Privacy Policy

This Privacy Policy ("Policy") explains how Ox Alpha ("we", "us", or "our") collects, uses, discloses, and protects personal information when you visit or use our website, applications, and related services (together, the "Service").

By using the Service, you acknowledge the practices described in this Policy. If you do not agree with this Policy, please do not use the Service.

The "Last updated" date shown with this Policy indicates when it was most recently changed.

Ox Alpha is the controller responsible for the personal information described in this Policy, meaning we decide how and why that information is used.

If you have any questions about this Policy or about how we handle personal information, you can reach us using the details in the Contact Us section at the end of this Policy.

The personal information we collect depends on how you interact with the Service. It may include:

• Information you provide to us, such as details you share if you create an account, complete a form, make a purchase where the Service offers paid features, subscribe to communications, respond to a survey, or contact us.
• Identifiers and contact details, such as a name, username, email address, or similar identifiers, where you choose to provide them.
• Transaction and billing information, such as records of purchases or subscriptions and related details, where the Service offers paid features. Payment card details are typically handled by our payment providers rather than stored by us.
• Usage and device information, such as how you interact with the Service, browser and device type, and general location inferred from technical data, collected automatically when you use the Service.
• Cookies and similar technologies, as described in the Cookies and Similar Technologies section below.
• Communications, such as the content of messages, requests, or feedback you send to us.

We may also derive or combine information from the categories above, such as preferences or inferences drawn from how the Service is used.

You are generally not required to provide personal information, but some features may not be available if you choose not to.

We use personal information for purposes that may include:

• Providing, operating, maintaining, and improving the Service.
• Creating and managing accounts and providing related support, if you create an account.
• Processing transactions and providing related features, where the Service offers paid features.
• Responding to your inquiries, requests, or feedback, if you contact us.
• Personalizing content and understanding how the Service is used so that we can improve it.
• Sending administrative or service-related messages and, where applicable and permitted, marketing communications that you can opt out of at any time.
• Maintaining the safety, security, and integrity of the Service, and detecting, preventing, or addressing fraud, abuse, or technical issues.
• Complying with applicable law and enforcing our terms and agreements.

The Service may be operated, in whole or in part, using automated and AI-assisted tools. We use personal information only for the purposes for which it was collected or for compatible purposes, unless we obtain your consent or are otherwise permitted by law.

We do not generally make decisions that produce legal or similarly significant effects about you based solely on automated processing. Where any such processing takes place, we will provide the information and safeguards required by applicable law.

If you are located in the European Economic Area, the United Kingdom, or a region with similar laws, we process personal information only where we have a valid legal basis to do so. Depending on the situation, these bases may include:

• Consent, where you have given us permission to process your information for a specific purpose, which you may withdraw at any time.
• Performance of a contract, where processing is necessary to provide a service or feature you have requested, or to take steps at your request before entering into a contract.
• Compliance with a legal obligation, where we are required to process information under applicable law.
• Legitimate interests, where processing is necessary for our legitimate interests (such as operating, improving, and securing the Service), provided those interests are not overridden by your rights and interests.

Where we rely on legitimate interests, you may object as described in the Your Data Protection Rights section below. Where we rely on consent, you may withdraw it at any time, without affecting the lawfulness of processing that already took place.

We and our providers may use cookies, pixels, tags, local storage, and similar technologies to operate the Service, remember your preferences, understand how the Service is used, and, where applicable, support analytics and marketing.

You can usually control these technologies through your browser or device settings and, where we make one available, through a cookie preferences tool. Some parts of the Service may not function properly if certain cookies are disabled.

Depending on how the Service is configured, some of these technologies may be provided by third parties whose own privacy practices apply to the information they collect.

We may share personal information with categories of recipients such as:

• Service providers and vendors who perform functions on our behalf, such as hosting, storage, analytics, payment processing where applicable, communications, customer support, and security, and who are permitted to use the information only to provide those services to us.
• Professional advisers, such as accountants, auditors, or legal advisers, where reasonably necessary.
• Legal, regulatory, and law enforcement bodies, where we believe in good faith that disclosure is required or permitted by applicable law, or is necessary to protect our rights, our users, or the public.
• Parties to a business transaction, such as in connection with a merger, acquisition, financing, reorganization, or sale of assets, in which case personal information may be among the transferred assets.
• Other parties with your consent or at your direction, or where you otherwise choose to share information through the Service.

We may also share information that has been aggregated or de-identified so that it does not reasonably identify you.

Some privacy laws define a "sale" or "sharing" of personal information broadly, so that certain uses of cookies, analytics, or advertising technologies may fall within those definitions even when no money is exchanged. Where that is the case, you can exercise the choices described in the Your California Privacy Rights section below.

