Privacy Policy

Effective Date: May 2026
Last Updated: May 2026
Version: 3.0 (Mainnet, Non-Custodial Protocol)

---

1. INTRODUCTION

PrediXpro Labs Limited (the “Company,” “PrediXpro,” “we,” “us,” or “our”) provides this Privacy Policy (the “Policy”) to describe how we collect, use, disclose, store, transfer, and otherwise process personal information when you access or use our website, mobile applications, APIs, documentation, communications, marketing activities, support channels, and other digital interfaces operated by us at predixpro.io and its subdomains (collectively, the “Interface”), together with any related services that link to this Policy (the Interface and such services together, the “Services”).

This Policy should be read together with our [Terms of Use], [Risk Disclosure], [Cookie Policy], and any other notices, terms, or supplementary disclosures we provide to you. Capitalized terms not defined in this Policy have the meaning given to them in our Terms of Use.

By accessing or using the Services, you confirm that you have read, understood, and (where consent is the applicable legal basis) consented to the collection, use, disclosure, and transfer of your personal data as described in this Policy. If you do not agree with this Policy, you must not access or use the Services.

---

2. CRITICAL NOTICES - PLEASE READ FIRST

2.1 Interface vs. Protocol - What This Policy Covers

This Policy applies ONLY to your use of the Interface and our communications with you, marketing activities, support channels, and other PrediXpro services that link to this Policy.

This Policy does NOT apply to the underlying PrediXpro Protocol (the “Protocol”), which is:

• Open-source software deployed on public blockchain networks (currently Unichain, an Ethereum Layer-2 network developed by Uniswap Labs and other ecosystem contributors, and such other networks as governance may approve from time to time);
• Operating autonomously according to its smart-contract code;
• Not custodied, controlled, managed, or operated by PrediXpro Labs Limited or any single party;
• Accessible by anyone with a compatible self-custodial wallet, regardless of whether they use our Interface;
• Subject to its own technical rules embedded in the smart-contract code, not to this Policy.

You may interact with the Protocol directly (for example, through alternative frontends, block-explorers, command-line tools, or your own integrations) without using our Interface. In that case, this Policy does not apply to that interaction. The Protocol is governed by its on-chain governance process, not by PrediXpro Labs Limited.

2.2 Non-Custodial - We Never Hold Your Assets

PrediXpro Labs Limited does not custody, hold, control, manage, or have access to your digital assets at any time. All transactions are executed via smart contracts on public blockchains, using your self-custodial wallet that you control. We never:

• Request, store, or have access to your private keys, seed phrases, or recovery phrases;
• Hold deposits, balances, or settlement funds on your behalf;
• Sign transactions on your behalf;
• Have unilateral authority to freeze, seize, or move your on-chain assets;
• Act as a money-services business, money transmitter, broker, dealer, or financial intermediary with respect to your assets.

Anyone asking you to share your private key, seed phrase, or recovery phrase is attempting to defraud you. We will never make such a request.

2.3 Eligibility

Access to and use of the Services is restricted to individuals who:

• Are at least eighteen (18) years of age (or the age of legal majority in your jurisdiction, whichever is higher);
• Have legal capacity to enter into binding agreements;
• Are not Restricted Persons and are not located in, ordinarily resident in, or accessing the Services from a Restricted Jurisdiction (see Section 19);
• Are not subject to applicable sanctions or watchlist designations.

2.4 Not Advice

Nothing on the Interface, in the Protocol, or in any PrediXpro communication constitutes financial, investment, legal, tax, accounting, or other professional advice. Use of the Services involves substantial risk, including total loss of digital assets.

2.5 Public Blockchain - Permanent and Public

Interactions with the Protocol are broadcast to and recorded on public blockchain networks. Wallet addresses, transaction hashes, timestamps, token transfers, smart-contract interactions, and on-chain market activity are public, immutable, and outside the control of PrediXpro Labs Limited. We cannot delete, modify, restrict, obscure, or reverse blockchain data. See Section 9 for details.

2.6 Evolving Compliance

PrediXpro is currently operating in an early phase. We are progressing through a phased compliance roadmap and are preparing to apply for appropriate licensing or registration in suitable jurisdictions. Until such licenses are granted, certain features and jurisdictions are restricted (Section 24). This Policy may be updated as our compliance posture evolves.

---

3. HOW TO CONTACT US

You may contact PrediXpro Labs Limited at:

General inquiries, privacy matters, security incidents, compliance, and legal: contact@predixpro.io

For matters concerning the Protocol itself (as opposed to the Interface), please engage with PrediXpro governance through the official governance forum referenced on the Interface. PrediXpro Labs Limited is not the operator of, and does not control, the Protocol.

---

4. DEFINITIONS

For the purposes of this Policy:

• “Aggregated Data” - information combined or summarized such that it does not, alone or with other reasonably available information, identify a natural person.
• “Anonymized Data” - information from which direct and indirect identifiers have been irreversibly removed.
• “Applicable Data Protection Law” - GDPR, UK GDPR, Swiss DPA, CCPA/CPRA and other US state privacy laws, PIPEDA, LGPD, APPI, APP, PDPA Singapore, PDPL Vietnam, and any other privacy laws applicable to our processing.
• “Blockchain Data” - information broadcast to or recorded on public blockchain networks, including wallet addresses, transaction hashes, timestamps, token transfers, smart-contract interactions, and on-chain market activity.
• “Embedded Wallet” - a self-custodial wallet provisioned through the Interface using third-party key-management infrastructure (e.g., secure enclave, Trusted Execution Environment, or multi-party computation), access to which is gated by your passkey or other authentication factor you have set.
• “Interface” - see Section 1.
• “KYC Data” - personal data collected for identity verification, anti-money-laundering, counter-terrorist-financing, sanctions, fraud-prevention, and risk-assessment purposes, applicable only at and above KYC Tier 2 (Section 5.1).
• “Passkey” - a phishing-resistant cryptographic credential based on the WebAuthn / FIDO2 standards, in which a public/private key pair is generated and stored on your device. The private key never leaves the device’s secure hardware.
• “Personal Data” or “Personal Information” - information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with an identified or identifiable natural person.
• “Protocol” - see Section 2.1.
• “Restricted Jurisdiction” and “Restricted Person” - see Section 19.
• “Sensitive Personal Information” - categories of personal data designated as sensitive, special category, or requiring enhanced protection under Applicable Data Protection Law, including government-issued identification numbers, biometric data used for identification, precise geolocation, and account credentials.
• “Token” - the PrediXpro utility token described in Section 21.

---

5. PERSONAL INFORMATION WE COLLECT

The Interface uses a tiered KYC model. The personal data we collect depends entirely on which tier you choose to access. Browsing and Tier 0 use of the Interface requires minimal data; higher tiers require progressively more.

