Privacy Policy

This Privacy Policy (the "Policy") explains how Ascnt Labs, Inc. (the "Company", "we", "us" or "our") collects, uses and shares data in connection with the services offered on our website at https://app.ascnt.fi (the "Site") and all of our other properties, products and services that link to this Policy (together, the "Services"). Your use of the Services is subject to this Policy as well as our Terms of Service. Please note that your use of the Ascnt Protocol or the Uniswap v4 protocol — immutable smart contracts deployed on public blockchains — is not governed by this Policy or by our Terms of Service.

High Level Summary

• We do not seek to collect information that directly identifies individuals, such as first name, last name, street address, date of birth or precise location. The Services have no user accounts, and you never need to provide us with an email address or any other personal detail to use them.
• We derive an approximate location — a country and, where available, a region, not a street address — from your internet-protocol ("IP") address in order to comply with U.S. sanctions law. We do not store your full IP address as part of that check.
• When you connect a wallet, we collect its public address and screen it against the U.S. Treasury’s Specially Designated Nationals and Blocked Persons List, and only that list. We do not obtain or act on risk scores, transaction histories or behavioural profiles.
• We collect limited technical data — browser type, device type, pages requested and, in our hosting provider’s request logs, your IP address — to keep the Services running and secure. We do not use advertising cookies or third-party analytics trackers.
• We do not sell personal information, and we do not share it with anyone for marketing purposes.
• Any material change to how we handle data will be reflected in an updated version of this Policy, and we will ask you to acknowledge it before you next transact.

Data We Collect

Privacy is central to how we have built the Services, and we aim to be transparent about what little data we do collect. We do not maintain user accounts, and we do not collect or store personal data such as your name. When you interact with the Services, we collect only:

• Publicly available blockchain data. When you connect your non-custodial blockchain wallet to the Services, we collect and log your publicly available blockchain address in order to display your positions and to screen your wallet against the U.S. sanctions list. We perform that screen ourselves, on our own servers, against a copy of the Specially Designated Nationals and Blocked Persons List taken from the U.S. Treasury’s own publication service, and against that list only — never risk scores, transaction histories or behavioural profiles — so a wallet is never refused because of who it has transacted with. Blockchain addresses are publicly available data that are not created or assigned by us or by any central party, and by themselves are not personally identifying.
• Location data. Our hosting provider derives a country and, where available, a region from the IP address of each request and passes them to us, so that we can enforce the jurisdictional restrictions described in our Terms of Service. When a request is refused on that basis, we keep a daily count of refusals by country and reason; we do not record your IP address, or anything else about the request, in that count.
• Information from localStorage and similar technologies. We store certain information in your browser’s local storage to provide the Services across sessions: a record that you accepted a particular version of our Terms of Service, Privacy Policy and Disclosures (with the version numbers, a timestamp and the wallet address connected at the time), and interface preferences such as your chosen accounting mode or slippage setting. This information stays on your device. Our wallet-connection provider may also use local storage or cookies to maintain your wallet session.
• Technical and usage information. Standard request data — browser type and version, operating system, device type, referring page, the pages you request, and timestamps — is kept in our hosting provider’s server logs for security and debugging. Those logs record the full IP address of each request. Our hosting provider retains them for no more than 30 days, and we do not copy them elsewhere, other than the compliance records described above. We look at usage in the aggregate, to improve the Services, not to track individuals.
• Information from other sources. We obtain the U.S. Treasury’s sanctions list from the Treasury’s own publication service. We do not obtain information about you from data brokers, analytics providers or any other third party.
• Correspondence. We will receive any communications and information you provide directly to us via email, a support channel or social media, including when you contest an access restriction or a screening result.
• Information you specifically provide us. If you specifically provide us with information (such as an email address), we may use that information for the purposes described when you provide it. We will not attempt to link any information you provide to your wallet address, IP address or other personal data. You do not need to provide us with any personal data to use the Services.

