Privacy Notice

This Privacy Notice explains on which basis PropellerHeads AG ("PropellerHeads," "we," "us," or "our") collects, uses, discloses, stores, and protects personal data when you access or use the Fynd website and user interface at https://app.fynd.xyz, together with related pages, features, APIs, support channels, software, and services that link to this Privacy Notice (collectively, the "Interface"). In addition, PropellerHeads may inform you about the processing of your personal data separately, for example in consent forms, terms and conditions, additional privacy notices, forms, and other notices. PropellerHeads uses the word "data" here interchangeably with "personal data".

If you provide information to PropellerHeads about any person other than yourself, you must ensure that the data is accurate, that these other people understand how their data will be used, and that they have given their permission for you to disclose it to PropellerHeads and for you to allow PropellerHeads, and its service providers, to use it. You are welcome to provide them with a copy of this Privacy Notice.

This Privacy Notice is aligned with the Federal Data Protection Act ("FDPA") and the EU General Data Protection Regulation ("GDPR"). However, the application of these laws depends on each individual case.

PropellerHeads does not ask for your private key, seed phrase, government ID, postal address, or financial account details to use the Interface. Never share your private key or seed phrase with PropellerHeads or anyone else.

1. Controller

The person responsible for processing your data under this Privacy Notice (the "Controller"), unless PropellerHeads tells you otherwise in an individual case, is:

PropellerHeads AG Bahnhofstrasse 7 6300 Zug Switzerland

You may contact PropellerHeads regarding data protection matters and to exercise your rights at dataprotection@propellerheads.xyz.

2. Data Collection

PropellerHeads may process the following data about you:

• Wallet and blockchain data: wallet address, connected network, public balances, approvals, signed orders, transaction hashes, on-chain activity, order status, settlement data, and liquidity-related data.
• Security and compliance data: IP address, approximate location or region, request metadata, risk signals, screening results, rate-limit data, error logs, and abuse-prevention data.
• Usage and device data: pages viewed, clicks, feature usage, timestamps, browser, operating system, device type, language, performance data, and error reports.
• Local device data: cookies, localStorage, sessionStorage, indexedDB, wallet-provider storage, session state, display preferences, wallet connection state, and accepted legal-notice versions.
• Support, communication, and feedback data: information submitted by email, forms, surveys, bug reports, Telegram, or other support channels.
• Product analytics data: page views, sessions, referrer and campaign parameters, wallet connections, chain switches, transaction events, and details of the trades you review and submit — the chain, the token pair, the quote preset, the exact amount you entered, the price impact, the number of swaps in the route, and the approximate value in USD — together with the searches you make in the token selector, collected through Formo.

3. On-Chain Data

When you use blockchains, you acknowledge that your wallet address and other data or information provided by your transactions — which are considered personal data if relating to an identified or identifiable natural person — are permanently and publicly stored on-chain, which means such data is publicly available to anyone. Neither PropellerHeads nor any third party has any power to delete such data published by its users to the blockchain. If you want to ensure that your privacy rights are not affected in any way, you should not transact on blockchains, as certain rights may not be available or exercisable by you or PropellerHeads due to the technological infrastructure of the blockchain.

Please also note that PropellerHeads does not have access to the third-party wallet connected to the Interface.

You hereby release and indemnify PropellerHeads from any liability associated with data that you transferred to the blockchain.

4. Purpose of Data Processing

PropellerHeads may use your data for the following purposes:

• operate and maintain the Interface and Fynd Router;
• provide services to you, enter into a contract with you, and perform and administer that contract;
• connect wallets and show balances, orders, quotes, and transaction status;
• remember preferences and legal-notice acceptance;
• respond to enquiries, provide support, and process feedback;
• detect, prevent, and investigate abuse, fraud, security incidents, and restricted access, as well as protect PropellerHeads' IT and other infrastructure;
• enforce eligibility, sanctions, restricted-jurisdiction, and other access controls;
• comply with legal, regulatory, sanctions, tax, audit, security, and dispute obligations;
• sell businesses, parts of businesses, or companies to others, or acquire them from others, as part of business development;
• enforce Terms and policies; and
• analyze aggregated or de-identified product usage to further develop the Interface and Fynd Router.