5.1 KYC Tier Structure - Summary

Tier	What You Can Do	Personal Data Required
Tier 0 - Browse	View markets, read documentation, view public Protocol data	None directly required from you (we automatically collect Section 5.6 data)
Tier 1 - Wallet Connect or Passkey	Connect wallet OR register a passkey-secured embedded wallet; view personalized data; interact with the Protocol at base limits	Wallet address (your own or embedded); cryptographic signature or passkey assertion for authentication; optional email
Tier 2 - Verified	Higher transaction tiers; access to fiat on-ramp partners; certain rewards programs	Tier 1 data + government-issued ID + selfie/liveness + residential country
Tier 3 - Enhanced	Highest transaction tiers; institutional features	Tier 2 data + source-of-funds/source-of-wealth + PEP declaration + supporting documents

You may choose your tier. You may use the Services at Tier 0 or Tier 1 without providing KYC Data. Higher tiers are optional and unlock additional functionality.

5.2 Tier 0 - Browsing the Interface

When you access the Interface without connecting a wallet, you do not provide personal data directly. We automatically collect limited technical information as described in Section 5.6 (IP address, browser, device, usage).

We do not require, request, or collect:

• Your name, email, phone number, address, government ID, or any other identifying information;
• Any cryptocurrency wallet information;
• Any payment information.

5.3 Tier 1 - Wallet Connection or Passkey Authentication

You may access Tier 1 features by either (A) connecting your own self-custodial wallet, or (B) authenticating with a passkey that secures an embedded wallet provided through the Interface. Both options are non-custodial: in neither case does PrediXpro Labs Limited custody, hold, or have access to your private keys.

5.3.A Self-Custodial Wallet Connection

When you connect a self-custodial wallet to the Interface, we collect or process:

• Public wallet address(es) - visible to anyone on the blockchain;
• Wallet provider and connection method (e.g., MetaMask, Coinbase Wallet, Rainbow, Rabby, Trust Wallet, WalletConnect, Phantom, or other EVM-compatible wallet supporting Unichain);
• Cryptographic signatures used to verify wallet ownership for authentication (no transaction is initiated by signing in);
• Blockchain network identifier and chain ID;
• Optional account information you choose to provide: email address (for notifications), display name, avatar, language and notification preferences.

We do not collect or store your private keys, seed phrases, recovery phrases, or wallet credentials at any tier.

5.3.B Passkey Authentication and Passkey-Secured Embedded Wallet

As an alternative to connecting an external wallet, the Interface offers passkey-based authentication using the WebAuthn / FIDO2 standard. A passkey is a phishing-resistant cryptographic credential generated by your device. Where you opt into this feature, an embedded self-custodial wallet may also be provisioned and bound to your passkey, allowing you to sign Protocol transactions using your passkey instead of an external wallet.

What is collected and processed when you use a passkey:

• Public key generated by your device (used to verify your future authentications);
• Credential ID (a random identifier created by your device, unique to your relationship with the Interface - it cannot be used to track you across other websites);
• Authenticator metadata (such as authenticator transports, e.g., “internal,” “hybrid,” “usb”; we do not request or store authenticator-attestation data that identifies your specific device model unless strictly necessary);
• Sign counter (a number incremented by your authenticator to detect cloned credentials);
• User handle (a random per-account identifier - not your email or any other identifying information);
• Public wallet address of the embedded wallet associated with your passkey (if you choose to provision an embedded wallet);
• Operational metadata such as registration and last-use timestamps, device labels you assign, and the IP address from which the passkey was registered or used.

What is NOT collected when you use a passkey:

• Your biometric data (fingerprint, face geometry, iris, or voiceprint) is NEVER transmitted to us and NEVER stored on our servers. Biometric authentication, where used to unlock your passkey, occurs entirely on your device in a secure hardware module (such as Apple Secure Enclave, Android Trusted Execution Environment, Windows TPM, or a hardware security key). Your biometric template never leaves that secure hardware.
• Your private key never leaves your device. It is generated and stored in your device’s secure hardware module. We receive only the corresponding public key and cryptographic signatures.
• No device PIN, screen-lock pattern, or password used to unlock your device is shared with us.
• No cross-site tracking identifier. Each passkey is unique to the Interface and cannot be correlated with any passkey you may have registered with another website or application.

Embedded wallet provisioning. If you choose to provision an embedded self-custodial wallet bound to your passkey, the underlying cryptographic keys are generated and held within a third-party key-management infrastructure (see Section 8.1) using techniques such as secure enclaves, Trusted Execution Environments, or multi-party computation (MPC). PrediXpro Labs Limited does not have unilateral access to the private key of your embedded wallet; access is gated by your passkey authentication. If you lose access to all of your registered passkeys and any recovery factors you have established, you may permanently lose access to the embedded wallet - including the assets it controls. We strongly recommend registering multiple passkeys on multiple devices and following any recovery setup steps offered through the Interface.

Adding, replacing, and revoking passkeys. You may add additional passkeys, revoke existing passkeys, or transfer access between devices through the Interface settings. Adding or revoking a passkey typically requires authorization with a previously registered passkey.

5.4 Tier 2 - Verified KYC

If you elect to upgrade to Tier 2, PrediXpro, through our third-party identity-verification provider acting on our behalf, will collect:

• Full legal name, date of birth, nationality, country of residence;
• Government-issued identification document details (document type, number, issue/expiry dates, issuing authority, machine-readable zone data);
• Images or scans of identification documents (front and back where applicable);
• Selfie or live video for facial-recognition matching and liveness detection;
• Biometric data derived from such images (facial-geometry templates used solely to confirm document match - see Section 5.8);
• Verification results, document-authenticity assessments, fraud signals, and risk scores returned by the provider.

Tier 2 verification is performed by our designated identity-verification provider under a Data Processing Agreement with PrediXpro. The provider processes your data in accordance with its own privacy policy in addition to the safeguards under this Policy.

You will be presented with separate, granular consent before Tier 2 data is collected, including specific consent for biometric processing.

5.5 Tier 3 - Enhanced Due Diligence

If you elect to upgrade to Tier 3 (typically required for institutional or high-volume use), in addition to Tier 2 data we may collect:

• Source-of-funds and source-of-wealth information, including supporting documentation (e.g., bank statements, payroll records, tax returns);
• Occupation and employer information;
• Politically Exposed Person (PEP) self-declaration and supporting documents;
• Tax-residency information and tax identification numbers where required by applicable tax-information-sharing laws (e.g., FATCA, CRS);
• Expected transaction volume and use case.

5.6 Automatically Collected - All Tiers

When you access the Interface (at any tier including Tier 0), we and certain service providers acting on our behalf automatically collect:

• Device and connection information: IP address (used for geo-restriction enforcement; see Section 19), device type, device identifiers, operating system, browser type and version, screen resolution, language, time zone, crash and error logs;
• Usage and interaction information: pages or screens viewed, features used, time spent, navigation paths, clicks, search queries within the Interface, session duration, referrer URL;
• Cookies, local storage, and similar technologies: see Section 10;
• Approximate location derived from IP address (country/region level), used for compliance, sanctions, and geo-restriction enforcement.