The Service may be operated from, and information may be processed in, countries other than the one in which you are located. These countries may have data protection laws that differ from those in your jurisdiction.

Where we transfer personal information across borders in a way that requires additional protection, we take steps to ensure appropriate safeguards are in place, such as relying on standard contractual clauses approved by the relevant authorities, an adequacy decision, or another lawful transfer mechanism, where applicable.

We retain personal information for as long as necessary to fulfil the purposes described in this Policy, unless a longer retention period is required or permitted by applicable law (for example, to comply with legal, tax, accounting, or reporting obligations, to resolve disputes, or to establish, exercise, or defend legal claims).

The criteria we use to determine how long to keep information include the nature and sensitivity of the information, the purposes for which it is processed, and applicable legal requirements. When personal information is no longer needed, we take reasonable steps to delete, anonymize, or otherwise remove it.

We use appropriate technical and organizational measures designed to protect personal information against unauthorized access, disclosure, alteration, loss, or destruction. The measures we consider appropriate take into account the state of the art, the nature, scope, and context of the processing, and the risks involved for individuals.

No method of transmission over the internet or method of electronic storage is completely secure, however, and we cannot guarantee absolute security. You also play an important role in keeping information secure, for example by protecting any account credentials and using the Service responsibly.

The Service may contain links to, or integrations with, third-party websites, products, or services that we do not operate or control. This Policy does not apply to those third parties, and we are not responsible for their content or their privacy practices.

We encourage you to review the privacy policy of any third party before providing it with personal information.

Depending on your location and applicable law, you may have some or all of the following rights in relation to your personal information:

• Access, to obtain confirmation of whether we process your information and a copy of it.
• Rectification, to have inaccurate or incomplete information corrected.
• Erasure, to request that we delete your information in certain circumstances.
• Restriction, to ask us to limit how we process your information in certain circumstances.
• Portability, to receive certain information in a structured, commonly used, machine-readable format, or to have it transferred to another provider where technically feasible.
• Objection, to object to certain processing, including processing based on legitimate interests and processing for direct marketing.
• Withdrawal of consent, where we rely on consent, at any time and without affecting processing that already took place.

You can exercise these rights by contacting us using the details in the Contact Us section. We may need to verify your identity before responding, and we will respond within the timeframe required by applicable law. Exercising these rights is free in most cases, and you will not receive discriminatory treatment for doing so.

If you are in the European Economic Area or the United Kingdom, you also have the right to lodge a complaint with your local data protection or supervisory authority. We would, however, appreciate the opportunity to address your concerns first, so we encourage you to contact us before doing so.

If you are a California resident, you may have the following rights under California privacy law, subject to certain exceptions:

• The right to know what categories of personal information we have collected, the purposes for collecting it, and the categories of sources and recipients.
• The right to access a copy of the personal information we have collected about you.
• The right to delete personal information we have collected from you.
• The right to correct inaccurate personal information.
• The right to opt out of the "sale" or "sharing" of personal information, as those terms are defined under California law.
• The right to limit the use and disclosure of sensitive personal information, where applicable.
• The right to non-discrimination for exercising your privacy rights.

The categories of personal information we may collect are described in the Information We Collect section, and the categories of recipients with whom we may share it are described in the How We Share Your Information section. We retain each category for the period described in the Data Retention section.

Do Not Sell or Share My Personal Information. Some privacy laws define "sale" and "sharing" broadly, so that certain uses of cookies, analytics, or advertising technologies may qualify even when no money is exchanged. To the extent Ox Alpha sells or shares personal information as defined under California law, you have the right to opt out. Where this applies, you can exercise that right by contacting us or, where we make them available, by using the "Do Not Sell or Share My Personal Information" controls or cookie preferences we provide.

You may submit a California rights request by contacting us using the details in the Contact Us section. You may also use an authorized agent to submit a request on your behalf, subject to verification. We will handle requests in accordance with applicable law.

The Service is not directed to children, and we do not knowingly collect personal information from children below the age at which consent is required under applicable law in their jurisdiction.

If you believe that a child has provided us with personal information, please contact us, and we will take reasonable steps to delete it in accordance with applicable law.

We may update this Policy from time to time to reflect changes in our practices, the Service, or applicable law. When we do, we will revise the "Last updated" date shown with this Policy and, where required by law or where the changes are significant, we will provide additional notice.

The version of this Policy that applies is the one made available through the Service as of the relevant date. We encourage you to review this Policy periodically.

If you have any questions, requests, or concerns about this Policy or about how we handle personal information, or if you would like to exercise any of your rights, you can contact us through the contact options on this website.

We will respond to your inquiry within the timeframe required by applicable law.