Lucid Privacy Notice

Imagine Tech Limited is the controller for personal information processed through Lucid-controlled website surfaces, browser-access wallet routes, extension-download pages, support workflows, and related product experiences.

This notice applies only to Lucid-controlled surfaces. Third-party dapps, bridges, exchanges, block explorers, websites, or services you access through Lucid are governed by their own terms and privacy notices.

• We do not collect or store your private keys or secret recovery phrase.
• We do not sell your personal information.
• We try to minimize data collection and limit wallet-linked processing to what is needed for product functionality, security, support, routing, or legally required operations.
• Where wallet, RPC, or network-routing functionality relies on infrastructure requests, limited technical data such as IP address, user agent, and request metadata may be processed for latency management, abuse prevention, sanctions screening, or service integrity.

• Support and contact details, such as your name, email address, and the contents of messages you send us.
• Optional account or access information if we later enable browser-session authentication, early-access registration, or support profiles.
• Feedback, survey responses, product research responses, bug reports, screenshots, and diagnostic material you voluntarily share.
• Payment or billing information only if a paid feature, premium route, or future service requires direct payment processing.
• Technical and product usage information such as IP address, browser metadata, device type, timestamps, crash data, and security telemetry needed to run the product or defend it.
• Wallet address, chain identifier, request parameters, or transaction-related metadata where required to present balances, read blockchain state, estimate fees, or perform a user-initiated routing request under the active configuration.

• Directly from you, such as when you contact support, submit a form, answer a survey, provide feedback, or register for optional updates.
• Automatically from your browser, device, or extension environment when Lucid renders pages, protects sessions, routes wallet requests, or records security events.
• From blockchain data providers, RPC providers, or network infrastructure when a user-initiated request requires us or our providers to read public chain state, estimate fees, or route a request.
• From third-party integrations you choose to use through Lucid, where the relevant feature or workflow necessarily involves that provider.
• From public blockchain records, explorers, or ecosystem services where a transaction, approval, token transfer, or wallet interaction is already public by the nature of the protocol.

Blockchain networks are public or semi-public systems. When you use Lucid to sign, submit, or inspect on-chain activity, some related data such as wallet addresses, transaction hashes, approvals, transfers, contract interactions, and timestamps may become publicly visible on the relevant network or through third-party indexing services.

Deletion or correction rights that apply to data under our control do not allow us to alter public blockchain records, third-party explorer archives, or independent network replicas that we do not control.

Lucid is designed to avoid custody of wallet secrets. We do not collect or retain your private keys or secret recovery phrase, and we cannot restore or rotate them for you.

• To operate Lucid and deliver requested wallet, routing, extension, or browser-session functionality. Legal basis: performance of a contract, steps requested before entering a contract, or legitimate interests in operating the product.
• To secure Lucid, prevent fraud, mitigate abuse, respond to incidents, and comply with sanctions or legal restrictions. Legal basis: legitimate interests and compliance with legal obligations.
• To answer support requests, investigate reports, and maintain service records. Legal basis: legitimate interests and, where applicable, steps requested before entering a contract.
• To measure performance, diagnose failures, and maintain product reliability. Legal basis: legitimate interests and, where required for optional analytics, consent.
• To send product updates or launch communications where you opt in or where otherwise permitted by law. Legal basis: consent or legitimate interests where legally available.

When Lucid or related browser surfaces need to fetch blockchain data, estimate fees, read token balances, or route requests to infrastructure providers, certain technical request data may be processed. Depending on how Lucid is configured, that can include an IP address, browser metadata, approximate region, wallet address, transaction metadata, and requested chain identifiers.

We use this processing to deliver basic functionality, reduce latency, route requests safely, troubleshoot outages, apply security controls, and comply with lawful restrictions. That can include sanctions screening, abuse-prevention logic, vendor-level safety controls, and temporary restrictions on a feature, network, or routing path.

Where configurable, advanced users may choose different infrastructure or privacy configurations when those options are made available. A different configuration can change the data path, privacy posture, and support assumptions for the relevant request.

Lucid may use cookies, local storage, and similar technologies for consent handling, security, remember-me behavior, feature continuity, language or display preferences, and the technical operation of browser wallet surfaces.

Where legally required, we will request consent before enabling non-essential analytics or marketing cookies. On the covered browser surfaces in this repository, a supported Global Privacy Control signal is recognized as a restrictive baseline for optional browser categories until you later make an explicit site-specific choice.

You can also adjust browser settings or use privacy tools such as VPNs or content blockers, although doing so may affect product performance, extension behavior, or routing outcomes.

• Within Imagine Tech Limited and its controlled affiliates where needed to operate Lucid.
• With service providers that support hosting, analytics, cybersecurity, email delivery, customer support, product diagnostics, or fraud prevention.
• With infrastructure and third-party platforms only where necessary to fulfill a request you initiate through Lucid or where technically required for a selected feature.
• With regulators, law enforcement, or courts where required by law or where we reasonably believe disclosure is necessary to protect rights, safety, or the integrity of Lucid.
• In connection with a merger, acquisition, financing, restructuring, or sale of assets, subject to appropriate confidentiality safeguards.
• For the covered Lucid repository surfaces, a public vendor and subprocessor register is maintained at /subprocessors as part of the transparency baseline.

Lucid may use service providers or infrastructure located in multiple jurisdictions. Where personal information is transferred internationally, we aim to rely on appropriate safeguards such as contractual commitments, adequacy mechanisms, or equivalent protections where required by law.

If you want more detail about the transfer safeguards relevant to your use, contact us using the details below.