We do not collect precise GPS or device-level location data.

5.7 From Third Parties

We may receive information about you from:

• Identity-verification providers (Tier 2+, see Section 5.4) - KYC outcomes, document-authenticity assessments, biometric match scores, liveness results, risk scores;
• Sanctions, PEP, and adverse-media screening providers - screening hits or clear results, PEP status, adverse-media flags;
• Wallet-screening and blockchain-analytics providers - wallet risk scores, exposure analysis, counterparty information derived from public blockchain data, used for compliance and fraud prevention;
• Wallet-connection infrastructure providers - wallet metadata, connection state;
• Fiat on-ramp/off-ramp partners (Tier 2+) - payment status and transaction confirmations; payment details are collected directly by the partner under its own privacy policy (we typically do not receive full payment details);
• Social sign-in providers (if you choose to link a social account at Tier 1) - basic profile information you authorize;
• Analytics, security, and anti-bot vendors - usage statistics, security signals, bot-detection flags;
• Public sources and public blockchains - Blockchain Data and publicly available regulatory, sanctions, and watchlist databases.

5.8 Biometric Data - Explicit Consent

Biometric data (facial-geometry templates derived from liveness checks and selfie-matching) is collected only at Tier 2+ and only by our identity-verification provider acting as a processor on our behalf.

Before any biometric processing occurs, you will be presented with a separate, granular consent notice explaining:

• The biometric data categories collected;
• The specific purpose (identity verification, liveness detection, fraud prevention);
• The identity-verification provider performing the processing;
• The retention period (Section 12);
• Your right to withdraw consent (noting that withdrawal may prevent access to Tier 2+ features).

Biometric data is used solely for identity verification. It is not used for advertising, profiling, behavioral analysis, AI training, or any other purpose. Where law requires a specific legal basis for biometric processing, we rely on your explicit consent and, where applicable, substantial public interest in preventing financial crime.

5.9 Inferred and Derived Information

We may generate or derive information about you, including:

• Fraud, abuse, and Sybil-activity risk scores;
• Wallet risk indicators (based on third-party blockchain-analytics signals);
• Sanctions, PEP, and adverse-media risk assessments;
• Behavioral patterns for product analytics;
• Eligibility status and tier-access indicators.

5.10 Sensitive Personal Information

At Tier 2+ we may process Sensitive Personal Information, including:

• Government-issued identification numbers;
• Biometric data used for identity verification;
• Account credentials and authentication data;
• Precise geolocation, only to the extent strictly necessary for sanctions and geo-restriction enforcement (typically not collected; IP-based approximate location is sufficient).

We use Sensitive Personal Information only for the limited compliance, security, fraud-prevention, and service-provision purposes described in this Policy. We do not use Sensitive Personal Information for marketing, advertising, profiling, cross-context behavioral advertising, or commercial inferences.

5.11 Information We Do NOT Collect

To minimize legal and privacy risk and to honor our non-custodial design, we do not collect, request, or maintain:

• Private keys, seed phrases, recovery phrases, or any wallet credentials;
• Bank account numbers or full payment card details (payments through fiat partners are processed directly by the partner; we typically receive only confirmation status);
• Custody-related records (we do not custody);
• Real-time precise GPS location;
• Social Security Numbers, national ID numbers (other than as part of government-issued ID at Tier 2+), or health/medical/genetic/sexual-orientation data;
• Personal data of children under 18;
• Passkey biometric data - Biometric data used to unlock your passkey (fingerprint, face, iris, voice) is processed entirely on your device by your operating system or hardware module; it is never transmitted to us and never stored on our servers. This is a fundamentally different processing model from the KYC biometric described in Section 5.4 (which applies only if you elect to upgrade to Tier 2);
• Passkey private keys - These are generated and stored exclusively in your device’s secure hardware. We only receive the corresponding public key.

5.12 Data About Others (Referrals and Invitations)

If the Interface provides features allowing you to invite other persons to use the Services (e.g., referral codes, invitation links, share-to-social features), we may collect limited information about those other persons that you provide to us, such as their email address, social media handle, or wallet address. By providing such information, you represent and warrant that:

• You have the necessary rights, permissions, and lawful basis to provide that information to us;
• The person whose data you provide has not objected to receiving such an invitation;
• You are not using such features to spam, harass, or otherwise abuse any third party.

We use such information solely to deliver the invitation, track referral eligibility (anti-Sybil purposes), and respond to subsequent communications. We do not add invitees to marketing lists without their own subsequent consent.

5.13 Networks and Connections

If the Interface offers social features (e.g., follow/follower relationships, public profiles, leaderboards, comments, reactions), we may collect information about:

• Other users you follow or who follow you;
• Public interactions you have with other users (comments, reactions, mentions);
• Leaderboard rankings and other public engagement metrics;
• Content you publicly post on the Interface.

You should not post any information on public-facing features that you do not want to be visible to other users, search engines, archival services, or third parties.

5.14 Communications Monitoring and Recording

We may, but have no obligation to, monitor, record, store, and review communications between you and us (including support tickets, customer service chats, emails, and any phone calls if such a channel is offered), in order to:

• Protect your safety and the safety of other users and the Services;
• Assist with regulatory, compliance, or law-enforcement efforts;
• Train support staff and improve service quality;
• Protect and defend our rights, property, and the integrity of the Services;
• Document the resolution of disputes and inquiries.

By contacting us through any communication channel, you consent to such recording, storage, monitoring, and disclosure as described in this Policy.

---

6. HOW WE USE PERSONAL INFORMATION

We use personal data for the following purposes, in each case only to the extent necessary and proportionate:

6.1 Operating the Interface

• Providing access to the Interface;
• Authenticating you (via wallet signatures and, optionally, email);
• Personalizing the Interface (showing your wallet’s positions, history, watchlists);
• Enabling wallet connections to the Protocol;
• Providing customer support;
• Maintaining service continuity, performance, and reliability.

6.2 KYC, Sanctions, and Compliance

• Verifying your identity at Tier 2 and Tier 3;
• Screening you, your wallet(s), and counterparty wallets against sanctions, PEP, and adverse-media lists;
• Enforcing geo-restrictions and Restricted Jurisdictions controls (Section 19);
• Detecting and preventing fraud, multi-accounting, Sybil activity, market manipulation, and other harmful conduct;
• Implementing tier-based access controls;
• Cooperating with regulators and law enforcement to the extent required by law;
• Maintaining records required by applicable law (typically 5 years post-relationship at Tier 2+).

6.3 Tax Reporting (Tier 2/3 Only Where Applicable)

Where required by applicable tax laws (including FATCA, CRS, or local equivalents), collecting and reporting tax-related information to competent tax authorities.

