Privacy Policy

Version 2026-09-21 — in effect from 21 September 2026

This explains what personal data NMine LLC (trading as Firsthand Bitcoin) collects, why we hold it, who else sees it and what you can ask us to do with it. We are the data controller. Our sites are in the United Arab Emirates, Nigeria, Argentina and Paraguay, and our systems are hosted in the United States and Europe, so your data crosses borders — Section 6 explains how.

1. What we collect

Because you have an account

• Your name, email address and the company you contract through
• Your billing contact details and invoicing name
• Sign-in records: when you signed in, and from roughly where

Because we host machines for you

• Your machines: model, serial number, where each one is and when it arrived
• Your bitcoin or other payout address, and your mining pool account names
• Hashrate, uptime and temperature readings, measured every few minutes
• Electricity used, and the invoices and payments that follow from it
• What each machine mined, and the payouts made to your address

Because you visit the site

• Pages you looked at and roughly where you were, from server logs
• A note of your preferences, such as the hosting site you chose to compare against

We do not collect card numbers, because we do not accept cards. We do not ask for identity documents unless we are required to verify you, and we do not seek any special category data — your health, beliefs, politics or anything similar. Please do not send it to us.

2. Why we hold it, and on what basis

To perform our contract with you

• Running your machines and reporting what they do
• Working out what you owe and collecting it
• Sending mining rewards to the address you gave us
• Answering you when you get in touch

Because we have a legitimate interest

• Keeping the service secure and detecting abuse
• Understanding how the site is used so we can improve it
• Establishing, exercising or defending legal claims

Because the law requires it

• Keeping accounting and tax records
• Sanctions screening, and responding to lawful requests from authorities

We do not sell your personal data, and we do not share it with anyone for their own marketing.

3. A wallet address is not anonymous

A public blockchain is permanent and open to everyone. When we send mining rewards to your address, that payment is visible to anybody, for ever, and cannot be deleted by us or by you.

Because we hold your address alongside your name, we can connect the two, and so could anyone who lawfully compelled that information from us. We treat your address as personal data and protect it accordingly, but we cannot make an on-chain payment private after the fact. If that matters to you, consider which address you give us.

4. Who else sees it

Service providers who process data on our instructions

• Our hosting and database providers, in the United States and Europe
• Mining pools — Luxor, F2Pool and MiningRigRentals — which need your pool account and worker names to pay you
• Our payment and invoicing providers, which need your billing details
• Email delivery, so we can send invoices and notifications

Other recipients

• Our site operators and staff in each country, so far as they need it to run your machines
• Professional advisers — accountants and lawyers — under a duty of confidence
• Authorities, where we are required to disclose or where we must to defend a legal claim
• A buyer, if the business is sold, under the same protections

We are open with you about the last of these: Section 6.3 of the Hosting Agreement lets us give account records to law enforcement or regulators where the law requires it, and it may not always be lawful for us to tell you when that happens.

5. How long we keep it

• Your account and machines: while you are a customer, and seven years afterwards
• Invoices, payments and accounting records: seven years, because tax law requires it
• Hashrate readings at five-minute detail: forty-five days, then kept as daily summaries
• Daily summaries of what your machines produced: seven years, as they support your invoices
• Server logs: twelve months
• Records of accepting an agreement: for as long as it could matter in a dispute

When a retention period ends we delete the data or anonymise it so it can no longer identify you.

6. Data leaving your country

Our systems are hosted in the United States and Europe, and we operate sites in the United Arab Emirates, Nigeria, Argentina and Paraguay. Running your machines therefore means your data is transferred and accessed across borders.

Some of these countries have not been judged by the European Commission to provide an equivalent level of protection. Where we transfer data of people in the UK or the European Economic Area to such a country, we rely on the European Commission's Standard Contractual Clauses, or on the transfer being necessary to perform our contract with you. You can ask us for details of the safeguards we use.

7. Your rights

You can ask us to

• Give you a copy of the personal data we hold about you
• Correct anything that is wrong
• Delete data we no longer have a reason to keep
• Restrict how we use it, or object to our using it
• Send your data to you or another provider in a portable form
• Stop sending you marketing, at any time and without giving a reason

These rights are not absolute. We may have to keep invoices and accounting records even if you ask us to delete them, and we cannot remove a payment from a blockchain. If we cannot do what you ask, we will tell you why.

Write to privacy@nmine.org. We answer within thirty days. If you are unhappy with our answer you may complain to your data protection authority — in the UK, the Information Commissioner's Office.

If you are in California, you have the right to know what we collect, to have it deleted, to correct it, and not to be treated differently for exercising those rights. We do not sell or share personal information as those terms are used in the CCPA.

8. Security

• Traffic to our site and dashboard is encrypted in transit
• Access to your records is restricted to your own account, enforced by the database itself
• Staff access is limited to those who need it to do their job
• Payment instructions are published only in the dashboard, so an email cannot redirect your money

No system is perfectly secure. If a breach affects your personal data and is likely to present a risk to you, we will tell you and the relevant authority without undue delay.

9. Cookies

We use cookies and local storage to keep you signed in and to remember small preferences, such as which hosting site you were comparing against. These are necessary for the service to work.

We do not use advertising cookies and we do not track you across other websites.

10. Children

The service is not for anyone under 18. We do not knowingly collect data about children, and we delete it if we discover we have.

11. Changes and contact

If we change this policy we will post the new version here with its effective date, and tell account holders by email where the change is material.

NMine LLC, trading as Firsthand Bitcoin, a Wyoming limited liability company. Data protection enquiries: privacy@nmine.org.