WAX Products and Services Privacy Policy

Date last updated: November 24, 2025

1. Welcome to WAX!

Worldwide Asset Exchange (“WAX”), its affiliated companies, and their partners offer unique and exciting products and services related to Non-Fungible Tokens (NFTs), digital collectibles, games, and merchandise, exchangeable virtual items (vIRLs), and decentralized applications (dApps) and communities, all building on the WAX global, secure, eco-friendly blockchain, including:

• Worldwide Asset eXchange (WAX): https://wax.io
• WAX Digital: https://wdny.io
• My Cloud Wallet: https://mycloudwallet.com
• WAX Developer Hive: https://developer.wax.io
• WAX Discord Server: https://go.wax.io/discord
• Spin Tycoon: https://www.spintycoon.com/

And many more! In this policy, we will refer to these services, collectively, as the “Services”.

WAX tokens may also be bought and sold on secondary marketplaces offered by third parties, such as those listed at https://www.wax.io/. Additional resources are available from WAX affiliated companies and others, including those listed at https://www.wax.io/.

We do not control your relationships with third parties or those third parties’ privacy practices, including our partners and any third party websites or applications to which we or others provide links. Please check the privacy policies for these platforms, websites, and applications for information on how they handle your personal data.

2. Your Data on the Blockchain

In order for the WAX blockchain to work in the secure and transparent manner intended, it is essential that there be a publicly accessible record of the history of all sales, trades, and transfers of a digital item. This means that certain data, such as your anonymized WAX blockchain account name, cannot be removed once it is part of the permanent blockchain record. This is true for all blockchains, not just WAX. That’s how blockchains work. However, if you delete, transfer, or close all of your WAX accounts, then your anonymized account name should no longer be publicly associated with you, unless you identify it in any of your own posts or communications with others. WAX will make no attempt to reidentify anonymized information once identifying information has been removed.

3. Scope of this Policy

This Privacy Policy describes the processing of information provided or collected on the sites and applications where it is posted, in addition to any other privacy notices on such sites or applications. This Notice does not apply to our job applicants, current employees, former employees, or independent contractors (“Personnel”).

To the extent permitted by applicable law, your use of any WAX Service signifies your understanding and acceptance of the terms of this Privacy Policy, in addition to the Terms of Service for the applicable WAX Service.

4. The Types of Information We Collect

a. Information We Collect from You Directly

When you use the WAX services, we may collect the following types of personal data directly from you:

• Information you provide when you register for or update your accounts, use our platform, games, websites, or applications, use tokens and/or create NFTs, which may include your account name, given name, surname, postal address, date of birth, email address, username, password, security questions, and telephone number if you provide such information;
• Information you post in public forums, communities, groups, games, or activities you engage in on our platform, websites, and applications, including your direct messages and public posts; and
• Transaction information you provide when you request information, contact us, or purchase, return, request, or exchange a product or service or when you sell, transfer, trade or otherwise dispose of a digital item or vIRL.

The Service may allow you to submit the personal data of someone else (for example, invite a friend). By providing another person’s information you represent you have that person’s consent. See Website Terms for details.

b. Cookies and Information Collected Automatically

We may also collect certain information from you automatically when you use our Services, including activity information (content you view, frequency of use, inferred preferences), imprecise location inferred from IP, and device/browser data.

We use various tracking technologies ("Tracking Technologies") such as cookies, web beacons, embedded scripts, SDKs, and APIs. For simplicity we refer to these collectively as Tracking Technologies and their providers as "Third-Party Digital Services".

Our cookies include:

• Strictly Necessary Cookies — necessary to provide Services. If refused, certain features may be unavailable.
• Performance Cookies — help enhance performance and functionality.
• Functional Cookies — collect information used to understand service usage and customize experiences.
• Targeting Cookies — record your visits and activity to recognize you on return visits; persistent cookies remain across sessions, session cookies are deleted when the browsing session ends.

Where permitted by law, third parties may use Tracking Technologies on our sites to collect information across websites for interest-based advertising. Where required, we will collect consent before processing personal data using such technologies.

You may restrict, block or delete cookies via your browser settings (see https://www.allaboutcookies.org). You can also use the consent management tool on our sites ("Your Privacy Choices"). "Do Not Track" signals are generally not honored due to lack of consensus on their meaning.

c. Third-Party Digital Services

The Service integrates with third-party content and services (e.g., social login, SDKs, plug-ins). If you use Social Features (Facebook, Google, etc.), those third parties may send personal data to us. We and third parties may have access to certain information about you.

We may also serve Matched List Ads and other targeted advertising using partners such as Facebook and X. We are not responsible for third parties' opt-out behavior or changes to their policies.

5. How Do We Use Your Personal Data?

Consistent with applicable law and your choices, we may use information to:

• Transact business with you and serve you as a customer;
• Personalize content and experiences;
• Assess interests, preferences and satisfaction;
• Keep you informed about WAX offerings and events;
• Provide targeted advertising;
• Improve Services, operations and marketing;
• Verify identity and eligibility for token sales;
• Conduct audits, data analysis and research;
• Provide customer service;
• Prevent and investigate fraud, abuse, or policy violations;
• Send important notices regarding purchases and business changes; and
• Comply with applicable law. When you create an account, you grant WAX the authority to access your account (including your public and private keys). See our Terms of Service for details.