5. Cookies and Local Storage

The Interface may use cookies, localStorage, sessionStorage, indexedDB, wallet-provider storage, and similar technologies.

Essential storage may be used for wallet connection, session state, network selection, display preferences, security controls, error recovery, and legal-notice acceptance.

The Interface uses Formo (formo.so) for product analytics. Formo records page views, sessions, referrer and campaign parameters, wallet connections and disconnections, chain switches, and transaction and signature events. It also records which wallet software you connect with, your interface preferences (selected chain, quote preset, slippage tolerance and theme), when you change the theme (light or dark), quotes that fail and why, and the trades you review, complete, or fail to complete, together with the chain, the token pair, the quote preset, the exact amount you entered, the price impact, the number of swaps in the route, the approximate value in USD, and the reason a swap failed; and it records how you use the interface: when you copy the API request or the raw quote response, when you open the self-hosting quickstart, when you open a pool in a block explorer, when you change the quote preset, and patterns such as repeatedly quoting one pair at rising sizes. It also records where the interface fails you: a token search that returns nothing, together with what you typed into it, a quote that times out, a network switch that fails, the stage a failed swap reached — including a wallet prompt you decline — and opening the connect dialog and closing it without connecting — including whether you left the terms box unticked. Where your wallet address has an ENS name, that name is recorded with it. When you connect a wallet, the Interface sends your wallet address to Formo so that the activity in a session is linked to that address. Formo sets first-party cookies holding an anonymous identifier, and, once you connect, an identifier derived from your wallet address. These cookies are set on our root domain rather than on this host alone, so the same identifier is shared with other PropellerHeads sites on that domain and your visit can be attributed across them. Formo states that it does not set third-party cookies and does not collect IP addresses or device fingerprints. Where a wallet address is recorded it is treated as personal data under this notice. No advertising or cross-site tracking tools are used.

6. Legal Basis

Insofar as PropellerHeads has asked for your consent, PropellerHeads processes your data on the basis of that consent. You can withdraw your consent at any time with effect for the future by sending PropellerHeads a written notification (email to: info@propellerheads.xyz). The withdrawal of your consent affects neither the legality of the processing that PropellerHeads carried out before your withdrawal nor the processing of your data on the basis of other processing grounds.

If PropellerHeads does not need your consent, PropellerHeads will not obtain it and will process your data for other reasons, such as the initiation or execution of a contract or a business relationship with you, a legal obligation, a vital interest of the data subject or another natural person, or to perform a public task. PropellerHeads may also process your personal data if PropellerHeads has a legitimate interest in doing so, which includes, for example, complying with applicable law, marketing PropellerHeads' products and services, better understanding PropellerHeads' markets, and safely and efficiently managing and developing PropellerHeads' company, including its activities.

7. Transfer of Data to Third Parties

As part of the data processing, PropellerHeads may share data with third parties, in particular the following categories of recipients:

• Service providers: PropellerHeads may share your information with service providers and business partners around the world with whom PropellerHeads collaborates to fulfil the above purposes (e.g. IT providers, hosting providers, security companies, banks, telecommunication companies, address-verification providers, lawyers, etc.), or who PropellerHeads engages to process data for any of the purposes listed above on its behalf and in accordance with its instructions only.
• Wallet token discovery: when you connect a wallet and wallet-token discovery is enabled, PropellerHeads sends the connected wallet address to Alchemy, an RPC and blockchain-data provider, to list the tokens held by that address. The address is not logged or stored by PropellerHeads beyond a short-lived in-memory cache.
• Contractual partners: if required by the respective contract, PropellerHeads will pass on your data to other contractual partners, subcontractors, etc.
• Acquirers of business: if PropellerHeads sells or buys any business or assets, it may disclose your data to the prospective seller or buyer of such business or assets, to whom PropellerHeads assigns or novates any of its rights and obligations.
• Authorities: PropellerHeads may also share information where required by law, regulation, court order, sanctions authority, law enforcement, legal process, business transfer, or user consent, or where necessary to protect PropellerHeads' interests. The authorities are responsible for processing data about you that they receive from us.

