Privacy Policy

Last Updated: September 2026

3-102-957450 Sociedad de Responsabilidad Limitada, a Costa Rican limited liability company with corporate ID 3-102-957450 and registered address at San Pedro, Barrio Dent, Calle 37, Avenida 3, Oficina 101, Montes de Oca, San José, Costa Rica ("Notch SRL", "we", "us" or "our"), operates Notch (as defined in the Terms of Use) and is the controller of your Personal Data.

This Privacy Policy explains how we collect, use, and share Personal Data through Notch, as well as through our marketing campaigns, affiliate program, product feedback forms, surveys, and events.

We process your Personal Data in accordance with applicable data protection laws, including Costa Rican Law No. 8968 on the Protection of Persons against the Processing of their Personal Data and its regulations and, where applicable to you, the EU General Data Protection Regulation ("GDPR"), the UK GDPR and Data Protection Act 2018, the Brazilian General Data Protection Law ("LGPD"), Argentine Personal Data Protection Law No. 25,326, the Canadian Personal Information Protection and Electronic Documents Act ("PIPEDA"), and applicable US state privacy laws.

Notch is not available to persons located in or residents of any Restricted Jurisdiction listed in our Terms of Use, including Costa Rica and the Province of Ontario, Canada.

1. Personal Data We Collect

"Personal Data" means any information that can be used to identify or contact you. We collect the following categories:

Identifiers and contact data: phone number, email address, Google account, and social media handles.
Wallet data: public wallet addresses and on-chain transactions associated with them.
Device and network data: IP address, device type, operating system, browser type, device identifiers, language settings, and general location derived from your IP address.
Usage data: how you interact with Notch, including pages viewed, features used, time spent, and trading volume.
Deposit data: transaction status, amount, and wallet address received from our deposit providers.
Referral data: the affiliate, referral link, or referral code through which you joined Notch.
Communications: information you provide when you contact us, send feedback, or answer surveys.

2. How We Use Your Personal Data

Purpose	Personal Data	Legal basis	Retention
Create and administer your Notch account	Identifiers and contact data, wallet address, IP address	Performance of contract (our Terms of Use)	While your account is active. We delete or anonymize it within 90 days after closure, except data we must keep longer to comply with legal obligations, resolve disputes, or prevent fraud, which we keep for up to 5 years.
Fund your account and interact with the Perp DEX Protocols	Wallet data, deposit data, trading activity	Performance of contract	Same as account data. On-chain data is permanently recorded on the blockchain and cannot be deleted.
Operate Notch Points (NP), referrals, and rewards, and calculate and display engagement metrics such as trading volume	Identifiers, social media handles, wallet address, trading volume	Performance of contract	While your account is active.
Run our affiliate program, attribute referrals, and calculate affiliate commissions	Referral data, a pseudonymous user ID, account creation date, trading volume	Our legitimate interest in running our affiliate program and paying affiliates	While your account is active, and up to 5 years after closure for accounting and dispute purposes.
Analytics and product improvement	Usage data, device and network data	Our legitimate interest in understanding how Notch is used and improving it	Up to 12 months, then anonymized.
Answer your requests, feedback, and correspondence	Communications, contact data	Our legitimate interest in responding to you	Up to 3 years after our last contact with you.
Marketing communications	Email address, communication preferences, whether you open our emails or click their links	Your consent	Until you withdraw your consent or unsubscribe.
Surveys	Contact data, survey answers	Our legitimate interest in improving Notch	Up to 3 years after your answer.
Fraud prevention, security, and enforcement of our Terms	Device and network data, wallet data, usage data, referral data, and information you provide at our request for compliance or fraud investigations	Our legitimate interest in protecting Notch and its users; compliance with legal obligations	As long as necessary, typically up to 5 years.
Handle requests to exercise your rights	Identification and contact data	Compliance with legal obligations	Up to 5 years after our last contact with you.
Create anonymous data for research and business purposes	Any of the data above	Our legitimate interest	Anonymous data is not Personal Data, so no retention period applies.

For fraud prevention and security, we may analyze IP addresses together with other data in case of attacks on our infrastructure or misuse of Notch, including abuse of our referral and affiliate programs, and, where appropriate, use them to identify responsible users in civil or criminal proceedings.

3. Cookies and Similar Technologies

We use only strictly necessary cookies and similar technologies to enable the core functionality of Notch, such as keeping you logged in, remembering your preferences, and recording the referral link or code through which you arrived. These cannot be disabled without affecting how Notch works.

Our analytics tools do not use cookies or advertising identifiers. We do not engage in advertising or cross-site or cross-app tracking. You can manage or delete cookies through your browser settings (see www.allaboutcookies.org).

4. Linking Your Wallet

When you link a wallet to your Notch account, we associate your public wallet address with your account information, such as your phone number or email. Transactions made from that wallet are publicly visible on the blockchain. We do not publish this association, but anyone who independently learns that a wallet belongs to you can see its full transaction history.

We share your Personal Data only with the categories of recipients listed below, or where you have given your consent.

Service providers. Companies that help us operate Notch, such as hosting, database management, customer support, analytics, and email delivery providers. They process your data only on our instructions.

Deposits. Deposits into Notch are processed by Privy and Unifold, third-party payment providers. When you use these services, each provider acts as an independent controller and may collect additional information from you, including identity verification (KYC) data, under its own privacy policy, available at https://www.privy.io/privacy-policy (Privy) and https://unifold.io/privacy (Unifold). Notch SRL does not collect, receive, or store your identity documents. We receive from these providers only the information needed to credit your account, such as transaction status, amount, and wallet address.

