Privacy Notice

This Privacy Notice describes the privacy practices of Ashbud ("Ashbud", "our", "us" or "we") in connection with the Ashbud website and platform, including any related services (collectively, the "Services"). This Privacy Notice also explains the rights and choices available to individuals with respect to their information.

Please read this Privacy Notice carefully. If you do not agree with our policies and practices, please do not use the Services. By accessing or using the Services, you acknowledge and agree to the terms of this Privacy Notice.

We may update this Privacy Notice based upon evolving laws, regulations and industry standards, or as we make changes to the Services. If we make changes that materially alter your privacy rights, we will take appropriate measures to inform you. If you disagree with the changes, you should discontinue your use of the Services.

The Services are not directed to, and we do not knowingly collect Personal Data from, anyone under the age of 18. If a parent or guardian becomes aware that their child has provided us with information, they should contact us. We will delete such information from our files as soon as reasonably practicable.

"Personal Data" as used in this notice describes information that can be associated with a specific person and can identify that person. Personal Data does not include information that has been aggregated or anonymised so that a specific person can no longer be identified.

A Personal Data controller is a person or organisation who controls the collection, holding, processing or use of Personal Data. Ashbud acts as the Personal Data controller in connection with the Services.

The types of Personal Data that we may collect from you or through third parties will depend on our interactions with you and may include:

• Financial information such as your Solana wallet addresses.
• Transaction information such as wallet addresses of senders and recipients of digital assets, your on-chain activities (index creation, minting, burning, rebalancing), your inquiries and our responses.
• Profile information such as a display name, bio, or linked X/Twitter handle and avatar, if you voluntarily provide them.
• Usage data which can include your IP address, country of origin, browser type and version, operating system, pages visited, and how you interact with the Services.
• Communications if you contact us directly, we may retain the content of that correspondence.

We may also collect Personal Data about you from third parties and publicly available sources, including the Solana blockchain.

Unless specified otherwise, all Personal Data requested by us is mandatory and failure to provide it may make it impossible for you to access or use the Services. Users who are uncertain about which Personal Data is mandatory may contact us for clarification.

When you visit the Services, we may automatically collect certain information about your device, including your web browser, IP address, domain name, browser type and version, timezone, operating system, and location information. As you browse, we may collect information about the pages you view, what referred you to the Services, and how you interact with them.

We use cookies (small, often encrypted, text files stored on your computer or mobile device) and similar technologies ("Cookies") to provide certain functions and help collect data. We do not combine or link data gathered from Cookies with third-party data for targeted advertising purposes.

We use both session Cookies (which expire when you close your browser) and persistent Cookies (which stay on your device until deleted). These include:

• Strictly Necessary. Required for the Services to function properly, including authentication.
• Functionality. Remember your choices and preferences while using the Services.
• Performance/Analytical. Help us understand how you navigate the Services so we can improve them.

You can control, block, or restrict Cookies through your browser settings. If you restrict Cookies, some features of the Services may not work properly. For more information about cookies, visit allaboutcookies.org.

We may use third-party analytics services such as Google Analytics to help analyse how you use the Services. These services collect usage data via cookies stored on your device and generate reports about website use. If you do not want your visit data reported by Google Analytics, you can install the Google Analytics opt-out browser add-on.

We may process Personal Data relating to you on one or more of the following bases:

• You have given your consent for one or more specific purposes.
• Processing is necessary for the performance of an agreement with you or for pre-contractual obligations.
• Processing is necessary for compliance with a legal obligation.
• Processing is necessary for the legitimate interests pursued by us or a third party.

Data we collect is used to:

• Provide the Services and any customer support you request.
• Process transactions and record associated data, including NAV snapshots and mint quotes.
• Personalise your experience, such as displaying your profile, linked X/Twitter handle, and activity history.
• Analyse usage patterns to improve platform performance and reliability.
• Detect and prevent fraud, abuse, and malicious activity.
• Comply with applicable legal and regulatory obligations.
• Protect the rights and interests of Ashbud and our users.
• Contact you where necessary regarding the Services.

We do not sell your Personal Data. We may share information in the following circumstances:

• Service providers. Third-party vendors who assist in operating the Services (e.g. hosting, analytics, RPC providers), subject to confidentiality obligations and authorised use only.
• Legal requirements. When required by law, legal process, or a governmental authority.
• Protection of rights. When disclosure is necessary to prevent harm or enforce our policies.
• Business transfers. In connection with a merger, acquisition, reorganisation, or sale of assets, your Personal Data may be transferred as part of that transaction.

We retain Personal Data for as long as necessary to fulfil the purposes for which it was collected, including to satisfy legal, regulatory, accounting, or reporting requirements. We determine retention based on the amount, nature, and sensitivity of the data, the potential risk of harm from unauthorised access, and applicable legal requirements.

Off-chain data such as display names, bios, and linked social accounts may be deleted upon request. Once a retention period expires, Personal Data will be deleted or de-identified where permitted by law. Note that not all Personal Data can be deleted — see "Blockchain Transactions" below.

Your use of the Services involves interactions with the Solana blockchain, a public and immutable distributed ledger. On-chain activity — including index creation, token minting, burning, and rebalancing — is permanently and publicly recorded. Blockchain data is visible to anyone and may be combined with other data in ways that could identify you.

As the Solana blockchain is a decentralised network not controlled or operated by us, we are not able to erase, modify, or alter any data recorded on-chain.

The Services may contain links to third-party websites or services. These links are not an endorsement of, or representation that we are affiliated with, any third party. We do not control third-party websites or services and are not responsible for their privacy practices. We encourage you to read the privacy policies of any third-party services you use.

We implement reasonable technical and organisational measures to protect your Personal Data against unauthorised access, loss, or misuse. However, no system is completely secure and transmission of data over the internet cannot be fully guaranteed against interception. Any transmission of Personal Data is at your own risk.

You are responsible for securing your own wallet, private keys, and seed phrases. Ashbud never has access to these and will never ask for them.

Depending on your jurisdiction, you may have rights with respect to your Personal Data, including:

• The right to obtain confirmation of the Personal Data we process about you.
• The right to rectify inaccurate Personal Data.
• The right to request erasure of your Personal Data, subject to exceptions under applicable law and the limitations of on-chain data.
• The right to restrict certain processing of your Personal Data.
• The right to receive your Personal Data in a structured, commonly used and machine-readable format.
• The right to object to the processing of your Personal Data, including automated decision-making.
• The right to withdraw consent where you have previously given it.

To exercise any of these rights, please contact us and provide enough information to identify you along with a description of the right you wish to exercise. Personal Data collected to verify your identity will be used solely for that purpose. If you are concerned that we have not complied with applicable privacy laws, you may also contact your local data protection authority.

Ashbud operates globally. As a result, your Personal Data may be transferred to and processed in countries other than the one in which you reside. Any such transfers will be conducted in compliance with applicable law and protected through appropriate safeguards. By using the Services, you understand that your Personal Data may be processed outside your country of residence.

We may update this Privacy Notice from time to time. We will indicate the date of the most recent revision at the top of this page. Continued use of the Services following any update constitutes your acceptance of the revised Notice. We encourage you to review this page periodically.

If you have any questions or concerns about this Privacy Notice or how we handle your Personal Data, please reach out to us through our official channels.