Privacy Policy

Effective Date: October 8, 2026

Last Updated: October 8, 2026

LunarShadow AI ("we," "our," "us"), a brand of Elder Holdings LLC, a Minnesota limited liability company, respects your privacy and is committed to protecting your personal information. This Privacy Policy explains how we collect, use, disclose, and protect information when you use the LunarShadow AI trading platform ("Platform").

By using the Platform, you consent to the data practices described in this policy.

1. Information We Collect

Account Information:

• The public address of the Solana wallet you sign in with, which identifies your account (we do not ask for a name, email address or password)
• Your Terms and Privacy Policy acceptance and its date
• Your bot settings, such as position sizes, loss limits and which strategies are enabled
• Referral codes you use or share

Wallet & Trading Data:

• The addresses of the bot wallet and Polymarket wallet the Platform creates for you, and their encrypted private keys
• Your Kalshi API key ID and private key, encrypted, if you connect Kalshi
• Orders, positions, trade history, settlement results, deposits, withdrawals and platform fees
• Your sign-in wallet's $LS balance, read to set your fee-discount tier

Technical Data:

• A session cookie that keeps you signed in
• IP address and request information, which our web servers and Cloudflare process when you connect; we do not store it in your account record

Optional Data:

• Messages and correspondence you send us, including any email address you use to contact us

IMPORTANT: We never ask for the seed phrase or private key of your sign-in wallet. We do generate and hold, encrypted, the private keys of the bot wallet and Polymarket wallet the Platform creates for you (see Section 4).

1a. Data Storage Infrastructure

User Accounts and Trading Data:

• Stored in a PostgreSQL database
• Private keys and API keys are encrypted before they are stored

Server Architecture:

• Application servers in the United States (Newark, New Jersey); the servers that run the Polymarket bots are in Spain
• Database servers are located in the United States (Kansas City, Missouri, with a standby in New York)
• Traffic between our servers travels over encrypted connections
• Database backups are stored with Cloudflare R2

2. How We Use Your Information

We use your information to:

• Provide and maintain the Platform
• Run the bots you enable: place orders on Kalshi and Polymarket according to your settings
• Sign transactions from the wallets the Platform holds for you: orders, fees, bridging and withdrawals you request
• Improve platform performance
• Show you your positions, results and account status in the app
• Read your sign-in wallet's $LS balance to set your fee-discount tier, and your platform fees to calculate Season points
• Comply with legal obligations and enforce our Terms of Service
• Prevent fraud and abuse
• Analyze usage patterns to improve features

We do not sell your personal information to third parties.

3. Legal Bases for Processing (GDPR Alignment)

We process your information under one or more of the following legal bases:

• Consent: When you create an account, connect a wallet, or opt into features
• Contractual necessity: To deliver services you request
• Legitimate interests: To improve the platform, prevent fraud, ensure security
• Legal obligations: Where required by applicable law or regulation

EU/EEA users have additional rights detailed in Section 12.

4. Wallets, API Keys & Security

Wallet Addresses:

• We store your sign-in wallet address to identify your account
• Wallet addresses are public information on their blockchains (see Section 4a)
• We never ask for the private key or seed phrase of your sign-in wallet

Platform-Created Wallets:

• The Platform generates a Solana bot wallet and a Polymarket wallet for you and stores their private keys encrypted
• Only the platform services that sign your transactions can decrypt them

Kalshi API Keys (if connected):

• Encrypted before storage, with restricted access
• Only the platform services that trade for you can decrypt them
• You can switch the key off on the Kalshi bot page, and delete it in your Kalshi account at any time

Security Measures:

• Encryption of private keys and API keys at rest
• Encrypted connections in transit
• Rate limiting
• Strict internal access controls

4a. Public Blockchain Data

IMPORTANT DISCLOSURE:

• Your wallet addresses and their transactions are publicly visible on the Solana and Polygon blockchains, including your Polymarket trades.
• This data is inherently public, immutable, and permanent.
• Anyone can view this activity using blockchain explorers (e.g., Solscan, Polygonscan).
• We do not control blockchain data; it is decentralized and cannot be deleted or modified.
• Third-party analytics services may track and analyze on-chain activity.
• Consider using separate wallets for different activities if privacy is a concern.

5. Cookies and Tracking

We keep your sign-in session in one essential cookie and in your browser's session storage while the tab is open. The app also remembers a referral code in your browser's local storage.

We do not use analytics or advertising cookies. Cloudflare, which delivers the website, may set its own security cookies.

Cookie Management:

• You may block cookies in your browser settings

We do not sell data to advertisers.

6. Data Sharing and Disclosure

We may share your information in the following circumstances:

With Service Providers:

• Hosting providers for our servers and databases
• Cloudflare, for website delivery, security and backup storage

With Trading Venues and Networks:

• Kalshi - the orders the bot places on your Kalshi account, using your API key
• Polymarket - orders and your Polymarket wallet address
• Solana and Polygon networks and RPC providers - wallet addresses and signed transactions
• Jupiter and Circle's Cross-Chain Transfer Protocol (CCTP) - wallet addresses and amounts when funds are bridged
• Price data providers receive no personal data

For Legal Compliance:

• To comply with applicable laws, regulations, or legal processes
• To respond to government requests or court orders
• To enforce our Terms of Service
• To protect our rights, safety, or property

In Business Transfers:

• In the event of a merger, acquisition, or sale of assets
• Users will be notified of any change in ownership or data control

Aggregated Data:

• We may share aggregated, anonymized data for analytics and research
• This data cannot identify individual users

We never sell personal data to advertisers or data brokers.