Perp DEX Protocols and operators. Operators and developers of the perpetual derivatives protocols accessible through Notch, including Tail.trade and Hyperliquid (the "Perp DEX Protocols"). We share your wallet address and aggregated trading metrics as needed to enable Notch and to administer builder codes, referrals, and similar on-chain mechanisms.

Affiliates. If you join Notch through an affiliate's referral link or code, we share with that affiliate the information needed to attribute your referral and calculate their commissions, such as a pseudonymous user ID, the date you joined, and your trading volume. We do not share your phone number, email address, social media handles, or wallet address with affiliates. Affiliates may use this information only for the purposes of our affiliate program.

Professional advisors. Lawyers, auditors, and other advisors, where needed for the services they provide to us.

Legal compliance and safety. Authorities or other parties where required by law, or where needed to protect our rights, our users, or the public, including for fraud prevention.

Business transfers. A buyer or successor in the event of a merger, acquisition, or sale of all or part of our business. We will inform you before your Personal Data becomes subject to a different privacy policy.

We do not sell your Personal Data or use it for targeted advertising.

We maintain pages on platforms such as X, Telegram, and Discord. When you interact with Notch on those platforms, their privacy policies apply to how they collect and use your data. We are not responsible for their processing.

7. Automated Decision-Making and KOPS AI

Notch uses an automated pricing system called KOPS AI to generate team strength ratings, prices, and other market signals ("KOPS Data"). KOPS AI processes publicly available sports, market, and news data, not Personal Data, and KOPS Data is shown to all users on a non-personalized basis.

We do not use KOPS AI or any other automated process to make decisions about you that produce legal effects or similarly significantly affect you within the meaning of Article 22 GDPR or equivalent laws. If you believe any processing has such an effect, you may request human review, express your point of view, and contest the decision by contacting us.

8. Your Rights

Depending on where you live, you may have the right to:

access the Personal Data we hold about you, including in a portable format;
correct inaccurate Personal Data;
delete your Personal Data;
restrict or object to our processing of your Personal Data; and
withdraw your consent at any time, where we rely on consent, without affecting processing carried out before the withdrawal.

To exercise these rights, email privacy@notch.win. We may ask you to verify your identity. We will respond within 30 days, which we may extend where permitted by law. If we cannot fulfill your request, we will explain why.

You can unsubscribe from marketing emails at any time using the link in each email. You will still receive service-related messages.

Blockchain data. Data recorded on a blockchain cannot be changed or deleted by us or anyone else. This may limit your ability to exercise rights such as erasure, restriction, or objection for on-chain data.

United States. Depending on your state of residence, you may have additional rights under state privacy laws, including the right to know what Personal Data we collect, use, and disclose, and the right to opt out of the sale of Personal Data, targeted advertising, and profiling. We do not sell Personal Data, use it for targeted advertising, or engage in profiling that produces legal or similarly significant effects. We honor Global Privacy Control signals. You may submit a request through an authorized agent, and we may ask for proof of the agent's authorization. If we decline your request, you may appeal by replying to our decision at privacy@notch.win within 45 days. We will respond to your appeal within 60 days. We will not discriminate against you for exercising your rights.

Argentina. The owner of the personal data has the right to access it free of charge at intervals of no less than six months, unless a legitimate interest is shown, as provided in Article 14(3) of Law No. 25,326. The Agency of Access to Public Information (AAIP), as the supervisory authority of Law No. 25,326, has the power to hear complaints and claims from anyone whose rights are affected by non-compliance with personal data protection rules.

9. International Data Transfers

We, our service providers, and our affiliates may process your Personal Data in countries other than your own, which may not offer the same level of protection. When we transfer Personal Data internationally, we rely on appropriate safeguards, including: (i) for transfers from the EEA, adequacy decisions or the European Commission's Standard Contractual Clauses; (ii) for transfers from the UK, UK adequacy regulations, the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses; (iii) for transfers from Brazil, mechanisms approved by the ANPD; (iv) for transfers from Argentina, adequacy or contractual clauses approved by the AAIP; and (v) for other jurisdictions, the safeguards required by applicable law. To request a copy of the relevant safeguards, contact us.

10. Security and Data Breaches

We maintain appropriate technical and organizational measures to protect your Personal Data against unauthorized access, loss, alteration, or disclosure. No method of transmission or storage, including over the internet or through a blockchain, is completely secure, and we cannot guarantee absolute security.

If a data breach affects your Personal Data, we will notify the competent authorities and, where required by law, you, within the timeframes required by applicable law.

11. Children

Notch is not intended for and may not be used by anyone under 18 years of age. We do not knowingly collect Personal Data from anyone under 18. If we learn that we have, we will delete it promptly and close the related account.

12. Third-Party Services

Notch links to third-party websites, protocols, and services, including the Perp DEX Protocols. These links are not an endorsement or a representation that we are affiliated with them. We do not control these services and are not responsible for their practices. Please review their privacy policies.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will update the date above and notify you through Notch or by email before the changes take effect, where required by law.

14. How to Contact Us

For any question about this Privacy Policy or our handling of your Personal Data, contact us at privacy@notch.win.

Data Protection Officer. Our data protection officer, who also acts as our Encarregado under the LGPD and as our privacy officer under PIPEDA, can be reached at privacy@notch.win.

EU Representative: privacy@notch.win
UK Representative: privacy@notch.win

You also have the right to lodge a complaint with your local data protection authority:

Costa Rica (PRODHAB): https://www.prodhab.go.cr/
EEA: https://edpb.europa.eu/about-edpb/board/members_en
UK (ICO): https://ico.org.uk/global/contact-us/
Brazil (ANPD): https://www.gov.br/anpd/
Argentina (AAIP): https://www.argentina.gob.ar/aaip
Canada (OPC): https://www.priv.gc.ca/
United States: your state attorney general.