6.4 Communications

• Sending Interface notices, security alerts, and account confirmations;
• Sending compliance and legal notices;
• Sending support replies;
• Sending periodic newsletters and Protocol updates (with your consent or where permitted by law);
• Notifying you of material events relating to your use of the Interface or the Protocol.

6.5 Personalization and Analytics

• Remembering your preferences;
• Recommending markets or features (you may disable in account settings);
• Measuring how the Services are used;
• Identifying and fixing technical issues;
• Testing and improving features.

6.6 Safety, Integrity, and Fraud Prevention

• Detecting and preventing fraud, abuse, manipulation, Sybil activity, multi-accounting, wash trading, and other harmful conduct;
• Investigating incidents;
• Enforcing the Terms of Use, this Policy, and our other policies.

6.7 Internal Machine Learning (Limited)

We may use Aggregated Data, Anonymized Data, and limited personal data to train internal models that improve the Interface, including for fraud detection, sanctions screening triage, anomaly detection, recommendation, and integrity monitoring.

We do not:

• Share personal data with third-party AI providers to train their general-purpose models;
• License, sell, or share personal data for third-party AI training;
• Use Sensitive Personal Information for AI training.

6.8 Legal and Regulatory Compliance

• Complying with applicable laws, regulations, court orders, subpoenas, regulatory inquiries, and lawful requests from competent authorities;
• Responding to legal claims;
• Establishing, exercising, or defending legal claims;
• Maintaining records required for compliance, audit, and accounting.

6.9 Verification and Data Quality

• Comparing and cross-referencing information you provide with information from third-party sources (e.g., identity-verification providers, sanctions providers, blockchain analytics) to verify accuracy and detect inconsistencies;
• Maintaining the accuracy and completeness of records;
• Compiling aggregated, anonymized, or de-identified statistical data for internal analysis, research, business planning, and reporting (such aggregated data may also be shared with third parties for the same purposes provided it cannot reasonably identify you).

---

7. LEGAL BASES FOR PROCESSING (EEA, UK, SWITZERLAND)

If you are in the European Economic Area, the United Kingdom, or Switzerland, we process your personal data on the following GDPR / UK GDPR / Swiss DPA legal bases:

Purpose	Legal Basis
Tier 0 browsing - strictly necessary technical processing	Legitimate interests (Art. 6(1)(f)) - providing a functioning Interface
Tier 1 wallet connection and account features	Performance of contract (Art. 6(1)(b))
Tier 2/3 KYC, sanctions, and compliance	Legal obligation (Art. 6(1)(c)); substantial public interest (Art. 9(2)(g)) for special category data; explicit consent (Art. 9(2)(a)) for biometric data
Tax-information reporting	Legal obligation (Art. 6(1)(c))
Fraud prevention, security, integrity	Legitimate interests (Art. 6(1)(f))
Personalized recommendations	Legitimate interests (Art. 6(1)(f)) - you may object
Marketing communications	Consent (Art. 6(1)(a)) - withdrawable
Non-essential cookies	Consent (Art. 6(1)(a)) under ePrivacy Directive
Establishment, exercise, defense of legal claims	Legitimate interests (Art. 6(1)(f)) and legal obligation (Art. 6(1)(c))
Compliance with court orders and lawful requests	Legal obligation (Art. 6(1)(c))

For special category data (Art. 9), we rely on explicit consent for biometric data (Art. 9(2)(a)) or substantial public interest in preventing financial crime as recognized under applicable law for sanctions and AML processing (Art. 9(2)(g)).

For criminal-conviction-related data processed in connection with sanctions and adverse-media screening (Art. 10), we rely on substantial public interest as authorized under applicable law and our role in preventing financial crime.

Note: While Section 19 restricts EEA Member States from access to the Services pending appropriate licensing, this section applies to any EEA-located individual whose personal data we have nonetheless collected.

---

8. HOW WE SHARE PERSONAL INFORMATION

We disclose personal data only to the categories of recipients listed below, in each case subject to appropriate safeguards.

8.1 Service Providers and Processors

Third parties performing services on our behalf under written Data Processing Agreements:

• Cloud hosting and infrastructure providers;
• Database, storage, and backup providers;
• Email delivery providers;
• Customer support platforms;
• Error monitoring and crash reporting;
• Privacy-respecting analytics providers;
• Security, anti-bot, DDoS-protection vendors;
• API gateway, RPC, and blockchain indexing providers;
• Wallet-connection infrastructure;
• Passkey and WebAuthn relying-party services and embedded-wallet infrastructure providers (e.g., Privy, Dynamic, Turnkey, Web3Auth, Magic, Dfns, or similar providers offering secure-enclave, TEE, or MPC-based key management);
• Authenticator-metadata services (FIDO Alliance Metadata Service or equivalent) that we may consult to verify authenticator authenticity;
• Content delivery networks.

8.2 KYC, Sanctions, and Compliance Providers (Tier 2+)

• Identity-verification providers (Tier 2+);
• Sanctions, PEP, and adverse-media screening providers;
• Blockchain analytics and wallet-screening providers;
• Compliance consultants, auditors, and legal advisors.

8.3 Fiat On-Ramp / Off-Ramp Partners

Where the Interface integrates third-party fiat on/off-ramp partners, you transact with the partner directly. The partner is an independent controller of the data you provide to it. We may receive limited confirmation status. Each partner’s privacy policy applies to its processing.

8.4 Authorities and Legal Recipients

Courts, regulators, financial-intelligence units, law-enforcement agencies, tax authorities, and other competent authorities, where required by Applicable Law, valid legal process, or where we reasonably believe disclosure is necessary to comply with our legal obligations.

8.5 Professional Advisors

Lawyers, auditors, accountants, bankers, insurers, where necessary in the course of services they render to us, subject to professional confidentiality.

8.6 Affiliates and Corporate Group

Affiliates and corporate group entities where necessary for shared infrastructure, administration, compliance coordination, and business continuity, subject to intra-group data-transfer agreements.

8.7 Business Transferees

In connection with actual or proposed mergers, acquisitions, financings, reorganizations, asset sales, bankruptcy, insolvency, receivership, or similar transactions. Recipients will be required to honor this Policy with respect to transferred personal data.

8.8 Public Blockchains

When you initiate transactions through the Protocol (whether via our Interface or directly), transaction data is broadcast to and recorded on public blockchain networks. This information is public, immutable, and outside PrediXpro Labs Limited’s control. See Section 9.

8.9 With Your Direction

Third parties to whom you direct us to disclose information (e.g., via integrations you choose to authorize).

8.10 What We Do NOT Do

For clarity, PrediXpro does not:

• Sell personal data for money or other valuable consideration;
• Share personal data for cross-context behavioral advertising as defined under California law;
• Use advertising pixels, retargeting tags, or third-party advertising SDKs;
• License, sell, rent, or trade your personal data to AI developers, data brokers, or research clients for third-party AI training;
• Use Sensitive Personal Information for advertising, marketing profiling, or commercial inferences;
• Custody, hold, or have access to your digital assets, private keys, seed phrases, or recovery phrases.

