Last updated: April 6, 2025

This Privacy Policy explains how Midcentury Labs Inc. ("we," "us," or "our") collects, uses, discloses, and protects your personal data when you use the ORO (the "Platform"), a platform operated by Midcentury Labs. We are committed to transparency, accountability, and upholding the highest standards of data privacy.

1. Information We Collect

We collect the following categories of information:

• Account Information: When you create an account, we collect identifiers such as your email address and any username you choose to provide.

• Connected Data: If you link external accounts (e.g., social media, health, financial platforms), we collect the categories of data you explicitly authorize.

• Quest Data: We collect information you actively generate by participating in in-app activities and Quests.

• Device and Usage Data: We may collect technical information such as device type, IP address, browser type, operating system, and interaction logs.

• Metadata: Timestamps, frequency of participation, and engagement data used for quality validation and reward attribution.

We do not knowingly collect personal data from children under 18. If we discover such data has been collected, it will be deleted promptly.

2. How We Use Your Information

We use your data for the following purposes:

• To provide, maintain, and improve the Platform and its features;

• To process, anonymize, and securely use your data in privacy-preserving AI training;

• To measure the quality and uniqueness of contributions and assign Points accordingly;

• To contact you with updates, platform notifications, or support responses;

• To comply with legal obligations and enforce our Terms of Service.

3. How We Protect Your Information

We implement industry-standard physical, technical, and administrative safeguards, including:

• Encryption of data in transit (TLS) and at rest;

• Privacy-preserving protocols, such as zkTLS and secure enclaves (TEEs);

• Access controls to ensure only authorized personnel can access systems with personal data;

• On-chain auditability via scoring mechanisms that preserve transparency without compromising data integrity.

Despite our efforts, no method of data transmission or storage is 100% secure. We encourage you to also protect your credentials and notify us immediately of any suspected breaches.

4. Your Rights and Choices

Depending on your jurisdiction, you may have the following rights under applicable privacy laws:

• The right to access the personal data we hold about you;

• The right to request correction or deletion of your personal data;

• The right to withdraw consent or restrict processing;

• The right to data portability in a structured, commonly used format.

To exercise any of these rights, please contact us at social@getoro.xyz. We may request verification of your identity before fulfilling certain requests.

5. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes outlined in this policy, comply with legal obligations, and enforce our agreements. You may request deletion of your account and data at any time, subject to any required retention under applicable law.

6. International Data Transfers

If you are located outside the United States, please be aware that your information may be processed and stored in the United States or other countries where our service providers are located. By using the Platform, you consent to such transfers, processing, and storage.

7. Third-Party Services

We may use third-party infrastructure providers or analytics services to operate and improve our Platform. These vendors are contractually obligated to adhere to confidentiality and data protection standards equivalent to our own. They are prohibited from using your raw data for any other purpose.

8. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Material changes will be posted on the Platform and, where appropriate, notified to you. Continued use of the Platform constitutes your acceptance of any changes.

9. Cookies and Similar Technologies

We may use cookies and similar technologies (e.g., local storage, web beacons, or device fingerprinting) to enhance your experience on the Platform, analyze usage patterns, and improve functionality. These technologies do not collect personal data unless you have provided it.

You can control or disable cookies through your browser settings, but doing so may limit certain features of the Platform.

10. Legal Basis for Processing (EEA/UK Users)

If you are located in the European Economic Area (EEA) or the United Kingdom (UK), we process your personal data based on the following legal grounds:

• Consent: Where you have given explicit consent (e.g., to link external accounts);

• Contract: When processing is necessary for the performance of a contract with you (e.g., delivering Platform functionality);

• Legal Obligation: Where processing is required by applicable law;

• Legitimate Interests: Where we have a legitimate interest, provided it is not overridden by your data protection rights (e.g., improving and securing our services).

11. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you may have rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), including:

• The right to know what categories of personal information we collect and how we use it;

• The right to access and request a copy of your data;

• The right to request deletion of your personal information, subject to certain exceptions;

• The right to opt out of the sale or sharing of personal data (note: we do not sell your data);

• The right to non-discrimination for exercising these rights.

You or your authorized agent can make a request by contacting us at social@getoro.xyz.

12. Children's Privacy

Our Platform is not directed to children under the age of 18, and we do not knowingly collect personal data from individuals in this age group. If we learn that we have collected personal data from a child under 18 without verified parental consent, we will delete such data as quickly as possible.

13. Versioning and Updates

This Privacy Policy may be updated from time to time. Each version will be identified by its effective date at the top of the policy. If changes materially affect how we handle personal data, we will notify users via the Platform or other reasonable means.

14. Contact Us

If you have any questions or concerns about this Privacy Policy or our data practices, please contact us at:

Midcentury Labs Inc.
169 Madison Ave STE 15018
New York, NY 10016
social@getoro.xyz