LockPad Privacy Policy

Last updated: [Effective Date] · Version 0.5 (draft of October 5, 2026)

This Privacy Policy explains how [LockPad Entity Name], [Address] ("LockPad," "we," "us") collects, uses, discloses and protects personal information when you use the website at officiallockpad.com, the launch interface, proof pages, the Locky chatbot, the waitlist, and related services (the "Services"). LockPad is the "business" (CCPA/CPRA) and the "controller" (GDPR/UK GDPR) for the personal information described here. Contact: Mike@officiallockpad.com.

1. Summary

• We do not ask for your name to use LockPad. Wallet addresses and transactions are public on the blockchain by design.

• We collect a limited set of data: wallet addresses and on-chain activity, IP address and device data, cookies/local storage, waitlist emails, admin emails, and what you type to Locky.

• Locky's conversations are processed by OpenAI as our service provider/processor.

• We do not sell your personal information, and we do not "share" it for cross-context behavioral advertising.

• Never send us, or type into Locky, a seed phrase or private key.

2. Information we collect

Sensitive information. We do not intend to collect sensitive personal information. Locky automatically detects and redacts content that looks like a seed phrase or private key before storage; this is best-effort, so please never enter one. If you include other sensitive information in a chat or message, you do so voluntarily.

3. How we use information

We use personal information to: (a) provide, operate and maintain the Services, including launches, refunds and proof pages; (b) screen wallets (including Payout Addresses) and IP addresses for sanctions, Restricted Jurisdictions and fraud, and enforce our Terms and policies, including scanning links shown for coins and analyzing public on-chain trading and wallet-funding patterns to detect phishing links and fake volume or fake holders under our Delisting Policy; (c) rate-limit and secure the Services, including Locky and admin login; (d) collect, review, deduplicate and act on feature suggestions; (e) send waitlist and service emails (you can unsubscribe from marketing at any time); (f) analyze and improve the Services using aggregated or de-identified data where possible; (g) comply with law, legal process and tax obligations; and (h) establish, exercise or defend legal claims.

We do not use your data to make decisions that produce legal or similarly significant effects based solely on automated processing, except automated sanctions/geoblocking screening required to comply with law. Automated link-scanning and trade-analysis flags never delist a coin on their own; a person reviews the evidence first. We do not use Locky conversations to train our own AI models. [TEAM TO CONFIRM.]

4. Legal bases (EEA/UK users)

• Contract: to provide launches and the Services you request.

• Legitimate interests: security, abuse prevention, rate limiting, analytics, improving the Services, handling suggestions, and defending claims. You may object (Section 9).

• Consent: non-essential cookies/analytics and waitlist marketing emails, where consent is required. You may withdraw consent at any time.

• Legal obligation: sanctions compliance, tax, record-keeping and responding to lawful requests.

5. Blockchain data is public and permanent

When you transact on a blockchain, your wallet address and transaction details are recorded on a public ledger that LockPad does not control and that cannot be changed or deleted by anyone. Proof pages display public on-chain data, including paying and Creator wallet addresses. Your rights to deletion or correction (Section 9) cannot be applied to data on a blockchain; we can only delete or hide data that we hold off-chain and remove items from our own interfaces.

6. How we disclose information

We disclose personal information only as follows:

• Service providers / processors, under written contracts limiting their use of the data to providing services to us:

• OpenAI, L.L.C. (AI model provider for Locky). Your Locky messages and conversation context are sent to OpenAI's API to generate replies. Under OpenAI's API terms as of the date of this policy, API data is not used to train OpenAI's models by default and may be retained by OpenAI for up to 30 days for abuse monitoring [TEAM/LAWYER TO CONFIRM current terms and any zero-data-retention arrangement].

• Hosting and infrastructure: Vercel, Inc. (website hosting, CDN and serverless functions) and Supabase, Inc. (database for Locky conversations and suggestions, and sign-in for LockPad's internal admin accounts) [TEAM/LAWYER TO CONFIRM DPAs and data regions].

• Email and waitlist: [Email/Waitlist Provider].

• Analytics: [Analytics Provider, if any].

• Blockchain infrastructure: RPC node providers [RPC Provider(s)], which see your IP address and the requests your browser sends when the site queries the blockchain.

