Privacy Policy

Turbine is the controller for merchant accounts, product analytics and the records we keep to run the service. When a merchant collects a subscriber's wallet address or email through a Turbine checkout page, that merchant decides why it is collected and how it is used. For that data, the merchant is the controller and Turbine is a processor acting on the merchant's instructions.

If you are a subscriber with a question about how a merchant uses your information, contact the merchant first. Their name and details appear on the checkout page and on the receipt we send you.

• Merchant account details: name, email address and profile image, provided by you or by your sign-in provider when you create an account.

• Business details: business name, headline, logo, the wallet address that receives payments, a notification email and a webhook URL if you add them, and the plans you publish with their names, prices and billing periods.

• Subscriber details: the wallet address used to subscribe and, when a merchant asks for it, the subscriber's email address. Merchants choose whether the email is optional or required and can add their own explanation on the checkout page.

• On-chain data: transaction signatures, plan and subscription account addresses, token amounts, mint addresses and timestamps. This data is read from and written to the Solana blockchain.

• Turbine plan billing: the wallet address and email used to pay for a Turbine plan, the plan, and the period it covers. We use this to grant access to paid features.

• Usage and device data: pages viewed, buttons clicked, referral source, browser and device type, IP address and approximate location, and error reports when something breaks.

• Communications: messages you send us, and delivery records for emails and webhooks we send on your behalf.

• Run the service: create accounts, publish businesses and plans, render checkout pages, prepare and submit on-chain transactions, and collect subscription payments for each billing period.

• Tell merchants about new subscribers by email, by webhook, or both, according to the notification settings on each business.

• Send subscribers a receipt for each new subscription when they have given an email address.

• Show merchants their subscribers, revenue and payment history in the dashboard.

• Grant and check access to paid Turbine features.

• Keep the service secure: authenticate requests, sign webhooks, rate-limit the API, detect abuse and investigate incidents.

• Understand how the product is used so we can fix problems and improve it.

• Meet legal obligations and enforce our Terms.

Turbine sends three kinds of email. Account emails such as sign-in codes and security notices come from our sign-in provider. Receipts go to subscribers who gave an email at checkout and confirm the plan, amount and merchant. New-subscription alerts go to the notification address a merchant sets on a business. Each message says who it is about and why you received it. We do not send marketing email to subscribers.

When a merchant adds a webhook URL to a business, Turbine sends that endpoint a signed event for every confirmed subscription. The event includes the subscriber's wallet address, the subscriber's email if one was given, the plan, and the transaction signature. From that point the merchant holds a copy of the data on their own systems, and their privacy practices apply to it. Merchants must only send webhooks to public HTTPS endpoints they control.

The merchant dashboard uses cookies to keep you signed in. Checkout pages remember the wallet you last connected in your browser's local storage so you are not asked to reconnect on every visit. Both are needed for the service to work.

We use PostHog for product analytics and error reporting across the website, dashboard and checkout. It records page views, interactions such as clicking a call to action or connecting a wallet, the wallet address at checkout, and technical details about the browser and device. We use this to understand where people get stuck and to find bugs. We do not use advertising cookies or sell analytics data. You can block analytics with a browser extension or by disabling JavaScript for analytics hosts, and the service will keep working.

We use a small number of providers to run Turbine. Each one processes data only to provide its service to us.

• Clerk for merchant sign-in and account management.

• Cloudflare for hosting the API and web apps, the database, the queue that delivers notifications, and storage for business logos.

• Resend for sending receipts and merchant alerts.

• PostHog for product analytics and error reporting.

• A Solana RPC provider for reading blockchain state and submitting transactions.

• Your wallet provider, which you choose, for approving transactions. Wallet providers have their own privacy policies.

We do not sell personal information. We share it only in these situations.

• With the merchant a subscriber pays, so the merchant can deliver what was bought, send receipts and provide support.

• With the service providers listed above.

• With the Solana network, where transaction details become public by design.

• With authorities or other parties when we believe in good faith that the law requires it, or to protect the safety, rights or property of Turbine, our users or others.

• With a successor if Turbine is involved in a merger, acquisition, financing or sale of assets. We will tell you before your information becomes subject to a different privacy policy.

Wallet addresses, payment amounts, plan accounts and transaction signatures are recorded on Solana. Anyone can read them, they cannot be changed, and they are not under Turbine's control. If you do not want a wallet address associated with a subscription to be public, do not subscribe with that wallet. Turbine never has access to your private keys.

Turbine is non-custodial: we do not hold funds and cannot move them outside the authorisation a subscriber approves on-chain. Requests to the dashboard and API are authenticated, webhooks are signed with a per-merchant secret so recipients can verify they came from us, the API is rate-limited, and our web apps ship a strict content security policy. Secrets are held server-side and never sent to the browser. No system is perfectly secure, so keep your own account and wallet credentials safe and tell us promptly if you suspect a problem.

We keep merchant and business records while your account is active and for as long as we need them to provide the service, resolve disputes and meet legal obligations. If you ask us to delete your Turbine account, we mark it deleted and stop using it, but we keep payment and subscription records that merchants and subscribers may need for their own accounting. Analytics data is kept in aggregate. Data on the Solana blockchain is permanent and outside our control.

Depending on where you live, you may have the right to access, correct, export, delete or restrict the use of your personal information, and to object to certain processing. You can update most merchant account details yourself in the dashboard. For anything else, contact us and we will respond within the time the law allows. We may ask you to verify your identity, and we may decline requests that would require removing on-chain data or records we must keep by law. Subscribers should send requests about a merchant's use of their data to that merchant.

Turbine is for adults. We do not knowingly collect personal information from anyone under 18. If you believe someone under 18 has used Turbine, contact us and we will remove what we can.

Our providers operate globally, so your information may be stored or processed outside your country, including in the United States. Where the law requires, we rely on recognised transfer mechanisms such as standard contractual clauses.

We will post any changes to this policy on this page and update the date at the top. If a change materially reduces your rights, we will tell merchants by email before it takes effect.

Questions and requests can be sent through the contact channel in the merchant dashboard or the checkout page.