Privacy Policy

Last updated: September 29, 2026

1. Introduction

This Privacy Policy explains how the Harbor team (the "Company," "we," "us") collects, uses, shares, and protects information in connection with our website at harbor.xyz (the "Site"), the Harbor Protocol, and related services (collectively, the "Services"). Capitalized terms not defined here have the meanings given in our Terms of Service.

The Site is a marketing website; the Company does not operate a user-facing trading interface for the Protocol and does not require you to create an account or submit personally identifying information to use the Protocol. We do collect certain information in connection with the Site, our compliance program, and any voluntary interactions you have with us (for example, emailing support). This Policy describes those practices.

Information broadcast to a public blockchain, including your Wallet address, the amounts and types of digital assets you transact, and the timing of your transactions, is public by design, permanently recorded across multiple blockchain networks, and outside the Company's control. We do not control public blockchain data and cannot amend or delete it. This Policy addresses only information that the Company itself collects or processes.

2. Information We Collect

2.1 Information Collected Automatically

When you visit the Site or otherwise interact with Company-operated infrastructure, we (and our service providers) may automatically collect:

• Network and device data: IP address, approximate geographic location derived from IP, Internet service provider, browser type and version, operating system, device type, screen resolution, language preferences, and referring URL;

• Usage data: pages visited, time spent on pages, links clicked, timestamps, and similar interaction data;

• VPN / proxy / anonymization indicators: signals that a connection originates from a VPN, proxy server, Tor exit node, or similar anonymizing service, collected for the purpose of enforcing jurisdictional restrictions described in our Terms of Service;

• Cookies and similar technologies: see Section 7 below.

2.2 Wallet Information

When your Wallet interacts with the Harbor Protocol, whether directly, through a third-party Wallet or interface, or through APIs operated by the Company, we may collect your public Wallet address, any destination or refund address you specify, and associated on-chain metadata (such as transaction history visible on public blockchains). We may use this information to:

• screen the Wallet against sanctions lists, known-illicit-activity databases, and risk-scoring heuristics maintained by our blockchain-analytics providers;

• determine whether to permit or deny the Wallet access to Company-operated services;

• detect circumvention of jurisdictional restrictions; and

• maintain records for compliance and security purposes.

We do not collect, and do not have access to, your private keys, seed phrase, or any authentication credentials controlling your Wallet.

2.3 Information You Provide

We collect information you voluntarily submit to us, including:

• Contact and support communications: your name, email address, message content, and any other information you provide when you email us (at legal@harbor.xyz), submit a form on the Site, or otherwise correspond with us;

• Institutional or counterparty onboarding information: if you are an institutional user, service provider, or counterparty entering a separate agreement with the Company, we may collect identifying information about your entity, authorized representatives, beneficial owners, and sources of funds, including information gathered for Know-Your-Business and enhanced due diligence purposes;

• Employment applications, vendor communications, and similar business inquiries;

• Survey or feedback responses you choose to provide.

2.4 Information from Third Parties

We may receive information about you from:

• Blockchain analytics providers, including Wallet risk scores, attribution data, and illicit-activity indicators;

• Sanctions and adverse-media screening providers;

• Identity verification providers (in the institutional onboarding context);

• Service providers such as hosting, analytics, email, customer-support, and anti-fraud vendors;

• Publicly available sources, including public blockchains, company registries, and news and media reports; and

• Law enforcement, regulators, and other governmental authorities in the course of investigations or legal process.

2.5 Information We Do Not Collect

For the avoidance of doubt, and because the Harbor Protocol does not require user accounts or KYC for ordinary use, we generally do not collect government-issued identifiers (passport, driver's license, national ID), Social Security or similar tax identifiers, date of birth, home address, biometric data, or payment card information from ordinary Protocol users. If we ever change this practice, we will update this Policy and, where required, obtain your consent.

3. How We Use Information

We use the information described above for the following purposes:

(a) Compliance and risk management. To enforce the eligibility and prohibited-use provisions of our Terms of Service; to screen Wallet addresses and network connections against sanctions lists and illicit-activity databases; to implement IP-based geoblocking and VPN detection; to detect and respond to suspected money laundering, terrorist financing, sanctions evasion, fraud, market manipulation, or other unlawful or prohibited activity; to maintain records required by law; and to respond to law-enforcement and regulatory inquiries.

(b) Security. To detect, investigate, and prevent unauthorized access, attacks, abuse of the Services, and threats to the integrity of the Harbor Protocol.

(c) Operation and improvement of the Services. To operate and maintain the Site, monitor performance, debug, and improve our products and communications.

(d) Communication and support. To respond to your inquiries, provide customer support, send transactional or administrative messages, and (where you have opted in) send marketing or product updates.

(e) Institutional and counterparty relationships. To conduct KYB / enhanced due diligence, to administer contracts, and to manage ongoing relationships with vendors, partners, and institutional users.

(f) Legal and governance. To exercise or defend legal rights, comply with legal obligations, enforce our agreements, and manage corporate governance matters.

(g) Aggregated and de-identified analysis. To produce aggregated or de-identified data that does not identify any individual; we may use and share such data freely.

3.1 Legal Bases (EEA/UK Users)

If you are located in the European Economic Area or the United Kingdom, our legal bases for processing are: (i) legal obligation (for AML, sanctions, and regulatory compliance); (ii) legitimate interests (for security, fraud prevention, risk management, and operation of our Services, balanced against your interests); (iii) contract performance (where we are providing services to you under an agreement); and (iv) consent (where required, for example for certain analytics cookies or marketing communications).

