Privacy Policy

This Privacy Policy (this “Policy”) describes how Uniform Labs, Inc., doing business as Multiliquid (“Multiliquid,” “we,” “us,” or “our”), collects, uses, discloses, retains, and protects personal information in connection with our website located at https://www.multiliquid.xyz/ (the “Site”), the Multiliquid web-based user interface (the “Interface”), and any related products, technologies, tools, APIs, or services made available by us (collectively, the “Services”). The Services use or provide access to the core Multiliquid decentralized finance (“DeFi”) smart contract protocol (the “Protocol”). The Protocol is distinct from the Services and may also be used or accessed through products and services offered by third parties. We are committed to protecting your privacy and handling your data in accordance with applicable data protection laws, including the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA/CPRA”), the Virginia Consumer Data Protection Act (“VCDPA”), the Colorado Privacy Act (“CPA”), the Connecticut Data Privacy Act (“CTDPA”), the Utah Consumer Privacy Act (“UCPA”), the Texas Data Privacy and Security Act (“TDPSA”), the Oregon Consumer Privacy Act (“OCPA”), the Montana Consumer Data Privacy Act (“MCDPA”), and other applicable U.S. privacy frameworks.

This Policy is incorporated by reference into the Multiliquid Terms of Service (the “Terms”) and should be read in conjunction with the Terms. Capitalized terms used but not defined in this Policy have the meanings given to them in the Terms.

By accessing or using the Services, you acknowledge that you have read, understood, and agree to be bound by this Policy. If you do not agree with this Policy, you must not access or use the Services.

This Policy applies to all individuals who interact with Multiliquid, including but not limited to users of the Services, prospective users, website visitors, affiliate partners, and any other individuals whose personal information we process. It applies regardless of how you access our Services, including through our Site, the Interface, APIs, integrations, or offline interactions. This Policy does not apply to products or services independently provided by third parties that use or provide access to the Protocol. Those third parties' privacy notices govern their processing of personal information.

Uniform Labs, Inc. (d/b/a Multiliquid) operates as the data controller for the personal information described in this Policy, meaning we determine the purposes and means of processing your personal data. Our Data Protection contact is Angelo D'Alessandro (COO), angelo@uniformlabs.co. If you have questions about this Policy or our data practices, you may contact us at privacy@multiliquid.xyz or Uniform Labs, Inc., 131 Continental Drive, Suite 305, Newark, DE 19713.

Important Note Regarding Public Blockchain Data: The Protocol consists of open-source smart contracts deployed on public blockchain networks. Transactions conducted through the Protocol are publicly visible on the applicable blockchain network. Multiliquid does not control and cannot ensure the privacy of on-chain transaction data. Public blockchain information, including wallet addresses and transaction details, may be permanently visible, cannot be deleted or altered by Multiliquid, and may be linked by analytics providers or other third parties to wallet addresses, transactions, or individuals.

For purposes of this Policy:

• “Personal Information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, to an identified or identifiable individual or household. Personal Information does not include publicly available information, deidentified information, or aggregated information that cannot reasonably be used to identify you.
• “Protocol” means the core Multiliquid smart contract infrastructure deployed on public blockchain networks and designed to facilitate atomic swaps between eligible tokenized assets and stablecoins.
• “Interface” means the non-custodial, front-end web application that permits eligible users to connect self-custodial wallets to the Protocol.
• “Services” means the Site, the Interface, and any related products, technologies, tools, APIs, or services made available by Uniform Labs that use or provide access to the Protocol. The Services do not include products or services independently provided by third parties.
• “Public Blockchain Data” means information that is recorded on and made publicly accessible through a distributed ledger or blockchain network, including transaction records, wallet addresses, smart contract interactions, and token balances.

We may collect and process the following categories of Personal Information. Not all categories are collected from every user; the specific information collected depends on how you interact with the Services and the features you use.

We collect and use Personal Information for the following purposes:

While U.S. federal law does not generally require identification of a legal basis for processing personal information, certain U.S. state laws and international frameworks do. We process Personal Information on the following bases, as applicable:

• Legitimate Interests: Processing necessary for our legitimate business interests or those of third parties, including fraud prevention, security, compliance monitoring, analytics, service improvement, and enforcing our Terms, where such interests are not overridden by your rights and interests.
• Consent: Processing based on your freely given, specific, informed consent, including for certain marketing communications and non-essential cookies or tracking technologies. You may withdraw consent at any time as described in this Policy.
• Legal Obligation: Processing necessary to comply with applicable legal obligations, including AML/KYC requirements, sanctions regulations, tax reporting, and responses to lawful government requests.
• Vital Interests: Processing necessary to protect the vital interests of an individual, where applicable.
• Protection of Rights: Processing necessary to establish, exercise, or defend legal claims or to protect the rights, property, or safety of Multiliquid, our users, or others.

