PRIVACY NOTICE

DEXU

Date: May 13, 2025

The security and protection of your Personal Data is a priority of Dexu LLC, a limited liability company duly registered in Switzerland with its principal place of business in Switzerland (the "Company"), operating DEXU Platform (the "Platform"). [cite: 1] This Privacy Notice aims to explain our practices with respect to Personal Data we Collect and Process in connection with your relationship with us. [cite: 2] This Privacy Notice is applicable to all data subjects whose Personal Data we Collect and Process, including Visitors of the Website, Representatives of our customers, and End-Users of our Services (all together referred as the "Data Subjects"). [cite: 3] This Privacy Notice should be read in conjunction with the Terms of Services provided by the Company. [cite: 4] The Company uses privacy by default standards and undertakes to store and Process the Personal Data of the Visitors and/or Users in a secured manner and with all appropriate care and attention in accordance with all the Applicable Laws as stated in Appendix A, especially the Swiss Federal Act on Data Protection (FADP). [cite: 5]

1. DEFINITIONS

The definitions available in Appendix A are applicable to the capitalized terms of this Privacy Notice. [cite: 6] Capitalized terms not defined in this Privacy Notice have the meanings set forth in the Terms. [cite: 7]

2. SCOPE

The Company provides this Privacy Notice to describe its procedures regarding the Processing and Disclosure of Personal Data Collected by the Company. [cite: 8] This Privacy Notice shall apply to any use of the Website and the use of the Services, whatever the method or medium used. [cite: 9] It details the conditions under which the Company may Collect, keep, use, Process and save information that relates to Visitors of the Website or Users of the Services of the Company (referred together as the "Data Subjects"). [cite: 10]

3. ACCEPTANCE

By Browse the Website or using the Services, the Visitor and/or User acknowledges that he/she has read and understood this Privacy Notice and agrees to be bound by it and to comply with all Applicable Laws. [cite: 11] IN THE EVENT OF NON-ACCEPTANCE OF THIS PRIVACY NOTICE, ALL USE OF THE WEBSITE AND/OR SERVICES MUST CEASE IMMEDIATELY. [cite: 12]

4. PROCESSING PRINCIPLES

While Processing Personal Data, the Company will be guided by the following principles: [cite: 13]

4.1. FAIRNESS AND LAWFULNESS

When Processing Personal Data, the individual rights of the data subjects will be protected. [cite: 14] Personal Data will be Collected and Processed lawfully, in a fair manner, in good faith and will be proportionate to the objective. [cite: 15]

4.2. RESTRICTION TO A SPECIFIC PURPOSE

Personal Data Processed by the Company will be adequate and relevant to the purpose for which they are Collected and Processed. [cite: 16] This requires, in particular, ensuring that the types of Personal Data Collected are not excessive to the purpose for which they are Collected. [cite: 17] Subsequent changes to the purpose are only possible to a limited extent and require substantiation. [cite: 18]

4.3. TRANSPARENCY

The data subject is informed of how his/her/its Personal Data is being Processed. [cite: 19] This Privacy Notice informs the data subject of: [cite: 20]

• the existence of this Privacy Notice; [cite: 20]
• the identity of the Data Controller; [cite: 20]
• the purpose of Personal Data Processing; [cite: 21]
• how, where and by whom the Personal data is being Processed; [cite: 22] and
• third parties to whom the Personal data might be transmitted. [cite: 22]

Generally, the data subject shall obtain this information for any other Personal Data Collected which are not listed in this Privacy Notice. [cite: 23]

4.4. ACCURACY

Personal Data kept on file will be correct and if necessary, be kept up to date. [cite: 24] Inaccurate or incomplete Personal Data will not be kept on file and deleted. [cite: 25]

5. COLLECTED DATA

This Privacy Notice applies to all Personal Data that is Collected by the Company: [cite: 26]

• through the Website; [cite: 27]
• through the use of the Services and the Platform. [cite: 27]

5.1. USE OF THE WEBSITE WITHOUT CONTACTING THE COMPANY

While Browse the Website, the Company may collect information such as the IP address of the Visitor, the length of time he/she spends on the Website, the Browse history, the device used and other such general information (the "Cookies Data"), in accordance with the Cookies Policy. [cite: 28]

