FRAKTA PRIVACY POLICY

The data controller of your Personal Information is: Frakta Email: support@frakta.io

Information you provide to us:

• Account and authentication data. Email address and authentication identifiers processed via our authentication provider; or the public address of the digital wallet you connect. We never collect, store, or have access to your wallet's private keys or seed phrase.
• Profile and organization data. Name, username, organization name, role within an organization, and membership and invitation records.
• Content you submit. Documents, files, and text you upload or enter into the Platform, including materials submitted to document-generation features (such as the Whitepaper Generator), asset details, and token configuration data.
• Communications. Messages, support requests, survey responses, and feedback you send us.
• Identity and verification data. Where required for identity verification, eligibility, security, or compliance, this may include your full legal name, date of birth, nationality, residential address, government-issued identification document and photographs.
• Institutional and beneficial ownership data. If you use the Services on behalf of an organization, we may collect organization registration and tax information and information about directors, authorized persons, controllers, and beneficial owners where reasonably required.
• Eligibility and compliance data. Information reasonably required to determine whether you are eligible to use particular Services, to conduct anti-money laundering and counter-terrorist financing, sanctions, fraud, security, or similar checks, or to comply with applicable law, regulation, court order, or a lawful request from a competent authority.
• Billing data. Where applicable, billing contact details and payment-related information (payment card data is processed by our payment providers and is not stored by frakta). Information collected automatically:
• Technical data. IP address, browser type and version, device and operating system information, time zone, and language settings.
• Usage data. Pages viewed, features used, dates and times of access, interaction events, and referral URLs.
• Cookies and similar technologies. See Section 9 below.
• Account and activity data. Information generated by your use of the Services, such as account settings, organization activity, token or asset configuration activity, document-generation activity, ownership transfer activity, transaction or deployment records, and other actions performed through your account.

Blockchain data:

• On-chain data. Wallet addresses, token contract addresses, transaction hashes, and transaction details associated with actions you take through the Platform (such as token deployment or ownership transfer acceptance) are recorded on public blockchains. Public blockchains are decentralized, publicly accessible, and immutable — frakta does not control them and cannot modify or delete on-chain data. See Section 7 (Data Retention) for the implications. Information from third parties:
• Where required for compliance or security purposes, we may receive information about you from identity verification, sanctions screening, or blockchain analytics providers. We do not knowingly collect Personal Information from individuals under 18. If you believe a minor has provided us with Personal Information, please contact us.

Purpose Personal Information Legal Basis

Create and manage your Email address, wallet Performance of a contract account, including address, profile data, authentication and account technical data changes

Provide the Tools, including Account data, organization Performance of a contract token creation and data, content you submit, management, organization on-chain data and member management, ownership transfer flows, and document generation

Operate Content you submit Performance of a contract document-generation features (e.g., Whitepaper Generator), including processing uploaded documents to generate output for you

Process billing and collect Billing data, account data Performance of a contract fees

Communicate with you Email address Performance of a contract about the service, including transactional and security notifications

Maintain security, prevent Technical data, usage data, Legitimate interest fraud and abuse, and on-chain data troubleshoot

Analyze usage and improve Usage data, technical data Legitimate interest the Platform, including aggregated analytics

Comply with legal Account data, identity data, Legal obligation obligations, including Purpose Personal Information Legal Basis

AML/CTF, sanctions on-chain data, technical data screening, tax, and responding to lawful requests from authorities

Establish, exercise, or Any of the above, subject to Legitimate interest defend legal claims and necessity and data enforce our Terms minimization

Send newsletters and Email address Consent (you may withdraw marketing communications at any time)

Where we rely on legitimate interest, we have assessed that our interest in operating, securing, and improving the Platform is not overridden by your rights and interests. You can request further information about these assessments by contacting us. Aggregated data. We may aggregate and anonymize data so that it no longer identifies any individual, and use it for analytics, product improvement, and business purposes. Such data is not Personal Information and is not covered by this Policy. AI-assisted features. Content you submit to AI-assisted features (such as the Whitepaper Generator) is processed to generate output for you. [TBD: state whether third-party AI/LLM providers are used, whether data is used for model training (recommended: no), and retention of prompts/outputs.]

