Privacy Policy

This Privacy Policy explains the nature, purpose, use and sharing of personal data or other information collected from users of the website on which this Privacy Policy is published and any websites using its subdomains (the "Site"). We are committed to protecting and respecting your privacy. Please read this carefully, as this Privacy Policy is legally binding when you use the Site.

As used in this Privacy Policy, "we," "us" or "our" refers to Sovereign Projects Inc., a Delaware corporation. We are responsible for the personal data described in this Privacy Policy and, for users in the European Economic Area (EEA), the United Kingdom and Switzerland, we act as the controller of that data. You can reach us with any requests relating to this Privacy Policy via the contact details in the "Contact us" section below.

In brief: Sovereign is a self-custodial interface with no account registration and no KYC. We never have access to your private keys or funds. The personal data we process is principally your wallet address and associated public blockchain data, technical data such as your IP address (used to enforce geographic restrictions), and usage data - plus whatever you choose to give us if you contact us or join any program we may offer.

The types of personal data we collect about you

Personal data means any information about an individual from which that person can be identified. We may collect, use, store and transfer the following kinds of personal data about you:

• Identity Data - a name, username or similar identifier, only if you provide it (e.g., by contacting support or participating in a program).
• Contact Data - an email address or similar, only if you provide it.
• Financial Data - information on your cryptocurrency wallet balances and virtual currencies, derived from public blockchain data.
• Transaction Data - details about your blockchain transaction history and your use of the Services, including positions opened through the Site and automation configurations you set.
• Technical Data - internet protocol (IP) address and the approximate location (country and region) derived from it, browser type and version, blockchain data, wallet address, time zone setting, browser plug-in types, operating system and platform, device identifiers, and other technology on the devices you use to access the Site.
• Compliance Data - the results of sanctions screening performed on connected wallet addresses (address, timestamp, screening result, action taken), and records of your acceptance of our Terms of Service.
• Profile Data - your preferences, feedback and survey responses, if you provide them.
• Usage Data - information about how you interact with and use the Site and Services.
• Marketing and Communications Data - your preferences in receiving marketing from us, if you subscribe to any communications.

We also collect, use and share aggregated data, such as statistical data, which is not personal data as it does not directly or indirectly reveal your identity - for example, aggregated usage data used to analyze how users interact with Site features in order to improve them.

How is your personal data collected?

Your interactions with us. You may give us personal data by filling in online forms or corresponding with us by email or otherwise, including when you contact support, give feedback, subscribe to communications, or enter any program we may offer.

Automated technologies or interactions. As you interact with the Site, we automatically collect Technical Data and Usage Data using server logs, edge infrastructure and similar technologies. Geographic checks used to enforce jurisdiction restrictions are performed at the network edge by our hosting and edge-infrastructure providers, which derive an approximate location from your IP address. See "Cookies and local storage" below for the browser technologies we use.

Third parties and publicly available sources. We receive data about you from public blockchains (wallet addresses, balances, transaction history - which are public by design and not created or controlled by us), from analytics providers, and from blockchain analytics and sanctions-screening providers (currently including Chainalysis) that we use to screen connected wallets against sanctions designations.

How we use your personal data

Legal basis

We use your personal data only for the purposes described in this Privacy Policy. Where the law of your jurisdiction (including the EU and UK GDPR) requires us to have a legal basis for collecting and using your personal data, we rely on one or more of the following:

• Performance of a contract with you - where we need to perform the contract we are about to enter into or have entered into with you (the Terms of Service).
• Legitimate interests - where necessary to conduct our business and pursue our legitimate interests, for example to secure the Site, prevent fraud and abuse, and improve the Services, provided your interests and rights do not override ours.
• Legal obligation - where necessary for compliance with a legal obligation to which we are subject, including sanctions compliance.
• Consent - only where we have obtained your active agreement for a specified purpose, for example if you subscribe to a newsletter.

Purposes for which we will use your personal data

Blockchain Data

Note that we are not responsible for your use of any blockchain and your data processed in such decentralized and permissionless networks. Wallet addresses, balances and transaction records are public by design, permanent, and outside our control; third parties (block explorers, analytics firms, the protocols themselves) may process that public data independently of us, and we cannot alter or delete it.

