before withdrawal. Open Privacy choices in the contact form or Cookie Policy to withdraw reCAPTCHA permission. When it has loaded, withdrawal reloads the page to stop it and discards unsent form text; it cannot undo information already sent to Google. The automated risk check can reject a web submission; you can still contact us by email. It does not decide access to an account or an API plan.

Send requests to info@supra-core.app, identifying the interaction concerned without including unnecessary sensitive data. Additional information to confirm identity may be necessary where there are reasonable doubts. Under the GDPR, requests must normally receive a response within one month; a permitted extension must be explained within that first month.

You can lodge a complaint with a competent supervisory authority, in particular where you habitually reside, work or believe an infringement occurred. In Italy, the competent supervisory authority is the Italian Data Protection Authority. Contacting TCP Labs first is not a condition for making a complaint.