We share Personal Information only as necessary with: 1. Our group companies — subsidiaries and affiliates, for the purposes described in this Policy. 2. Service providers — including cloud hosting, authentication (e.g., our login/wallet-connection provider), email delivery, analytics, customer support, payment processing, and AI infrastructure providers, in each case only to the extent necessary to provide the Platform. 3. Compliance providers — identity verification, sanctions screening, and blockchain analytics providers, where required for legal compliance or security. 4. Members of your Organization — your name, email, role, and activity within an Organization may be visible to that Organization's Admins and members as part of team-management features. 5. Authorities and law enforcement — where required by law, court order, or lawful request, or where disclosure is reasonably necessary to protect our rights, property, or safety or those of our users or others. 6. Linked or integrated third-party services — when you choose to use a third-party product, wallet, website, application, or integration through the Services, information may be shared with or received from that third party as necessary to provide the requested functionality. The third party’s own terms and privacy policy govern its independent processing. 7. Business transfers — if frakta or substantially all of its assets are acquired, merged, or reorganized, Personal Information may be transferred as part of that transaction, subject to this Policy. We do not sell your Personal Information.We do not provide Personal Information to third parties for their own direct marketing or advertising purposes unless we have obtained any authorization required by applicable law.

Your Personal Information may be stored and processed in [HOSTING REGION(S)] and may be transferred to countries other than your own. Where such countries do not provide an equivalent level of data protection, we implement appropriate safeguards (such as standard contractual clauses) where required by applicable law. Contact us for details of the mechanisms used.

We implement technical and organizational measures designed to protect Personal Information, including access controls limited to personnel with a business need, encryption in transit, and periodic security reviews. We maintain procedures to address actual or suspected data breaches and will notify you and applicable regulators where legally required. No transmission over the Internet is completely secure; transmission of information is at your own risk. You should also protect yourself: safeguard your wallet and private keys, use a strong unique password and two-factor authentication where available, and be cautious about sharing Personal Information.

We retain Personal Information for no longer than necessary for the purposes described in this Policy, or as required to meet legal, regulatory, tax, or accounting requirements (for example, AML record-keeping obligations may require retention for a statutory period after account closure). Blockchain data cannot be deleted. Data recorded on public blockchains (wallet addresses, transaction records) is immutable by design. We cannot erase, modify, or restrict on-chain data. Erasure requests will be honored with respect to data under our control, but cannot extend to public blockchain records.

Subject to applicable law, you may have the right to: 1. access the Personal Information we hold about you; 2. rectify inaccurate or incomplete Personal Information; 3. request erasure of your Personal Information in certain circumstances (subject to the blockchain limitation in Section 7 and legal retention requirements); 4. restrict or object to processing in certain circumstances, including for direct marketing; 5. receive a portable copy of Personal Information you provided to us; 6. withdraw consent at any time where processing is based on consent (e.g., marketing emails and non-essential cookies), without affecting the lawfulness of processing before withdrawal; and 7. lodge a complaint with your local data protection supervisory authority. To exercise your rights, contact us at [PRIVACY EMAIL]. We may need to verify your identity before acting on a request. We aim to respond to legitimate requests within one month; complex or multiple requests may take longer, in which case we will keep you informed. You will not be charged a fee unless a request is manifestly unfounded, repetitive, or excessive. We will not discriminate against you for exercising your rights. Marketing emails include an unsubscribe link you can use at any time.

We use cookies and similar technologies to operate the Platform (strictly necessary cookies), and — with your consent where required — to analyze usage (analytics cookies). You can manage your preferences through the cookie banner or your browser settings. [TBD: link to a standalone Cookies Notice with the full cookie table, or embed the table here.]

The Platform connects to third-party services governed by their own privacy policies, including your wallet provider, our authentication provider, and blockchain networks. We encourage you to review those policies; frakta is not responsible for the privacy practices of third parties.

We may update this Policy from time to time. Changes will be posted on this page with an updated "Last updated" date, and material changes will be notified to you via the Platform or by email where appropriate. Please review this Policy periodically.

Questions, comments, or requests regarding this Policy should be addressed to: Frakta Email: support@frakta.io