> For the complete documentation index, see [llms.txt](https://terms.tessera.fun/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://terms.tessera.fun/privacy-policy.md). # Privacy Policy **Date last revised: 5 September 2026** [*Terms of Service*](/readme.md) *·* [*Privacy Policy*](/privacy-policy.md) *·* [*End User Licence Agreement*](/eula.md) *·* [*On-ramp providers*](/providers.md) ## 1. Who is responsible for your data *Published at terms.tessera.fun/privacy-policy. Terms of Service: terms.tessera.fun.* 1.1 This Privacy Policy explains how **ALEX Lab Foundation**, a private interest foundation established under the laws of the Republic of Panama, registered at the Panama Public Registry under Folio No. 25046591, with its registered office at Ricardo Arias Street, Advanced Tower Building, First Floor, Panama City, Republic of Panama (the "**Operator**", "**we**"), collects, uses, shares and protects personal data when you use the consumer application, whether as a web application, a progressive web app or a native mobile application (the "**Application**"). 1.2 The Operator is the **controller** of the personal data described in this Policy. The Operator operates the Application in its own right. The Application software is licensed from Tessera Lab Pte. Ltd. (Singapore), which does not receive personal data from the Application in the ordinary course and is not a controller of it. 1.3 Some services reached through the Application are provided by third parties who are **independent controllers** of the data you give them, in particular the fiat on-ramp provider (section 4) and the issuers of digital assets you choose to hold (section 5). 1.4 This Policy, not the Tessera Works Foundation privacy policy published at terms.tessera.pe, governs personal data processed through the Application. ## 2. What we collect We collect only what the Application needs to work. | Category | Examples | Source | | ---------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------ | | **Account identifiers** | Email address; identifiers returned by a social login you choose (Apple, Google), such as a user ID and, where you allow it, name and avatar; passkey public credentials; multi-factor settings | You, via the sign-in provider | | **Wallet data** | The public address of your Embedded Wallet and of any wallet you connect; on-chain transaction history associated with those addresses | The wallet infrastructure provider; public blockchains | | **Profile data you choose to add** | Display name, profile photo, referral code, social handle used for a share or campaign | You | | **Usage and device data** | App version, platform, device model and OS, language, coarse network location derived from IP address (used for the access restrictions in the Terms), interaction and crash diagnostics | Automatically | | **Support data** | Messages you send to support, including through the in-app assistant, and the responses | You | | **Notification data** | Push-notification token, if you enable notifications | Your device | ## 3. What we do not collect 3.1 **No identity documents.** the Operator does not collect, request, receive, store or process government-issued identity documents, passport or ID numbers, selfies or liveness captures, proof-of-address documents, or the results of any identity-verification ("KYC") check. The Application has no identity-verification step of its own. 3.2 **No financial-account data.** the Operator does not collect card numbers, bank account details or other payment credentials. Fiat purchases are completed with the on-ramp provider on its own pages. 3.3 **No private keys.** the Operator does not hold your private key or any share of it (see the Terms, clause 3). ## 4. Fiat purchases 4.1 If you buy USDC or SOL with fiat currency, the purchase is provided by a third-party payment provider (an "**On-Ramp Provider**") acting as an **independent controller** under its own privacy policy. The On-Ramp Provider performs identity verification as required by its licences and policies. The provider for a given purchase is identified to you before you proceed, and the providers in use are listed at terms.tessera.fun/providers. 4.2 The Application passes to the On-Ramp Provider only the public address of your Embedded Wallet, the asset and network to deliver to, the fiat currency and amount you entered, and a technical reference. Everything you then provide on the provider's pages goes to that provider directly. **No On-Ramp Provider sends identity documents, verification data or verification results to the Operator, and the Operator does not ask for them.** 4.3 The Operator may learn from the public blockchain that a deposit arrived in your wallet. It does not learn who verified you, how, or what documents you supplied. ## 5. Digital assets issued by third parties Digital assets you hold through the Application, including loan participation rights issued by subsidiaries of Tessera Works Foundation, are governed by their issuers' terms and privacy policies. The Operator does not share your account identifiers with an issuer. An issuer can see, as anyone can, the public on-chain record of the addresses that hold its tokens. ## 6. Who processes data for us We use service providers that process personal data on our instructions ("**processors**"): | Provider | Role | Data | | -------------------------------- | --------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------- | | **Dynamic** (Dynamic Labs, Inc.) | Sign-in and embedded-wallet infrastructure | Account identifiers, wallet public address, authentication events | | **Fireblocks** | Threshold key-management infrastructure used by the wallet provider | Cryptographic key shares and signing events; no account identifiers from the Operator | | **Cloudflare** | Hosting, application backend and storage, network security, access restrictions by location, in-app support assistant | All data in section 2 as it transits or is stored; IP address and derived