We may share Personal Information with the following categories of recipients and for the following purposes:

Multiliquid does not sell Personal Information for monetary consideration. However, certain U.S. state privacy laws, including the California Consumer Privacy Act, as amended (“CCPA”), and similar state laws, define “sale” or “sharing” broadly to include certain disclosures of Personal Information for targeted advertising or cross-context behavioral advertising purposes.

To the extent that our use of cookies, pixels, or similar tracking technologies constitutes a “sale” or “sharing” of Personal Information under applicable state law, you may opt out of such activities as described in Section 10 below. If you wish to exercise an opt-out right, please contact us using the information provided in Section 15 or submit a request to privacy@multiliquid.xyz.

We retain Personal Information for as long as reasonably necessary to fulfill the purposes for which it was collected, including to:

• Provide and operate the Services;
• Comply with applicable legal, regulatory, and compliance obligations, including AML/KYC record-keeping and sanctions requirements;
• Prevent fraud and maintain security;
• Resolve disputes and enforce our agreements, including the Terms of Service; and
• Support legitimate business purposes such as analytics and service improvement.

The specific retention period for any category of Personal Information depends on the nature of the data, the purposes for which it is processed, applicable legal requirements, and our legitimate business needs. KYC/AML and sanctions screening records may be retained for extended periods as required by applicable law.

Specific retention periods include: user relationship data, including contact and behavioral information, is retained for the duration of the user relationship plus five (5) years; financial and transaction records, including KYC/AML records and tax reporting documentation, are retained for the duration of the relationship plus seven (7) years; and marketing and communications data is retained until you opt out of marketing communications.

Public Blockchain Data: Information recorded on public blockchain networks persists indefinitely and is outside the control of Multiliquid. We cannot delete, modify, or restrict access to on-chain transaction data.

When Personal Information is no longer required for the purposes described above, we will securely delete, destroy, or deidentify it in accordance with our data retention policies and applicable law.

Depending on your jurisdiction of residence, you may have certain rights with respect to your Personal Information under applicable data privacy laws, including the CCPA, the Virginia Consumer Data Protection Act (“VCDPA”), the Colorado Privacy Act (“CPA”), the Connecticut Data Privacy Act (“CTDPA”), and other applicable U.S. state privacy laws. These rights may include:

• Right to Know / Access: The right to request information about the categories and specific pieces of Personal Information we have collected about you, the sources of collection, the purposes for collection, and the categories of third parties with whom we share your information.
• Right to Correction: The right to request correction of inaccurate Personal Information we hold about you.
• Right to Deletion: The right to request deletion of Personal Information we have collected from or about you, subject to certain exceptions, including where retention is required by law or necessary for security or compliance purposes.
• Right to Data Portability: The right to request a copy of your Personal Information in a portable, readily usable format, where technically feasible.
• Right to Opt-Out of Sale/Sharing: The right to opt out of the “sale” or “sharing” of your Personal Information for targeted advertising purposes, as those terms are defined under applicable state law.
• Right to Limit Use of Sensitive Personal Information: The right to limit our use and disclosure of sensitive personal information to purposes permitted under applicable law.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing conducted prior to withdrawal.
• Right to Appeal: If we deny your privacy request, you may have the right to appeal that decision. We will provide instructions for submitting an appeal in our response to your request.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your privacy rights.

How to Exercise Your Rights: To submit a privacy rights request, please contact us using the information provided in Section 15 below. We may need to verify your identity before processing your request. Depending on the nature of your request and applicable law, we may ask you to provide information that allows us to reasonably verify that you are the person about whom we collected Personal Information.

Authorized Agents: You may designate an authorized agent to submit a request on your behalf. We may require that you provide written authorization and verify your identity directly, or that the authorized agent provide proof of a valid power of attorney.

California Residents: If you are a California resident, you may have additional rights under the CCPA, including the right to request disclosure of the categories and specific pieces of Personal Information collected, the categories of sources, the business or commercial purposes for collection, and the categories of third parties with whom Personal Information is shared. You also have the right to opt out of the sale or sharing of Personal Information as described in Section 7 above.

Limitations: Certain rights may be subject to limitations or exceptions under applicable law. We cannot delete, modify, or restrict access to Public Blockchain Data recorded on public blockchain networks, as such data is outside our control.

