XNDR.network / Legal

Presale Privacy Notice

Effective Date: November 11, 2026 Last Updated: November 11, 2026

This XNDR Presale Privacy Notice (the “Privacy Notice”) explains how ALX Labs, LLC (“ALX Labs,” “we,” “us,” or “our”) collects, uses, discloses, and otherwise processes personal information in connection with the official XNDR Network presale portal (the “Portal”) and the XNDR token presale (the “Sale”).

This Privacy Notice applies only to processing for which ALX Labs determines the purposes and means. Third-party wallets, blockchain networks, wallet-connection providers, block explorers, infrastructure providers, and websites may independently process information under their own privacy notices and terms.

Before the Sale opens, the Portal does not provide a purchase flow, wallet connection, payment processing, KYC/AML form, or accredited-investor verification. The processing described below relating to those functions applies when and to the extent those functions become available.

1. Controller and Contact Information

ALX Labs, LLC is the controller or business responsible for personal information processed by ALX Labs through the Portal, except where applicable law or the nature of a third-party service provides otherwise.

ALX Labs, LLC Our mailing address will be provided upon request. Privacy inquiries: privacy@alxlabs.io

Information about a data protection officer or an EU or UK representative, where applicable law requires one, will be provided upon request to privacy@alxlabs.io.

2. Information We Process

Depending on how you use the Portal and participate in the Sale, we may process the following categories of information.

Wallet and Blockchain Information

When you connect a wallet or interact with the Sale, we or our service providers may process information such as:

• your public wallet address;
• selected blockchain network;
• wallet connection and session information;
• selected payment token;
• transaction hashes and identifiers;
• transaction status;
• token approvals;
• purchase, allocation, vesting, and claim information; and
• other information publicly associated with your wallet or transactions on the applicable blockchain.

Blockchain information may be publicly available and may be copied, indexed, analyzed, or retained by third parties independently of ALX Labs.

A public wallet address may constitute personal information under some privacy laws when it identifies, relates to, or can reasonably be linked with an individual.

Device, Network, and Technical Information

When you access or use the Portal, ALX Labs and its hosting, security, analytics, wallet-connection, RPC, and other infrastructure providers may automatically process technical information such as:

• IP address;
• browser type and version;
• device and operating-system information;
• language or regional settings;
• referring and requested URLs;
• request date and time;
• connection and session information;
• network and RPC requests;
• security-event information;
• diagnostic information; and
• error, performance, and server logs.

The specific information processed depends on the Portal configuration and the services used to operate it.

Communications and Support Information

If you contact ALX Labs, we may process your email address, name or other identifier you choose to provide, the contents of your communication, attachments, and information reasonably necessary to investigate and respond to your request.

Compliance and Security Information

Where necessary or appropriate for security, fraud prevention, sanctions compliance, legal compliance, or enforcement of the Presale Terms, we may process information derived from public blockchains, sanctions lists, fraud-prevention tools, wallet-screening services, or other lawful sources.

This information may include risk indicators or information concerning wallet activity and associations.

If ALX Labs later implements additional identity, eligibility, KYC, AML, sanctions, or similar compliance procedures, we will provide any additional privacy disclosures required by applicable law.

3. Information We Do Not Request Through the Standard Wallet Purchase Flow

The standard wallet-only purchase flow is not intended to request:

• private keys;
• seed phrases or recovery phrases;
• wallet passwords;
• identity documents or selfies;
• tax records;
• payment-card numbers; or
• source-of-funds documentation.

You should not send private keys, seed phrases, recovery phrases, or wallet passwords to ALX Labs or to anyone claiming to represent ALX Labs.

ALX Labs does not need these credentials to process a Sale transaction and will not ask you to disclose them.

The fact that the standard purchase flow does not request particular information does not prevent ALX Labs from requesting information later where reasonably necessary to satisfy a legal, regulatory, sanctions, security, fraud-prevention, or compliance requirement.

4. Sources of Information

We may obtain personal information:

• directly from you when you interact with the Portal or contact us;
• automatically from your browser, device, or connection;
• from the wallet you choose to connect;
• from public blockchain networks;
• from wallet-connection, RPC, hosting, security, support, and other service providers; and
• where appropriate, from public records, sanctions lists, blockchain-analysis services, fraud-prevention services, or other lawful sources.

5. Wallet Connections and Third-Party Providers

The Portal uses the following providers and software. Each receives only what is described here from the Portal, and may process further information under its own privacy notice where it acts independently of ALX Labs.

