Privacy Policy

1. Introduction

Nebula Labs Inc., together with its affiliates and subsidiaries (“Nebula”, “we”, “us”, and “our”), owns and operates https://alpha.haus/ and https://www.staking.haus/ (the “Sites”). When you visit the Sites, use our platform, applications, or interact with our customer support, sales, marketing, or event channels (collectively, the “Services”), we may collect information about you. Our policy is to respect your privacy and comply with any applicable law and regulation regarding any personal information you entrust us with. We take that trust seriously and are committed to protecting your privacy.

This Nebula Privacy Policy (“Privacy Policy”) explains our privacy practices with respect to what information we collect, how we use it, and what rights you have regarding your data. Please take the time to read it carefully. If you don’t agree or aren’t legally able to agree, please do not use our Services.

Important: Some Services involve interactions with public blockchains (such as Solana). Transactions and content posted to a blockchain are publicly visible, immutable, and beyond our control. While we can remove certain blockchain content from display in the user interface, we cannot delete, alter, or obscure it on the blockchain itself. This includes wallet addresses, messages, and transaction metadata. Public blockchain data may be accessed, used, and analyzed by anyone and linked to other data to identify you. You should consider the public and permanent nature of blockchain transactions before using the Services.

2. Personal Data We Collect

We distinguish between two categories of data: (A) “Off-Chain Data” – information we collect or process through our Site’s user interface, support, analytics, and related tools; and (B) “On-Chain Data” – information recorded on public blockchains as part of protocol use. Examples of Off-Chain Data include email addresses (if provided), support tickets, analytics logs, and marketing preferences. Examples of On-Chain Data include wallet addresses, transaction hashes, token balances, messages posted via the protocol. We treat wallet addresses as personal data when linked with other information that could identify a user, consistent with applicable law.

When you use the Services or otherwise interact with Nebula, we may collect data that identifies you or can be used to identify you, which is sometimes referred to as “personal information,” “personally identifiable information,” or “personal data” under applicable law. We refer to this kind of data in this Privacy Policy as “Personal Data.” Personal Information does not include aggregated, de-identified, and/or anonymized information, i.e., when the information has been transformed so that it no longer relates back to a person’s identity.

We may also collect or receive other kinds of information about you automatically when you use the Services as described below. We refer to all information collected about you collectively (including Personal Data and all other information) as “Information.”

3. How We Collect Information

Information That You Provide to Us

We and our Service Providers may collect Information that you provide to us directly via the Services. You share Information with us in various ways, such as when you:

• Upload user-generated content to the Services;
• Send us questions, comments or feedback;
• Seek customer support;
• Fill out online surveys or questionnaires;
• Sign up for any of our newsletters, materials or our Services;
• Participate in promotions;
• Apply as a candidate for employment; or
• Otherwise communicate with us or other users of the Services.

When you engage in these activities, you may provide certain information to us and/or our Service Providers, which may include your name (optional), email address, and public key. Use of the Services requires you to connect an external non-custodial third-party digital wallet (“Wallet”). We maintain records of transactions conducted through your connected Wallet on the Sites, including posting messages on the Solana blockchain.

Messages, comments, and content you post through the Sites are stored on the blockchain. While we may be able to remove some of this content from being viewed from our Sites, we cannot edit or delete any information that is stored on a blockchain.

Information Collected Automatically

When you access or use the Services, we and our Service Providers and third-party business partners may automatically collect certain Information about your use of the Services, such as:

• Log Data: Your internet protocol (IP) address, device ID, browser type and language, device operating system, model, configuration, settings, internet service provider (ISP), session IDs, session token data, authentication token data, mobile network information, or platform information.
• Cookies and other tracking technologies: When you visit the Services, certain cookies, web beacons and similar tracking technologies may be set on your device.

Wallet Connections – Information from Third Parties

To use certain features of the Services, you must connect a supported Wallet, such as Phantom, Solflare, and Backpack. When you connect your Wallet, we receive your Wallet’s public key address and related network information. We do not receive your private keys, seed phrase, or other credentials that grant direct access to your Wallet, and we will never request them.

Once connected, your Wallet’s public key address may allow us or others to view publicly available information on the blockchain, such as your current token balances, transaction history, or other on-chain activity. We encourage you to consider the privacy implications of using a public blockchain before connecting your Wallet to the Services.