We and our service providers may use cookies, web beacons, pixels, local storage, and similar tracking technologies to collect information about your interactions with the Services. These technologies serve the following purposes:

We implement appropriate technical and organizational measures to protect Personal Information from unauthorized access, use, disclosure, alteration, or destruction. These measures include, where appropriate, TLS encryption in transit, encryption at rest, role-based access controls, multi-factor authentication on administrative accounts, firewalls, web application firewall protections, secure development practices, tokenized payment credentials, centralized identity and access management with single sign-on, employee training, pseudonymized analytics where possible, and periodic security assessments.

However, no method of transmission over the Internet or method of electronic storage is completely secure. We cannot guarantee the absolute security of your Personal Information, and any transmission of Personal Information is at your own risk.

Data Breach Notification: In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority and, where required by applicable law, notify affected individuals without undue delay.

Your Responsibilities: You are responsible for maintaining the security of your self-custodial wallets, private keys, seed phrases, and devices used to access the Services. Multiliquid does not have access to and cannot recover private keys or seed phrases. You are also responsible for maintaining the security of any account credentials associated with the Services.

Blockchain Security: Multiliquid does not control and cannot ensure the security of public blockchain networks, third-party wallets, or third-party protocols. Security risks inherent in blockchain technology, including smart contract vulnerabilities and network attacks, are outside our control.

The Services are not directed to, and we do not knowingly collect Personal Information from, children under the age of 13, or such other age as may be specified by applicable law. Furthermore, in accordance with our Terms of Service, the Services are intended for use only by individuals who are at least 18 years of age or the age of legal majority in their jurisdiction of residence, whichever is greater.

If we become aware that we have collected Personal Information from a child under the age of 13 without verified parental consent, we will take steps to delete such information promptly. If you believe we have inadvertently collected information from a child under 13, please contact us using the information provided in Section 15 below.

Multiliquid is based in the United States, and Personal Information we collect is primarily processed and stored in the United States. If you access the Services from outside the United States, please be aware that your Personal Information may be transferred to, stored in, and processed in the United States or other countries whose data protection laws may differ from those in your country of residence.

Where required by applicable law, we will implement appropriate safeguards for international transfers of Personal Information, which may include standard contractual clauses, data processing agreements, or other mechanisms recognized under applicable law.

By using the Services, you acknowledge and consent to the transfer of your Personal Information to the United States and other jurisdictions as described in this Policy.

We may use automated tools and processes to support compliance, security, and fraud prevention activities. These include:

• Automated wallet screening against sanctions lists, watchlists, and illicit activity indicators using blockchain intelligence tools;
• IP-based geographic restriction enforcement, VPN and proxy detection; and
• Risk scoring and fraud detection algorithms.

These automated processes may result in the restriction, suspension, or termination of access to the Services, or the blocking of wallet addresses. Where automated decisions significantly affect you, you have the right to obtain human intervention, express your point of view, and contest the decision, as provided under applicable law.

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, or if you wish to exercise any of your privacy rights, please contact us at:

Uniform Labs, Inc.
Address: 131 Continental Drive, Suite 305, Newark, DE 19713
Email: privacy@multiliquid.xyz
Website: https://www.multiliquid.xyz/

You may also Contact us. We will respond to your inquiry or request within the time periods required by applicable law.

The Services may contain links to third-party websites, applications, or services that are not owned or controlled by Multiliquid, including wallet provider interfaces, issuer onboarding portals, and other DeFi protocols or platforms. This Policy does not apply to the privacy practices of such third parties.

We encourage you to review the privacy policies of any third-party services before providing them with your Personal Information. Multiliquid is not responsible for the privacy practices, content, or security of third-party websites or services.

Some assets available through the Protocol may require users to complete onboarding and KYC checks directly with relevant issuers or integration partners. Such processes are governed by those parties' own privacy policies and data practices, and Multiliquid is not responsible for the collection or processing of Personal Information by those third parties.

We may update this Privacy Policy from time to time to reflect changes in our practices, the Services, applicable law, or for other operational, legal, or regulatory reasons. When we make material changes, we will update the “Last Updated” date at the top of this Policy and provide notice as appropriate, which may include posting the updated Policy on the Site, displaying a notice through the Interface, or other means reasonably determined to reach you.

Your continued use of the Services following the posting of an updated Policy constitutes your acknowledgment of, and agreement to be bound by, the updated Policy. We encourage you to review this Policy periodically to stay informed about our data practices.