2.1 Information You Provide

We collect only the minimal information necessary for Platform functionality:

• Email Address - Required for account creation and essential communications
• Name - Required for service provisioning
• Wallet Address - Your cryptocurrency wallet identifier

2.2 Automatically Collected Information

Our systems and third-party services automatically collect:

• IP Address - Collected by our hosting provider (Vercel) and analytics
• Device Information - Browser type, operating system, device identifiers
• Usage Analytics - Via Google Analytics including pages visited, time spent, user interactions
• Technical Data - Access logs, error reports, performance metrics

2.3 Blockchain Data

We analyze publicly available blockchain data associated with your wallet address, including:

• Transaction history and patterns
• Token holdings and transfers
• DeFi protocol interactions

ALL BLOCKCHAIN DATA IS PUBLIC AND NOT PRIVATE

3.1 Service Provision

We use collected information solely to:

• Operate and maintain the Platform
• Process your deposits and withdrawals
• Execute our rebalancing algorithms
• Provide customer communications when absolutely necessary

3.2 Analytics and Improvement

• Monitor Platform performance and usage patterns
• Identify technical issues and system optimization needs

WE DO NOT USE DATA FOR MARKETING OR ADVERTISING

3.3 Legal Compliance

We may use information to comply with legal obligations, including:

• Responding to court orders and subpoenas
• Cooperating with regulatory investigations
• Meeting anti-money laundering requirements through third parties

4.1 No Voluntary Sharing

WE DO NOT VOLUNTARILY SHARE YOUR PERSONAL INFORMATION WITH THIRD PARTIES FOR COMMERCIAL PURPOSES.

4.2 Legal Compulsion Only

We may disclose information only when legally compelled by:

• Valid court orders or subpoenas
• Regulatory investigation demands
• Law enforcement requests with proper legal authority

WE WILL RESIST DISCLOSURE TO THE EXTENT LEGALLY POSSIBLE

4.3 Third-Party Service Providers

Certain third parties process data on our behalf:

• Vercel - Hosting and infrastructure (may log IP addresses and technical data)
• Google Analytics - Usage analytics and performance monitoring
• MoonPay - KYC verification for fiat transactions (separate privacy policy applies)

WE ARE NOT RESPONSIBLE FOR THIRD-PARTY DATA PRACTICES

5.1 Storage Location

• Data is stored on Vercel's cloud infrastructure
• We do not control the specific geographic location of data storage
• NO GUARANTEES ARE MADE REGARDING DATA LOCATION

5.2 Security Measures

We implement basic security measures including:

• HTTPS encryption for data transmission
• Standard cloud security provided by hosting services

WE MAKE NO GUARANTEES ABOUT DATA SECURITY

5.3 Security Limitations

YOU ACKNOWLEDGE THAT:

• No security system is completely secure
• Data breaches may occur despite security measures
• We cannot guarantee protection against all threats

COMPLETE DATA SECURITY IS IMPOSSIBLE

6.1 Retention Period

WE RETAIN PERSONAL INFORMATION INDEFINITELY UNLESS:

• You request deletion (subject to legal exceptions)
• We are legally required to delete specific data
• We voluntarily choose to delete data (at our sole discretion)

6.2 Legal Retention Requirements

We may retain information longer when required by:

• Ongoing legal proceedings
• Regulatory investigation requirements
• Anti-money laundering obligations

LEGAL REQUIREMENTS OVERRIDE DELETION REQUESTS

7.1 GDPR Rights

If you are located in the European Union, you have the following rights under GDPR:

• Right to Access: Request copies of your personal information
• Right to Rectification: Request correction of inaccurate information
• Right to Erasure: Request deletion of your personal information
• Right to Restrict Processing: Request limitation of data processing
• Right to Data Portability: Request transfer of your data
• Right to Object: Object to certain processing activities

7.2 Exercising Your Rights

To exercise GDPR rights:

• Email: main@lucamoney.com
• Response Time: Up to 30 days
• Verification Required: We may request identity verification
• Exceptions Apply: Legal obligations may prevent full compliance

7.3 Right to Erasure Limitations

DATA DELETION MAY BE REFUSED OR DELAYED WHEN:

• Required for legal compliance
• Needed for establishment, exercise, or defense of legal claims
• Necessary for protection of rights of other persons

BLOCKCHAIN DATA CANNOT BE DELETED

8.1 Cookie Usage

• Google Analytics may automatically set cookies for analytics purposes
• We do not intentionally set additional cookies

WE DO NOT CONTROL THIRD-PARTY COOKIES

8.2 Tracking Technologies

• Google Analytics tracks user behavior and Platform usage
• Vercel may track technical performance metrics

TRACKING IS NECESSARY FOR PLATFORM OPERATION

9.1 Cross-Border Processing

Your information may be processed in countries other than your own, including:

• United States (Vercel, Google Analytics)
• Other jurisdictions where our service providers operate

WE DO NOT CONTROL WHERE THIRD PARTIES PROCESS DATA

9.2 Transfer Protections

WE PROVIDE NO ADDITIONAL PROTECTIONS FOR INTERNATIONAL TRANSFERS BEYOND WHAT OUR SERVICE PROVIDERS IMPLEMENT

10.1 Blockchain Privacy

YOU ACKNOWLEDGE THAT:

• Blockchain transactions are permanently public
• Wallet addresses can be linked to your identity
• Transaction patterns may reveal personal information

BLOCKCHAIN ACTIVITY IS NOT PRIVATE

10.2 Third-Party Privacy

• We cannot control third-party privacy practices
• Service providers may have different privacy policies

THIRD-PARTY PRIVACY VIOLATIONS ARE NOT OUR RESPONSIBILITY

10.3 Data Accuracy

• We do not verify the accuracy of information you provide
• You are responsible for providing accurate information

INACCURATE DATA MAY AFFECT SERVICE QUALITY

11.1 Privacy Breach Liability

TO THE MAXIMUM EXTENT PERMITTED BY LAW, WE SHALL NOT BE LIABLE FOR:

• Data breaches or unauthorized access
• Identity theft or fraud resulting from data exposure
• Privacy violations by third-party service providers
• ANY DAMAGES ARISING FROM PRIVACY INCIDENTS

11.2 Maximum Liability Cap

OUR TOTAL LIABILITY FOR PRIVACY-RELATED CLAIMS SHALL NOT EXCEED:

• The lesser of actual fees paid by you to us
• One hundred US dollars ($100)

THIS CAP APPLIES TO ALL PRIVACY CLAIMS COMBINED

11.3 Consequential Damages Exclusion

We shall not be liable for:

• Indirect, incidental, or consequential damages
• Lost profits or business opportunities
• Emotional distress or reputational harm

ALL CONSEQUENTIAL DAMAGES ARE EXCLUDED

12.1 Amendment Rights

WE MAY MODIFY THIS PRIVACY POLICY:

• At any time without prior notice
• With or without reason

CONTINUED USE CONSTITUTES ACCEPTANCE OF CHANGES

12.2 Change Notification

• Changes will be posted on the Platform
• We have no obligation to provide individual notice
• USERS ARE RESPONSIBLE FOR REVIEWING CHANGES

13.1 Governing Law

This Privacy Policy is governed by the laws of the British Virgin Islands.

13.2 Arbitration Requirement

ALL PRIVACY-RELATED DISPUTES MUST BE RESOLVED THROUGH:

• Binding arbitration in the British Virgin Islands
• Individual arbitration only (no class actions)

ARBITRATION IS MANDATORY FOR ALL DISPUTES

13.3 Limitation Period

All privacy-related claims must be brought within one (1) year of when the claim first arose.