---

9. PUBLIC BLOCKCHAIN DATA

9.1 The Public Nature of Blockchain Activity

The Protocol operates on public blockchain networks. Public blockchains are decentralized, transparent, immutable, and globally accessible. Information recorded on a blockchain may be visible to anyone and may remain permanently accessible.

Blockchain Data that may be associated with your activity includes:

• Wallet addresses (yours and counterparties’);
• Transaction hashes and timestamps;
• Token transfers and balances;
• Outcome-share holdings and positions on the Protocol;
• Smart-contract interactions;
• Gas-fee metadata;
• Public market activity, including price impact and order flow on the on-chain order book;
• Public market resolution data.

Although Blockchain Data alone may not identify you by name, it may become associated with you when combined with other information (e.g., your account information at Tier 1+, KYC data at Tier 2+, IP address, social-media activity, or third-party blockchain-analytics inferences). Where required by Applicable Data Protection Law, we treat Blockchain Data linked to you as personal data subject to this Policy.

9.2 PrediXpro Cannot Modify Blockchain Data

We cannot delete, modify, restrict, obscure, or reverse information recorded on a public blockchain. The Protocol is open-source software operating autonomously; the Blockchain Data it produces is propagated to and stored by independent network participants worldwide.

Requests to delete, correct, restrict, or object to processing of Blockchain Data may be technically infeasible or legally limited to the extent the data exists on a public blockchain outside our control. Where feasible and required by law, we will:

• Delete or anonymize internal records under our control that link Blockchain Data to your identity;
• Stop processing Blockchain Data for purposes beyond what is required by law;
• Cease displaying the linkage between your identity and your wallet addresses in our internal systems;

but we cannot alter the underlying public blockchain records.

9.3 Acknowledgment

By using the Services and interacting with the Protocol, you acknowledge the public, irreversible, and permanent nature of blockchain transactions and on-chain data, and you accept that this is an inherent characteristic of the Protocol that PrediXpro cannot change.

---

10. COOKIES AND SIMILAR TECHNOLOGIES

10.1 Categories We Use

Category	Purpose	Consent in EEA/UK
Strictly necessary	Authentication, session management, security, fraud prevention, wallet-connection state, consent-preference storage, geo-restriction enforcement	No (essential)
Functional	Remembering preferences (language, time zone, layout, dark mode)	Yes
Analytics (aggregated)	Aggregated usage statistics, performance measurement	Yes
Security & fraud prevention	Anti-bot, anti-abuse, anti-fraud detection	Legitimate interests / legal obligation
Compliance	Geo-restriction signals, device fingerprinting for sanctions and fraud	Legal obligation / legitimate interests

We do not use advertising cookies, retargeting pixels, conversion pixels, social-media tracking pixels, or third-party advertising SDKs.

10.2 Consent

Where required by law, we present a cookie-consent banner on first visit allowing you to accept, reject, or selectively manage non-essential Tracking Technologies. You can revisit your choices through the Cookie Settings link in the Interface footer.

10.3 Browser Controls, DNT, and GPC

You can manage cookies through your browser. Disabling strictly necessary cookies may prevent the Interface from functioning.

We do not respond to browser “Do Not Track” signals (no industry consensus on interpretation). We do honor the Global Privacy Control (GPC) signal for users in jurisdictions where GPC carries legal effect (including California), treating it as a valid opt-out of “sale” and “sharing” of personal data.

---

11. INTERNATIONAL DATA TRANSFERS

Your personal data may be transferred to, stored in, and processed in countries other than your country of residence. These countries may have data-protection laws different from those in your country.

Where required by Applicable Data Protection Law, we implement appropriate safeguards for international transfers, which may include:

• From the EEA, Switzerland, or the UK to a country without an adequacy decision: the European Commission’s Standard Contractual Clauses (SCCs), the UK International Data Transfer Agreement (IDTA), the UK Addendum to the SCCs, the Swiss-specific addendum, together with supplementary technical and organizational measures (following Schrems II and EDPB guidance);
• From other jurisdictions: equivalent recognized mechanisms.

In limited circumstances we may rely on permitted derogations (e.g., transfers necessary to perform a contract, transfers necessary to establish, exercise, or defend legal claims, explicit consent).

Because the Protocol operates on public blockchain networks, certain information associated with your activity may be broadcast to, validated by, stored on, indexed from, or accessed through decentralized networks and participants located globally. PrediXpro does not initiate or control these blockchain-wide propagations and cannot impose contractual safeguards on independent network participants. This is an inherent characteristic of public blockchain technology that you accept by using the Protocol.

A copy of the applicable transfer safeguards may be requested at contact@predixpro.io , subject to redaction of confidential commercial information.

---

12. DATA RETENTION

We retain personal data only as long as necessary to fulfill the purposes for which it was collected, including to satisfy applicable legal, regulatory, accounting, and audit obligations.

Data Category	Retention Period
Tier 0 (anonymous browsing) data	Up to 13 months in identifiable form; thereafter aggregated/anonymized
Tier 1 account data (wallet linkage, email, preferences)	Duration of account, plus up to 180 days after closure
Tier 2 KYC documents and verification records	Minimum 5 years after end of customer relationship or account closure (consistent with FATF Recommendation 11 and applicable AML laws); extendable in jurisdictions requiring longer (up to 7–10 years)
Tier 2 biometric data used for identity matching	Deleted promptly after verification is complete; not retained beyond what is required to defend a verification decision (typically not more than 12 months); in no case longer than 5 years after end of customer relationship
Tier 3 enhanced due diligence records (source of funds, PEP, etc.)	Minimum 5 years after end of customer relationship
Sanctions screening results	Minimum 5 years after the screening event
Risk assessments and fraud-related records	5 years for routine records; longer where required to defend a specific incident
Communications and support records	24 months from last interaction; longer where related to a dispute or legal claim
Security and authentication logs	12 months for routine logs; 5 years for security-incident logs
Usage and analytics logs	13 months in identifiable form; thereafter aggregated or anonymized
Tax-reporting records (Tier 2+ only, where applicable)	Per applicable tax law (typically 5–10 years)
Marketing-consent records	For as long as consent is active, plus 3 years after withdrawal (to evidence prior consent)
Cookie-consent records	13 months
Records required to defend or pursue legal claims	Duration of the applicable limitation period
Aggregated or anonymized data	Indefinitely
Public blockchain data	Permanent - outside our control

Note on Tier 2+ retention: Because we collect KYC Data only when you elect to upgrade to Tier 2 or Tier 3, the AML retention obligations apply only to those users. Tier 0 and Tier 1 users do not generate AML-retention records.

When retention is no longer required, we delete or irreversibly anonymize personal data, except where retention is required by law.