• Support and contact records: retained for as long as reasonably necessary to answer, document, and follow up on the request, plus any applicable legal retention period.
• Security, abuse-prevention, and performance logs: retained for the period reasonably necessary to protect the service, investigate misuse, and satisfy legal or audit needs.
• Consent and preference records: retained for the period necessary to remember or evidence the user's choice, subject to the applicable storage period and law.
• Wallet-related request metadata: retained only for the period reasonably necessary to operate the relevant feature, troubleshoot incidents, or satisfy legal obligations, unless a longer period is required by law or a specific workflow.
• Where data is no longer needed for the disclosed purpose and is not subject to a security, dispute, legal, or audit hold, we aim to delete, minimize, anonymize, or archive it in line with the applicable retention schedule.

You may voluntarily send us screenshots, logs, diagnostics, crash reports, or other support materials. Please do not send private keys, seed phrases, secret recovery phrases, or credentials that would let anyone move your assets or impersonate your wallet.

If you nevertheless include credential material in a support request, we may be unable to guarantee complete removal from every downstream support or email system that already processed the submission. You should treat wallet credentials as uncompromisable secrets and rotate or abandon them if they are exposed.

We do not currently sell personal information as that term is commonly used in modern privacy statutes, and we do not intentionally activate cross-context behavioral advertising on the covered Lucid surfaces before the corresponding notice and control requirements are in place.

If a future Lucid surface introduces a data practice that triggers sale, sharing, targeted advertising, or sensitive-information limitation obligations, we will update the notice and controls before activating that practice for the relevant users.

Lucid may direct you to third-party dapps, block explorers, browser stores, token pages, and ecosystem resources, including Ghost App and external tokenomics materials for $ANO. We are not responsible for the privacy practices of those third parties, and their handling of your information is governed by their own policies.

Lucid is not designed to make solely automated decisions with legal or similarly significant effects about users on the basis of personal data alone. If a specific workflow changes that position, we will update the relevant notice and explain the logic and consequences where required.

• EEA, UK, and similar regimes: you may have rights to access, rectify, erase, restrict, object, port your data, withdraw consent, and complain to a supervisory authority.
• California residents: you may have rights to know categories, sources, purposes, disclosures, and specific pieces of personal information, request deletion or correction, opt out of sale or sharing, use an authorized agent, limit certain sensitive-personal-information uses where applicable, and receive non-discriminatory treatment.
• Virginia, Colorado, and Connecticut residents: you may have rights to access, correct, delete, obtain a portable copy of personal data, opt out of targeted advertising, sale, or certain profiling, and appeal a denial under the rules of the relevant state.
• Utah residents: you may have rights to confirm processing, access personal data, delete personal data you provided to us, obtain a portable copy of that data, and opt out of targeted advertising or sale where applicable.
• Brazilian users: you may have rights to confirmation of processing, access, correction, anonymization, blocking, deletion, portability, information about public and private entities with which data is shared, consent withdrawal, and petition to the ANPD or consumer-protection bodies where applicable.
• Argentine users: you may have rights to information, access, rectification, update, suppression, confidentiality, and habeas-data style recourse, including complaint routes to the AAIP.
• Chilean users: current rights and the Law 21.719 reform track are treated as part of an implementation path. Before the reform effective date, any remaining Chile-specific deltas should be finalized before a market-specific launch relies on them.
• Colombian users: you may have rights of consultation, update, rectification, deletion, revocation, and complaint handling before the SIC, generally after first using the controller-side request route.
• Mexican users: you may have ARCO rights of access, rectification, cancellation, and opposition, as well as consent-revocation pathways and complaint routes before INAI where applicable.
• Israeli users: you may have rights and protections under the Protection of Privacy Law, 5741-1981, related regulations, and any database-management or transfer rules that apply to the relevant system and use case.

To exercise privacy rights, use the Privacy Request Center or contact privacy-requests@imagine-tech.org. We may need to verify your identity, authority, or relationship to the data before completing a request, and we may ask for additional information where this is reasonably necessary to prevent unauthorized disclosure or deletion.

Where local law allows the use of an authorized agent or representative, we may require signed authority, proof of identity, or direct confirmation from the user before completing the request. If we deny or limit a request, we will explain the decision to the extent required by law and preserve any appeal route that applies to the jurisdiction.

You may also complain to the relevant supervisory or regulatory authority where local law gives you that right, including an EEA or UK supervisory authority, the California Privacy Protection Agency or other relevant California authority, the applicable US state attorney general or consumer-protection authority, the ANPD in Brazil, the AAIP in Argentina, the SIC in Colombia, INAI in Mexico, or the relevant Israeli privacy or court forum as applicable.

Lucid is not intended for unsupervised use by children, and we do not knowingly collect personal data from children in a manner that would require a dedicated parental-consent flow without implementing that flow first.

We may also restrict access where sanctions, export controls, anti-money-laundering controls, or local law make a user or jurisdiction ineligible for the relevant service.

We implement administrative, technical, and organizational measures reasonably designed to protect personal information. No system is perfectly secure, and no internet transmission is guaranteed to be safe. You should keep this in mind when sending support messages or diagnostic material to us.

If you believe your interaction with Lucid has exposed a privacy or security issue, contact us promptly at support@imagine-tech.org.

We may update this Privacy Notice to reflect legal, technical, product, or operational changes. The revised version will be posted on the relevant Lucid surface together with an updated revision date. Your continued use of Lucid after changes become effective means you acknowledge the updated notice.

For privacy requests, contact privacy-requests@imagine-tech.org. For general support, contact support@imagine-tech.org. For legal correspondence, contact legal@imagine-tech.org.

Mailing address: Unit 1-3, Irish Place, Irish Town, GX11 1AA, Gibraltar.