4. How We Use the Information Collected

Nebula uses your Information for the commercial purpose of providing the Service and related functionality, or as otherwise specifically described in this Privacy Policy and as permitted by applicable laws, including the following:

• To operate our Services and business: Provide, operate and improve the usability and effectiveness of our Services; provide functionality, analyze performance, troubleshoot, and fix errors.
• To communicate with you: Send administrative and support messages; provide support and respond to inquiries, requests and feedback.
• To administer promotions and contests: Enforce the terms of the promotion; disclosed to third parties for administrative purposes and as required by law.
• To provide you with transactional and marketing material: Invite you to events or conferences; conduct research and surveys.
• To promote safety and security: Prevent and detect fraud, abuse of Services and cyberattacks; protect the security of our Customers and others.
• For legal purposes and law enforcement requests: Enforce terms of use; comply with applicable laws, rules, regulations, and legal obligations; protect operations, rights, privacy, safety or property; cooperate with public authorities; pursue available legal remedies and/or defend legal claims.

We will not collect additional categories of Personal Data or use the Personal Data we collected for materially different, unrelated or incompatible purposes without providing you notice.

5. How Information May Be Shared or Disclosed

Subprocessors and Service Providers

Nebula uses the services of third-party vendors, contractors, consultants and service providers who need access to your Information in order to enable them to perform services on our behalf (“Service Providers”). These Service Providers have access to Information needed to perform their services or functions, but are not permitted to use it for other purposes except as permitted under our contract with them or by applicable law. They are bound by contractual obligations to ensure the security, privacy, and confidentiality of your information.

Third Parties You Access, Authorize or Authenticate

When you use certain features of the Services that integrate with third-party platforms, such as Wallets, those third parties may collect information from you or your device. Nebula is not responsible for data collected, received, or used by third parties as a result of these integrations.

Business Transactions

All of your Personal Data that we collect may be disclosed or transferred to a third party in connection with a reorganization, merger, sale, transfer, assignment or other disposition of all or any portion of our business, assets or stock, including if we go out of business or enter into bankruptcy.

Regulators and Competent Authorities

We may share your Information with law enforcement, government authorities, or other parties where we believe in good faith that such disclosure is required by law or is otherwise necessary to comply with legal obligations, protect your rights and safety or those of other individuals, or to protect, investigate, and deter fraudulent, harmful, unauthorized, unethical, or illegal activity.

6. International Transfers

Our Services are offered from the United States (“U.S.”) and we process and store the information we collect in the U.S. If you choose to use the Services from the European Economic Area (“EEA”), the United Kingdom (“U.K.”), Switzerland, or other regions with laws governing data collection and use that differ from U.S. law, please note that your Personal Data will be transferred to the U.S. for processing.

Where we transfer Personal Data from the EEA, the U.K., or Switzerland to the U.S. or other countries that have not been deemed to provide an adequate level of data protection, we rely on the European Commission’s Standard Contractual Clauses or other appropriate safeguards permitted under applicable data protection laws.

7. Rights of Users in the EEA, United Kingdom and Switzerland

Legal Bases for Processing European Personal Information

If you are located in the EEA or the U.K., we only process your personal information when we have a valid “legal basis,” including:

• Consent: We may process your personal information where you have consented to certain processing. You have the right to withdraw your consent at any time.
• Legitimate Interests: We may process your personal information where we or a third party have a legitimate interest, such as product development, internal analytics, and improving the safety, security, and performance of our Services.
• Contractual Necessity: We may process your personal information where required to provide you with our Services or otherwise fulfill our contractual duties.
• Compliance with a Legal Obligation: We may process your personal information where we have a legal obligation to do so.

Data Subject Requests

Subject to applicable law, you have the right to request access to the Off-Chain Personal Data we hold about you; to request that it be provided in a portable format; to ask that your Off-Chain Personal Data be corrected or deleted; and to object to, or request that we restrict, certain processing activities. Because blockchain networks are generally immutable, we are not able to correct or delete Personal Data that is recorded On-Chain.

If you would like to exercise any of these rights, please contact us at privacy@nebula.haus.

Questions or Complaints

If you have concerns about our handling of Personal Data, we encourage you to reach out to us initially. However, if we cannot resolve your concern, you have the right to file a complaint with your local Data Protection Authority:

• For individuals in the EEA: edpb.europa.eu
• For individuals in the UK: ico.org.uk
• For individuals in Switzerland: edoeb.admin.ch

8. How You Can Control or Change What Is Collected

Nebula does not require you to create an account with us or include Personal Data when using our Sites. However, certain blockchain-based features or protocols may require you to connect a digital wallet to participate. When you connect a wallet, we may receive the wallet address and related transaction information, which may be considered Personal Data under applicable law. If you signed up for updates and newsletters, you can control which optional email messages you choose to receive by unsubscribing using the link at the bottom of each email.

