Privacy Policy Launchpad

EFFECTIVE DATE: July 9, 2026

Launchpad Limited, a British Virgin Islands business company ("Launchpad," "we," "us," or "our"), provides cryptocurrency-related products and services, including consumer applications, non-custodial wallet services, wallet infrastructure, credential management and authorization services, connectivity services, command-line interfaces, and agent-enabled interfaces that support user-directed automated clients (collectively, our "Services"). This Privacy Notice (this "Notice") describes how we collect, use, share, and protect personal data in connection with your access to, or use of, the Services.

By using the Services, you acknowledge that you have read and understood this Notice. If you do not agree with our processing of your personal data as described in this Notice, please do not use the Services. 

Who We Are

Launchpad Limited is a British Virgin Islands business company and a wholly owned subsidiary of MoonPay Inc., a Delaware corporation. Launchpad is the data controller for personal data processed through the Services as described in this Notice. 

If you have questions about this Notice, please contact our Data Protection Officer at [email protected]. 

Scope of This Notice

This Notice applies to personal data we process in connection with the following Services, whether offered directly by Launchpad or made available through MoonPay Group interfaces, developer integrations, or third party applications:

• App Services: Consumer mobile, desktop, web, and account interfaces made available by Launchpad or through MoonPay Group surfaces for Launchpad Services.
• Wallet Services: Non-custodial wallet creation, management, signing, recovery, export, and related user-authorized wallet services. 
• Software Services: Software, APIs, SDKs, iframes, portals, and connectivity tools that allow you or your applications to access, configure, or connect supported wallets, credentials, and other services.
• MoonPay CLI: The command-line software interface that enables you to access, initiate, or transmit requests to certain connected services from a local computing environment. 
• MoonAgents App: The desktop application that provides users with access to the MoonPay CLI, including related binaries, scripts, software development kits, documentation, updates, and associated endpoints. 
• Dawn CLI: The command-line interface that enables you to research prediction markets, build and deploy trading strategies, and interact with third-party prediction market platforms from a local computing environment. 
• Paybox: Credential management, authorization, approval, and agent-access services that allow users to store or connect supported credentials and set rules for how those credentials may be used.
• MoonX WaaS: Wallet infrastructure and Wallet-as-a-Service functionality, including embedded wallet creation, authentication, signing, export, and related services and integrations.

This Notice does not apply to regulated MoonPay Group services, or to other MoonPay Group products or services that are governed by separate privacy policies. For information about those services, please see the MoonPay Global Privacy Policy at moonpay.com/legal/privacy_policy or the privacy notice presented with the relevant product or service.

This Notice also does not apply to personal data processed by third-party services you may access through, or connect to, our Services, including third-party customer applications, AI agents, large language models, blockchain networks, payment networks, wallet providers, exchanges, decentralized applications, or other external platforms. Those third parties maintain their own privacy policies governing their processing of your data.

Our Role as Data Controller

Launchpad acts as a data controller for personal data processed through the Services when Launchpad determines the purposes and means of that processing. Where applicable, other MoonPay Group entities may act as separate controllers for regulated products, localized services, or other MoonPay Group services that are not covered by this Notice.

Where you use our Services to interact with third-party services, customer applications, blockchain networks, payment providers, exchanges, decentralized applications, or wallet providers, those third parties may be separate controllers for the data they collect from you directly or receive from you through your use of their services. Please review their privacy policies for information about how they collect and use your data.

Personal Data We Collect

We collect personal data in a variety of ways depending on how you interact with us and our Services. The categories below are intended to describe our processing across the Services generally; not every category applies to every Service or user.

Information You Provide to Us

• Account and Profile Information: Email address, phone number, name, profile information, login credentials, one-time passwords, OAuth or account identifiers, and other information required to create, access, or manage an account or profile.
• Wallet and Credential Information: Blockchain wallet addresses, public keys, wallet configuration information, credential names, credential types, token references, provider references, and metadata about wallets or credentials you create, connect, import, store, or authorize through the Services.
• Transaction, Request, and Operation Information: Information about transactions, signing requests, credential requests, approvals, denials, wallet imports, key exports, token issuance, timestamps, amounts, currencies, destination addresses, merchant or recipient details, and other parameters required to provide the Services.
• Preferences: Settings and preferences you select within the Services. 
• Communications and Support Data: Correspondence with our team, survey responses, and information provided to our customer support team.

Information We Collect Automatically

• App, Browser, Device, and Network Information: Information about the device, operating system, browser, app, software environment, network, IP address, device characteristics, and device or online identifiers you use to access the Services.
• Location Information: General location information inferred from your IP address or other technical information..
• Product Usage Information: Activity information about what you view, configure, approve, connect, or interact with while using the Services, including feature usage, product settings, and usage events.
• Diagnostic, Analytics, and Troubleshooting Information: Service-related diagnostic, analytics, security, reliability, and performance information, including timestamps, crash data, performance logs, error messages, session information, and or troubleshooting data.
• Cookies and Similar Technologies: Information collected through cookies and similar tracking technologies. Please refer to our Cookie Policy for more information.

