PRIVACY POLICY FOR VIBE PASSPORT APP

Effective Date: [05.06.2025]

1. Introduction

This Privacy Policy describes how MultiversX Labs AG, a company incorporated under the laws of Liechtenstein with registered offices at Werdenbergerweg 11, 9490 Vaduz, Liechtenstein ("we", "us", or "our"), collects, processes, stores, and protects your personal data in connection with the use of the Vibe Passport App ("Passport" or "App"). The Passport App provides decentralized authentication services within the VibeOX ecosystem and is designed with a strong emphasis on user privacy and data minimization. This Privacy Policy is intended to comply with the General Data Protection Regulation (EU) 2016/679 ("GDPR"), as well as applicable Liechtenstein and EEA data protection laws.

2. Data Controller

The controller of your personal data under Article 4(7) GDPR is:

MultiversX Labs AG
c/o SERATIO Treuunternehmen reg.
Werdenbergerweg 11
9490 Vaduz, Liechtenstein
Email: [email protected]

3. Scope of Application

This policy applies exclusively to the processing of personal data by the Passport App in its role as an authentication and identity layer. It does not apply to data processing carried out by other services or platforms that integrate with Passport. Those third-party controllers are responsible for providing separate privacy disclosures.

4. Categories of Personal Data Processed

The Passport App is built on principles of data minimization and privacy by design. We only collect and process the following categories of personal data:

• Email address: Collected during social login (e.g., via Google) and used solely for authentication and identity binding.
• Authentication metadata: Timestamp of login, key type, and pseudonymous app interaction metadata (e.g., success/failure of authentication).

We do not collect:

• Names, contact information, or biometric data
• IP addresses, device identifiers, or geolocation
• Seed phrases, wallet balances, or private keys
• Audio, camera, or microphone data

5. Legal Basis for Processing

We rely on the following lawful bases under GDPR for the processing of your personal data:

• Article 6(1)(b) – Processing is necessary for the performance of a contract (your use of the App).
• Article 6(1)(f) – Legitimate interest in providing a secure, functional, and user-friendly authentication experience.

In exceptional cases (e.g., to comply with legal obligations), processing may be based on:

• Article 6(1)(c) – Compliance with a legal obligation.

6. Purpose of Processing

Your personal data is processed exclusively for the following purposes:

• To enable secure authentication using passkey technology
• To link your social login identity to cryptographic credentials
• To facilitate decentralized login to VibeOX and integrated dApps
• To ensure service integrity, security, and accountability

Your email address is not used for marketing, advertising, profiling, or analytics.

7. Data Retention

We retain your email address and related metadata only for as long as necessary to:

• Provide the authentication service
• Maintain user session continuity
• Fulfill legal or regulatory obligations, where applicable

If you delete the Passport App or revoke access via your social login provider, your data will be deleted from our systems within 30 days, unless retention is legally required.

8. Data Sharing and Recipients

We do not sell, rent, or disclose your personal data to third parties. The only instances where data may be shared are:

• With trusted sub-processors (e.g., secure cloud authentication providers) under GDPR-compliant contracts
• With legal authorities, upon valid legal request and subject to strict scrutiny

All recipients are located within the European Economic Area (EEA) or in jurisdictions that ensure an adequate level of protection.

9. Data Transfers

We do not transfer your personal data outside the EEA. If future operations involve international transfers, we will:

• Use Standard Contractual Clauses (SCCs) approved by the European Commission
• Implement additional technical and organizational safeguards

10. Your Rights Under GDPR

As a data subject, you have the following rights:

• Right of access (Art. 15 GDPR): Obtain confirmation of whether your data is being processed and access to that data
• Right to rectification (Art. 16 GDPR): Request correction of inaccurate or incomplete data
• Right to erasure (Art. 17 GDPR): Request deletion of your data when it is no longer necessary
• Right to restriction of processing (Art. 18 GDPR): Limit processing under certain conditions
• Right to data portability (Art. 20 GDPR): Receive your data in a structured, commonly used format
• Right to object (Art. 21 GDPR): Object to processing based on legitimate interests
• Right to lodge a complaint with a supervisory authority in your country or in Liechtenstein

To exercise your rights, contact: [email protected]

11. Automated Decision-Making and Profiling

We do not use your personal data for profiling or automated decision-making that produces legal or similarly significant effects.

12. Security Measures

We implement state-of-the-art technical and organizational measures to protect your personal data, including:

• End-to-end encryption of authentication processes
• Zero access to your passkey or private key
• Data minimization and pseudonymization protocols
• Regular security audits and compliance checks

Your passkey and biometric data remain securely on your device and are never transmitted to or accessible by us.

13. Updates to This Policy

We may update this Privacy Policy to reflect legal, regulatory, or operational changes. When we make material changes, we will notify you via the App or your registered email address, and provide an updated version for review. We encourage you to periodically review this policy to stay informed of our data protection practices.

14. Contact

For questions, concerns, or to exercise your rights under GDPR, please contact:

MultiversX Labs AG
c/o SERATIO Treuunternehmen reg.
Werdenbergerweg 11
9490 Vaduz, Liechtenstein
Email: [email protected]