Privacy Policy

Last Updated: 7 May 2026

3-102-957450 Sociedad de Responsabilidad Limitada, a Costa Rican Sociedad de Responsabilidad Limitada with corporate ID 3-102-957450 and registered address at San Pedro, Barrio Dent, Calle 37, Avenida 3, Oficina 101, Montes de Oca, San José, Costa Rica (including all affiliates, collectively referred to as "Notch SRL", "we", "us" or "our") operates Notch (as defined in the Terms of Use).

This privacy policy ("Privacy Policy") applies to all Personal Data (defined below) collected through Notch and cookies used, as well as marketing campaigns, product feedback forms, surveys, events, and sales.

We collect and use your Personal Data in accordance with this Privacy Policy and in compliance with applicable data protection legislation, including but not limited to: the Costa Rican Law on the Protection of Persons against the Processing of their Personal Data (Law No. 8968) and its implementing regulations; the EU General Data Protection Regulation ((EU) 2016/679) ("GDPR"); the EU Privacy and Electronic Communications Directive (2002/58/EC); the UK Data Protection Act 2018 and UK GDPR; the California Consumer Privacy Act, as amended by the California Privacy Rights Act (Cal. Civ. Code § 1798.100 et seq.) ("CCPA"); other US state privacy laws to the extent applicable, including those of Virginia, Colorado, Connecticut, Utah, and Texas; the Brazilian General Data Protection Law (Lei Geral de Proteção de Dados, Law No. 13.709/2018) ("LGPD"); the Singapore Personal Data Protection Act 2012 ("PDPA"); the Australian Privacy Act 1988 (Cth); and the Canadian Personal Information Protection and Electronic Documents Act ("PIPEDA").

Personal Data

"Personal Data" or "Personal Information" refers to any personally identifiable information that can be used to identify or contact you, which may include, but is not limited to:

Phone number used to register for or log into a Notch account;
Email address;
Wallet identifiers (such as public wallet addresses) used to interact with the Perp DEX Protocols (including Tail.trade, Hyperliquid, and any other perpetual derivatives protocols accessible through Notch); and
Usage metadata.

Overview of how we collect your Personal Data

Purpose of the processing	Categories of Personal Data	Legal basis	Retention period
To create and administer your Notch account.	Your phone number, your email, your Google account, your social media handle, your wallet ID; your device data, such as your computer's or mobile device's operating system type and version, manufacturer and model, browser type, screen resolution, RAM and disk size, CPU usage, device type (e.g., phone, tablet), IP address, unique identifiers (including identifiers used for advertising purposes), language settings, mobile device carrier, radio/network information (e.g., WiFi, LTE, 5G), and general location information such as city, state or geographic area when you access Notch.	Performance of contract, you enter into a contract with us when accepting our Terms of Use for the service.	For as long as the account is active; deletion within a reasonable period of time after closure to comply with legal or contractual obligations.
To allow you to fund your account with an external crypto wallet and to interact with the Perp DEX Protocols.	Your wallet ID, where a wallet is linked to your Notch account, certain interaction data (e.g. trading volume, usage metrics) may be associated with your account information.	Performance of contract, you enter into a contract with us when accepting our Terms of Use for the service.	Blockchain-related data (e.g., cryptocurrency wallet addresses or transaction records) may be permanently recorded on-chain and cannot be deleted.
To operate our Notch Points (NP), referral, and rewards system.	Your account identification data, your social media handles.	Performance of contract, you enter into a contract with us when accepting our Terms of Use for the service.	For as long as the account is active.
To calculate and display engagement metrics such as trading volume based on your use of Notch.	Your account identification data, wallet ID, your online activity data, such as trading volume, pages or screens you viewed on Notch, how long you spent on a page or screen, navigation paths between pages or screens, information about your activity on a page or screen, access times, and duration of access, and whether you have opened our marketing emails or clicked links within them.	Performance of contract, you enter into a contract with us when accepting our Terms of Use for the service.	For as long as the account is active.
To answer your contact request or respond to your feedback and correspondences.	Feedback or correspondence, such as information you provide when you contact us with questions, feedback, product reviews, or otherwise correspond with us online.	Our legitimate interest to answer your correspondences.	The time needed to answer you and no longer than 3 years after the last contact with you.
For marketing and advertising purposes.	Your preferences for receiving communications about our activities, events, and publications, and details about how you engage with our communications.	Your consent if you are an individual and our legitimate interest to promote our services and product if you are a professional.	Until you withdraw your consent or opt out.
To conduct surveys.	Your identification and contact details and your answers to surveys.	Our legitimate interest to conduct surveys to improve our services and product.	Up to 3 years after your answer to the survey.
Analytics and product improvement: Develop existing products and new products and services, including by studying how you use our products.	Usage logs, interaction data.	Our legitimate commercial interest to improve our products and develop products.	Up to 12 months; anonymized thereafter. Anonymous data is no longer personal data, no retention period applies.
Analytics through third-party tools: we use third party analytics tools to understand how users interact with Notch and to improve functionality and performance. No cookies are used. We do not use analytics for advertising or cross-app tracking.	Device information, usage events, and diagnostic data generated by Notch.	Our legitimate commercial interest to improve our products and develop products.	Up to 12 months; anonymized thereafter. Anonymous data is no longer personal data, no retention period applies.
Fraud prevention, security, enforcement: For compliance, fraud prevention, and safety including to (a) protect our, your or others' rights, privacy, safety or property (including by making and defending legal claims); (b) enforce the terms and conditions that govern Notch; and (c) protect, investigate and deter against fraudulent, harmful, unauthorized, unethical or illegal activity.	Device/browser data, wallet data. IP addresses may be evaluated, together with other data, in case of attacks on the network infrastructure or other unauthorized use or misuse of Notch, for the purpose of intelligence and protection, and if appropriate, used in criminal proceedings for identification and civil and criminal proceedings against the relevant users.	Our legitimate interest to protect our products against fraud, abuse, and misuse as well as to comply with a legal obligation or as otherwise required by applicable law.	As long as necessary for fraud detection and enforcement; typically, up to 5 years.
To create anonymous data.	All of the data processed, as mentioned above.	Our legitimate business interest to create anonymous data sets for research and business purposes.	Anonymous data is no longer personal data, no retention period applies.
To process your request to exercise your rights.	Your identification and contact details. Where needed, we may request you to provide an ID.	Our legal obligation to manage your rights.	The time needed to answer you and no longer than 5 years after the last contact with you (legal prescription).