Information Specific to CLI, Agent, Credential, Automated Client and Wallet Infrastructure Products

When you use CLI, agent-enabled, credential-management, automated-client Services, or wallet infrastructure Services, we may additionally collect or generate:

• Authentication and Session Data: Session tokens, access tokens, refresh tokens, presence or step-up tokens, passkey or WebAuthn metadata, OAuth identifiers, login events, and similar authentication credentials or metadata.
• Credential and Authorization Data: Information about credentials, client keys, scopes, grants, approval modes, limits, revocations, and access rules that you configure or authorize.
• Wallet Infrastructure Data: Wallet identifiers, public wallet addresses, key-share references, encrypted key-share data, signing metadata, import/export metadata, and related public or encrypted wallet information.user-authorized 
• Operation and Audit Data: Records of requests, approvals, denials, timeouts, key exports, signing events, credential outputs, account actions, and related audit or evidence records.
• Compliance and Security Data: Wallet-screening results, fraud and abuse signals, blocklist or enforcement records, risk ratings, security events, and related information used to protect the Services and comply with law.
• Developer and Integration Data: Application identifiers, tenant or integration settings, API key metadata, redirect or callback information, SDK configuration, and similar information used to provide developer or customer-application integrations.

We do not collect through CLI and agent products: private keys, strategy source code, or full command input text, except where you intentionally submit information to us or authorize a Service to process it as part of a request.

Information Collected from Other Sources

• Blockchain and Public Data: We may analyze public blockchain data, including transaction IDs, digital signatures, transaction amounts, timestamps, smart contract information, risk signals, and wallet addresses.
• MoonPay Group Affiliates, Service Providers, and Integration Partners: We may obtain information about you from our affiliates, service providers, customer applications, developer integrations, payment or wallet providers, and other partners as needed to provide, secure, support, or improve the Services.

What We Do Not Collect Sensitive Personal Data

Some information processed through or in connection with the Services may be considered sensitive personal data or sensitive personal information under applicable law. For example, you may choose to store, connect, or authorize the use of credentials, secrets, wallet information, financial credential references, identity-related materials, or security and authentication information. For Paybox, secrets are user-managed values, and Launchpad does not collect, verify, or present any secret, including any identity or KYC information, on your behalf or on behalf of any member of the MoonPay Group. Our Services are designed to process this information using tokenized, encrypted, scoped, or metadata-based methods where appropriate, and we do not seek to view or use the underlying contents of user-stored credentials except where you expressly direct a reveal, export, user-authorized signing, execution, or similar use. We use sensitive personal data only as necessary to provide, secure, support, or comply with legal obligations relating to the Services, or as otherwise permitted by applicable law.

What We Do Not Collect

Except where you intentionally provide information to us, configure a credential, or expressly direct a Service to reveal, export, sign, facilitate user-authorized signing, or otherwise process information, Launchpad does not seek to collect raw card numbers, CVV codes, seed phrases, complete private keys, reusable signing material, or plaintext secrets. Certain Services may process encrypted key-share data, token references, credential metadata, signatures, transaction hashes, or other information necessary to provide non-custodial wallet, credential-management, authorization, export, or signing functionality. Launchpad does not receive biometric templates from device passkeys; passkey or biometric approval occurs through your device or authenticator, and we receive only the technical result and related authentication metadata.

How We Use Personal Data

We use your personal data for the following purposes: 

• Service Operation and Delivery: Operating, maintaining, and providing the Services, including account access, wallet creation and management, credential storage or connection, scoped authorization, passkey or step-up approvals, signing, key export, token issuance, software connectivity, and user-initiated requests.facilitating user-authorized 
• Account Management: Creating and maintaining accounts, profiles, sessions, passkeys, credentials, client or developer settings, and other information needed to manage your relationship with us.
• Customer Support: Addressing your requests for support and responding to inquiries. 
• Service Communications: Sending you administrative or account-related communications about the Services, including security updates or transaction-related information. 
• Safety, Security, and Integrity: Verifying accounts and related activity, authenticating users and clients, detecting and preventing fraud, unauthorized use, account compromise, malicious activity, and other harmful or unlawful behavior, and maintaining the security and integrity of the Services.
• Product Improvement: Operating, maintaining, debugging, analyzing, and improving the Services, including using usage, diagnostic, analytics, and aggregated or anonymized data to identify reliability issues, improve documentation, and develop product features.
• Compliance and Legal Obligations: Complying with applicable laws, responding to lawful requests, screening wallet addresses or transactions where required or appropriate, maintaining audit and enforcement records, and preventing, detecting, or addressing fraud, sanctions, security, or other legal risks.
• User Controls and Auditability: Providing user-facing controls, approvals, revocation tools, activity records, and support for privacy, security, dispute, compliance, and operational review requests.
• Marketing Communications: With your consent where required, sending you promotional communications about our Services. You may opt out of marketing communications at any time.