5.2. USE OF THE WEBSITE WITH CONTACTING THE COMPANY

The Data Subject may contact the Company through the Website by contacting us via email. [cite: 30] The Data Subject may contact the Company by using other media channels such as social media. [cite: 31] All Personal Data shared in the context, which includes (i) contact information, (ii) content of the messages to the Company, will be Collected and Processed by the Company. [cite: 32]

5.3. PERSONAL DATA COLLECTED IN THE PROVISION OF OUR SERVICES

The DEXU Platform (the "Platform") is a Web3 analytics platform, providing data, knowledge, tracking and analytics functionality to Users. [cite: 33] To access and utilize the premium features of the Services provided by the Platform, Users are required to complete a registration process and create a User account (the "Account"). [cite: 34] The Company will Collect Personal Data concerning the User, primarily comprising, but not limited to, the following: [cite: 35]

a. Account information

When You register as a User and create your Account on the Platform, you will connect your Google account or connect with another email and register an Account on the Platform. [cite: 36] During this registration process, the following Personal Data will be Collected: [cite: 37]

• Email address; [cite: 37]
• Encrypted password; or [cite: 37]
• Google account credentials; [cite: 37]

(the "Registration Data"). [cite: 37]

b. Activities on the Platform

When Users access the Services, the Company Collects the following types of Personal Data: [cite: 38]

• Account information: Services requested by the User and all Personal Data shared in the provision of the Services, including the Personal Data required for fulfilling the subscription; [cite: 38]
• usage data: information about how Users interact with the Platform's features (e.g., Browse history, clicks, page views, session durations, activity timestamps, and watch list); [cite: 39]
• technical data: information related to the User's device and connection to the Platform, including device type, browser information, IP address, and operating system; [cite: 40]
• communication data: content of communications with the Platform (such as customer support inquiries, email correspondence, and support tickets); [cite: 41]
• analytics information: statistical data regarding Platform usage patterns and feature adoption. [cite: 42]

This information is collectively referred to herein as "Platform Data". [cite: 43] While the Company collects certain Personal Data relating to Platform usage, this data is anonymized before being used for analytical purposes. [cite: 44] The anonymization process removes or transforms identifying information so that the data can no longer be associated with a specific User. [cite: 45, 46] The Company uses this anonymized data solely to understand usage patterns, improve the Platform's functionality, and enhance the User experience. [cite: 47] The Company does not: [cite: 48]

• create User profiles based on Platform activity; [cite: 48]
• track which specific cryptocurrencies, tokens, projects, or market segments individual Users are analyzing or monitoring; [cite: 49]
• build behavioral models that categorize Users based on their investment interests or trading preferences; [cite: 50]
• develop individualized analytics about a User's investment strategy, portfolio composition, or trading patterns; [cite: 51]
• use Platform usage data to determine a User's investment sophistication, risk tolerance, or financial capacity; [cite: 52]
• generate any form of personalized investment recommendation or suggestion based on User behavior; [cite: 53]
• segment Users into investor categories or investment style classifications for any purpose. [cite: 54]

Our Platform is designed to provide analytics about the Web3 market, not to analyze our Users themselves. [cite: 55] We maintain a strict separation between providing market analytics and collecting analytics about our Users' investment interests or preferences. [cite: 56] This commitment to not creating investor profiles distinguishes our approach from many financial platforms and trading tools, reflecting our respect for User privacy in the sensitive area of investment behavior. [cite: 57]

5.4. PAYMENT DATA

Payments made through the Platform, whether via fiat currency (e.g., credit card) or cryptocurrency, are processed by third-party Payment Providers. [cite: 58] The Company does not directly process or store any sensitive payment information, such as credit card numbers or private cryptocurrency keys. [cite: 59] Instead, the following data may be collected and handled by our Payment Providers: [cite: 60]