• Compliance: [Sanctions/wallet-screening provider, if any]; [link-scanning / phishing-reputation provider, if any], which receives the URLs shown for coins (not your personal information).

• Wallet providers and protocols: when you connect a wallet or transact, your wallet software and third-party protocols (e.g., Meteora, Uniswap, PancakeSwap) process data under their own privacy policies.

• Legal and safety: to comply with law, subpoenas or court orders; to respond to lawful requests from authorities; to protect the rights, property or safety of LockPad, users or others; and to investigate fraud, infringement or violations of our Terms.

• Rights holders: limited information needed to resolve infringement or impersonation complaints.

• Business transfers: in connection with entity formation, merger, acquisition, financing or sale of assets, subject to this policy.

• With your direction or consent.

No sale or sharing. We do not sell personal information and do not share it for cross-context behavioral advertising, as those terms are defined in the CCPA/CPRA, and have not done so in the preceding 12 months. We do not knowingly sell or share the personal information of consumers under 16.

7. Retention

We keep personal information only as long as needed for the purposes above, then delete or de-identify it:

8. Security

We use reasonable administrative, technical and physical safeguards, including TLS encryption in transit, salted hashing of IP addresses in Locky's database, access controls, admin login lockouts and least-privilege access. No system is completely secure; you are responsible for the security of your wallet and devices.

9. Your rights

California residents (CCPA/CPRA). You have the right to: (a) know the categories and specific pieces of personal information we collected, the sources, purposes, and the categories of third parties to whom we disclosed it; (b) delete personal information we hold; (c) correct inaccurate personal information; (d) opt out of sale or sharing (we do neither); (e) limit use of sensitive personal information (we do not use it for purposes requiring this right); and (f) not be discriminated against for exercising these rights. Categories collected in the last 12 months: identifiers (wallet address, IP address, email), internet or network activity, approximate geolocation, commercial information (launch payments), and inferences only as needed for fraud prevention. Business purposes are described in Section 3 and disclosures in Section 6.

EEA, UK and Swiss residents (GDPR/UK GDPR). You have the right to access, rectify, erase, restrict and port your personal data, to object to processing based on legitimate interests, to withdraw consent at any time, and to lodge a complaint with your local supervisory authority. [LAWYER: consider appointing an EU/UK representative under Art. 27 if offering services to the EEA/UK.]

Other U.S. states (e.g., Colorado, Connecticut, Virginia, Texas, Oregon and others with comprehensive privacy laws): you may have similar rights to access, correct, delete, port and opt out, and to appeal a denial by replying to our decision. [LAWYER TO CONFIRM thresholds/applicability.]

How to make a request. Email Mike@officiallockpad.com with the subject "Privacy Request." Because we usually do not know your name, we may verify your request by asking you to sign a message with the relevant wallet or to confirm access to the relevant email address. You may use an authorized agent, who must provide proof of authorization. We will respond within the time required by law (generally 45 days under CCPA, one month under GDPR, extendable where permitted).

Global Privacy Control. We honor Global Privacy Control (GPC) browser signals as an opt-out of sale/sharing and of non-essential cookies, where applicable.

Marketing emails. Unsubscribe using the link in any email.

10. Children

The Services are for adults 18 and older and are not directed to children. We do not knowingly collect personal information from anyone under 18. If you believe a child has provided us personal information, contact Mike@officiallockpad.com and we will delete it (off-chain).

11. International transfers

LockPad is based in the United States, and our service providers (including OpenAI and our hosting providers) may process data in the United States and other countries. Where we transfer personal data from the EEA, UK or Switzerland to countries without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum / Swiss amendments), the EU-U.S. Data Privacy Framework where a recipient is certified, or another lawful mechanism. You can request a copy of the relevant safeguards at Mike@officiallockpad.com.

12. Third-party links and services

The Services link to block explorers, protocols, wallets and social media that have their own privacy practices. We are not responsible for them.

13. Changes

We may update this policy. We will post the new version with a new "Last updated" date and give notice of material changes (for example, by a website banner or email).

14. Contact

[LockPad Entity Name] · [Address] · Mike@officiallockpad.com · X: @OfficialLockPad