Legal Basis for Processing

We process personal data in accordance with the British Virgin Islands Data Protection Act, 2021 (the "DPA") and other applicable data protection laws. We process personal data only where a lawful basis exists and where the processing is for a lawful purpose directly related to our activities, necessary for or directly related to that purpose, and not excessive in relation to that purpose.

• Express Consent: You have consented to the processing of your personal data for specified purposes, such as optional marketing, optional cookies, certain sensitive-data processing, or other processing for which consent is required.
• Contractual Necessity: Processing is necessary for the performance of our contract with you, to provide the Services you request, or to take steps at your request before entering into a contract.
• Legal Obligations: Processing is necessary for compliance with a legal obligation to which Launchpad is subject, including lawful requests, recordkeeping, sanctions, security, tax, corporate, or other compliance obligations where applicable.
• Vital Interests: Processing is necessary to protect your vital interests or those of another person. 
• Administration of Justice and Legal Functions: Processing is necessary for the administration of justice or the exercise of functions conferred by law.

Where the laws of the European Economic Area, the United Kingdom, Switzerland, or another jurisdiction apply, we may also rely on other lawful bases recognized by those laws, such as legitimate interests for fraud prevention, service security, product improvement, direct marketing for similar services where permitted, or legal claims, provided that applicable balancing, transparency, and opt-out requirements are satisfied.

How We Share Personal Data

We disclose personal data only where necessary for the purposes described in this Notice, where you direct us to do so, where disclosure is otherwise permitted by applicable law, or where required to operate, support, secure, or improve the Services. Such third parties may include:

• Blockchain networks, protocols, and external platforms with which the Services interoperate, including wallet providers, exchanges, decentralized applications, payment networks, AI tools, customer applications, and other platforms acting as independent controllers where applicable.
• Service providers and processors that support the operation of the Services, such as providers of technical infrastructure, hosting, cloud services, key management, wallet infrastructure, tokenization, analytics, error logging, security, communications, payment processing, customer support, identity or authentication, compliance screening, and related operational services.
• Professional advisers, including legal, accounting, and audit advisers. 
• Entities affiliated with Launchpad, including other entities within the MoonPay Group, where relevant for internal administration, service delivery, security, compliance, customer support, reporting, or other purposes described in this Notice.
• Developer, customer-application, and integration partners, where you use the Services through an integrated application, authorize a connection, or direct us to make information available to support your requested integration or transaction.
• Regulators, law enforcement, and government authorities, where required to comply with applicable laws or regulations, court orders, or lawful requests, or to detect, investigate, prevent, or address fraud and other illegal activity. 
• Third parties in connection with a corporate transaction, such as a merger, reorganization, sale of assets, or similar event, including in the context of insolvency or liquidation. 

We do not sell personal data and do not share personal data for targeted or cross-context behavioral advertising purposes.

International Data Transfers

Launchpad, MoonPay Group affiliates, and our service providers may process personal data in jurisdictions outside the British Virgin Islands and outside your country, state, province, or region of residence, including the United States, the United Kingdom, the European Economic Area, and other locations where we or our service providers operate.

Where we transfer personal data internationally, we implement safeguards designed to protect the data in accordance with applicable legal requirements, which may include consent, adequacy assessments, standard contractual clauses, data processing agreements, intra-group arrangements, transfer impact assessments, or other approved or appropriate transfer mechanisms.

Data Retention

We retain personal data only for as long as necessary to fulfill the purposes described in this Notice, unless a longer retention period is required or permitted by law, needed for security, fraud prevention, dispute resolution, compliance, sanctions or abuse prevention, auditability, or legal claims, or otherwise consistent with applicable law.

When determining retention periods, we consider the nature, sensitivity, and amount of the data; the purposes for which it was collected; user expectations and product controls; our legal and operational obligations; and the potential risk of harm from unauthorized use or disclosure. When personal data is no longer required, we delete, de-identify, or anonymize it in accordance with our data retention schedules and applicable law.

Due to the nature of cryptocurrency transactions, information associated with our Services may be recorded on public, decentralized blockchain ledgers that Launchpad does not control. This data, including wallet addresses, transaction hashes, amounts, timestamps, and related public blockchain data, may be immutable and may not be capable of being modified or deleted by Launchpad.

