Privacy Notice.

01 Who we are

This Privacy Notice (the “Notice”) describes how Nodefleet LLC, a Delaware limited liability company (“Nodefleet”, “we”, “us”, “our”), processes personal information in connection with the FleetWallet browser extension, the FleetWallet website, and related services (together, the “Service”). Where applicable data protection law treats Nodefleet as the “controller” of personal information, Nodefleet is the controller.

02 Scope of this Notice

This Notice covers personal information we process when you (a) install, configure, or use the FleetWallet extension; (b) visit our website at fleetwallet.nodefleet.net; (c) contact us for support; or (d) interact with us in any other way related to the Service.

This Notice does not cover:

• blockchain networks themselves, which are public, permissionless ledgers operated by independent third parties;
• RPC providers, block explorers, dapps, swap aggregators, on-ramps, hardware wallets, or other third-party services you connect to through FleetWallet; or
• other Nodefleet products that publish their own privacy notice.

Those parties are independent data controllers and govern your information under their own policies.

03 Information we collect

We aim to collect as little personal information as possible. The Service is structured so most sensitive material never leaves your device. The categories below summarize what we may process and where it lives.

We do not knowingly collect special categories of personal data (such as government identifiers, health information, biometric identifiers, racial or ethnic origin, religious beliefs, or sexual orientation) through the Service.

04 How we collect it

• Directly from you when you install the extension, set a password, configure chains and RPCs, submit a support request, or join the waitlist.
• Automatically from your device or browser when you visit our website or download an artifact (e.g., IP address, request metadata).
• From third parties only in narrow cases — for example, an email service provider that delivers a waitlist confirmation, or an infrastructure provider that flags abusive traffic.
• From public blockchain networks when the wallet reads on-chain data through an RPC endpoint you have selected.

05 How we use information

We use personal information for the following purposes:

• Providing the Service. Operating the extension, serving the website, distributing the extension build, and rendering on-chain information you have asked us to fetch on your behalf.
• Communicating with you. Responding to support requests, sending product announcements you have opted into, and delivering security or legal notices.
• Improving the Service. Diagnosing problems, monitoring service health, and developing new features. Where this involves any non-aggregate or non-opt-in data, we will tell you and offer a choice.
• Security & fraud prevention. Detecting, preventing, and responding to abusive, fraudulent, or unauthorized activity, including denial-of-service attempts against our infrastructure.
• Legal & compliance. Complying with applicable law, responding to lawful requests, enforcing our Terms of Service, and protecting our rights, property, and users.

We do not sell personal information, and we do not share personal information with third parties for their own independent advertising purposes.

06 Legal bases (EEA/UK)

If you are in the European Economic Area, the United Kingdom, or another jurisdiction that requires a legal basis for processing, we rely on the following bases under Article 6 of the GDPR / UK GDPR:

• Performance of a contract — to provide the Service you have requested under our Terms.
• Legitimate interests — to keep the Service secure, prevent abuse, debug issues, and improve our products, where those interests are not overridden by your rights.
• Consent — for optional features such as marketing emails or any future opt-in analytics. You can withdraw consent at any time.
• Compliance with a legal obligation — to comply with applicable laws and lawful requests.

07 How we share information

We share personal information only in limited circumstances:

• Service providers. Vendors that host our website, distribute the extension build, deliver our email, and protect our infrastructure (e.g., hosting, CDN, email, DDoS protection, error logging). They process data on our behalf under written agreements that limit use to providing services to us.
• Affiliates. Other entities under common control with Nodefleet, where this Notice continues to apply.
• Legal & safety. Law enforcement, regulators, or other parties when we believe in good faith that disclosure is required by law, necessary to comply with a lawful request, or necessary to protect the rights, property, or safety of Nodefleet, our users, or others.
• Corporate transactions. A buyer or successor in connection with a merger, acquisition, financing, reorganization, sale of assets, or similar transaction, subject to the protections of this Notice.
• With your direction. Any other party you direct us to share with, including via a feature you choose to use in the Service.

We do not sell personal information for monetary or other valuable consideration as defined under the California Consumer Privacy Act.

