Varqena Privacy Policy

1. About this Policy

This Privacy Policy explains how Varqena collects, uses, stores, shares and protects personal data related to the use of its public website and participation in its waiting list and early access program ("waitlist" or "Early Access").

Varqena is currently in a pre-operational stage. This Policy specifically applies to the landing page, waitlist, Early Access-related communications and the contact channels currently made available.

It is not intended to describe in advance features that are not yet available, such as user accounts, wallet integrations, payments, subscriptions, strategy execution, production artificial intelligence products or other future platform features.

Before such features become available and involve new processing of personal data, this Policy may be updated.

2. Who is responsible for your data

Until a legal entity is incorporated to operate Varqena, the controller of the personal data processed under this Policy is:

Eduardo Rodrigues Leal, acting as the natural person responsible for decisions regarding Varqena's processing of personal data.

For matters related to privacy, data protection or the exercise of rights, contact:

support@varqena.com

In this document, references to "Varqena", "we", "us" or "our" refer to the Varqena project operated by the controller identified above.

3. What data we collect

3.1. Data provided through the waitlist

When you request early access, we may collect:

• Email address: used to identify your registration and contact you about your Early Access request.
• Liquidity Provider status: whether you currently identify yourself as a liquidity provider.
• Capital range: when applicable, the approximate capital range you declare for Liquidity Providing activities.
• Protocols used: liquidity or DeFi protocols you declare that you use.
• Main challenge: the category of problem or need selected in the form.
• Language: the language selected for your Varqena experience.

3.2. Data generated by the application

When your registration is recorded, our systems may also generate or associate operational information such as:

• an internal record identifier;
• creation date and time;
• registration source;
• the version of the Privacy Policy in effect at the time of registration;
• the verification status and date of the email address;
• operational metadata associated with the verification process.

These data are used for administration, security, traceability and governance of the waitlist.

3.3. Technical data

When you access the website, technical information may necessarily be processed by the infrastructure receiving your connection, including, as applicable, IP address, request time, HTTP headers, browser information, device information and data needed for routing, security and network operation.

Such information may be processed by our infrastructure providers according to their technical functions and applicable policies.

The Varqena application does not store IP addresses, User-Agent values or cookies in the waitlist table, and our explicit API logger does not record your email address or the contents of the waitlist form.

3.4. Communications with us

If you send a message to support@varqena.com, we may process your email address, the contents of your message and other information you voluntarily provide in order to respond to your request.

We recommend that you do not send information that is unnecessary for the support request.

4. Information we do not currently request

The current waitlist does not request:

• blockchain wallet addresses;
• private keys;
• seed phrases;
• passwords;
• payment card data;
• bank account information;
• identity documents;
• exchange or brokerage credentials.

Never send your seed phrase, private key or password through the form or by email.

If future features require new categories of data, they will be evaluated separately and this Policy will be updated when necessary.

5. How we use your data

We may use data processed under this Policy to:

• administer and maintain the waitlist;
• process your Early Access request;
• confirm that the user has access to the email address provided;
• send and manage transactional messages necessary to confirm the registration;
• contact you about Varqena's development and launch;
• communicate relevant stages of product development;
• inform you about testing opportunities and beta availability;
• send a potential Early Access invitation;
• understand aggregate profiles and needs of potential Varqena users;
• evaluate which features and problems should receive development priority;
• maintain application integrity and security;
• prevent abuse, fraud, spam and misuse;
• investigate technical failures;
• respond to support requests;
• address data subject rights requests;
• comply with applicable legal or regulatory obligations;
• exercise or defend legal rights when necessary.

We do not use waitlist data to sell contact lists to third parties.

6. Legal bases for processing

Varqena processes personal data only where an applicable legal basis exists.

For waitlist administration, Early Access planning, understanding user needs and protecting the platform, we may rely on legitimate interests, taking into account the purpose of the processing, the necessity of the data, reasonable expectations of the individual and their rights and freedoms.

Where processing is necessary to respond to a request initiated directly by you and is related to a potential future service relationship, preliminary procedures carried out at the request of the data subject may also apply where legally appropriate.

Where processing is required by law, we may rely on compliance with a legal or regulatory obligation.

For the establishment, exercise or defense of rights, we may rely on the corresponding legal grounds available under applicable law.

7. Waitlist-related communications and marketing

By requesting Early Access, you may receive communications directly related to Varqena's development and launch, including relevant product development updates, testing opportunities, beta availability and a potential access invitation.

Participation in the waitlist does not constitute general consent to receive newsletters, recurring promotional content or other marketing communications unrelated to Early Access.

If Varqena offers a newsletter or other promotional communications in the future, a separate, optional and specific opt-in will be provided.

Where consent is used for those communications, it may be withdrawn free of charge through an appropriate method.

Refusing or later opting out of marketing communications will not prevent you from participating in the waitlist.

8. Data sharing and service providers

We may use specialized service providers to operate Varqena.

Our currently relevant providers include:

Vercel, used for application hosting, content delivery, application and API execution, and infrastructure and security functionality.

Neon, used as PostgreSQL database infrastructure for storing waitlist records. The production database is currently configured in AWS South America East 1, São Paulo, Brazil.

Hostinger, used for services related to the domain and institutional email. If you contact us by email, information necessary for the communication may be processed through this infrastructure.

Resend, used to send transactional messages related to email verification and operation of the waitlist. To enable delivery, the recipient's email address and technical metadata necessary for message delivery may be processed through this infrastructure.

These providers may process information as necessary to provide their respective services and in accordance with the terms and policies applicable to their operations.