1. Fiat currency payments (credit card): when paying via credit card or other fiat currency methods, Users' payment data, including credit card details, billing information, and transaction amount, are securely handled by the Payment Provider, namely Stripe, in compliance with applicable data protection laws and regulations. [cite: 60] The Company receives only confirmation of payment and transaction details necessary to complete the order, such as the payment status and transaction ID. [cite: 61]
2. Cryptocurrency payments: when Users make payments in cryptocurrency through our third-party Payment Provider, Loop, the following data processing occurs: Loop facilitates the direct transfer of funds from the customer's wallet to the Company's wallet, processing transaction authorization and settlement. [cite: 62] The Company receives transaction confirmation, payment amount, timestamp, transaction ID, and a reference to the originating public wallet address. [cite: 63] This information is necessary for subscription management, financial recordkeeping, and fraud prevention. [cite: 64] No private keys, wallet seed phrases, or authentication credentials are accessed or stored by either Loop or the Company. [cite: 65] All payment data is processed in accordance with applicable data protection laws, and necessary transaction records are maintained for accounting and compliance purposes. [cite: 66]

By using the Platform, Users agree to the collection, storage, and processing of their payment data by the Payment Providers and the Company. [cite: 67] The Company does not assume responsibility for the handling of payment data by these third-party providers, and Users are encouraged to review the privacy policies of the Payment Providers used to process their payments. [cite: 68]

5.5. KEY OPINION LEADER (KOL) DATA PROCESSING

The Company collects and processes publicly available data from social media platforms, particularly X (formerly Twitter), regarding Key Opinion Leaders (KOLs) in the Web3 and cryptocurrency space. [cite: 70] This data includes: [cite: 71]

• profile information: publicly visible usernames, display names, profile descriptions, and follower counts; [cite: 71]
• public posts: content of public posts, including text, engagement metrics (likes, reposts, comments), and posting timestamps; [cite: 72]
• interaction Patterns: publicly observable interactions between KOLs and other accounts related to Web3 topics. [cite: 73]

KOLs who wish to inquire about their data being processed, and opt-out from such processing, should contact us directly at info@dexu.ai. [cite: 74]

6. USE OF COLLECTED DATA

The following paragraphs detail the purposes for which the Company Collects and Processes the Data Subjects' Personal Data, as specified in Article 5 of this Privacy Notice. [cite: 75]

6.1. LEGITIMATE INTEREST

The Company has a legitimate interest to Process Visitors' and/or Users' Cookies, to actively monitor, investigate, prevent and mitigate any potentially prohibited or illegal activities, and/or violations of the Terms or the Applicable Laws. [cite: 76] In addition, the Company Processes Visitors' and/or Users' Cookies to know who uses the Website, to ensure that there is no cyber-security threat, as well as to have an initial verification of the Users that use the Website. [cite: 77] The Company uses the geographical location information of the Visitor and/or User to ensure that the Website and/or the Platform will not be used in a country/area where it is expressly prohibited for the Website and/or the Platform to be used. [cite: 78] The Company also Processes Visitors' and/or Users' Cookies to evaluate the use of the Website and/or the Platform, to optimize and improve the Website and/or the Platform, as well as to analyze the preferences and the patterns of each User to personalize User's experience of the Website and/or the Platform. [cite: 79] Finally, the Company's Collection and Processing of KOLs's Personal Data can be justified based on legitimate interest. [cite: 80] Indeed, this Collection of Data allows the Company to provide market intelligence and social sentiment analysis to its Users. [cite: 81] Furthermore, this Personal Data is publicly available and the Collection is only focused on professional and market-related content rather than personal information. [cite: 82]

6.2. CONTRACT

The Company will Process the Registration Data, Payment Data and Platform Data in direct connection with the conclusion or the performance of the contract with Users, and with the Terms of use of the Services, to which Users are parties when they use the Services and/or the Platform. [cite: 83] Indeed, Collecting and Processing the Registration Data, Payment Data and Platform Data enable the Company to provide its Services. [cite: 84] Therefore, Data Subjects understand that without this Collection and Processing, the Company would be unable to provide its Services on the Platform. [cite: 85]

6.3. CONSENT

a. Generality

The Data Subject is free to communicate to the Company the Personal Data he/she/it desires. [cite: 87] By voluntarily communicating his/her/its Personal Data to the Company, the Data Subject expressly Consents that the Company Processes the Personal Data shared with the Company. [cite: 88] In any case, Data Subjects agree that the Company may Process: [cite: 89]