Cookies and Automatic Data Collection

We use essential cookies and similar technologies to enable the core functionality of Notch, such as maintaining user sessions and preferences. We also use analytics cookies to understand how users interact with Notch and to improve performance. Cookies are small pieces of data — usually text files — placed on your computer, tablet, phone or similar device when you use that device to access our services. You can opt out of having your online activity and device data collected through these third-party services, including by:

Blocking cookies in your browser by following the instructions in your browser settings. For more information about cookies, including how to see the cookies on your device, manage them, and delete them, visit www.allaboutcookies.org.
Blocking or limiting the use of your advertising ID on your mobile device through the device settings.
Using privacy plug-ins or browsers. Certain browsers and browser extensions can be configured to block third-party cookies and trackers.
Using advertising industry opt-out tools on each device or browser where you use the services, available at http://optout.aboutads.info and http://optout.networkadvertising.org.

We may use plug-ins from social networks on Notch and/or maintain pages on social platforms, such as Telegram, Discord, X (formerly Twitter), and other third-party platforms. When you activate plug-ins by clicking on them, the operators of the respective social platforms may record that you are on Notch and may use this information. Additionally, when you visit or interact with Notch-related pages on those social media platforms, the relevant social platform's privacy policy will apply to your interactions and their collection, use and processing of your personal information. You may provide us with information through Notch, and we will treat such information in accordance with this Privacy Policy. Notch SRL is not responsible for data collected by these individual social media platforms, and any processing of your personal data by social media platforms is solely their responsibility and occurs according to their privacy policies. Please check with them regarding their privacy policies.

Sharing of Personal Information

With the exception of the providers of Notch SRL, we do not make your Personal Data available to third parties unless you have expressly consented to it, if we are legally obligated to, or if this is necessary to enforce our rights concerning a contractual relationship. This is our legitimate interest in the processing of data in the sense of Art. 6 Par. 1 lit. f GDPR.

Service providers. We may share your Personal Information with third party companies and individuals that provide services on our behalf or help us operate Notch (such as customer support, hosting, data processors, analytics, email delivery, marketing, identity verification, and database management services).

Perp DEX Protocols and operators. We may share your Personal Information (including your wallet ID and aggregated trading metrics) with operators and developers of the Perp DEX Protocols accessible through Notch — including, without limitation, the operators of Tail.trade and Hyperliquid — as necessary to enable the functionality of Notch and to administer builder codes, referrals, and similar on-chain mechanisms.

Web3 projects and collaborators. We may share your Personal Information with web3 projects and collaborators as necessary to provide Notch.

Professional advisors. We may disclose your Personal Information to professional advisors, such as lawyers and auditors, where necessary in the course of the professional services that they render to us.

For compliance, fraud prevention and safety. We may share your Personal Information for compliance, fraud prevention, and safety purposes described above.

Financial transactions. If you conduct financial transactions by credit card or debit card through Notch, we may forward your credit/debit card information to the credit/debit card issuer and the credit/debit card acquirer. If you choose to use a credit/debit card, you may be asked to provide all the necessary information. The legal basis for passing on the data lies in the fulfillment of an agreement in the sense of Art. 6 Par. Lit. b GDPR.