location | | **Expo** | Application updates and push-notification delivery | Device and app version data; notification token | | **DFlow** | Transaction routing for buys and sells | Wallet public address and order parameters | | **Sentry** (when enabled) | Error and crash reporting | Device, app and diagnostic data; no account identifiers by design | Processors act under contracts that restrict their use of the data to providing the service. Some are outside your country; see section 10. ## 7. Why we use your data | Purpose | Data | Basis | | ---------------------------------------------------------------------- | --------------------------------------------- | ---------------------------------------------- | | Creating and securing your account and wallet | Account identifiers, wallet data, device data | Performance of the Terms | | Showing your balances, positions and history | Wallet data | Performance of the Terms | | Constructing and routing the transactions you authorise | Wallet data | Performance of the Terms | | Applying the access restrictions in the Terms | IP-derived location, device data | Legitimate interests; legal obligation | | Support, and the in-app support assistant | Support data, account identifiers | Performance of the Terms; legitimate interests | | Sending notifications you have enabled | Notification data | Consent | | Referral and share features you choose to use | Profile data, wallet public address | Performance of the Terms; consent | | Security, fraud and abuse prevention, service integrity | All categories | Legitimate interests | | Compliance with law, sanctions and lawful requests | All categories | Legal obligation | | Improving the Application (aggregated or de-identified where possible) | Usage and device data | Legitimate interests | We do not sell personal data. We do not use it for third-party advertising. We do not share your holdings or history with anyone for marketing. ## 8. Public blockchains Transactions from your wallet are recorded on a public blockchain. Anyone can read them, they cannot be deleted, and the Operator does not control the blockchain. A wallet address is pseudonymous, but it can be linked to you by anyone who learns it is yours, including through a share or referral feature you use. ## 9. Sharing We share personal data with the processors in section 6; with the independent controllers in sections 4 and 5, only as described there; with a successor operator of the Application on notice to you; with professional advisers under confidentiality; and where required by law, court order, regulator or sanctions authority, or to protect the rights, safety or property of the Operator, users or others. ## 10. International transfers The Operator and its providers process personal data in Panama, Singapore and the United States, and in such other jurisdictions as its providers operate from. Where we transfer your personal data across jurisdictions, we will ensure that it is protected in accordance with this Policy and applicable laws regardless of the jurisdiction to which it is transferred, and in any event to a level no less stringent than the jurisdiction from which it is transferred. Where required by applicable law we put in place appropriate safeguards, including EU Model Clauses, or rely on adequacy decisions. ## 11. Retention We retain your personal data only for as long as is necessary to fulfil the purposes for which we collected it, and to satisfy our business and legal purposes, including audit, accounting and reporting. How long we keep it depends on the nature of the data: where personal data may be required to commence or defend legal proceedings, we keep it for at least the duration of the limitation period for bringing those claims. Some data is retained for longer where the law requires it. Where we anonymise personal data so that it can no longer be associated with you, we are entitled to retain and use it without restriction. Public blockchain data is outside our control and is permanent. ## 12. Your rights Depending on where you live, you may have the right to access, correct, delete or export your personal data, to object to or restrict certain processing, to withdraw consent, and to complain to a data-protection authority. You can delete your account from within the Application (Account › Settings › Delete account) or contact us at . Before deletion the Application asks you to export your wallet key, because the Operator cannot recover it afterwards. Deleting your account removes our records of you and your sign-in with the wallet infrastructure provider; it does not remove on-chain data, which is public and permanent, and it does not remove assets from the wallet address, which you control with the exported key. Where you obtained the Application from the Apple App Store, Apple's own privacy policy governs data Apple collects. ## 13. Security We use encryption in transit and at rest, access controls, and the security features of our providers. No system is perfectly secure; keep your credentials, passkeys and devices safe, and tell us at once if you suspect misuse. ## 14. Children The Application is not for anyone under 18, and we do not knowingly collect data from them. ## 15. Changes We will publish changes here and update the date below. Material changes will be notified in the Application. ## 16. Contact ALEX Lab Foundation, Ricardo Arias Street, Advanced Tower Building, First Floor, Panama City, Republic of Panama. If you have any feedback or issues in relation to your personal data, or about this Policy, or wish to make a complaint to us, you may contact our Data Protection Officer at: **Email:** This does not affect your statutory rights. *** *Effective: 5 September 2026. Controller: ALEX Lab Foundation. This Policy does not apply to the Tessera Website (tessera.pe), which is operated by Tessera Works Foundation under its own privacy policy, or to an On-Ramp Provider's services, which are governed by that provider's privacy policy.*