• Cookies data which are not Processed on the basis of a legitimate interest as specified in the Cookies Policy; [cite: 89]
• The Personal Data listed under Article 5.2 of this Privacy Notice, to answer to the question asked by the Data Subject whilst entering into contact with the Company; [cite: 90]
• The Personal Data listed under Article 5.3 of this Privacy Notice, the Registration Data, Payment Data and Platform Data, to provide its Services. [cite: 91]

For the sake of clarity, the Company also Collects and Processes all the Personal Data the Data Subject freely and voluntarily indicates in any communication with the Company, either by phone, by email or by mail, as long as said Personal Data is required to provide an answer to a Data Subject, to help the User in his/her/its use of the Platform and/or Services, as well as to provide the Data Subject with any other kind of service. [cite: 92]

b. Communication with the Company (Article 5.2)

For the purpose of allowing the Data Subject to contact the Company, the latter needs to Process the Personal Data described under Article 5.2 (a) of this Privacy Notice. [cite: 93] By contacting the Company and providing the mandatory Personal Data, the Data Subject expressly Consents with the use of his/her/its mandatory Personal Data listed under Article 5.2 (a) of this Privacy Notice. [cite: 94] The Data Subject is not obliged to communicate the optional Personal Data listed under Article 5.2 (b) of this Privacy Notice but if he/she/it does, the Data Subject expressly Consents with the use of his/her/its optional Personal Data listed under Article 5.2 (b) of this Privacy Notice. [cite: 95]

c. Personal Data Collected in the provision of the Services (Article 5.3)

For allowing Users to use the Platform and the Services provided by the Company, the latter needs to Process the Personal Data described under Article 5.3 of this Privacy Notice. [cite: 96] By getting access to the Platform and the Services provided by the Company, through his/her/its Account, and providing the Company with information, the User expressly Consents with the use of his/her/its Personal Data. [cite: 97] By providing his/her/its Personal Data to the Company, User hereby expressly Consents with the use and Processing of his/her/its Personal Data communicated in accordance with the terms of this Privacy Notice and this Article 6.3. [cite: 98]

7. DATA DISCLOSURE

The Company may disclose Data Subject's Personal Data under some circumstances specified in this Article. [cite: 99] In any case, the Company shall ensure that an adequate protection is guaranteed for Data Subject's Personal Data, especially by using data transfer agreements or data processing agreement (if needed). [cite: 100] In some specific cases, when the level of protection is not guaranteed, the Company will obtain Data Subject's prior Consent or establish with the Recipient of Personal Data a contractual framework or sufficient safeguards that ensure an adequate level of protection abroad, especially by using Standard Contractual Clauses. [cite: 101, 102] The Data Subject may request access to a copy of these safeguards by contacting the Company. [cite: 103] The Data Subject shall be informed of any cross-border transfer in the event that it occurs. [cite: 104] The development and maintenance of the Website and the Platform, the provision of the Services, and the storage of Personal Data may require that Personal Data is ultimately transmitted to, and/or stored at a destination outside of Data Subject's country of residence. [cite: 105] Where permitted by law, by accepting the terms of this Privacy Notice, Data Subject accepts that this transmission and disclosure may occur. [cite: 106]

7.1. STORAGE OF PERSONAL DATA

The Company stores Personal Data on Amazon Web Services (AWS) infrastructure, with datacenters located in the Northern Europe region. [cite: 107] The storage of Personal Data may require that Personal Data is ultimately transmitted to, and/or stored at a destination outside of Data Subject's country of residence. [cite: 108] Where permitted by law, by accepting the terms of this Privacy Notice, Data Subject accepts that this transmission and disclosure may occur. [cite: 109]

7.2. PROVISION OF THE SERVICES

The Company may share Users' Personal Data with third-party service providers and partners, as necessary to provide and maintain the Services. [cite: 110] Specifically, the Company may share Personal Data with: [cite: 111]

• cloud infrastructure providers such as AWS that host the Platform's infrastructure, databases, and storage systems; [cite: 111]
• payment processors such as Stripe and Loop that handle subscription payments and billing; [cite: 112]
• email and communication services like Gmail that facilitate the delivery of notification, alerts, subscription confirmations and other communications; [cite: 113]
• authentication services provided by third parties, that assist with user verification and account authentication processes, including our Google account login functionality; [cite: 114]
• blockchain data providers, such as Dune, supplying raw blockchain and crypto market data that our Platform analyses; [cite: 115]
• performance monitoring tools that help us maintain Platform stability, identify technical issues, and optimize performance; [cite: 116]
• business operations software for customer relationship management, contract management, and other business functions; or [cite: 117]
• professional service providers such as legal, accounting, auditing and other professional services that may require limited access to User data. [cite: 118]