---

13. DATA SECURITY

13.1 Our Measures

We implement technical and organizational measures appropriate to the risks of processing, including:

• Encryption in transit (TLS 1.2+) and encryption at rest for personal data;
• Salted, hashed password storage using industry-standard algorithms (Argon2, bcrypt) where passwords are used;
• Multi-factor authentication for administrative access;
• Role-based access controls with least-privilege principles;
• Network segmentation, firewalls, intrusion detection;
• Vulnerability scanning, dependency monitoring, code review;
• Periodic penetration testing and security audits;
• Smart-contract audits by reputable third-party firms;
• Vendor security due diligence and written Data Processing Agreements;
• Employee training on data protection and information security;
• Audit logging of administrative actions;
• Incident-response plan with defined roles, timelines, and escalation procedures;
• Physical and logical safeguards at hosting providers (SOC 2, ISO 27001 certified facilities).

13.2 Your Responsibilities

You are solely responsible for the security of your wallet, private keys, seed phrases, recovery phrases, devices, browsers, extensions, and network environment.

We will never ask you to disclose your private key, seed phrase, or recovery phrase. Anyone asking for these is attempting to defraud you.

You should

• Use a hardware wallet for significant balances;
• Verify URLs before connecting your wallet (always check you are at the official Interface URL: predixpro.io);
• Enable two-factor authentication on any account features;
• Register at least two passkeys on separate devices if you choose to use passkey authentication, so that loss of a single device does not lock you out of your account and (if applicable) your embedded wallet;
• Keep the secure-element-backed authenticator on your device up to date and protected by a strong device passcode, screen lock, or biometric - this is what protects your passkey at rest;
• Be alert to phishing, social engineering, fake-support attacks, and impostor sites;
• Report suspected unauthorized access to contact@predixpro.io promptly.

13.3 Limitations

No internet transmission, electronic storage, blockchain network, wallet interface, smart contract, or decentralized protocol is fully secure. We cannot guarantee absolute security and we are not responsible for losses resulting from your own device compromise, phishing, social engineering, credential misuse, or wallet-security failure. We are also not responsible for vulnerabilities or exploits in the Protocol or in third-party wallets, blockchains, oracles, or services that you use.

---

14. DATA-BREACH NOTIFICATION

In the event of a personal-data breach likely to result in a risk to your rights and freedoms, we will:

• Notify the relevant supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of the breach (as required under GDPR Art. 33, UK GDPR Art. 33, and similar laws);
• Notify affected data subjects without undue delay where the breach is likely to result in a high risk to your rights and freedoms (GDPR Art. 34 and equivalents), via email or in-Interface notification, including a description of the breach, likely consequences, measures taken, and contact information;
• Notify other authorities or counterparties required to be notified under sectoral law.

We maintain internal breach-response procedures designed to identify, contain, assess, and remediate breaches promptly.

---

15. YOUR RIGHTS - GENERAL

Depending on your location and Applicable Data Protection Law, you may have:

• Right of access - to obtain confirmation whether we process personal data about you and a copy;
• Right to rectification - to have inaccurate or incomplete personal data corrected;
• Right to erasure (“right to be forgotten”) - subject to applicable exceptions;
• Right to restriction of processing - to limit how we process your personal data in certain circumstances;
• Right to data portability - to receive a copy in a structured, machine-readable format and transmit it to another controller;
• Right to object - to processing based on legitimate interests, direct marketing, or scientific research (subject to statutory exceptions);
• Right to withdraw consent - for processing based on consent, withdrawable at any time without affecting prior lawful processing;
• Right to lodge a complaint - with the supervisory authority in your country of residence, place of work, or place of the alleged infringement;
• Right not to be subject to solely automated decisions producing legal or similarly significant effects.

Important limitations specific to the Services:

• We may decline or limit erasure, restriction, or portability requests with respect to Tier 2/3 KYC records that we are legally required to retain.
• We may decline or be unable to fulfill requests with respect to Blockchain Data, which is outside our control (Section 9).
• We may require identity verification before responding to a request.

To exercise rights, see Section 17.

---

16. REGION-SPECIFIC RIGHTS

16.1 European Economic Area (EEA), Switzerland, United Kingdom

Rights described in Section 15 apply under GDPR, UK GDPR, or Swiss DPA. Contact contact@predixpro.io .

Response timeline: within one (1) month of receipt, extendable by up to two (2) months for complex or numerous requests (with notice).

Complaints: to your EU Member State supervisory authority, the UK Information Commissioner’s Office (ICO, ico.org.uk), or the Swiss FDPIC (edoeb.admin.ch).

Note: The EEA and UK are listed as Restricted Jurisdictions in Section 19 pending appropriate licensing. This section applies to any EEA/UK-located individual whose personal data we have nonetheless collected.

16.2 California (CCPA / CPRA)

If you are a California resident:

• Right to Know - categories and specific pieces of personal information collected, sources, purposes, recipients.
• Right to Delete - subject to permitted exceptions (including AML/CTF retention at Tier 2+ and legal-claim defense).
• Right to Correct - request correction of inaccurate personal information.
• Right to Opt Out of Sale or Sharing - PrediXpro does not sell personal data and does not share personal data for cross-context behavioral advertising. We honor GPC signals.
• Right to Limit Use of Sensitive Personal Information - Sensitive Personal Information is used only for the purposes permitted under CPRA, including identity verification, sanctions, fraud prevention, security, and legal compliance.
• Right to Non-Discrimination.

Categories of personal information collected in the preceding 12 months:

• Identifiers (email address, IP address, wallet address, device identifiers, government ID numbers at Tier 2+);
• Personal information under California Customer Records statute (Tier 2+: name, address, signature, government ID);
• Commercial information (Interface interaction history; on-chain Protocol activity associated with your wallet);
• Internet or network activity (usage logs, interactions);
• Geolocation (approximate, country/region level);
• Sensory data (Tier 2+: selfies/video for liveness);
• Professional or employment information (Tier 3 only);
• Inferences (risk scores, behavioral patterns);
• Sensitive personal information (Tier 2+: government IDs, biometric data, account credentials).

Sources, purposes, and recipients: as described in Sections 5, 6, and 8.

To exercise rights: email contact@predixpro.io with subject “California Privacy Request” or use in-Interface privacy tools. We respond within 45 days (extendable by 45 days with notice). Authorized agents permitted with verifiable written authorization. Appeals: reply with subject “California Privacy Appeal.”

Note: The United States is restricted under Section 19. If a California user accesses the Interface in violation of Section 19, this section still applies to the personal data we have nonetheless collected.

16.3 Other US States

Residents of Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, Iowa, Delaware, New Hampshire, New Jersey, Maryland, Minnesota, Rhode Island, Tennessee, Indiana, Kentucky, and other states with comprehensive privacy laws have substantively similar rights. Contact contact@predixpro.io . Appeals available where statutory right exists.