6. To Whom Do We Disclose Your Personal Data?

We may disclose personal data to:

• WAX affiliates and partners for providing Services and order fulfillment;
• Third-party service providers (IT, cloud, payment processors such as Stripe), marketing/analytics providers, shipping vendors, auditors, and advisors;
• Third parties who partner to provide Services to you;
• Third-Party Digital Services as described above;
• To enforce Terms of Service, this Privacy Policy, or to protect operations or users;
• To comply with law, or in response to legal process;
• As part of a business divestiture, sale, merger, or acquisition;
• In the event of insolvency, bankruptcy, or receivership;
• To suppliers and partners who may send communications or offers to you; and
• With your permission or at your direction.

Promotions (sweepstakes/contests) may require you to submit personal data; if you enter, your data may be shared with co-sponsors and service providers per the promotion rules.

7. Your Controls and Choices

WAX and partners may provide controls including:

• Correcting, updating, and deleting your account (note: blockchain transactions remain tied to anonymized wallet identifiers and cannot be altered or deleted);
• Choosing or changing subscriptions, newsletters, alerts, and marketing preferences;
• Choosing whether we share your data with other companies for offers and promotions;
• Controlling targeted advertising via device settings, advertising identifiers, or opting out of interest-based ads;
• Requesting the personal data we have about you, subject to legal limitations and verification requirements.

If you do not allow us to collect personal data, we may not be able to deliver certain experiences or services.

8. Data Security, Integrity, and Retention

We maintain physical, electronic, and procedural safeguards designed to protect your information. Please be aware no system can be completely secure. We retain personal information as long as needed to fulfill the purposes in this Policy, unless a longer period is required or permitted by law. Actual retention depends on legitimate business purpose and legal obligations (e.g., litigation or government investigation).

9. Children’s Privacy

The WAX Services are not designed for use by anyone under the age of eighteen (18) years.

If we learn we collected personal data from anyone under the age of sixteen (or older if applicable), we will take steps to comply with applicable legal requirements to delete such information.

10. U.S. State Privacy Notice

Some U.S. states have adopted comprehensive privacy laws (“State Privacy Laws”), and residents of those states are entitled to certain disclosures with respect to our personal data processing practices. These State Privacy Laws also permit individuals, referred to as “consumers,” to exercise certain rights with respect to their personal data. At WAX, we provide these rights to residents of all U.S. states and territories, subject to certain limitations, discussed below.

a. WAX Processing Activities

The information below describes the categories of personal data we collect and examples of types of data that fit within such categories. Please also refer to the Types of Information We Collect section of our Privacy Policy above.

Identifiers

Examples: your account name, name, postal address, date of birth, email address, username, password, security questions, and telephone number if you provide such information.

Categories of Recipients for Business Purposes: software and IT service providers; website and app management vendors (development, security, analytics, etc.); third-party promotional partners; payment processors; other members of our corporate group; and other parties such as litigants and government entities.

Categories of Sale/Sharing Recipients: Third-Party Digital Businesses and third-party promotional partners.

Account Details & Commercial Information

Examples: transaction information; information you provide when you request information, contact us, or purchase, return, request, or exchange a product or service; or when you sell, transfer, trade, or otherwise dispose of a digital item or vIRL.

Categories of Recipients for Business Purposes: software and IT service providers; website and app management vendors; third-party promotional partners; other corporate group members; litigants and government entities.

Categories of Sale/Sharing Recipients: Third-Party Digital Businesses and third-party promotional partners.

Financial Information

Examples: information regarding your crypto wallet.

Categories of Recipients for Business Purposes: payment processors and crypto wallet services; corporate group members; litigants and government entities.

Categories of Sale/Sharing Recipients: N/A.

Service Usage Data

Examples: information about your use of our Services; interactions within our games or Services; content you view or post; frequency of use; and preferences.

Categories of Recipients for Business Purposes: software and IT service providers; website and app management vendors; third-party promotional partners; corporate group members; litigants and government entities.

Categories of Sale/Sharing Recipients: Third-Party Digital Businesses and third-party promotional partners.

Geolocation Data (Not Precise)

Examples: approximate location inferred from your IP address.

Categories of Recipients for Business Purposes: software and IT service providers; website and app management vendors; third-party promotional partners; corporate group members; litigants and government entities.

Categories of Sale/Sharing Recipients: N/A.

Inferences

Examples: inferences reflecting preferences, characteristics, predispositions, behavior, and attitudes.

Categories of Recipients for Business Purposes: software and IT service providers; website and app management vendors; third-party promotional partners; corporate group members; litigants and government entities.

Categories of Sale/Sharing Recipients: Third-Party Digital Businesses and third-party promotional partners.

Categories of Sensitive Personal Data

Account Log-In Information
Examples: username and password to a WAX account.
Categories of Business Recipients(for Business Purposes): IT service providers, other members of our corporate group, and other parties (e.g., litigants and government entities).
Categories of Sale/Sharing Recipients: N/A.