The Company only shares the minimum amount of Personal Data necessary for these service providers to perform their functions and does not authorize them to use or disclose the Personal Data for any purpose other than providing services to the Company. [cite: 119] The Company ensures that all third-party Recipients of Personal Data Process such data in accordance with Applicable Laws and take appropriate measures to protect the integrity and security of the data. [cite: 120]

7.3. PUBLIC OR REGULATORY AUTHORITIES

If required from time to time, the Company may disclose Personal Data to public authorities, regulators or governmental bodies, including when required by law or regulation, under a code of practice or conduct, or when these authorities or bodies require the Company to do so. [cite: 122]

8. RETENTION OF USER'S PERSONAL DATA

In accordance with Applicable Laws, the Company will use Data Subject's Personal Data for as long as necessary to satisfy the purposes for which Data Subject's Personal Data was Collected and/or to comply with applicable legal requirements. [cite: 123]

9. SECURITY OF DATA SUBJECT'S PERSONAL DATA

The Company applies high industry standards and will always apply adequate technical and organizational measures, in accordance with Applicable Laws to ensure that Users' Personal Data is kept secure. [cite: 124] These security measures include encryption of User passwords to protect Account access, access controls, and regular security assessments. [cite: 125] While we are committed to protecting your Personal Data, no method of electronic storage or transmission is 100% secure, and we cannot guarantee absolute security. [cite: 126] In the event of a Breach, the Company shall without undue delay, and where feasible, notify the Breach to the Federal Data Protection and Information Officer, unless said Breach is unlikely to result in a risk to Data Subject's rights and freedoms. [cite: 127] If the Breach is likely to result in a high risk to Data Subject's rights and freedoms, the Company shall communicate the Breach to the Data Subject, if it is necessary or when the Federal Data Protection and Information Officer demands it, if it is feasible, without undue delay. [cite: 128] In the cases where GDPR is applicable, in the event of a Breach, the Company shall without undue delay, and where feasible, not later than seventy-two (72) hours after having become aware of it, notify the Breach to the competent supervisory authority, unless said Breach is unlikely to result in a risk to Data Subject's rights and freedoms. [cite: 129] If the Breach is likely to result in a high risk to Data Subject's rights and freedoms, the Company shall communicate this Breach to the Data Subject, if it is feasible, without undue delay. [cite: 130] The Company shall not be held liable for any Breach that occurs due to unforeseen circumstances beyond the reasonable control of the Company, including but not limited to natural disasters, acts of war, terrorism, cyber-attacks by third parties, or other events of force majeure. [cite: 131] In such instances, the Company is absolved from all liability provided that it has exercised due diligence and adhered to generally accepted industry standards in safeguarding personal data. [cite: 132]

10. PRIVACY BY DESIGN AND BY DEFAULT

The Company will, both at the time of the determination of the means for Processing and at the time of the Processing itself, implement appropriate technical and organizational measures, such as anonymization, pseudonymization, which are designed to implement data-protection principles, such as data minimization, in an effective manner and to integrate the necessary safeguards into the Processing in order to meet the requirements of the Applicable Laws and protect Data Subject's rights. [cite: 133] The Company will implement appropriate technical and organizational measures, in order to ensure that by default, only Personal Data which are necessary for each specific purpose of the Processing are Processed. [cite: 134] This obligation applies to the amount of Data Subject's Personal Data the Company Collects, the extent of their Processing, the period of storage and their accessibility. [cite: 135] These measures will ensure that by default User's Personal Data is not made accessible without Data Subject's intervention to an indefinite number of third parties. [cite: 136]