9. Specific Information for U.S. Residents

Privacy Information for California Residents

If you are a California resident, you may be entitled to certain rights with respect to your personal information under the California Consumer Privacy Act (“CCPA”). The CCPA provides California consumers with the following rights:

• Right to know about the personal information a business collects about them and how it is used and shared;
• Right to delete personal information collected from them (with some exceptions);
• Right to opt-out of the sale or sharing of their personal information;
• Right to non-discrimination for exercising their California privacy rights;
• Right to correct inaccurate personal information; and
• Right to limit the use and disclosure of sensitive personal information collected about them.

Nebula does not sell your personal information to third parties without your consent.

Privacy Information for Nevada Residents

Nebula does not currently sell covered information as defined in Nevada Revised Statutes Section 603A. If you want to be notified if we change that practice, please send your name and email address to privacy@nebula.haus.

Privacy Information for Connecticut, Colorado, Virginia or Nebraska Residents

If you are a resident of the State of Connecticut, Colorado, Virginia, or Nebraska you may take advantage of certain privacy rights, such as to request access, correction, or deletion of your personal information. You may also exercise your right to opt-out of sales or targeted advertising. You have the right to appeal a denial of your privacy rights.

How to Submit Your Request

If you would like to exercise your rights as a resident under the laws of California, Colorado, Connecticut, Virginia or Nebraska, you can submit a request at any time by sending an email to privacy@nebula.haus. We will confirm receipt of your request within 10 business days and will respond within 45 calendar days, after proper verification.

10. Our Use of Cookies and Tracking Technologies

What Are Cookies?

A “cookie” is a small text file that is sent to your browser or device. They allow Nebula and our Service Providers and other third-party business partners to recognize your browser and/or device and to transfer information about you and your use of the Services.

What Types of Cookies May Be Used?

• Strictly Necessary Cookies: Essential for the Services to function properly. These cannot be disabled by users.
• Preference Cookies: Enable enhanced functionality and personalization, such as remembering your username and password.
• Performance Cookies: Used for data analytics purposes to measure and improve performance and design of the Services. All data collected is aggregated and anonymized.

How Can You Control the Use of Cookies?

You may instruct your browser to stop accepting cookies at any time or set your browser to prompt you before accepting cookies. Please note that if you do block cookies, you may not be able to use or access some or all features of the Services.

Nebula does not currently monitor or take action with respect to “Do Not Track” signals.

11. Third Party Access and Links

This Privacy Policy does not apply to the practices of any third party that is not owned or controlled by Nebula. When you use third-party extensions, integrations, or follow references and links within our Services, use of your information by such third parties is subject to those third party terms of service and privacy policies.

12. A Note About Children

We require all users to be 18 years of age or older. Users who are ages 13 to 17 are permitted to browse and use the Services only through their parent or legal guardian, with permission and direct supervision. Nebula does not knowingly collect Personal Data from individuals under the age of 13 in the U.S. or under 16 in the EEA and U.K. If we learn that we have inadvertently collected such data, we will delete any associated Off-Chain Data. If you believe we may have Personal Data from a child under the age of 13, please contact us at privacy@nebula.haus.

13. Retention and Security

Nebula retains your Personal Data for as long as it is needed to provide the Services to you, or as permitted in light of the purposes for which it was obtained and consistent with applicable law. When we no longer need to use your Personal Data and there is no need for us to keep it to comply with our legal or regulatory obligations, we will either remove it from our systems or anonymize it so that it can no longer be associated with you.

Nebula uses reasonable and appropriate administrative, technical, and physical security controls to protect your Personal Data. However, no system can be guaranteed to be 100% secure. We cannot guarantee the security of the Information transmitted to us. Any such transmission is at your own risk.

14. Accessibility

If you have a disability and would like to access this policy in an alternative format, please contact us at privacy@nebula.haus.

15. Changes to This Privacy Policy

We may change this Privacy Policy from time to time. When we post modifications, we will revise the “Last Updated” date at the top of this page. The modified Privacy Policy will be effective immediately upon posting. If we make significant changes that affect your information, we may also provide you notice through the Services, by email, or some other means of contact.

16. How to Contact Us

If you have any questions, comments or concerns, you may contact us at privacy@nebula.haus.

17. Nebula List of Subprocessors