7. Data Retention

We retain data as follows:

Account Information:

• Retained while your account is active
• Retained for 7 years after account closure for legal compliance

Trading History:

• Retained indefinitely for performance tracking, compliance, and dispute resolution
• Required for tax reporting and regulatory audits

Session Logs and Technical Data:

• Retained for 90 days
• Security logs retained for 1 year

Support Messages:

• Retained for 3 years

You may request deletion of your data at any time (see Section 12), subject to legal retention requirements.

8. Data Security

We implement industry-standard security measures:

Technical Safeguards:

• Private keys and API keys encrypted at rest (AES-256-GCM, or AES-128 with HMAC authentication)
• TLS encryption for data in transit, and encrypted connections between our servers
• Regular security reviews of the platform code

Access Controls:

• Strict internal access controls (principle of least privilege), including separate database roles for each service

Monitoring:

• Automated health checks and alerts on platform services

IMPORTANT: No system is 100% secure. While we take reasonable measures to protect your data, we cannot guarantee absolute security. You use the Platform at your own risk.

9. Data Breach Notification

In the event of a data breach involving personal information:

• We will promptly notify affected users through the Platform within 72 hours of discovery
• We will describe the nature of the breach, data affected, and remedial actions
• We will comply with all applicable breach notification laws and regulatory reporting requirements (GDPR, CCPA, state laws)
• We will take immediate steps to contain and remediate the breach

10. Third-Party Services

The Platform integrates with the following third-party services:

Trading Venues:

• Kalshi and Polymarket

Blockchain & Bridging:

• Solana and Polygon RPC providers - blockchain queries and transaction broadcasting
• Jupiter - token swaps when bridging between SOL and USDC
• Circle's Cross-Chain Transfer Protocol (CCTP) - moving USDC between Solana and Polygon

Price Data Providers:

• Market and price data providers (such as CoinGecko and GeckoTerminal) for SOL and $LS prices

Your interactions with third-party services are governed by their privacy policies:

• We are not responsible for the privacy practices of third parties
• We recommend reviewing third-party privacy policies before use
• We do not share personal data with price data providers

11. International Data Transfers

Your data is processed in the United States, where our application and database servers are, and in Spain, where the Polymarket bot servers are. Service providers may process it in other countries.

For EU/EEA Users:

• We implement appropriate safeguards for international data transfers
• We comply with GDPR requirements for cross-border data transfers
• We use Standard Contractual Clauses (SCCs) where applicable

By using the Platform, you consent to international data transfers as described in this policy.

12. Your Rights

Depending on your location, you may have the following rights:

Access: Request a copy of your personal data Correction: Request correction of inaccurate or incomplete data Deletion: Request deletion of your data (subject to legal retention requirements) Objection: Object to certain types of data processing Restriction: Request restriction of data processing Portability: Receive your data in a portable format Withdraw Consent: Withdraw consent for data processing (where applicable)

EU/EEA Residents (GDPR):

• Right to lodge a complaint with a supervisory authority
• Right to object to automated decision-making

California Residents (CCPA):

• Right to know what personal information is collected
• Right to know if personal information is sold or shared (we do not sell data)
• Right to opt-out of sale (not applicable as we do not sell data)
• Right to non-discrimination for exercising privacy rights

To Exercise Your Rights:

Contact us at: [email protected] We will respond within 30 days of receiving a valid request.

13. "Do Not Track" & CCPA Compliance

Do Not Track:

• We honor valid "Do Not Track" browser signals where technically feasible
• Note: We do not track users across third-party websites

CCPA Compliance:

• We do not sell or share personal data with advertisers or data brokers
• We do not discriminate against users who exercise CCPA rights
• California residents have rights described in Section 12

14. AI Transparency

Automated Strategies:

• We may use aggregated, anonymized trading data to evaluate and improve the bots' strategies
• No personal data is used for individual profiling or third-party marketing
• Strategies analyze market patterns, not individual user behavior
• You can opt-out of contributing anonymized data by contacting [email protected]

$LS Token and Season Data:

• We read your sign-in wallet's $LS balance to set your fee-discount tier; we never move those tokens.
• We use the platform fees you pay to calculate Season points and rewards.
• Season leaderboards show a shortened sign-in wallet address, points and share; nothing else.
• We do not share token holding information with third parties.

15. Children's Privacy

The Platform is not intended for individuals under 18 years old.

• We do not knowingly collect data from minors
• If we discover we have collected data from a minor, we will delete it immediately
• Parents or guardians who believe we have collected data from a minor should contact us at [email protected]

16. Changes to This Policy

We may update this Privacy Policy periodically to reflect:

• Changes in our data practices
• New features or services
• Legal or regulatory requirements

When We Update:

• Updated versions will be posted with a new "Last Updated" date
• Material changes will be communicated in the Platform, and you will be asked to accept the updated policy
• Continued use after changes constitutes acceptance of the updated policy

17. Contact Us

For privacy concerns, data requests, or questions:

Email: [email protected] Legal: [email protected] General Support: [email protected]

Website: www.lunarshadow.ai

Company Information:

Elder Holdings LLC A Minnesota Limited Liability Company 19883 Erin Ave, Prior Lake, MN 55372, USA

Response Time:

We will respond to privacy requests within 30 days.

By using LunarShadow AI, you acknowledge that you have read and understood this Privacy Policy and agree to the collection, use, and disclosure of your information as described herein.