Your Rights and Choices

Opt out of marketing communications. You may opt out of marketing-related emails by following the opt-out or unsubscribe instructions at the bottom of the email. You may continue to receive service-related and other non-marketing emails.

Data protection rights. Depending on where you live, you may have the following rights, as provided under applicable law and subject to any limitations in such law:

To access the Personal Information we hold about you (including, if applicable, to receive it in a structured and commonly used machine-readable format);
To request we correct any inaccurate Personal Data we hold about you;
To request we delete any Personal Information we hold about you;
To restrict the processing of Personal Data we hold about you;
To object to the processing of Personal Information we hold about you; and/or
To withdraw your consent to the processing of Personal Data we hold about you, when we have relied on consent as the legal basis to process your Personal Information.

Please note that, prior to any response to the exercise of such rights, we may require you to verify your identity. In addition, we may have valid legal reasons to refuse your request and will inform you if that is the case. For more information on your rights, please contact us using the details in the "How to contact us" section below.

Please note that part of Notch incorporates blockchain technology. A blockchain is a shared and synchronized digital database that is stored on multiple nodes (computers that store a local version of the database). As, by design, data on a blockchain cannot be changed or deleted, your ability to exercise your data protection rights such as your right to erasure, or your rights to object or restrict processing with respect to on-chain Personal Data may be affected.

International Data Transfers

By using Notch, you understand and acknowledge that we may transfer your Personal Information to service providers or other third parties who are located in countries which may not provide the same protections as the data protection laws where you are based. This includes service providers of Notch SRL and e-commerce providers such as payment solution providers to assist us in the processing of your online payments. When we transfer your Personal Data to third parties abroad for the purposes of the data processing described in this Privacy Policy, unless we can rely on a derogation provided under data protection law, we will ensure that relevant safeguards are in place to afford adequate protection for your Personal Information and we will comply with applicable data protection laws, including by relying on (i) for transfers from the EEA, the European Commission's Standard Contractual Clauses (Module 1, 2, 3, or 4 as applicable) or an adequacy decision; (ii) for transfers from the United Kingdom, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or a UK adequacy regulation; (iii) for transfers from Brazil, mechanisms approved under the LGPD by the Brazilian National Data Protection Authority (ANPD); (iv) for transfers from Switzerland, the Swiss Federal Data Protection and Information Commissioner-approved Standard Contractual Clauses; and (v) for transfers from other jurisdictions, contractual or other safeguards required under applicable law. For more information about how we transfer Personal Data internationally, or to obtain a copy of the relevant transfer mechanism, please contact us as set out in the "How to contact us" section below.

Automated Decision-Making and KOPS AI

Notch uses an automated pricing system referred to as KOPS AI to generate team strength ratings, prices, and other market signals (collectively, the "KOPS Data"). The KOPS AI system processes publicly available sports, market, and news data, not Personal Data, in order to produce the KOPS Data, and the KOPS Data is then displayed to all users of Notch on a non-personalized basis. Notch SRL does not use the KOPS AI system, or any other automated process, to produce decisions concerning you that have legal effects or similarly significantly affect you within the meaning of Article 22 GDPR or any analogous provision of applicable data protection law. To the extent that any processing carried out by us is regarded as automated decision-making producing such effects, you have the right to request human intervention, to express your point of view, and to contest the decision by contacting us at the address set out in the "How to Contact Us" section below.

No Sale of Personal Information

Notch SRL does not sell your Personal Information for monetary or other valuable consideration, and has not done so in the preceding 12 months. We also do not "share" your Personal Information for cross-context behavioral advertising purposes within the meaning of the CCPA. We honor opt-out preference signals, including the Global Privacy Control (GPC), where they are made available to us through your browser or device.

Security and Data Breach Notification

We implement and maintain reasonable and appropriate technical and organizational measures designed to protect Personal Information against unauthorized or unlawful processing and against accidental loss, destruction, damage, or disclosure. In the event of a personal data breach affecting your Personal Information, we will notify the competent supervisory authority and, where required by applicable law (including Article 33 and 34 GDPR, the LGPD, and applicable US state laws), affected individuals, in each case within the timeframes and in the manner required by such law. Notwithstanding the foregoing, no method of transmission or storage is completely secure and we cannot guarantee absolute security.

Notice to California Residents

The California Consumer Privacy Act or "CCPA" (Cal. Civ. Code § 1798.100 et seq.) affords consumers residing in California certain rights with respect to their personal information. If you are a California resident, this section applies to you.

California Civil Code Section 1798.83 permits individual California residents to request certain information regarding our disclosure of certain categories of personal information to third parties for those third parties' direct marketing purposes. To make such a request, please contact us using the information in the "How to Contact Us" section below. This request may be made no more than once per calendar year.