8. Disclosure of Data Abroad

The data that PropellerHeads collects from you may be transferred to, processed, and stored in a country outside the European Economic Area (EEA) or Switzerland. From the perspective of the EEA or Switzerland, the law in some of those countries may not offer an adequate level of data protection. PropellerHeads only transfers data to these countries when it is necessary for the performance of a contract or for the exercise or defence of legal claims, or if such transfer is based on your explicit consent or subject to safeguards that assure the protection of your data, such as the EU-U.S. Data Privacy Framework, the Swiss-U.S. Data Privacy Framework, and/or the Standard Contractual Clauses approved by the European Commission (SCCs), adjusted according to Swiss law — all of the aforementioned if applicable and required.

9. User Rights

In connection with the processing of your data, you have various rights under applicable data protection law: the right to information about how PropellerHeads processes which personal data about you, the right to rectification, the right to erasure, the right to restriction of processing, the right to data portability, the right to withdrawal of a previously given consent, the right to file a complaint with the competent data protection authority if you believe that PropellerHeads is not processing your personal data in accordance with data protection requirements, and the right to object to a particular processing. However, PropellerHeads asks that you please contact PropellerHeads first if you believe that it is not processing your personal data in accordance with your wishes, so that PropellerHeads can address your concerns and implement appropriate changes.

Please note that PropellerHeads reserves the right to enforce legal restrictions where necessary, e.g. if PropellerHeads is obliged to store or process certain data, has an overriding interest (insofar as PropellerHeads can invoke such interests), or needs the data to assert claims. If the exercise of certain rights involves costs for you, PropellerHeads will inform you in advance. PropellerHeads has already referred to the possibility of withdrawing consent above.

If you wish to exercise the rights mentioned above, please contact PropellerHeads at dataprotection@propellerheads.xyz or at the contact details provided above, unless otherwise indicated or agreed. Please note that PropellerHeads may need to verify your identity in order to prevent misuse, e.g. by means of a copy of your ID card or passport, unless identification is otherwise possible.

In addition, every data subject has the opportunity to assert their rights in court or to file a complaint with the relevant data protection authority. In Switzerland, the relevant data protection authority is the Federal Data Protection and Information Commissioner (http://www.edoeb.admin.ch).

These rights may be limited by law and by the public, permanent nature of blockchain data.

10. Retention and Storage

PropellerHeads only processes your data for as long as necessary to fulfil the purposes for which PropellerHeads collected it, including for the purposes of complying with legal retention requirements and where required to assert or defend against legal claims, until the end of the relevant retention period or until the claims in question have been settled. Upon expiry of the applicable retention period, PropellerHeads securely destroys your data in accordance with applicable laws and regulations.

11. Data Security

PropellerHeads takes appropriate organizational and technical security measures to prevent your data from being accidentally lost, used or accessed in an unauthorized way, altered, or disclosed. However, PropellerHeads and your data can still become victims of cyber-attacks, cyber-crime, brute force, hacker attacks, and further fraudulent and malicious activity, including but not limited to viruses, forgeries, malfunctions, and interruptions, which is out of PropellerHeads' control and responsibility. PropellerHeads has also put in place procedures to deal with any suspected data breach and will notify you and any applicable regulator of a breach where PropellerHeads is legally required to do so.

12. Children

PropellerHeads does not knowingly collect personal data from children. The Interface and Fynd Router are not intended for users under 18, and such individuals are not permitted to use the Interface or Fynd Router.

If PropellerHeads becomes aware that it has collected personal data from a child without valid parental consent, PropellerHeads will take steps to delete such data without undue delay.

If you have reason to believe that a child has provided data to PropellerHeads through the Interface, please contact PropellerHeads at info@propellerheads.xyz. If you are a parent or guardian and believe that your child has provided data, please contact PropellerHeads, and PropellerHeads will take appropriate steps, including deletion of the data where required.

13. Changes

Due to continuous development of the Interface and the Fynd Router and the contents thereof, changes in law, or regulatory requirements, PropellerHeads may update this Privacy Notice from time to time. The current Privacy Notice can be found on the Interface.

14. Contact

Questions about privacy may be sent to dataprotection@propellerheads.xyz.