AgentDEX Privacy Notice

1. About this Notice

This Privacy Notice explains how FOTNMC Limited, a company incorporated under the laws of Hong Kong under incorporation number 79303431, with its registered address at Unit 507, 5/F Chinachem Golden Plaza, 77 Mody Road, Tsim Sha Tsui, Hong Kong ("FOTNMC," "AgentDEX," "we," "us" or "our"), collects, uses, stores and discloses information in connection with AgentDEX.

This Notice applies to the AgentDEX website and trading interface available at https://agentdex.xyz, the AgentDEX APIs and Model Context Protocol server, and any related application, integration or service that links to this Notice (collectively, the "Services").

For the purposes of applicable data protection laws, FOTNMC is the data user or data controller responsible for the processing described in this Notice.

AgentDEX does not require conventional identity information or know-your-customer documentation merely to connect a wallet and use the Services. However, public wallet addresses, transaction records, online identifiers and technical information may constitute personal data where they relate to, identify or can reasonably be linked to an individual. We refer to such information as "Personal Data" in this Notice. Not every item of information described below will identify you to us.

2. Personal Data We Process

Depending on how you interact with the Services, we may process the following categories of Personal Data.

2.1 Wallet and authentication data

This may include:

• your public wallet address and the blockchain network used;
• cryptographic signatures used to verify control of a wallet;
• authentication messages, nonces, issue and expiry timestamps, and permission scopes; and
• account, session or other identifiers linked to your wallet.

A wallet signature allows us to verify that you control the relevant wallet. It does not disclose your private key to us. We do not request or collect wallet seed phrases or private keys.

2.2 Trading, account and transaction data

This may include:

• orders, order instructions, fills, positions and trading history;
• balances, collateral, margin, profit and loss, funding and liquidations;
• deposits, withdrawals and related status information;
• transaction hashes, token movements and smart-contract interactions; and
• API-key identifiers, permissions, limits and activity, including actions initiated through bots, MCP clients or AI agents and linked to your wallet or AgentDEX account.

This information is necessary to provide the trading and account functionality you request, maintain appropriate records of activity, and protect the Services and their users.

2.3 MCP, API and integration data

If you access AgentDEX through a third-party AI application, MCP client, API client, bot or other integration, we may receive and process:

• the request, tool-call parameters, transaction instructions and other data that the relevant client sends to AgentDEX at your direction;
• authentication credentials or tokens, key identifiers, permission scopes and limits;
• records of tools made available, requested or used, and the outcome of those requests; and
• related timestamps, security events, error information and technical metadata.

AgentDEX does not necessarily receive your entire conversation with the third-party application. The information received depends on the client, the tools used, the request submitted and the permissions you grant. You should not include names, contact details, identification documents, financial account information or other sensitive personal information in prompts, tool inputs or API requests unless it is strictly necessary.

2.4 Technical and security data

When you access or use the Services, we and our service providers may automatically process:

• IP address and approximate country or location derived from the IP address;
• browser type, device type, operating system and similar technical information;
• access times, session timestamps, request identifiers and referring pages;
• server, authentication, security, network and activity logs; and
• error reports, diagnostics and information concerning suspected misuse, attacks or unauthorised access.

2.5 Analytics and cookie data

We may use cookies, local storage and similar technologies to operate the Services, maintain sessions, remember preferences, protect accounts and understand how the Services are used.

The AgentDEX website uses Google Analytics. Google Analytics may process a pseudonymous client identifier, first-party cookies, page views, session activity, browser and device information, and approximate location derived from an IP address. We use this information to understand usage, diagnose performance issues and improve the Services.

You can control or delete cookies through your browser settings. Blocking strictly necessary cookies or local storage may prevent parts of the Services from functioning correctly. You may also use the Google Analytics Opt-out Browser Add-on. Where applicable law requires consent for non-essential analytics cookies, we will use those cookies on the basis of your consent.

For further information about Google's processing, please see the Google Privacy Policy.

2.6 Public blockchain data

Blockchains are public by design. We may access, receive, copy, index, analyse and store publicly available blockchain information, including:

• wallet addresses;
• transaction hashes;
• token transfers and balances;
• smart-contract interactions; and
• other publicly available on-chain records.

We may associate this information with an AgentDEX account, session, deposit, withdrawal, order, security review or other activity where necessary to provide or protect the Services.