If you are a California resident, you have certain additional rights with respect to your personal information pursuant to the CCPA.

We are required to inform you of:

What categories of information we may collect about you, including during the preceding 12 months: see the section above "Personal Data".
The purposes for which we may use your personal information, including during the preceding 12 months: see the section above "Overview of how we collect your Personal Data".
The purposes for which we may share your personal information, including during the preceding 12 months: see the section above "Sharing of Personal Information". In addition, we may share the following categories of information with the following parties: (i) Identity information with service providers such as KYC service providers; (ii) Contact information with marketing partners and event partners; and (iii) Financial information with service providers such as payment service providers and logistics providers.
In the preceding 12 months, we have not sold any personal information of consumers.

You have the right to request to know: (i) the categories of personal information we have collected about you in the last 12 months; (ii) the specific pieces of personal information we have about you; (iii) the categories of sources from which that personal information was collected; (iv) the categories of your personal information that we sold or disclosed in the last 12 months; (v) the categories of third parties to whom your personal information was sold or disclosed in the last 12 months; and (vi) the purpose for collecting and selling your personal information. These rights are subject to limitations as described in the CCPA. We may deny your request if we need to do so to comply with our legal rights or obligations.

We will not discriminate against any consumer for exercising their CCPA rights.

You may exercise these rights yourself or you may designate an authorized agent to make these requests on your behalf. To protect your information, we may need to verify your identity before processing your request, including by collecting additional information to verify your identity, such as government issued identification documents. We will not fulfill your request unless you have provided sufficient information for us to reasonably verify you are the individual about whom we collected personal information. We will only use the personal information provided in the verification process to verify your identity or authority to make a request and to track and document request responses, unless you initially provided the information for another purpose. When we verify your agent's request, we may verify your identity and request a signed document from your agent that authorizes your agent to make the request on your behalf. To protect your personal information, we reserve the right to deny a request from an agent that does not submit proof that they have been authorized by you to act on their behalf.

If you would like to exercise any of these rights, please contact us at the email in the "How to Contact Us" section below.

Other Sites, Applications and Services

Notch may contain links to other websites, mobile applications, blockchain protocols, blockchain applications, blockchain exchanges and other online and blockchain services (collectively, "Third Party Resources") operated by third parties, including the Perp DEX Protocols (such as Tail.trade and Hyperliquid). These links are not an endorsement of, or representation that we are affiliated with, any third party. In addition, our content may be included in Third Party Resources that are not associated with us. We do not control all Third Party Resources, and we are not responsible for their actions. Other websites and services follow different rules regarding the collection, use and sharing of your Personal Information. We encourage you to read the privacy policies of the Third Party Resources you use.

Security Practices

We take precautions to protect your stored Personal Data against manipulation, partial or complete loss, and unauthorized access by third parties of Personal Information we maintain. Unfortunately, data transmission over the internet (including via blockchain) cannot be guaranteed as completely secure. Please note that any data transmission on the internet (including through blockchains) is generally not secure or may be accessed by third parties, and we accept no liability for data transmitted to us via the internet or through a blockchain.

Children

Notch is not intended for use by children under 18 years of age. If we learn that we have collected Personal Information through Notch from a child under 18 without the consent of the child's parent or guardian as required by law, we will delete it.

Changes to this Privacy Policy

We reserve the right to modify this Privacy Policy at any time. If we make material changes to this Privacy Policy, we will notify you by updating the date of this Privacy Policy and posting it on Notch. We may also provide notification of changes in another way that we believe is reasonably likely to reach you, such as via e-mail (if you have an account where we have your contact information) or another manner through Notch.

Any modifications to this Privacy Policy will be effective upon our posting the new terms and/or upon implementation of the new changes on Notch (or as otherwise indicated at the time of posting).

How to Contact Us

If you have a concern about our privacy practices, including the way we handle your Personal Information, please contact us at: support@notch.win. We will endeavor to respond to your complaint as soon as possible.

You can also report it to your local data protection authority that is authorized to hear those concerns. Contact details for certain data protection authorities can be found using the links below:

For individuals in Costa Rica (PRODHAB): https://www.prodhab.go.cr/
For individuals in the EEA: https://edpb.europa.eu/about-edpb/board/members_en
For individuals in the UK: https://ico.org.uk/global/contact-us/
For individuals in Switzerland: https://www.edoeb.admin.ch/en/contact-2
For individuals in California: https://cppa.ca.gov/about_us/contact.html
For individuals in Brazil (ANPD): https://www.gov.br/anpd/
For individuals in Singapore (PDPC): https://www.pdpc.gov.sg/
For individuals in Australia (OAIC): https://www.oaic.gov.au/
For individuals in Canada (OPC): https://www.priv.gc.ca/