How We Use Data

We use the data we collect in accordance with your instructions, including any applicable terms in our Terms of Service, and as required by law. We may also use data for the following purposes:

• Providing the Services. We use the data we collect to provide, maintain and improve the Services and their features — for example, reading public chain data for a connected address so that we can show you your positions.
• Legal compliance. We use location data and wallet screening results to comply with U.S. sanctions law, and we may use the information we collect as needed or requested by regulators, government entities and law enforcement to comply with applicable laws and regulations.
• Safety and security. We may use data to protect against, investigate and stop fraudulent, unauthorised or illegal activity, to address security risks, to solve potential security issues such as bugs, to enforce our agreements, and to protect our users and the Company.
• Customer support. We may use information to provide customer support for, and answer enquiries about, the Services — including to review a contested access restriction or screening result.
• Aggregated data. We may use some of the information we collect to compile aggregated data that helps us learn how the Services are used and where we can improve them.

How We Share Data

We may share or disclose the data we collect:

• With service providers. We may share your information with our service providers and vendors to assist us in providing, delivering and improving the Services. For example: our hosting and edge provider processes request data, including IP addresses, to serve the Site and to derive the location used for the jurisdictional check; blockchain node providers and a public indexer receive the queries needed to read chain data for a connected address; and our wallet-connection provider receives what is needed to establish your wallet session. No third party receives your wallet address for sanctions screening; that check runs on our own servers.
• To comply with our legal obligations. We may share your data in the course of litigation, regulatory proceedings and compliance measures, and when compelled by subpoena, court order or other legal process. This includes reporting to the U.S. Treasury’s Office of Foreign Assets Control where a sanctions match requires it. We may also share data when we believe it is necessary to prevent harm to our users, the Company or others, and to enforce our agreements and policies, including our Terms of Service.
• Safety and security. We may share data to protect against, investigate and stop fraudulent, unauthorised or illegal activity, to address security risks, to solve potential security issues such as bugs, to enforce our agreements, and to protect our users, the Company and the ecosystem.
• Business changes. We may transfer or share data to another entity in the event of a merger, acquisition, bankruptcy, dissolution, reorganisation, asset or stock sale, or other business transaction, subject to this Policy continuing to apply.
• With your consent. We may share your information at any other time you provide us with your consent to do so.

We do not share your information with any third parties for any marketing purposes whatsoever.

Cookies, Local Storage and Analytics

We do not use advertising cookies, and we do not use third-party analytics services such as Google Analytics. Browser local storage is used only for the purposes described under "Data We Collect" — remembering that you accepted our Terms of Service, and remembering your interface preferences. These are strictly necessary or functional, and they stay on your device. You can clear them at any time through your browser settings; doing so will cause the Services to ask you to accept the Terms of Service again the next time you connect a wallet. Your wallet software and wallet-connection service may set their own cookies or storage, governed by their own privacy policies.

Third-Party Links and Sites

We may integrate technologies operated or controlled by other parties into parts of the Services. For example, the Services may include links to websites, platforms and other services not operated or controlled by us, such as block explorers, wallet providers and hook documentation. Please note that when you interact with these other parties, including when you leave the Site, those parties may independently collect information about you and solicit information from you. You can learn more about how those parties collect and use your data by consulting their privacy policies and other terms.

Security

We implement and maintain reasonable administrative, physical and technical security safeguards to help protect data from loss, theft, misuse, unauthorised access, disclosure, alteration and destruction. Nevertheless, transmission via the internet is not completely secure, and we cannot guarantee the security of information about you. You are responsible for all of your activity on the Services, including the security of your blockchain network addresses, cryptocurrency wallets and their cryptographic keys. We never have access to your private keys or seed phrase, and no part of the Services will ever ask you for them; any request that appears to is fraudulent.

Data Retention

• Server and security logs, including the full IP address of each request: retained by our hosting provider for no more than 30 days and then deleted.
• Refused requests: a daily count by country and reason, with no IP address or other detail of any individual request, retained with our compliance records.
• Sanctions-screening matches and related records: retained for as long as U.S. sanctions record-keeping rules require, currently ten years. Screening results that are not matches are not stored by us at all; your browser keeps the most recent result for a few minutes so that moving between pages does not repeat the check.
• Terms acceptance: stored in your browser until you clear it.
• Correspondence: retained for as long as needed to resolve the matter and to meet our legal obligations.