16.4 Canada (PIPEDA / Provincial)

PIPEDA, Quebec Law 25, BC PIPA, Alberta PIPA give rights to access, correct, withdraw consent. Complaints to the Office of the Privacy Commissioner of Canada or provincial regulator.

16.5 Brazil (LGPD)

Rights of access, correction, anonymization or deletion, portability, information about sharing, consent withdrawal. Complaints to ANPD (gov.br/anpd).

16.6 Australia (Privacy Act 1988 / APPs)

Rights to access and correct personal information. Complaints to OAIC (oaic.gov.au).

16.7 Japan (APPI)

Rights to disclose, correct, suspend use of, and erase retained personal data.

16.8 South Korea (PIPA)

Rights of access, correction, deletion, suspension.

16.9 Singapore (PDPA)

Rights of access, correction, withdrawal of consent. Complaints to PDPC (pdpc.gov.sg).

16.10 Other Jurisdictions

Contact contact@predixpro.io we respond per applicable law.

Note: Vietnam (PDPL 91/2025), Mainland China (PIPL), and certain other jurisdictions are listed as Restricted Jurisdictions in Section 19. Residents of those jurisdictions are not permitted to use the Services. If we have nonetheless collected personal data from a person located in such a jurisdiction, we will respond to data-subject requests to the extent required by Applicable Law.

---

17. HOW TO EXERCISE YOUR RIGHTS

1. In-Interface self-service. Some rights can be exercised through Interface settings (profile correction, communication preferences, cookie preferences, account closure).
2. Email us. Send a request to contact@predixpro.io from the email address associated with your account, clearly describing the request.
3. Authorized agents. Designate via verifiable written authorization; we may also verify your identity directly.

Verification. We verify your identity before fulfilling a request, with rigor proportionate to the sensitivity of the request. For Tier 2+ KYC-related requests, we may require re-verification through our identity provider
Response timeline. Per applicable law (typically 30, 45, or 60 days). Extendable with notice for complex or numerous requests.

Fees. No fee, except where requests are manifestly unfounded or excessive.

Appeals. Where a statutory appeal right exists, reply with subject “Privacy Appeal” or contact contact@predixpro.io .

Limitations. Requests relating to Tier 2/3 KYC, sanctions screening, or AML records may be denied in whole or in part where retention is legally required. Requests relating to Blockchain Data may be technically infeasible (Section 9).

---

18. CHILDREN’S PRIVACY

The Services are not directed to, designed for, or intended to be used by individuals under the age of 18 (or the age of legal majority in your jurisdiction if higher). We do not knowingly collect personal data from children under 18.

By accessing or using the Services, you represent and warrant that you are at least 18 (or the age of legal majority in your jurisdiction if higher) and have legal capacity to enter into binding agreements.

If you are a parent or legal guardian and believe a child under 18 has provided us personal data, contact contact@predixpro.io immediately. We will promptly investigate and, where confirmed, delete the data and terminate the account.

We do not rely on parental consent to permit minors to use the Services. The Services remain unavailable to individuals under the applicable minimum age regardless of parental consent.

---

19. RESTRICTED JURISDICTIONS AND RESTRICTED PERSONS

The Services are not offered to, and not intended for use by, the following (“Restricted Jurisdictions” and “Restricted Persons”):

19.1 Sanctioned Countries and Regions

Any country, territory, or region subject to comprehensive sanctions administered by the United Nations, the European Union, the United Kingdom, the United States Office of Foreign Assets Control (OFAC), Switzerland, or other applicable sanctions authorities, including without limitation:

• Cuba
• Iran
• North Korea (DPRK)
• Syria
• Russia and Belarus (to the extent comprehensive sanctions apply)
• The Crimea region of Ukraine
• The so-called Donetsk People’s Republic and Luhansk People’s Republic
• The Kherson and Zaporizhzhia regions of Ukraine
• Any other comprehensively sanctioned jurisdiction designated from time to time

19.2 Prohibitive or High-Risk Jurisdictions for Prediction Markets

Until PrediXpro obtains appropriate license, registration, or no-action relief in the following jurisdictions, the Services are not available to persons located in or resident of:

• The United States of America and its territories;
• Ontario, Canada;
• United Kingdom;
• Vietnam;
• Mainland China, Hong Kong SAR, Macao SAR;
• Singapore;
• South Korea, Japan, Taiwan;
• France, Italy, Spain, Germany, Netherlands, Belgium, Poland;
• Australia, New Zealand;
• Türkiye, Thailand, Indonesia, Malaysia, Philippines;
• United Arab Emirates, Saudi Arabia, Qatar, Kuwait, Bahrain, Oman;
• Any FATF-blacklisted or FATF-call-for-action jurisdiction.

19.3 Restricted Persons

The Services are not available to:

• Persons listed on any sanctions, watchlist, or restricted-party list administered by OFAC, the UN, EU, UK, Switzerland, or other applicable authority (a “Sanctioned Person”);
• Persons acting on behalf of or for the benefit of a Sanctioned Person;
• Persons located in, ordinarily resident in, incorporated in, or with a registered office in a Restricted Jurisdiction;
• Citizens of comprehensively sanctioned jurisdictions, regardless of location;
• Persons under the age of 18 (or the age of legal majority in your jurisdiction if higher);
• Persons prohibited by local law from accessing online prediction-market or financial services.

19.4 Enforcement

We employ:

• IP-based geo-blocking;
• VPN/proxy detection;
• Wallet screening through third-party blockchain analytics;
• Sanctions screening at Tier 2+;
• Self-attestation requirements.

If we determine that you are a Restricted Person or in a Restricted Jurisdiction, we will deny, suspend, or terminate access to the Interface and may report findings to competent authorities where required.

19.5 Anti-Circumvention

You agree not to use a VPN, proxy, fake identification, or any other circumvention tool to access the Services from a Restricted Jurisdiction or as a Restricted Person. Doing so is a violation of our Terms of Use and may also violate applicable laws of your jurisdiction.

19.6 Protocol Access

The Protocol is open-source software accessible to anyone with a compatible wallet, including persons in Restricted Jurisdictions. Such access does not involve PrediXpro Labs Limited or this Policy and is at the user’s own risk and responsibility under applicable laws.

---

20. KYC, SANCTIONS, AND COMPLIANCE PROCEDURES

PrediXpro implements compliance procedures at the Interface level commensurate with our current phase and intended licensing trajectory (Section 24).

20.1 Procedures

• Geo-restriction and IP filtering at Tier 0;
• Sanctions and watchlist screening at all tiers using third-party screening providers;
• Wallet risk screening via third-party blockchain analytics for all wallet connections;
• Tier-based KYC as described in Section 5;
• Adverse-media screening at Tier 2+;
• PEP screening at Tier 2+;
• Enhanced due diligence at Tier 3;
• Ongoing monitoring of sanctions, PEP, and adverse-media status for verified users;
• Suspicious-activity reporting to competent financial-intelligence units where required by law.