• Hosting (Vercel). The Portal is hosted by Vercel, which processes your IP address, browser information, and the requests your browser makes to the Portal, including request logs.
• Web analytics (Vercel). The Portal’s pages use Vercel Web Analytics, which counts page views without cookies. For each page view, Vercel records the page address, the referring page, the approximate location (country, region, and city), and the browser, operating system, and device type, and counts visitors by a hash of the request that Vercel discards after 24 hours. Vercel Web Analytics does not receive your wallet address from the Portal.
• Blockchain reads (ALX Labs’ server and Alchemy). To show balances, allowances, quotes, purchases, and vesting schedules, the Portal sends read requests through ALX Labs’ server to its RPC provider, Alchemy. Requests that check your USDC or ETH balance, allowance, or permit nonce, the XNDR you have purchased, or whether you have a vesting schedule, and requests for that schedule’s identifier, contain your wallet address. So does the request that tests a vesting or claim transaction without sending it, which the Portal makes before your wallet is asked to approve it. Requests that read the schedule’s total, released, vested, and releasable amounts contain its identifier, which is derived from your wallet address. Requests for the Sale’s finalization and TGE times do not contain your wallet address. ALX Labs’ server receives them with your IP address; the RPC provider receives the request without your IP address or browser headers.
• Browser wallets. If you connect a wallet extension installed in your browser, such as MetaMask, the Portal exchanges connection, signature, and transaction requests with it directly.
• Coinbase Wallet SDK (Coinbase). The Portal’s wallet software includes Coinbase’s SDK so that you can choose Coinbase Wallet. Once the wallet software loads, the SDK may send usage events, with a device identifier it generates, to Coinbase at cca-lite.coinbase.com. If you choose Coinbase Wallet, the SDK opens Coinbase’s window at keys.coinbase.com and uses Coinbase’s network service at chain-proxy.wallet.coinbase.com, which receive your wallet address and requests.
• Reown (WalletConnect), where offered. If the Portal offers Reown’s wallet chooser or its card and bank funding option, Reown and any funding provider you select receive your wallet address, network, and device information.

ALX Labs does not control the privacy practices of independent third parties and does not make their privacy notices part of this Privacy Notice.

Information about any other security, blockchain-analysis, support, or other material service providers will be provided upon request to privacy@alxlabs.io.

6. Blockchain Transactions

Payment, allocation, token-delivery, vesting, and claim transactions may occur through smart contracts deployed on a public blockchain.

Information submitted to a public blockchain may become permanently and publicly accessible. Blockchain information can be viewed, copied, indexed, analyzed, or redistributed by independent third parties anywhere in the world.

Because ALX Labs does not control the blockchain or independent network participants, ALX Labs generally cannot alter, erase, or restrict information that has been recorded on a public blockchain.

Connecting a wallet to the Portal does not give ALX Labs custody or control of your wallet, private keys, or digital assets. Transactions are authorized through your wallet and executed through the applicable blockchain infrastructure.

7. How We Use Information

ALX Labs may process personal information as reasonably necessary to:

• operate, maintain, secure, and improve the Portal;
• provide wallet-connection and Sale functionality;
• prepare, submit, verify, and monitor transactions;
• determine or display purchase, allocation, vesting, and claim information;
• provide technical and customer support;
• detect, investigate, prevent, and respond to fraud, abuse, security incidents, malicious activity, and technical problems;
• protect the Portal, smart contracts, ALX Labs, participants, and others;
• comply with applicable laws, regulations, court orders, sanctions requirements, and lawful governmental requests;
• establish, exercise, or defend legal claims;
• enforce the Presale Terms and other applicable agreements;
• conduct internal auditing, debugging, monitoring, and recordkeeping; and
• perform other purposes disclosed when information is collected or otherwise permitted by applicable law.

8. Legal Bases for Processing

Where applicable law requires ALX Labs to identify a legal basis for processing personal information, information about the applicable legal bases will be provided upon request to privacy@alxlabs.io.

Where ALX Labs relies on legitimate interests, those interests may include operating and securing the Portal and Sale, preventing fraud and abuse, maintaining business records, protecting legal rights, and improving the reliability of ALX Labs’ systems, subject to the balancing requirements of applicable law.

9. Disclosure of Personal Information

ALX Labs may disclose personal information:

• to vendors and service providers that host, secure, maintain, operate, monitor, or support the Portal and Sale;
• to wallet-connection, RPC, blockchain infrastructure, cybersecurity, fraud-prevention, and support providers;
• through a public blockchain when you authorize and submit a blockchain transaction;
• to professional advisers, including lawyers, accountants, auditors, insurers, and consultants;
• to governmental, regulatory, judicial, law-enforcement, or other authorities where disclosure is required or permitted by law;
• where reasonably necessary to investigate fraud, security threats, unlawful conduct, or violations of applicable terms;
• where reasonably necessary to protect the rights, property, safety, or security of ALX Labs, participants, or others; and
• in connection with an actual or proposed merger, financing, acquisition, reorganization, sale of assets, insolvency proceeding, or similar corporate transaction, subject to applicable law.

ALX Labs does not disclose private keys or seed phrases because the Portal is not designed to collect them.

10. Sale or Sharing of Personal Information and Advertising

ALX Labs does not use the wallet-only Sale flow to sell personal information for monetary consideration or for cross-context behavioral advertising.

The Portal contains no advertising code. Vercel Web Analytics’ page-view counts and the Coinbase Wallet SDK’s usage events are described in Section 5.