3.2 Automated Decisions

We use automated wallet screening. Based on a screening result, a Wallet may be blocked from Company-operated services, or a deposit may be declined or refunded, without human review at the time of the decision. Any refund may be held for compliance review before it is processed. If you believe an automated decision about your Wallet was wrong, you can ask for human review by contacting legal@harbor.xyz. See also the note on wallet-screening accuracy in Section 8.

4. How We Share Information

We do not sell your personal information. We share information only as described below:

(a) Service providers. With vendors that process information on our behalf, including hosting, cloud-infrastructure, analytics, email, customer-support, blockchain-analytics, sanctions-screening, VPN-detection, anti-fraud, and legal and professional-services providers. These providers are bound by written agreements that restrict their use of your information.

(b) Blockchain-analytics and compliance vendors. With blockchain-analytics and sanctions-screening providers for the purposes of Wallet screening, transaction monitoring, and risk analysis.

(c) Law enforcement and regulators. With law enforcement, regulators, courts, and other governmental authorities: (i) pursuant to a valid subpoena, court order, warrant, or similar legal process; (ii) as required by applicable law; (iii) in response to an emergency involving the safety of any person; or (iv) where we determine in good faith that disclosure is necessary to investigate, prevent, or respond to suspected illicit activity, fraud, security threats, or violations of our Terms of Service.

(d) Affiliates. With our corporate affiliates, subsidiaries, and parent entities, for purposes consistent with this Policy.

(e) Corporate transactions. In connection with any merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of our assets, subject to customary confidentiality protections and, where required, notice and choice.

(f) Counterparties under separate agreements. With auditors, advisors, and other counterparties under separate agreements, where information sharing is necessary for the relationship and permitted by law.

(g) With your consent. For any other purpose disclosed to you at the time we collect the information, or to which you otherwise consent.

5. International Transfers

Personal information we collect may be transferred to and processed in the United States and other countries where our service providers operate. Where required by applicable law, we use Standard Contractual Clauses or other lawful safeguards for such transfers.

6. Data Retention

We retain information only for as long as necessary to fulfill the purposes described in this Policy, comply with applicable law (including AML and sanctions recordkeeping obligations), resolve disputes, and enforce our agreements. When information is no longer needed, we delete, anonymize, or securely dispose of it.

7. Cookies and Similar Technologies

The Site uses cookies and similar technologies for security, analytics, and preferences. You can disable cookies through your browser settings; doing so may impair your ability to use the Site. We do not use third-party advertising cookies or cross-site tracking cookies.

Do Not Track. Some Internet browsers may be configured to send "Do Not Track" signals to the online services that you visit. We currently do not respond to "Do Not Track" signals. To find out more about "Do Not Track," please visit allaboutdnt.com.

8. Your Rights and Choices

Depending on where you live, you may have certain rights regarding your personal information, including the right to:

• Access the personal information we hold about you;

• Correct inaccurate information;

• Delete your information (subject to legal and compliance retention obligations described in Section 6);

• Object to or restrict certain processing;

• Data portability, where applicable;

• Withdraw consent where processing is based on consent; and

• Lodge a complaint with your local data-protection authority.

To exercise any of these rights, contact us at legal@harbor.xyz. We may need to verify your identity before acting on your request. Note that we cannot modify or delete information recorded on public blockchains, and certain compliance records must be retained even if you request deletion.

A note on accuracy for wallet-screening data. Wallet-risk scores and attribution are produced by third-party analytics providers and can contain errors. If you believe your Wallet has been incorrectly associated with illicit activity or sanctioned parties, contact us at legal@harbor.xyz with supporting information; we will investigate and, where appropriate, ask our vendors to reassess.

Opt-out of communications. You may opt out of marketing-related emails by following the unsubscribe instructions at the bottom of any such email, or by contacting us at legal@harbor.xyz. If you choose to opt out, you may continue to receive service-related and other non-marketing emails.

9. Security

We maintain reasonable administrative, technical, and physical safeguards designed to protect information against unauthorized access, disclosure, alteration, or destruction. However, no system is perfectly secure, and we cannot guarantee the security of any information you transmit to us or that we store. You are responsible for the security of your Wallet, your private keys, and the devices you use to access the Services.

10. Third-Party Services

The Site may link to, or the Harbor Protocol may be accessed through, third-party websites, applications, or interfaces that we do not operate or control. This Policy does not apply to those third parties. We encourage you to review the privacy policies of any third parties you interact with.

11. Children

The Services are not intended for use by anyone under 18 years of age. If you are a parent or guardian of a child from whom you believe we have collected personal information in a manner prohibited by law, please contact us. If we learn that we have collected personal information through the Services from a child without the consent of the child's parent or guardian as required by law, we will comply with applicable legal requirements to delete the information.

12. Changes to This Policy

We may update this Policy from time to time. When we do, we will revise the "Last updated" date above and, if the changes are material, provide additional notice (for example, by posting a prominent notice on the Site). Your continued use of the Services after the effective date of the updated Policy constitutes acceptance of the changes.

13. Contact Us

If you have questions about this Policy or our privacy practices, contact the Harbor team at legal@harbor.xyz.