Privacy Policy

1. Introduction & scope

vildX (“vildX,” “we,” “us,” or “our”) operates the website at vildx.com and the related non-custodial smart-contract platform that allocates user deposits across curated DeFi yield strategies (together, the “Services”). This Privacy Policy explains how we collect, use, share, and protect information when you visit our website, use our application, or interact with us.

vildX is a software platform. We are not a bank, broker-dealer, investment adviser, or regulated financial institution. We do not take custody of your digital assets.

Jurisdictional availability. The vildX application is not available to U.S. persons as defined in Regulation S under the U.S. Securities Act of 1933. The Services are also unavailable to residents of sanctioned jurisdictions or jurisdictions where decentralised finance services are restricted. This Privacy Policy applies to all visitors to vildx.com regardless of location, and to all users of the Services in jurisdictions where the Services are permitted.

2. Information we collect

2.1 Information you provide directly

You can use the vildX website and application without creating an account. We collect information directly only when you choose to provide it, such as when you:

• Contact us by email (e.g., hello@vildx.com) — we collect your email address, the content of your message, and any attachments.
• Subscribe to our mailing list, fill out a form, or respond to a survey.
• Apply to a job posting — we collect the information in your application.

2.2 Information collected automatically

When you visit vildx.com or use our application, we may automatically collect:

• Device & usage data — IP address, browser type and version, device type, operating system, referring URL, pages visited, time stamps, and similar log data.
• Wallet address — when you connect a self-custody wallet to the vildX application, we may receive your public wallet address. We do not receive or have access to your private keys, seed phrase, or signing credentials.
• Cookies and similar technologies — see Section 5.

2.3 Information from third parties

We may receive information from third-party services we use, including infrastructure providers, analytics providers, compliance vendors (e.g., sanctions screening), and public on-chain data sources.

2.4 Information we do not collect

We do not collect government identification, bank account information, payment-card details, social security numbers, biometric data, or other categories of sensitive personal information through our website. We do not have access to private keys, recovery phrases, or any credential that could let us access or move your digital assets.

3. How we use information

We use information for the purposes described below, on the legal bases noted (where applicable):

• Provide and operate the Services — to deliver the website, maintain the application, route requests, and authenticate wallet connections. Legal basis: performance of a contract; legitimate interests.
• Improve the Services — to understand how users interact with the website and application, debug issues, and prioritise improvements. Legitimate interests.
• Communicate with you — to respond to inquiries, send service updates, and (where you opt in) deliver newsletters. Consent; legitimate interests.
• Compliance, security & fraud prevention — to screen against sanctions lists, prevent abuse, detect and respond to fraud or unauthorised access, and comply with applicable law. Legal obligation; legitimate interests.
• Aggregate analytics — to produce de-identified, aggregated statistics about how the Services are used.

4. Sharing & disclosure

We do not sell personal information. We share information only as described below:

• Service providers and processors — companies we use to host the website, deliver email, monitor performance, run analytics, screen sanctions, and similar functions. These providers are bound to use information only as we direct.
• Legal requirements — to comply with applicable law, valid legal process, or governmental requests; to enforce our Terms; to protect the safety, rights, or property of vildX, our users, or others; and to address security or technical issues.
• Business transfers — in connection with a merger, acquisition, financing, reorganisation, or sale of assets, subject to standard confidentiality protections.
• With your consent — for any purpose disclosed at the time of collection or with your subsequent consent.

On-chain transactions are public by design. Any information you send to a public blockchain (including your wallet address and transaction history) is permanently and publicly visible and outside our control.

5. Cookies & analytics

We use cookies and similar technologies (web beacons, local storage) to operate the website, remember preferences, measure performance, and produce aggregate analytics. Categories we may use:

• Strictly necessary — required for the site to function; cannot be disabled.
• Functional — remember your settings and preferences.
• Analytics — measure how visitors use the site so we can improve it. We endeavour to use privacy-preserving analytics providers and to honour Do-Not-Track and Global Privacy Control (GPC) signals where technically feasible.

You can manage cookies through your browser settings. Disabling cookies may impair some functionality.