Direct marketing

You will only receive marketing communications from us if you have requested them or subscribed to them and have not opted out. We may analyze your Technical, Usage and Profile Data to make communications relevant.

Third-party marketing

We will get your express consent before we share your personal data with any third party for their own direct marketing purposes.

Opting out of marketing

You can ask us to stop sending you marketing communications at any time by following the opt-out links in any marketing communication or by contacting us using the details in the "Contact us" section. If you opt out, you may still receive service-related communications essential for administrative purposes, such as notice of changes to our Terms.

Cookies and local storage

The Site uses browser local storage and strictly necessary cookies to operate: for example, to remember your wallet connection state, interface preferences and your acceptance of our Terms of Service. These are required for the Site to function and cannot be switched off in our systems, though you may clear them through your browser at any time. Where we use analytics or error-monitoring tools to understand how the Site is used and to fix problems, those tools may set cookies or similar identifiers; where applicable law requires your consent for such tools, we will ask for it before they are set and you may withdraw it at any time through the Site's cookie settings. We do not use advertising or cross-site tracking cookies.

Disclosures of your personal data

We may share your personal data where necessary with the parties set out below:

• Service providers acting as processors who provide services including hosting and edge infrastructure, blockchain RPC/node and indexing services, keeper and automation infrastructure, IT and system administration, analytics, error monitoring, email delivery (if applicable), and data storage.
• Compliance providers - blockchain analytics and sanctions-screening providers (currently including Chainalysis), solely to help us promote the safety, security and integrity of the Services.
• Our professional advisors, including lawyers, auditors, insurers and consultants providing legal, accounting and insurance services.
• Authorities - where required by law, regulation, executive order or compulsory legal process, including in connection with sanctions enforcement.
• Third parties to whom we may choose to sell, transfer or merge parts of our business or our assets, or businesses we may seek to acquire or merge with; if a change happens to our business, the new owners may use your personal data in the same way as set out in this Privacy Policy.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions. We do not sell your personal data, and we do not share it with third parties for cross-context behavioral advertising.

International transfers

We are based in the United States and process personal data there. If you access the Site from outside the United States, your personal data will be transferred to, stored and processed in the United States and in other jurisdictions where our service providers operate, which may not offer the same level of data protection as your own. For personal data of users in the EEA, the United Kingdom and Switzerland, we ensure such transfers are subject to appropriate safeguards, such as standard contractual clauses approved by the European Commission or the UK International Data Transfer Addendum. To obtain a copy of these safeguards, please contact us using the details in the "Contact us" section.

Data security

We use appropriate technical and organizational security measures to protect your personal data, and our measures are continuously improved in line with technological developments. Please note that any data transmission on the Internet (e.g., communication by email) is generally not secure and, subject to any liability which cannot be excluded under applicable law, we accept no liability for data transmitted to us via the Internet. We will never ask for your private keys or seed phrase - anyone who does is attempting to defraud you.

Third-party links

The Site may include links to third-party websites, plug-ins and applications, including wallet providers, the underlying protocols, and any Guardians you appoint through Sovereign Shield. Clicking those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third parties and are not responsible for their privacy statements. When you leave the Site, we encourage you to read the privacy policy of every website you visit.

Data retention

We will retain your personal data only for as long as reasonably necessary to achieve the purpose for which we collected it, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. Compliance Data (sanctions-screening logs and Terms acceptance records) is retained for ten (10) years from the date of the record, consistent with U.S. sanctions record-keeping requirements (31 C.F.R. § 501.601), or longer where required by applicable law. We may retain personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect of our relationship with you. To determine appropriate retention periods, we consider the amount, nature and sensitivity of the data, the potential risk of harm from unauthorized use or disclosure, the purposes of processing and whether we can achieve them by other means, and applicable legal requirements.

Your rights

Depending on where you live, you may have rights under applicable privacy law regarding your personal data. Two structural limits apply to our ability to fulfill them: we hold very little information about you and typically cannot link technical data to a named individual; and we cannot rectify or erase data recorded on public blockchains. You may exercise any of the rights below by contacting us using the details in the "Contact us" section.