We may also disclose data where necessary to comply with a court order, legal obligation, valid request from a competent authority, protection of rights or investigation of abusive or unlawful use of the service.

We do not share waitlist data with advertisers for behavioral advertising.

Service providers may change as Varqena's infrastructure evolves. Material changes will be reflected in this Policy when appropriate.

9. International data transfers

The main database currently used for the waitlist is configured in a region located in São Paulo, Brazil.

However, some infrastructure providers or their subprocessors may operate systems, support, security or technical processing in other countries.

Where an international transfer of personal data is subject to applicable data protection law, legally permitted mechanisms will be considered as appropriate.

10. Cookies, local storage and similar technologies

In the current version of the landing page, the Varqena application does not create first-party cookies for analytics, advertising or marketing.

We also do not currently use advertising pixels, session replay tools or executable Web Analytics integrations in the application.

We use browser local storage ("localStorage") to remember your selected language preference.

This preference contains only the selected language, such as Portuguese, English or Spanish. It does not contain your email address or the data submitted through the waitlist form.

The information remains in your browser until it is replaced or deleted by you or by the browser.

Varqena's current email verification flow is configured without open or click tracking for this purpose.

Infrastructure providers may use technologies that are strictly necessary for the operation, protection and delivery of their services.

If we begin using non-essential cookies, analytics or advertising technologies requiring additional transparency or consent measures, this Policy and the website experience will be updated as appropriate.

11. Automated decisions and profiling

Information declared through the waitlist may be used to understand different profiles of potential users and guide product development.

At the stage covered by this Policy, we do not use waitlist data to make decisions producing legal or similarly significant effects on you solely through automated processing.

If this changes, we will provide the information required by applicable law and appropriate means for exercising rights related to automated decisions.

12. How long we keep data

As a general rule, data related to the waitlist will be retained for up to 24 months from the data subject's last relevant interaction with Varqena.

Before that period ends, data may be deleted when:

• the purpose for which they were collected has been fulfilled;
• they are no longer necessary;
• the Early Access program has ended and there is no legitimate reason to continue processing;
• a valid deletion request applies to the relevant data.

If the individual later becomes a user of a Varqena service, different retention periods may apply to that relationship and will be described in the corresponding privacy policy.

Certain information may also be retained for the period strictly necessary to comply with legal obligations, exercise or defend rights, prevent fraud or maintain security where permitted by law.

Following deletion, temporary copies may remain for a limited period in technical history, backup or recovery mechanisms until they are overwritten or expire according to the infrastructure's operational lifecycle.

Verification links use temporary tokens that remain valid for 60 minutes. The application does not store the usable token in plaintext; only a cryptographic hash is persisted for validation.

This retention policy does not mean that a TTL, cron job or automated database deletion routine currently exists.

13. How we protect your data

We adopt technical and organizational measures intended to reduce risks of unauthorized access, loss, alteration, improper disclosure or processing inconsistent with the purposes described in this Policy.

These measures may include:

• HTTPS-protected communications;
• server-side data validation;
• access controls;
• abuse protection;
• restricted database permissions;
• limitation of data included in explicit application logs.

No internet-connected system is completely immune from risk.

We therefore do not guarantee absolute security, but seek to adopt measures appropriate to the nature of the data and the current stage of the service.

If we identify a personal data security incident that creates notification obligations under applicable law, we will take the required measures.

14. Your rights

Under the Brazilian General Data Protection Law (LGPD), and where applicable to each situation, you may request:

• confirmation of processing;
• access to your personal data;
• correction of incomplete, inaccurate or outdated data;
• anonymization, blocking or deletion of unnecessary, excessive or unlawfully processed data;
• portability where applicable and subject to applicable regulation;
• information about entities with which your data has been shared;
• deletion of data processed on the basis of consent where applicable, subject to lawful retention exceptions;
• information about the possibility of refusing consent and the consequences, where consent is used;
• withdrawal of consent;
• objection to certain processing carried out without consent where the requirements of applicable law are not met;
• review of exclusively automated decisions affecting your interests where applicable.

To exercise these rights, contact:

support@varqena.com

We may request information strictly necessary to confirm your identity and protect your data against unauthorized disclosure.

We do not charge a fee merely for exercising rights provided by the LGPD.

You may also submit a petition to the Brazilian National Data Protection Authority (ANPD) in the circumstances provided by law.

15. People under 18

The Varqena landing page, waitlist and Early Access program are intended exclusively for people aged 18 or older.

We do not intentionally seek to collect personal data from people under 18 through the waitlist.

If we become aware that a person under 18 provided data contrary to this rule, we may delete the registration and corresponding data, subject to any applicable legal obligations.

16. Third-party links and services

The website may contain links to websites, social networks, documentation or other services operated by third parties.

Varqena does not control the privacy practices of those external services.

When accessing a third-party website, we recommend reviewing the privacy policy applicable to that service.

17. Changes to this Policy

We may update this Policy to reflect changes:

• to Varqena features;
• to categories of data processed;
• to our service providers;
• to processing purposes or legal bases;
• to applicable law or regulation;
• to the legal structure responsible for Varqena.

The update date and version will be displayed at the beginning of this document.

Where a change is material to data subjects, we may provide additional notice proportionate to the change and context of the processing.

If Varqena begins to be operated by a legal entity, this Policy will be updated to properly identify the new controller.

18. How to contact us

If you have questions about this Policy, the processing of your data or wish to exercise a data protection right, contact:

Varqena

Controller: Eduardo Rodrigues Leal

Privacy and support email: support@varqena.com

We will make reasonable efforts to review and respond to requests in accordance with applicable law.