Version 2026-09-21 — in effect from 21 September 2026
This explains what personal data NMine LLC (trading as Firsthand Bitcoin) collects, why we hold it, who else sees it and what you can ask us to do with it. We are the data controller. Our sites are in the United Arab Emirates, Nigeria and Argentina, and our systems run in the United States, Brazil and Europe, so your data crosses borders — Section 6 explains how.
1. What we collect
Because you have an account
Your name, email address and the company you contract through
Your billing contact details and invoicing name
Sign-in records: when you signed in, and from roughly where
Because we host machines for you
Your machines: model, serial number, where each one is and when it arrived
Your bitcoin or other payout address, and your mining pool account names
Hashrate, uptime and temperature readings, measured every few minutes
Electricity used, and the invoices and payments that follow from it
What each machine mined, and the payouts made to your address
Because you visit the site
Pages you looked at and roughly where you were, from server logs
A note of your preferences, such as the hosting site you chose to compare against
Because you write to us
Your name and email address, and your phone or WhatsApp number if you give it
What you wrote, and the page you wrote from
The internet address and country your message came from, which we use to stop spam
We do not collect card numbers, because we do not accept cards. We do not ask for identity documents unless we are required to verify you, and we do not seek any special category data — your health, beliefs, politics or anything similar. Please do not send it to us.
2. Why we hold it, and on what basis
To perform our contract with you
Running your machines and reporting what they do
Working out what you owe and collecting it
Sending mining rewards to the address you gave us
Answering you when you get in touch
Because we have a legitimate interest
Keeping the service secure and detecting abuse
Understanding how the site is used so we can improve it
Establishing, exercising or defending legal claims
Because the law requires it
Keeping accounting and tax records
Sanctions screening, and responding to lawful requests from authorities
We do not sell your personal data, and we do not share it with anyone for their own marketing.
3. A wallet address is not anonymous
A public blockchain is permanent and open to everyone. When we send mining rewards to your address, that payment is visible to anybody, for ever, and cannot be deleted by us or by you.
Because we hold your address alongside your name, we can connect the two, and so could anyone who lawfully compelled that information from us. We treat your address as personal data and protect it accordingly, but we cannot make an on-chain payment private after the fact. If that matters to you, consider which address you give us.
4. Who else sees it
Service providers who process data on our instructions
Our database and application providers in the United States, our mining relay servers in Brazil and Germany, and a global content network
Mining pools — Luxor, F2Pool and MiningRigRentals — which need your pool account and worker names to pay you
Our payment and invoicing providers, which need your billing details
Email delivery, so we can send invoices and notifications
Cloudflare, whose check on our contact form tells people apart from automated spam
WhatsApp (Meta), if you message us there: the conversation is carried under WhatsApp's own privacy policy
Other recipients
Our site operators and staff in each country, so far as they need it to run your machines
Professional advisers — accountants and lawyers — under a duty of confidence
Authorities, where we are required to disclose or where we must to defend a legal claim
A buyer, if the business is sold, under the same protections
We are open with you about the last of these: the "Suspension and disclosure" clause in Section 6 of the Hosting Agreement lets us give account records to law enforcement or regulators where the law requires it, and it may not always be lawful for us to tell you when that happens.
5. How long we keep it
Your account and machines: while you are a customer, and seven years afterwards
Invoices, payments and accounting records: seven years, because tax law requires it
Hashrate readings at five-minute detail: forty-five days, then kept as daily summaries
Daily summaries of what your machines produced: seven years, as they support your invoices
Server logs: twelve months
Records of accepting an agreement: for as long as it could matter in a dispute
Messages sent through our contact form: two years, unless they become part of your account records
When a retention period ends we delete the data or anonymise it so it can no longer identify you.
6. Data leaving your country
Our database and application are hosted in the United States, the servers that relay your machines to the mining pools run in Brazil and Germany, and we operate sites in the United Arab Emirates, Nigeria and Argentina. Running your machines therefore means your data is transferred and accessed across borders.
Some of these countries have not been judged by the European Commission to provide an equivalent level of protection. Where we transfer data of people in the UK or the European Economic Area to such a country, we rely on the European Commission's Standard Contractual Clauses, or on the transfer being necessary to perform our contract with you. You can ask us for details of the safeguards we use.
7. Your rights
You can ask us to
Give you a copy of the personal data we hold about you
Correct anything that is wrong
Delete data we no longer have a reason to keep
Restrict how we use it, or object to our using it
Send your data to you or another provider in a portable form
Stop sending you marketing, at any time and without giving a reason
These rights are not absolute. We may have to keep invoices and accounting records even if you ask us to delete them, and we cannot remove a payment from a blockchain. If we cannot do what you ask, we will tell you why.
Write to hello@firsthandbitcoin.com. We answer within thirty days. If you are unhappy with our answer you may complain to your data protection authority — in the UK, the Information Commissioner's Office.
If you are in California, you have the right to know what we collect, to have it deleted, to correct it, and not to be treated differently for exercising those rights. We do not sell or share personal information as those terms are used in the CCPA.
8. Security
Traffic to our site and dashboard is encrypted in transit
Access to your records is restricted to your own account, enforced by the database itself
Staff access is limited to those who need it to do their job
Payment instructions are published only in the dashboard, so an email cannot redirect your money
No system is perfectly secure. If a breach affects your personal data and is likely to present a risk to you, we will tell you and the relevant authority without undue delay.
9. Cookies
We use cookies and local storage to keep you signed in and to remember small preferences, such as which hosting site you were comparing against. These are necessary for the service to work.
We do not use advertising cookies and we do not track you across other websites.
10. Children
The service is not for anyone under 18. We do not knowingly collect data about children, and we delete it if we discover we have.
11. Changes and contact
If we change this policy we will post the new version here with its effective date, and tell account holders by email where the change is material.
NMine LLC, trading as Firsthand Bitcoin, a Wyoming limited liability company. Data protection enquiries: hello@firsthandbitcoin.com.