Rights of U.S. residents

If you are a resident of California, Colorado, Connecticut, Virginia, Texas, Oregon or another U.S. state with a comprehensive privacy law, you may have the right to: confirm whether we process your personal data and access it; correct inaccurate personal data; delete personal data you provided to us; obtain a portable copy of your personal data; and opt out of the sale of personal data, the sharing of personal data for targeted advertising, and profiling in furtherance of decisions that produce legal or similarly significant effects. We do not sell personal data, share it for targeted advertising, or engage in such profiling. We will not discriminate against you for exercising any of these rights. If we deny a request, you may appeal by replying to our decision; we will respond to your appeal within the period required by applicable law. You may designate an authorized agent to make a request on your behalf, in which case we may require proof of the agent's authority. California residents may also request information about our disclosure of personal data to third parties for their direct marketing purposes under California's "Shine the Light" law; we make no such disclosures.

Rights of users in the EEA, United Kingdom and Switzerland

• Right to access. You have the right to obtain from us confirmation of whether we process personal data about you, a copy of that data, and information about: the purposes of processing; the categories of personal data concerned; the envisaged retention period or the criteria used to determine it; your rights to rectification, erasure, restriction and objection; your right to lodge a complaint with a supervisory authority; the source of data not collected from you; and the existence of any automated decision-making.
• Right to rectification. You have the right to obtain, without undue delay, the rectification of inaccurate personal data concerning you, and to have incomplete personal data completed; we may need to verify the accuracy of new data you provide.
• Right to be forgotten. You have the right to obtain the erasure of personal data concerning you without undue delay where required by law, including where: the data is no longer necessary for the purposes for which it was collected; there is no longer a legal ground for the processing; you object and there are no overriding legitimate grounds; the data has been unlawfully processed; or erasure is required for compliance with a legal obligation. We may not always be able to comply for specific legal reasons (for example, retention of sanctions-screening records), which will be notified to you at the time of your request.
• Right to restriction of processing. You have the right to obtain restriction of processing where: you contest the accuracy of the data, for a period enabling us to verify it; the processing is unlawful and you oppose erasure and request restriction instead; we no longer need the data but you require it for the establishment, exercise or defense of legal claims; or you have objected to processing pending verification of overriding grounds.
• Right to object. You have the right to object at any time to processing based on our legitimate interests; we shall no longer process the data unless we demonstrate compelling legitimate grounds which override your interests, rights and freedoms, or the processing is needed for legal claims. You also have the absolute right to object at any time to processing for direct marketing purposes.
• Right to withdraw consent. Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal. If you withdraw consent, we may not be able to provide certain services to you and will advise you if so.

No fee usually required. You will not have to pay a fee to exercise your rights; however, we may charge a reasonable fee, or refuse to comply, if your request is clearly unfounded, repetitive or excessive.

What we may need from you. We may need to request specific information to confirm your identity before fulfilling a request - a security measure to ensure personal data is not disclosed to a person who has no right to receive it. For wallet-linked data, this may include verifying control of the relevant wallet address.

Time limit to respond. We try to respond to all legitimate requests within one month. If your request is particularly complex or numerous, it may take longer, in which case we will notify you and keep you updated.

Conflict or inconsistency

In the event of any conflict or inconsistency between this Privacy Policy and any non-English translation, the English version shall control.

Children

The Site and Services are intended for business use by adults and are not directed to anyone under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

Do Not Track

Some browsers transmit "Do Not Track" signals. Because there is no common industry standard for responding to them, the Site does not currently respond to such signals. Where required by applicable law, we honor opt-out preference signals such as the Global Privacy Control.

Contact us

Please contact us with questions, comments or concerns regarding this Privacy Policy, and with any requests, at the contact email address published on the Site, addressed to Sovereign Projects Inc.

Complaints

We would appreciate the chance to deal with any concerns before you approach a regulator, so please contact us in the first instance. If you are in the United States, you may also contact the Federal Trade Commission or your state attorney general. If you are in the EEA, the United Kingdom or Switzerland, you have the right to lodge a complaint at any time with the data protection supervisory authority in the country where you live or work, such as the UK Information Commissioner's Office (www.ico.org.uk).

Amendments to this Policy

We may amend this Privacy Policy at any time by posting the amended version on the Site, including the effective date of the amended version. The current version, as published on the Site, is applicable. It is important that the personal data we hold about you is accurate and current; please keep us informed if your personal data changes during your relationship with us.