Privacy Policy

Effective Date: 05 September 2025

OWNAI Lab Inc. (“we,” “our,” or “us”) is committed to protecting your personal data (“Personal Data”) and upholding the highest standards of privacy and data security.

This Privacy Policy outlines how we collect, use, share, and safeguard your personal data when you access or interact with our services. It also explains your rights regarding your personal information and how you can reach us with questions or concerns.

We treat your data responsibly and in accordance with applicable privacy laws and regulatory requirements. This policy does not cover third-party platforms that may be linked to our website but are not operated by us.

1. Acceptance of Terms

By accessing, using, or engaging with our services, you acknowledge and agree to the collection, processing, and handling of your information as described in this Policy. If you do not agree with this Privacy Policy, please refrain from using or accessing the services.

2. Legal Basis for Processing

We rely on the following legal bases to process your personal data. Where required, we process your data based on your explicit consent, such as when you agree to undergo KYC. In addition, certain data is processed to comply with applicable laws and regulatory obligations.

3. Collection of Personal Data

OWNAI LAB does not directly collect or store personal information for identity verification. Instead, we utilize third-party service providers for Know Your Customer (KYC) compliance. The information below is essential for providing our services, and we will not be able to provide the requested services without it. We do not collect additional categories of personal data without informing you.

We may collect or receive information that is automatically collected during your use of the service. This includes public blockchain data such as wallet addresses, transactions, and token balances. We may also collect technical information including your IP address, device type, operating system, browser type, and approximate geolocation at the city or country level. If you contact us for assistance, you may provide details such as your email address, wallet address, and other information relevant to your request, which may include payment or transaction data. We may also collect data regarding your clickstream activity and usage behavior on our site.

We engage independent third-party providers to carry out Know Your Customer (KYC) and Anti-Money Laundering (AML) checks as part of the service experience. These third parties collect and process your identity documents and conduct the necessary compliance reviews. OWNAI LAB does not receive or store your identity documents. Instead, we receive limited verification results such as your verification status, a unique user reference or hash, and similar metadata. You should consult the privacy policy of the respective KYC provider for more information on how they manage your personal data. Where mandated by law or regulatory requirements, we may obtain limited personal information from the KYC provider in connection with the verification process.

4. Purpose of Data Use

We may process your personal data for the following purposes. We use your data to enable participation in our website and related services, provide ongoing access and functionality, communicate with you about service usage, and offer support when needed. Your information helps us detect and investigate misuse, unauthorized access, fraudulent activity, violations of our terms, and other potentially harmful or unlawful conduct. We also use personal data to respond to your inquiries, troubleshoot technical issues, and communicate with you regarding service-related matters. With your consent, we may use your data to send announcements, promotional materials, updates, and other information relevant to our services and ecosystem. In addition, we may analyze aggregated usage patterns to better understand how our services are accessed and improve the functionality, design, and performance of our platform. Lastly, we may process personal data to comply with applicable laws, respond to regulatory or legal requests, enforce our Terms of Use, pursue or defend legal claims, and fulfill our obligations under AML/CFT and other compliance frameworks.

5. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes described in this Privacy Policy or as otherwise directed by you. This may include retaining certain information to meet legal, accounting, or compliance requirements. In some cases, we may be required or permitted by law to retain data for longer periods—for example, where it is necessary to establish, exercise, or defend legal claims, handle regulatory investigations, or respond to formal complaints.

6. International Transfers

We are headquartered in the Republic of Panama and provide services to users globally. If you access our services from outside Panama, your personal data may be transferred across international borders as part of normal service operations.

In such cases, we will make reasonable efforts to implement appropriate safeguards to ensure that your personal data is handled in a manner consistent with applicable data protection standards and the rights of data subjects.

7. Disclosure of Personal Data

We may disclose your personal data when required to do so by law or legal process, including in response to lawful requests by public authorities such as court orders, regulatory inquiries, or government investigations.

In such cases, the recipient of your information may not be subject to the same level of security for your personal data as under your jurisdiction.

Additionally, in the event of transfer of business or corporate restructuring, your personal data may be disclosed or transferred as part of that transaction, provided such disclosure is subject to appropriate confidentiality safeguards.