11. DATA SUBJECT'S RIGHTS

The Data Subject has the right to information regarding the data Processed about him/her/it. [cite: 138] Indeed, the User has the right to request access to or information about his/her/its Personal Data which are Processed by the Company. [cite: 139] The Data Subject may visualize the Personal Data the Company Collects and Processes in his/her/its profile information on his Account profile of the Platform. [cite: 140] Where provided by Applicable Law, the Data Subject, his/her successors, his/her/its representatives and/or proxies may (i) request deletion, correction or revision of Data Subject's Personal Data; [cite: 141] (ii) oppose the data Processing; and (iii) limit the use and Disclosure of Data Subject's Personal Data. [cite: 142] Where the Company Processes Data Subject's Personal Data on the basis of his/her/its Consent, Data Subject has the right to withdraw that Consent at any time. [cite: 143] The withdrawal of Consent shall not affect the lawfulness of Processing based on Consent before the withdrawal. [cite: 144] The Data Subject has the right to request erasure of his/her/its Personal Data that: (i) is no longer necessary in relation to the purposes for which it was Collected or otherwise Processed; [cite: 145] (ii) was Collected in relation to Processing that Data Subject previously Consented to, but later withdraw such Consent; [cite: 146] or (iii) was Collected in relation to Processing activities to which Data Subject objects, and there are no overriding legitimate grounds for the Company Processing. [cite: 147]

The Data Subject may request to receive his/her/its Personal Data in a structured, commonly used and machine-readable format, and to have the Company transmit Data Subject's Personal Data directly to another Data Controller, where technically feasible, unless exercise of this right adversely affects the rights and freedoms of others (portability of Personal Data). [cite: 148] All the above-mentioned rights can be exercised by contacting the Company at: info@dexu.ai attaching a copy of User's ID. [cite: 149] If the request is submitted by a person other than the User, without providing evidence that the request is legitimately made on Data Subject's behalf, the request will be rejected. [cite: 150] The request is free of charge unless User's request is unfounded or excessive. [cite: 151] In such a case, the Company may charge the Data Subject a reasonable request fee according to Applicable Laws. [cite: 152] The Company may refuse, restrict or defer the provision of Personal Data where it has the right to do so, for example if fulfilling the request will adversely affect the rights and freedoms of others. [cite: 153]

12. DATA CONTROLLER

The Company is the Data Controller of the Data Subject's Personal Data listed under Article 5 of this Privacy Notice. [cite: 154]

13. CHANGES TO THE PRIVACY NOTICE

The Company may modify this Privacy Notice from time to time and will post the most current version on the Website and/or Platform. [cite: 155]

14. LINKS

The Website may contain links which direct the Data Subject to third party websites, applications, third parties' content, and may also contain information about third parties and/or third parties' content. [cite: 156] The Company rejects any liability relating to the privacy policy in force on said third party websites or applications, the collection and use of User's Personal Data by the latter and relating to the contents of said websites or applications (whether the links are hypertext links or deep links). [cite: 157] Furthermore, the Data Subject acknowledges and agrees that using the Website and/or Platform could imply downloading or using third party applications. [cite: 158] Under no circumstances the Company shall be liable for the utilization of these others applications, especially regarding the Personal Data protection rules. [cite: 159]

15. JURISDICTION AND GOVERNING LAW

This Privacy Notice and any questions relating thereto shall be governed by the laws of Switzerland, to the exclusion of any rules of conflict resulting from private international law. [cite: 160] Any dispute relating to this Privacy Notice must exclusively be brought before the courts of Lausanne, Switzerland, subject to possible recourse to the Federal Court. [cite: 161]

16. CONTACT

To ask questions or make comments on this Privacy Notice or to make a complaint about the Company's compliance with Applicable Laws, please contact the Company through: [cite: 162]

info@dexu.ai [cite: 162]

The Data Subject can also complain about the Processing of his/her/its Personal Data to the Office of the Federal Data Protection and Information Commissioner: FDPIC, Feldeggweg 1, 3003 Bern, Switzerland. [cite: 162] The Data Subject understands that communicating by email/phone may not ensure confidentiality, integrity and authenticity. [cite: 163] The Company will not answer any request which will be considered unsafe or not ensuring Data Subject's identity authenticity. [cite: 164]

***

APPENDIX A - DEFINITIONS

Capitalized terms defined in the Terms of the Platform shall also apply to this Privacy Notice and be incorporated by reference. [cite: 165]

The following table: [cite: 166]

The following table: [cite: 168]

The following table: [cite: 170]