Privacy Notice

01 Scope

This Privacy Notice applies to personal information processed by Senthos Inc. in connection with the Senthos websites, hosted applications, software, APIs, data connections, support, and related services (the "Services"). It does not govern a third party's independent processing, including processing by a venue, data provider, or identity provider under its own notice.

02 Information we collect

Depending on how you interact with the Services, we may collect:

• account and contact details, such as name, business email, firm, role, access preferences, and authentication records;
• workspace data, such as wallet addresses, venue account identifiers, positions, balances, orders, fills, quotes, market lists, and related portfolio information;
• communications and support information you send to us;
• usage and device information, such as IP address, browser, timestamps, pages, actions, diagnostics, and security events; and
• information from connected venues, public blockchains, market-data providers, identity or security services, and other sources you direct us to use.

We do not sell personal information or use it for third-party behavioral advertising.

03 Connected accounts

A connection screen identifies the credential and permission needed for that integration. Provide only the minimum read-only access requested. Unless a separately enabled workflow expressly says otherwise, do not provide withdrawal, transfer, trading, account-administration, or similar privileges.

Persistent connection secrets are encrypted before storage and scoped to the authenticated workspace owner. Shared demo connections are isolated by browser session and kept in an ephemeral store. We do not return stored private-key or secret material through normal connection responses.

You can disconnect an integration in the Services and should also revoke its key with the relevant provider when access is no longer needed.

04 How we use information

We use information to:

• provide, operate, authenticate, maintain, and improve the Services;
• retrieve and normalize data you request, calculate portfolio and model outputs, and maintain connection state;
• communicate about access, support, security, product changes, and requested updates;
• protect accounts, investigate misuse, enforce agreements, and maintain audit records;
• comply with law and conduct identity, authority, sanctions, fraud, or other compliance checks where appropriate; and
• analyze aggregated or de-identified service performance and usage.

05 How we disclose information

We may disclose information to service providers that support hosting, databases, security, identity verification, communications, analytics, and customer support; to a connected venue or provider as needed to complete your request; to professional advisers and auditors under appropriate duties; and to authorities or other parties where reasonably necessary to comply with law, protect rights and safety, investigate abuse, or enforce our agreements.

We may transfer information in connection with a financing, merger, acquisition, reorganization, or sale of assets, subject to appropriate confidentiality and applicable law. We require service providers to process information only for authorized purposes and with appropriate safeguards.

06 Retention and deletion

We retain information for as long as reasonably necessary to provide the Services, maintain security and auditability, comply with legal and contractual obligations, resolve disputes, and enforce agreements. Retention varies by information type and relationship.

Persistent connection records are retained until disconnected or until no longer needed for the Services, subject to backup, security, and legal-retention requirements. Ephemeral shared-demo connection data expires or is purged when the relevant session is removed. De-identified information may be retained where it no longer reasonably identifies you.

07 Security

We use administrative, technical, and organizational safeguards designed for the nature of the information we process. These include encrypted transport, encryption of persistent connection secrets, scoped access, credential redaction, session controls, and monitoring. No system is completely secure, and we cannot guarantee that unauthorized access, loss, or misuse will never occur.

08 International processing

Senthos is based in the United States. We and our service providers may process information in the United States and other countries whose privacy laws may differ from those where you live. Where required, we use contractual or other legally recognized safeguards for international transfers.

09 Your choices and rights

You may update certain account or connection information in the Services, disconnect integrations, revoke provider credentials, opt out of optional product communications, and control certain browser storage through your browser. Authentication cookies and comparable storage are necessary to operate and secure the workspace.

Depending on your jurisdiction, you may have rights to request access, correction, deletion, restriction, objection, portability, or withdrawal of consent. To submit a request, email contact@senthos.xyz. We may verify your identity and authority before acting, and some information may be exempt or retained where permitted by law.

10 Children

The Services are intended for business and institutional users and are not directed to children under 18. We do not knowingly collect personal information from children through the Services.

11 Updates and contact

We may update this notice to reflect changes in the Services, law, or our practices. We will post the updated notice and revise the effective date. Material changes apply prospectively.