Age Requirements

The Services are intended for adults and are not directed at children. We do not knowingly collect personal information from children under 13, the age to which the U.S. Children’s Online Privacy Protection Act ("COPPA") applies. Separately, our Terms of Service require every user to be at least 18 years old, or older where the age of majority in their jurisdiction is higher, so we do not knowingly collect personal information from anyone under 18 either. If you believe we have received personal information from anyone under 18, please contact us at privacy@ascnt.fi and we will delete it.

Additional Notice to California Residents ("CCPA Notice")

The California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act ("CCPA"), requires certain businesses to provide a CCPA Notice to California residents to explain how we collect, use and share their personal information, and the rights and choices we offer California residents regarding our handling of their information.

• Privacy practices. We do not "sell" personal information, and we do not "share" it for cross-context behavioural advertising, as those terms are defined under the CCPA. We do not use your information for advertising of any kind. Please review the "How We Share Data" section above for the categories of parties with whom we share information.
• Privacy rights. The CCPA gives individuals the right to request information about how we have collected, used and shared their personal information, the right to request a copy of any information we may maintain about them, and the right to ask us to delete or correct personal information we hold. The CCPA limits these rights — for example, by prohibiting us from providing certain sensitive information in response to access requests, and by limiting the circumstances in which we must comply with a deletion request, which include records we are legally required to keep such as sanctions-screening records. We will respond to requests only to the extent we are able to associate, with reasonable effort, the information we maintain with the identifying details you provide; because we hold so little, we are often unable to do so. If we deny a request, we will tell you why. You are entitled to exercise these rights free from discrimination.
• Submitting a request. You can submit a request for information, access, correction or deletion to privacy@ascnt.fi.
• Identity verification. The CCPA requires us to collect and verify the identity of any individual submitting a request to access or delete personal information before providing a substantive response.
• Authorised agents. California residents can designate an "authorised agent" to submit requests on their behalf. We will require the authorised agent to have a written authorisation confirming their authority.

Residents of Colorado, Connecticut, Virginia and other states with comparable privacy laws have similar rights under those statutes, and may exercise them in the same way.

Disclosures for European Union and United Kingdom Data Subjects

We process personal data for the purposes described in the section titled "How We Use Data" above. Our legal bases for processing your data include: (i) you have given consent to the processing for one or more specific purposes; (ii) processing is necessary for the performance of a contract with you, including recording that you accepted our Terms of Service; (iii) processing is necessary for compliance with a legal obligation, which is the basis for location data and wallet screening; and/or (iv) processing is necessary for the purposes of the legitimate interests pursued by us or a third party — operating, securing and improving the Services — and your interests and fundamental rights and freedoms do not override those interests.

Your rights under the General Data Protection Regulation ("GDPR") and the UK GDPR include the right to (i) request access to and obtain a copy of your personal data, (ii) request rectification or erasure of your personal data, (iii) object to or restrict the processing of your personal data, and (iv) request portability of your personal data. Additionally, you may withdraw your consent to our collection at any time. Nevertheless, we cannot edit or delete information that is stored on a public blockchain: information such as your transaction data, blockchain wallet address and the assets held by your address is beyond our control. To exercise any of your rights, please contact us at privacy@ascnt.fi. We may require additional information from you to process your request. Please note that we may retain information as necessary to fulfil the purpose for which it was collected, and may continue to do so even after a data subject request, in accordance with our legitimate interests and our legal obligations, including to resolve disputes, prevent fraud, enforce our agreements and keep the records that sanctions law requires.

You also have the right to lodge a complaint with your local supervisory authority. Where we transfer personal data out of the European Economic Area or the United Kingdom — our hosting provider is in the United States — we rely on the European Commission’s standard contractual clauses, the UK International Data Transfer Addendum, or another lawful transfer mechanism.

Changes to this Policy

If we make material changes to this Policy, we will notify you via the Services by updating the version number and effective date at the top of this Policy and by asking you to acknowledge the new version before you next transact. Your continued use of the Services reflects your periodic review of this Policy and other Company terms, and indicates your consent to them.

Contact Us

If you have any questions about this Policy or how we collect, use or share your information, please contact us at privacy@ascnt.fi or write to us at: Ascnt Labs, Inc., 2525 Arapahoe Ave, Ste E4 #1069, Boulder, CO 80302, United States.