6. Security

We use technical and organisational measures designed to protect information against unauthorised access, alteration, disclosure, or destruction — including encryption in transit (TLS), least-privilege access controls, vendor security review, and regular code audits of smart contracts via third-party auditors. However, no method of transmission or storage is perfectly secure. You are responsible for the security of your wallet, private keys, and any device used to access the Services.

7. Data retention

We retain personal information only as long as needed for the purposes for which it was collected, including to comply with legal obligations, enforce agreements, resolve disputes, and produce aggregated analytics. Log and analytics data are typically retained for up to 24 months; email correspondence for up to 36 months; sanctions-screening records for the period required by law.

8. International data transfers

vildX operates internationally. Information we collect may be transferred to, stored, or processed in countries other than your country of residence, including jurisdictions whose data-protection laws may differ from those of your home jurisdiction. Where we transfer personal information from one region to another, we rely on appropriate safeguards — including, where relevant, contractual protections, the European Standard Contractual Clauses, and equivalent measures recognised under PIPEDA and provincial Canadian law.

9. California (CCPA / CPRA)

If you are a California resident and the Services are made available to you, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA/CPRA”), gives you the following rights:

• Right to know what personal information we collect, the sources, the purposes, and to whom we disclose it.
• Right to access & portability — a copy of personal information we hold about you.
• Right to delete personal information, subject to legal exceptions.
• Right to correct inaccurate personal information.
• Right to limit use of sensitive personal information (we do not collect categories that would trigger this right).
• Right to opt out of sale or sharing — we do not sell or share personal information for cross-context behavioural advertising.
• Right to non-discrimination for exercising your rights.

To exercise these rights, email privacy@vildx.com. We will verify your identity through a reasonable process before responding. You may use an authorised agent. We do not charge for responding to requests except where permitted by law.

Notice at collection. We collect the categories described in Section 2 for the purposes described in Section 3. We retain information for the periods described in Section 7.

10. Other U.S. state privacy rights

Residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), and other U.S. states with comprehensive privacy laws may have rights similar to those described for California — including access, correction, deletion, portability, and opt-out of targeted advertising or sale. To exercise these rights, contact privacy@vildx.com. You have a right to appeal a refusal of a request; appeal instructions will be provided with our response.

Because the vildX application is not available to U.S. persons, certain rights described here apply only to interactions with the vildX website.

11. Canada (PIPEDA & provincial law)

If you are located in Canada, your interactions with vildX are governed by Canada’s federal Personal Information Protection and Electronic Documents Act (“PIPEDA”) and applicable provincial laws — including the Quebec Act respecting the Protection of Personal Information in the Private Sector (as amended by Quebec Law 25), British Columbia’s Personal Information Protection Act, and Alberta’s Personal Information Protection Act.

You have rights to:

• Access personal information we hold about you.
• Request correction of inaccurate or incomplete information.
• Withdraw consent to collection, use, or disclosure (subject to legal or contractual limitations).
• Receive a copy of personal information in a structured, commonly used format (data portability), where applicable.
• File a complaint with the Office of the Privacy Commissioner of Canada or with your provincial privacy regulator.

To exercise these rights, contact our Privacy Officer at privacy@vildx.com. Under Quebec Law 25, our Privacy Officer can be reached at the same address.

12. Children’s privacy

The Services are not directed to children under the age of majority in your jurisdiction (typically 18). We do not knowingly collect personal information from children. If you believe a child has provided personal information to us, please contact privacy@vildx.com and we will take appropriate steps to delete it.

13. Wallets, on-chain data, and decentralised infrastructure

The vildX application interacts with public blockchains and self-custody wallets. Information you send to a public blockchain — including your wallet address and the details of transactions you authorise — is permanently public and cannot be deleted by vildX. The decentralised infrastructure that operates the vildX smart contracts (including RPC providers, validators, indexers, and oracle networks) is generally outside vildX’s control. We are not responsible for, and this Privacy Policy does not govern, information collected or processed by such third-party infrastructure.

14. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by posting the updated policy on the website with a new “Last updated” date. We encourage you to review this policy periodically.

15. Contact us

If you have questions about this Privacy Policy or our privacy practices, or to exercise any rights described here:

Email: privacy@vildx.com
General inquiries: hello@vildx.com