Data Security

We implement technical and organizational measures designed to protect personal data against unauthorized access, alteration, disclosure, loss, or destruction, taking into account the nature of the data and the risks associated with the processing.

These measures include, where appropriate:

• Encryption of data in transit and at rest;
• Access controls, authentication mechanisms, passkey or step-up verification, and session-management controls;
• Credential, key-management, and wallet-signing controls designed to support non-custodial product functionality; and user-authorized 
• Audit logging, monitoring, and abuse-prevention controls;
• Regular review of our security practices;
• Measures for ensuring the reliability, integrity, and competence of personnel having access to personal data; and
• Internal policies and procedures for handling personal data in accordance with generally accepted industry standards. 

Where a data processor carries out processing on our behalf, we require the processor to provide sufficient guarantees in respect of technical and organizational security measures and take reasonable steps to ensure compliance with those measures, including through appropriate contractual and operational controls.

Your Privacy Rights

Subject to applicable law and your location, you may have certain rights regarding your personal data. These rights may include:

• Right of Access and Right to Know: You may request access to your personal data, confirmation that we process your personal data, or information about the categories, sources, purposes, recipients, and specific pieces of personal data we process about you, where required by applicable law.
• Right of Rectification or Correction: You may request that we correct or rectify personal data that is incomplete, incorrect, misleading, excessive, not current, or not relevant to the purpose for which it is held.
• Right to Prevent Processing for Direct Marketing and Opt Out of Certain Processing: You may require us to stop or not begin processing your personal data for direct marketing purposes and, where applicable, opt out of targeted advertising, sale, sharing, profiling, or similar processing.
• Right to Withdraw Consent: Where our processing is based on your consent, you may withdraw your consent at any time. Please note that withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal. 
• Right of Deletion or Erasure: You may request that we delete personal data we process about you, subject to exceptions for public blockchain data, security, fraud prevention, compliance, dispute resolution, legal obligations, audit records, and other circumstances where retention is permitted or required by law.
• Right to Restrict, Object, or Port Data: Where applicable, you may request that we restrict processing, object to processing, or provide certain personal data in a portable format.
• Right to Limit Use of Sensitive Personal Information: Where applicable, you may request that we limit the use or disclosure of sensitive personal information to purposes permitted by law.

These rights are not absolute and may not apply in all circumstances. We may ask you for additional information to verify your identity or authority before responding to a request. Because wallet data may be pseudonymous and blockchain records may be public and immutable, we may not be able to identify, correct, or delete certain wallet or transaction data unless you provide information reasonably necessary to verify your relationship to the relevant data.

To exercise your rights, opt out of marketing, or ask questions about our processing of personal data, please contact us at [email protected].

Depending on your location, you may also have the right to lodge a complaint with the BVI Information Commissioner once appointed, your local data protection authority, a U.S. state privacy regulator, or another competent authority. We will not discriminate against you for exercising privacy rights protected by applicable law.

Children's Personal Data

Our Services are not directed to individuals under the age of 18. We do not knowingly collect personal data from children. If you are under the age of 18, please do not use the Services or provide any personal data to us. If we become aware that a user is under the age of 18, we will take steps to close the account and delete the associated personal data as soon as possible, subject to any legal, security, fraud-prevention, or blockchain-related limitations.

Third-Party Services

Our Services may interact with third-party services, including blockchain networks, wallet providers, exchanges, decentralized applications, payment networks, customer applications, developer integrations, prediction market platforms, AI agents, and large language models. These third-party services are not operated by Launchpad, and this Notice does not apply to the processing of personal data by those third parties.

Where you use a third-party AI agent, large language model, customer application, developer tool, or other external service in connection with the Services, that tool or service may be independently sourced, configured, or directed by you or by the relevant third party. The collection and processing of data by those tools and services is governed by their own privacy policies and terms.

We encourage you to review the privacy policies of any third-party service you access through or in connection with the Services.

Cookies

Our websites, applications, SDKs, portals, and integrations may use cookies and similar technologies to collect information about your browsing and usage activities. For detailed information about the cookies we use and how to manage your preferences, please refer to our Cookie Policy available at https://www.moonpay.com/legal/cookie_policy.

Changes to This Notice

We may update this Notice from time to time to reflect changes in our Services, processing activities, or applicable data protection law. If we make material changes, we will update the effective date at the top of this Notice and, where practicable or required by law, notify you by email, through the Services, or by other appropriate means before the changes take effect.

Your continued access to or use of our Services after any changes constitutes acceptance of the updated Notice. We encourage you to review this Notice periodically.

How to Contact Us

If you have questions or concerns regarding this Privacy Notice, wish to exercise your privacy rights, or have a complaint, please contact our Data Protection Officer at [email protected].