20.2 Tipping-Off

Where law prohibits us from informing you of a suspicious-activity report or similar filing, we will not do so. Decisions to limit, freeze (at the Interface level), or close accounts may be required by law without further notice.

20.3 Failure to Verify

If you fail or refuse to complete required verification, submit false or misleading information, use another person’s identity, or present an unacceptable compliance risk, we may deny, restrict, suspend, or terminate access to the Interface.

20.4 No Custody Limitation

Because we are non-custodial, we cannot freeze, seize, or move your on-chain assets. We can only restrict your access to the Interface. The Protocol itself is permissionless; we have no ability to prevent you from interacting with it directly. This means our compliance controls are limited to the Interface layer.

---

21. THE PREDIXPRO TOKEN

PrediXpro is associated with the development of the PrediXpro Token (the “Token”), a utility token providing certain rights and access within the PrediXpro ecosystem.

21.1 Nature of the Token

The Token is intended to be a utility token providing:

• Governance rights with respect to certain Protocol parameters;
• Fee discounts or rebates when using the Interface or the Protocol;
• Staking rewards from a portion of Protocol-generated fees;
• Access to certain Interface features.

The Token is not offered as a security, investment, financial instrument, share, debt instrument, derivative, or other regulated financial product. The Token has no inherent monetary value, no fixed redemption value, and no claim against PrediXpro Labs Limited or the Protocol.

The Token is not available to Restricted Persons, including US persons.

21.2 Token-Related Data

If you participate in Token-related activities through the Interface (e.g., claiming an airdrop, staking, governance voting), we may process additional personal data including:

• The wallet address used for Token-related actions;
• Eligibility records for any airdrop, distribution, or rewards program;
• Anti-Sybil signals to prevent multi-accounting in distributions;
• Governance vote records (which are also public on-chain);
• Tax-residence information (Tier 2+ only, where applicable to Token-related distributions under tax law).

21.3 No Token Investment Advice

Nothing in this Policy, on the Interface, or in any PrediXpro communication constitutes investment advice, a recommendation to acquire, hold, sell, or trade the Token, or any guarantee of Token utility, value, or performance. The Token is highly speculative and you may lose all value associated with it. See our Risk Disclosure for more.

21.4 Token Disclosures Are Not a Token Sale Offer

References to the Token in this Policy are for the limited purpose of explaining how related personal data is processed. They do not constitute an offer to sell or solicitation to purchase the Token in any jurisdiction. Distribution of the Token (if any) is governed by separate documentation.

---

22. AI AND AUTOMATED DECISION-MAKING

22.1 Automated Tools We Use

We use automated and semi-automated tools at the Interface level for limited purposes:

• Sanctions, PEP, and adverse-media screening;
• Wallet-risk and counterparty-risk assessment;
• Fraud, bot, and Sybil-activity detection;
• Anomaly detection in Interface usage patterns;
• Content moderation (with human review for material decisions);
• Recommendations for relevant markets.

22.2 Human Review

Where automated tools produce decisions that materially affect your access to the Interface (e.g., denial of verification, account suspension, transaction blocking), human review is available on request. We honor your right not to be subject to solely automated decisions producing legal or similarly significant effects under GDPR Art. 22 and equivalents.

For sanctions, AML, and fraud-related automated decisions, processing may be necessary to comply with legal obligations and may continue notwithstanding objections where required by law.

22.3 AI Training Commitments

We do not:

• Share personal data with third-party AI providers to train their general-purpose models;
• License, sell, or share personal data for third-party AI training;
• Use Sensitive Personal Information for any AI training.

We may use Aggregated Data, Anonymized Data, and limited personal data for internal model training to improve the Interface (e.g., fraud detection, recommendations). You may object to AI-related processing of your personal data by contacting contact@predixpro.io ; we will honor objections unless we can demonstrate compelling legitimate grounds or legal obligation.

---

23. THIRD-PARTY SERVICES, THE PROTOCOL, AND BLOCKCHAINS

The Services may link to, integrate with, or interact with third-party websites, applications, wallets, blockchains, decentralized protocols, smart contracts, oracle systems, blockchain explorers, payment providers, identity-verification providers, social-media platforms, and other services.

This Policy does not apply to:

• The Protocol itself (open-source smart contracts on public blockchains), even when you access the Protocol through our Interface;
• Third-party wallets (e.g., MetaMask, Coinbase Wallet, Rainbow, Rabby, Trust Wallet, Phantom, WalletConnect, and other EVM-compatible wallets supporting Unichain);
• Third-party blockchains and their validators, node operators, and infrastructure;
• Oracles providing data to the Protocol;
• KYC providers, sanctions providers, blockchain-analytics providers, and fiat partners (these are independent or joint controllers depending on the relationship);
• Block explorers and on-chain analytics services;
• Social media platforms and messaging services;
• Other third-party services linked from the Interface.

These third parties operate independently and are governed by their own privacy policies. We encourage you to review them before using such services.

We are not responsible for the privacy, security, availability, accuracy, or data practices of third-party services or the Protocol.

---

24. COMPLIANCE EVOLUTION

PrediXpro is currently operating in an early phase and is progressing through a phased compliance roadmap. We are preparing to apply for appropriate licensing or registration in suitable jurisdictions in due course.

Until appropriate licenses are granted, certain features and jurisdictions are restricted (Section 19). Our compliance posture and the scope of the Services may evolve as regulatory clarity develops in our markets of operation.

This Policy may be updated to reflect:

• Changes in law (e.g., MiCA implementation across the EU, evolving CFTC posture, new state laws in the US, PDPL implementation in Vietnam, FATF Travel Rule guidance);
• Changes in our compliance posture (e.g., upon obtaining a license);
• Changes in our practices.

Operating in an early phase does not relieve us of obligations under Applicable Data Protection Law. We comply with privacy laws in the jurisdictions in which we operate and from which we serve users.

---

25. CHANGES TO THIS POLICY

We may update this Policy from time to time. When we make material changes, we will:

• Update the “Last Updated” date at the top;
• Post the revised Policy on the Interface;
• Provide notice via email, in-Interface notification, or prominent banner prior to the change becoming effective, where required by law;
• Obtain renewed consent where required by law.

Your continued use of the Services after a revised Policy takes effect constitutes your acceptance, except where law requires explicit re-consent. If you do not agree, discontinue use of the Services and request closure of your Tier 1+ account.

Past versions of this Policy are available on request.

---

26. HOW TO CONTACT US

For all matters concerning this Policy or our privacy practices, please contact:
PrediXpro Labs Limited

All inquiries - general, privacy, security, compliance, and legal: contact@predixpro.io

For matters concerning the Protocol itself (as opposed to the Interface), please engage with PrediXpro governance through the official governance forum referenced on the Interface. PrediXpro Labs Limited is not the operator of, and does not control, the Protocol.

---

This Policy is © 2026 PrediXpro Labs Limited. All rights reserved.