08 Third-party services

FleetWallet is built to connect to third-party services that you choose. When you connect to or use:

• RPC endpoints & block explorers — the operator of that endpoint receives the requests your wallet makes (including IP, user-agent, and the on-chain addresses being queried).
• Dapps — the dapp may request access to public information (e.g., a public address) and may receive any data you transmit through it. The dapp’s own privacy policy applies.
• Hardware wallets — data exchanged with the device is governed by the hardware vendor.
• Fiat on-ramps, swap aggregators, staking providers, or other partner services — these are independent controllers; review their notices before using them.

We do not control these parties and are not responsible for their data practices. Where reasonably possible, FleetWallet exposes which endpoint each request is going to.

09 Cookies & analytics

Our website may use strictly necessary cookies to operate properly and, where you consent, limited first-party analytics to measure aggregate traffic. We do not use third-party advertising cookies or cross-site tracking. The FleetWallet extension itself does not set cookies in your browser for analytics purposes.

You can manage cookies and similar technologies through your browser settings. Blocking strictly necessary cookies may break parts of the website.

10 Data retention

We retain personal information only for as long as necessary to fulfill the purposes for which it was collected, including to provide the Service, comply with our legal obligations, resolve disputes, and enforce our agreements. When we no longer need it, we delete or anonymize it.

Indicative retention periods:

• Website request logs — short-lived (typically up to 30 days), longer where required for security investigations;
• Support emails — up to 24 months after the matter is resolved, or longer if required by law;
• Waitlist / mailing list entries — until you unsubscribe or for up to 24 months of inactivity, whichever comes first.

We have no ability to delete information published on a public blockchain. On-chain data is, by design, immutable and outside our control.

11 Security

We use commercially reasonable administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, alteration, disclosure, or destruction. These include encryption in transit, least-privilege access, isolated build infrastructure, and signed extension releases.

For wallet material, the most important controls are the ones you apply: use a strong, unique password; keep your recovery phrase offline; verify the integrity of the extension build (SHA-256 is published on each release tag); enable a hardware wallet where supported; and verify each transaction before signing.

No method of transmission over the internet or method of electronic storage is 100% secure. We cannot guarantee absolute security.

12 International transfers

Nodefleet is based in the United States and we and our service providers may process personal information in countries other than the country in which you live, including the United States. Where we transfer personal information out of the EEA, the UK, or another jurisdiction with cross-border transfer restrictions, we rely on appropriate safeguards such as Standard Contractual Clauses (SCCs) or adequacy decisions.

13 Your rights

Depending on where you live, you may have the following rights with respect to personal information we hold about you:

• Access — obtain confirmation of whether we process your personal information and a copy of it.
• Rectification — correct inaccurate or incomplete information.
• Erasure — ask us to delete personal information, subject to legal exceptions.
• Restriction — ask us to restrict processing in certain circumstances.
• Objection — object to processing based on legitimate interests or for direct marketing.
• Portability — receive a copy of certain information in a structured, machine-readable format.
• Withdraw consent — where processing relies on consent, withdraw it at any time without affecting prior lawful processing.
• Complain — lodge a complaint with your local data protection authority.

You can exercise these rights by contacting nodes@nodefleet.net. We may need to verify your identity before responding. We will respond within the time required by applicable law.

14 California rights (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act:

• the right to know what personal information we collect, use, disclose, and share;
• the right to request deletion of personal information we have collected;
• the right to correct inaccurate personal information;
• the right to limit the use of sensitive personal information; and
• the right not to be discriminated against for exercising your privacy rights.

We do not sell personal information and do not “share” it for cross-context behavioral advertising as those terms are defined under California law. To exercise your California rights, contact nodes@nodefleet.net. You may use an authorized agent to make a request on your behalf, subject to verification.

15 Children’s privacy

The Service is not directed to children under 18. We do not knowingly collect personal information from anyone under 18. If you believe a child has provided us with personal information, please contact us and we will take appropriate steps to delete it, subject to legal retention obligations.

16 Changes to this Notice

We may update this Notice from time to time. The current version is identified by its “Effective” date at the top of this page. If we make material changes, we will provide reasonable notice through the Service, our website, or by other means. Your continued use of the Service after the effective date of an updated Notice constitutes your acceptance of it.

17 Contact

To exercise a privacy right, ask a question, or report a concern, contact us at nodes@nodefleet.net.