We process the personal data described above for the purposes defined in Section 5, How Do We Process Your Personal Data.

b. Consumer Rights

Consumers may exercise the following privacy rights, subject to certain limitations:

• The right to confirm whether we are processing your personal data;
• The right to access categories and specific pieces of personal data, sources, purposes, and disclosure details;
• The right to opt out of WAX’s sale or sharing of personal data for cross-context behavioral advertising;
• The right to opt out of targeted advertising;
• The right to request information about disclosures of personal data for third-party direct marketing;
• The right to request correction of inaccurate personal data;
• The right to request deletion of personal data (with legal exceptions);
• The right to receive equal service and pricing even if privacy rights are exercised.

You may appeal our decision regarding a request by following the instructions in our response to your request.
Depending on the way in which you interact with us, you may need to use different methods to opt-out of sales / sharing / targeted advertising.

Opt-out for non-Tracking Technology Personal Data: If you would like to opt-out of the sale/sharing of your non-Tracking Technology personal data or use of such personal data for targeted advertising (e.g., your email address), you must submit an opt-out request to [email protected].

App-based opt-out: If you would like to limit our processing of your personal data for targeted advertising or opt-out of the sale/sharing of such data via app-based Tracking Technologies, you must exercise a separate opt-out request by navigating to settings and selecting the “Your Privacy Choices” option. When you select this option, a pop-up will appear to enable you to opt out. Switch the toggle to the left to opt out of sales / sharing / targeted advertising via app-based Tracking Technologies. A separate mechanism must be used to opt out of sales / sharing / targeted advertising cookie-based Tracking Technologies because we must use different technologies to apply your opt-out of sales / sharing / targeted advertising via app-based Tracking Technologies and your opt-out of non-Tracking Technology personal data.

Opt-out for Cookie Personal Data: If you would like to limit our processing of your cookie-related personal data for targeted advertising or opt-out of the sale/sharing of such data, you must exercise a separate opt-out request via our consent management tool here. Our cookie consent management tool enables you to exercise such an opt-out request and enable certain cookie preferences on your device. You must exercise your preferences on each of our websites you visit, from each browser you use, and on each device you use. Since your browser opt-out is designated by a cookie, if you clear or block cookies, your preferences will no longer be effective, and you will need to enable them again via our cookie management tool.

Global privacy control or “GPC”: The State Privacy Laws require businesses to process GPC signals, which are signals sent by a platform, technology, or mechanism, enabled by individuals on their devices or browsers, that communicate the individual’s choice to opt-out of the sale or sharing of personal data. To use a GPC, you can download an internet browser or a plugin to use on your current internet browser and follow the settings to enable the GPC. We have configured the settings of our consent management platform to receive and process GPC signals on our website, which is explained by our consent management tool here. We process GPC with respect to sales and sharing that may occur in the context of collection of cookie personal data, discussed above, and apply it to the specific browser on which you enable GPC. We process GPC for opt-outs of sales and sharing in other contexts (e.g., non-cookie personal data).

We do not engage in automated decision making or profiling as those terms are defined under U.S. State Privacy Laws. We only process the sensitive personal data of consumers for purposes that are exempt from choice under the U.S. State Privacy Laws. If you provide us with your sensitive personal data, you will have consented to such processing. We do not knowingly sell or share the personal data of consumers under 16.

Any request you submit to us must be a verifiable consumer request, meaning when you make a request, we may ask you to provide verifying information, such as your name, email, phone number, account and/or transaction information. We will not fulfill your request unless you have provided sufficient information for us to reasonably verify you are the Consumer about whom we collected personal data. We do not verify opt-outs of sale/sharing unless we suspect fraud.

Only you, or someone legally authorized to act on your behalf (your authorized agent), may make a verifiable Consumer request related to your personal data. You may use an authorized agent to make a request for you, subject to our verification of the agent, the agent’s authority to submit requests on your behalf, and of you. To make such a request, or if you have any questions or concerns about our Privacy Policy or our processing of your personal data, please contact us at [email protected].

c. Notice of Financial Incentive

From time to time, we may request that you take certain action, such as downloading another application, taking action within an application, participating in a survey, or purchasing something within or outside the Service to obtain a benefit within the application. For example, you may receive in-app tokens in exchange for taking one of the actions described above. To participate in such programs, we may require the collection, retention, or sale of personal data. The value of the incentive is calculated based on a good faith estimate of the value of the personal data, which forms the basis for offering such financial incentives. The categories of personal data that are implicated by the financial incentive or price or service difference include: Identifiers, Service Usage Data, and Inferences. Factors we consider when calculating the value of the data in order to determine what financial incentives we offer include: revenue generated by us from the collection, retention, or sale of the personal data. You may enroll in or withdraw from our financial incentive program at any time by updating your preferences in your account.

11. European Residents (including United Kingdom)

If you are a resident of the European Union, the European Economic Area ("EEA"), Switzerland, or the United Kingdom ("UK"), you are entitled to certain disclosures and afforded certain rights regarding your personal data. This section provides such disclosures and describes the rights provided under applicable law.