8. Data Sharing and Third Parties

We may share data with third-party service providers where such disclosure is necessary for the proper operation and delivery of our services. These providers may assist with infrastructure hosting, system maintenance, network administration, cybersecurity protection, and customer support operations. In particular, we may utilize cloud-based platforms to store data and ensure stable service performance.

Additionally, we use Google Analytics to gain insights into how users interact with our website and to improve overall user experience. Data collected through Google Analytics is handled in accordance with Google’s own Privacy Policy. If you wish to opt out of this data collection, you can install Google’s official browser add-on available at: https://tools.google.com/dlpage/gaoptout.

9. Data Security

We are committed to protecting your personal data and have established a dedicated information security team to uphold that commitment. This team applies industry-standard technical, organizational, and physical safeguards to secure your data against unauthorized access, loss, or misuse. These measures include, but are not limited to, encryption, access controls, and secure deletion protocols. We continuously review and enhance our security practices to ensure ongoing protection of your personal information.

10. Your Rights

You have a number of rights concerning the personal data we collect and process. These rights may be exercised in accordance with applicable data protection laws. You have the right to request confirmation of whether we process your personal data and, if so, to receive a copy of such data along with information on how and why it is being used, including details about retention periods and any third parties with whom it is shared. In limited circumstances, we may deny access requests where permitted by law, in which case we will provide a clear explanation.

If the personal data we hold about you is inaccurate or incomplete, you may request that it be corrected or updated. Where direct correction via account settings is not possible, you may contact us, and we will make the necessary changes on your behalf.

You may request the deletion, anonymization, or removal of your personal data under certain circumstances. We will honor such requests unless we are required to retain the data for overriding legal, regulatory, or legitimate business reasons. If we are unable to comply, we will inform you of the reason.

In specific cases, such as where the accuracy of your data is disputed or the processing is unlawful, you may request that we limit how your data is used, rather than deleting it entirely.

You have the right to object to our processing of your data where it is based on our legitimate interests, including for direct marketing purposes. We will cease such processing unless we can demonstrate compelling legal grounds that override your interests or where processing is required to establish, exercise, or defend legal claims.

Where processing is based on your consent or a contract, you may request a copy of your personal data in a structured, machine-readable format, or ask that we transmit this data to a third party where technically feasible.

If you have given consent for the processing of your personal data, you have the right to withdraw it at any time. This will not affect the lawfulness of any processing carried out prior to the withdrawal. If your data has been shared with third parties based on your consent, you will need to contact those third parties separately to manage your preferences.

You will not be penalized, denied services, or otherwise discriminated against for exercising your rights under applicable data protection laws.

To ensure that requests are made by the rightful data subject or their authorized representative, we may request additional information to verify your identity or authority. Any information provided for this purpose will be used solely for verification. If you are submitting a request on behalf of another individual, you must provide valid documentation such as a signed power of attorney or legal proof of parental or guardian responsibility.

We will acknowledge receipt of your request within 30 business days. In most cases, we aim to fully respond within the same period. If more time is needed, up to an additional 30 days, we will inform you of the reason and expected timeline. Requests are processed free of charge. However, if a request is clearly excessive, repetitive, or unfounded, we may charge a reasonable fee to cover administrative costs. If so, you will be notified in advance along with a cost estimate

11. Cookies and Tracking

Cookies are small text files stored on your device when you visit a website. They help us recognize your device, remember your preferences, and deliver a seamless user experience. You can learn more about cookies in general at https://www.aboutcookies.org/

We use only essential cookies which are strictly necessary for the proper functioning of our services. They enable core features such as site navigation, security, and preference settings. Because these cookies are fundamental to service delivery, they cannot be disabled or declined.

12. Children's Privacy

Our services are not directed toward children, and we do not knowingly collect personal data from individuals under the age of majority. To access or use the service, you must have the legal capacity to enter into a binding contract in your jurisdiction.

13. Policy Updates

We may update this Privacy Policy from time to time to reflect changes in applicable laws, technological developments, or our data practices. Any revisions will be made available through our services, and the “Last Updated” date will indicate when the changes took effect.

By continuing to use or access the services after such updates are posted, you acknowledge that you have read and understood the most recent version of this Privacy Policy.

14. Contact us

If you have any questions about this Privacy Policy or concerns regarding how we handle your personal data, you may contact us via [e-mail].

We aim to respond to all inquiries within one month of receipt, in accordance with applicable data protection laws.