Any further disclosures required under applicable U.S. state privacy laws will be provided upon request to privacy@alxlabs.io.

If ALX Labs later changes its practices in a manner that triggers additional notice or opt-out requirements, ALX Labs will provide the disclosures or choices required by applicable law.

11. Cookies and Similar Technologies

The Portal and its service providers may use cookies, local storage, SDKs, connection identifiers, or similar technologies where necessary to provide wallet connectivity, security, fraud prevention, preferences, session functionality, performance monitoring, or other Portal functions.

The Portal’s own code sets no cookies. It uses your browser’s local storage as follows:

• the wallet-connection library stores the wallet you last connected, its address, and its network, so that you stay connected when you return, until you disconnect or clear your browser’s storage; and
• the Coinbase Wallet SDK stores its device identifier and, if you use Coinbase Wallet, its session information.

Where the Portal offers Reown, Reown’s software stores its own session information in the same way.

Where applicable law requires consent for a particular technology, ALX Labs will seek consent before using that technology.

12. International Data Transfers

ALX Labs and its service providers may process information in jurisdictions other than the jurisdiction where you are located.

Where applicable law requires safeguards for an international transfer of personal information, ALX Labs will use an applicable transfer mechanism or other lawful safeguard.

Information about the transfer mechanism used for a particular transfer will be provided upon request to privacy@alxlabs.io.

Public blockchain transactions present different considerations because information submitted to a decentralized blockchain may be replicated by independent network participants in multiple jurisdictions outside ALX Labs’ control.

13. Data Retention

ALX Labs retains personal information for as long as reasonably necessary for the purposes described in this Privacy Notice, including to operate the Sale, maintain transaction and business records, comply with legal obligations, resolve disputes, enforce agreements, prevent fraud, and protect legal rights.

Specific retention periods may vary based on the nature of the information and applicable legal requirements.

Information about the retention period for a particular category of personal information will be provided upon request to privacy@alxlabs.io.

Information recorded on a public blockchain may remain publicly available indefinitely and is generally outside ALX Labs’ ability to delete or modify.

14. Data Security

ALX Labs uses administrative, technical, and organizational measures designed to protect personal information against unauthorized access, loss, misuse, alteration, or disclosure.

No method of transmission, storage, blockchain interaction, or information-security system is completely secure. Accordingly, ALX Labs cannot guarantee absolute security.

Participants are responsible for maintaining the security of their wallets, devices, private keys, seed phrases, recovery credentials, and transaction approvals.

15. Your Privacy Rights

Depending on where you reside and applicable law, you may have rights concerning personal information processed by ALX Labs, which may include rights to:

• request access to or information about personal information;
• request correction of inaccurate personal information;
• request deletion of certain personal information;
• request restriction of processing;
• object to certain processing;
• obtain certain information in a portable format;
• withdraw consent where processing is based on consent;
• opt out of certain sales, sharing, targeted advertising, or profiling where applicable; and
• complain to an applicable privacy or data-protection regulator.

These rights are not absolute and may be subject to exceptions, verification requirements, legal-retention obligations, and other limitations under applicable law.

ALX Labs may request information reasonably necessary to verify a request and the requester's authority to make it.

Because public blockchain records are maintained by decentralized networks and independent participants, ALX Labs may be unable to alter or delete information recorded on a blockchain even when ALX Labs deletes corresponding information from systems under its control.

To submit a privacy request:

Email: privacy@alxlabs.io

Information about how requests are verified, any appeal process where applicable law provides one, and response periods will be provided upon request to privacy@alxlabs.io.

ALX Labs will not unlawfully discriminate against a person for exercising an applicable privacy right.

16. Children

The Sale and Portal are not directed to children, and ALX Labs does not knowingly seek to collect personal information from children through the Sale.

A person must satisfy the minimum-age requirements applicable to participation in the Sale:

The Presale Terms require each participant to satisfy any minimum-age requirement that applies to them and, in all events, to be at least 18 years of age.

If ALX Labs learns that it has processed a child's personal information in circumstances prohibited by applicable law, ALX Labs will take appropriate steps consistent with applicable legal requirements and the technical limitations of public blockchains.

17. Changes to This Privacy Notice

ALX Labs may update this Privacy Notice from time to time to reflect changes in the Sale, Portal, technology, service providers, legal requirements, or privacy practices.

When ALX Labs updates this Privacy Notice, it will publish the revised version and update the effective or “Last Updated” date above.

Where applicable law requires additional notice or consent for a material change, ALX Labs will provide that notice or seek that consent as required.

18. Contact Us

Questions, concerns, and requests regarding this Privacy Notice or ALX Labs’ processing of personal information may be directed to:

ALX Labs, LLC Our mailing address will be provided upon request. Email: privacy@alxlabs.io

Contact information for a data protection officer or an EU or UK representative, where applicable law requires one, will be provided upon request to privacy@alxlabs.io.