Privacy Policy

Last updated: December 5, 2025

ALPHAX TECH PTY LTD ("AlphaX", "we", or "our") respects and is committed to protecting your privacy. This Privacy Policy (the "Policy") explains how we collect, use, share, and protect your personal information when you access our website (https://www.alphax.com), use our mobile application or APIs, or otherwise use our decentralized trading protocol (collectively, the "Services").

Important Note: AlphaX is a non-custodial decentralized exchange (DEX). Unlike centralized exchanges, we do not custody your assets and generally do not proactively collect your name, address, or government-issued identification documents, unless expressly required by applicable laws or regulations (such as anti-money laundering laws) or voluntarily provided by you.

Read this Policy carefully. By using our Services, you acknowledge and agree to the data practices described in this Policy.

---

1. Definitions

1.1 "Personal Data" means any information relating to an identified or identifiable natural person, including but not limited to email addresses, online identifiers (such as IP addresses), device information, or contact details provided by you under specific circumstances.

1.2 "Blockchain Data" means transaction data recorded on public blockchain networks that is immutable and publicly accessible.

2. Data We Collect

As a DEX, we follow the principle of "data minimization". The categories of data we collect are as follows:

2.1 Automatically Collected Technical Data When you access the AlphaX website, we may automatically collect the following information to maintain the security and compliance of the Services:

• (a) Device and Log Information: IP address, device model, operating system version, browser type, mobile network information, time zone settings, and the date and time of access to the Services.
• (b) Geolocation Information: We may infer your approximate geographic location based on your IP address to ensure compliance with applicable sanctions laws and service restrictions in relevant jurisdictions (for example, blocking access from restricted countries).

2.2 Data You Voluntarily Provide

• (a) Customer Service: When you contact our customer service team (for example, via email or ticketing system), the email address, username, and communication content you provide.
• (b) Surveys and Feedback: Information you provide if you participate in our surveys or marketing activities.

2.3 Sensitive Data We Generally Do Not Collect Unless required for special compliance reviews (see Section 3.4), AlphaX itself does not collect the following data:

• Your real name, residential address, or phone number;
• Passport, driver's license, or Social Security Number (SSN);
• Biometric data.

3. How We Use Your Data

We use the data we collect primarily for technical operations and compliance purposes:

3.1 Providing and Maintaining the Services

• Processing your transaction requests and assisting in broadcasting them to blockchain networks.
• Displaying your asset balances and transaction history (by indexing on-chain data).

3.2 Security and Compliance Enforcement (Geo-blocking)

• Monitoring platform activities to detect security vulnerabilities, fraudulent activities, bot attacks, or malicious activities.
• Implementing Geo-Blocking: Using your IP address to identify whether you are located in jurisdictions where our Services are prohibited (such as the United States, Mainland China, etc.) in order to fulfill our legal obligations.

3.3 Customer Service and Communication

• Responding to your inquiries, feedback, or disputes.
• Service Notifications: Sending important notices related to your account security, updates to the terms, or technical maintenance (such notices cannot be unsubscribed from).
• Marketing Communications: We will send you promotional information only where you have explicitly opted in. You may unsubscribe at any time through the link provided in the email.

3.4 Legal Compliance and Law Enforcement Assistance

• Although we are a DEX, as a registered entity, in rare circumstances, we may be required to assist investigations upon receipt of a valid court order, subpoena, or to comply with anti-money laundering (AML) investigation requests from regulatory authorities such as AUSTRAC. In such cases, we may cooperate using the limited data available to us (such as email addresses and IP records).

4. Third-Party Services and Data Sharing

4.1 Blockchain Networks: You acknowledge and agree that when you use the Services to conduct transactions, your email address, transaction amounts, and counterparties will be permanently recorded on public blockchains. Such data is inherently public, and AlphaX cannot control, conceal, or delete such on-chain data.

4.2 Service Providers: We may share non-identifiable technical data with third-party vendors that assist us in operating the Services (such as cloud hosting providers AWS/Google Cloud, analytics tools, and DDoS protection services). These vendors are subject to strict confidentiality obligations.

5. Special Statement Regarding Blockchain Data (GDPR and Limitations on Data Rights)

5.1 On-Chain Data Cannot Be Deleted: Due to the immutable nature of blockchain technology, once data is recorded on a blockchain, AlphaX cannot modify or delete it. This means that, with respect to on-chain data, your "Right to be Forgotten" or "Right to Erasure" under the GDPR or other privacy laws cannot be exercised.

5.2 Data Transparency: Anyone may view your on-chain transaction history through blockchain explorers (such as Etherscan). Be aware of this privacy risk when conducting transactions, and we recommend using a new address for each transaction to enhance privacy.

6. Data Storage and International Transfers

6.1 Storage Location and Cross-Border Transfers: AlphaX is a globally operated organization (with its principal entity located in Australia). Your personal data may be transferred to and stored on servers located in Singapore, Australia, or other countries. By using our Services, you consent to such cross-border transfers of your data.

6.2 Safeguards: We will implement reasonable contractual and technical measures such as referencing the EU Standard Contractual Clauses (SCCs) or the Australian Privacy Principles (APPs) to ensure that your data receives protection consistent with the standards set out in this Policy during cross-border transfers.

7. Your Rights

Subject to the laws of your jurisdiction (such as the EU GDPR or Australian Privacy Act), you have the following rights (subject to the blockchain-related limitations set out in Section 5):

• (a) Right of Access and Correction: To access or correct the data we hold about you.
• (b) Right of Erasure: To request deletion of the data stored on our centralized servers relating to you (such as IP logs and customer service records), excluding on-chain data.
• (c) Verification Requirement: As we do not collect real-name identity information, in order to exercise the above rights, we may require you to verify that you are the lawful owner of the account through mobile phone number, email address, and Google Authenticator.

8. Data Security and Retention

8.1 Security Measures: We implement industry-standard security measures (such as SSL encryption, firewalls, and access controls) to protect the data stored on our servers.

8.2 Data Retention: We retain your personal data only for as long as necessary to fulfill the purposes described in this Policy, unless a longer retention period is required by law (for example, certain IP logs may be retained for a period of time for security audit purposes).

8.3 User Responsibility: Your email address is the sole credential for your assets and identity. AlphaX shall not be liable for any data breaches or asset losses resulting from compromised devices or phishing attacks.

9. Cookies and Tracking Technologies

We use cookies and similar technologies to identify your browser, remember your preferences (such as language settings), and analyze traffic. You may refuse cookies through your browser settings. However, this may result in certain features of the Services (such as staying signed in) not functioning properly.

10. Protection of Minors

Our Services are not directed to individuals under the age of 18. If we become aware that we have collected data from a minor, we will delete such data as soon as possible.

11. Policy Updates

We may update this Privacy Policy from time to time to reflect legal or business changes. The updated version will be published on our website. For material changes, we will make reasonable efforts to notify you.

12. Contact Us and Dispute Resolution

12.1 Contact Information If you have any questions about this Privacy Policy, contact: ALPHAX TECH PTY LTD Email: [e-mail]

12.2 Governing Law This Privacy Policy is governed by the laws of the Republic of Singapore. Any disputes arising out of or in connection with this Policy shall be submitted to the Singapore International Arbitration Centre (SIAC)0> for resolution in accordance with the arbitration clause in the User Agreement.