2.7 Communications

If you contact us through an official support channel, email, Discord, Telegram, a bug report or a security report, we may process the information you voluntarily provide, together with relevant contact details, message metadata and our correspondence with you. Please do not send private keys, seed phrases or unnecessary sensitive information through any support channel.

3. Information We Do Not Require

AgentDEX does not require you to provide your legal name, residential address, telephone number, date of birth, government-issued identification, biometric information, bank account details or payment-card details merely to connect a non-custodial wallet and use the Services.

We do not conduct identity verification or collect KYC documentation as part of the ordinary wallet-connection process. We do not request or collect private keys or seed phrases. If anyone claiming to represent AgentDEX asks you for a private key or seed phrase, do not provide it.

You may nevertheless provide limited contact or other information voluntarily when communicating with us. We may also be required to collect additional information in a particular case where reasonably necessary to comply with applicable law, respond to a lawful request, investigate misuse or protect legal rights. If this occurs, we will process that information for the relevant purpose and in accordance with applicable law.

4. How We Obtain Personal Data

We obtain Personal Data:

• directly from you, your wallet, your browser, or a client or agent acting at your direction;
• automatically when you access or use the Services;
• from public blockchains and other public sources; and
• from service providers and integrations, including wallet-connection providers, RPC and blockchain infrastructure providers, analytics providers, hosting and security providers, logging and error-monitoring providers, and MCP or API clients selected by you.

Providing wallet, authentication, transaction and instruction data is necessary where you wish to use the corresponding features. If you do not provide that information, we may be unable to authenticate you, connect the relevant wallet or client, execute a requested action, or provide the relevant part of the Services. Providing information in a support or other voluntary communication is optional, although we may be unable to respond adequately without sufficient information.

5. How We Use Personal Data

We may use Personal Data to:

• provide, operate and maintain the Services;
• connect wallets and authenticate users, sessions, API keys and MCP clients;
• receive, validate, process and record orders, transactions and other instructions;
• calculate and display balances, positions, margin, profit and loss, funding and liquidation information;
• process and reconcile deposits and withdrawals;
• administer API keys, permissions, limits, integrations and agent activity;
• provide support and respond to enquiries, bug reports and security reports;
• monitor availability, troubleshoot errors, analyse performance and improve the Services;
• detect, investigate and prevent fraud, abuse, security incidents, unauthorised activity and violations of our terms;
• establish, exercise or defend legal claims and protect our rights, property, users and systems;
• comply with applicable laws, court orders and lawful requests from competent authorities; and
• create aggregated or anonymised information that no longer identifies or is reasonably linkable to an individual.

We do not use Personal Data for direct marketing unless we provide an appropriate separate notice and obtain any consent required by applicable law.

6. Legal Grounds for Processing

Where applicable law requires us to identify a legal ground for processing, we rely on one or more of the following:

• performance of a contract: where processing is necessary to provide the Services you request or take steps at your request;
• legitimate interests: including operating, securing, supporting, developing and protecting the Services, preventing fraud and misuse, and establishing or defending legal claims, provided those interests are not overridden by your rights and interests;
• legal obligations: where processing is necessary to comply with applicable law or a binding legal request; and
• consent: where we ask for consent, including for non-essential cookies where required. You may withdraw consent at any time, without affecting processing carried out before withdrawal.

7. How We Disclose Personal Data

We may disclose Personal Data only as reasonably necessary for the purposes described in this Notice, including to:

• hosting and infrastructure providers that host, transmit or support the Services;
• CDN, WAF, cybersecurity, logging and error-monitoring providers that help us maintain availability, diagnose issues and protect the Services;
• analytics providers, including Google Analytics;
• wallet, wallet-connection and authentication providers, including WalletConnect where you choose or use a connection supported by it;
• RPC, node, indexing and other blockchain infrastructure providers used to read from or interact with a blockchain;
• MCP clients, AI applications, API clients and other integrations selected by you, where disclosure is necessary to return a requested result or carry out your instruction;
• professional advisers, auditors, insurers and other persons who owe appropriate duties of confidentiality;
• courts, regulators, law-enforcement bodies and other authorities where disclosure is required by law or reasonably necessary to protect rights, safety or the integrity of the Services; and
• actual or prospective transaction counterparties and advisers in connection with a financing, corporate reorganisation, merger, acquisition, sale of assets, insolvency or similar transaction, subject to appropriate confidentiality protections where applicable.

We do not sell Personal Data for monetary consideration.

Some third parties, including wallet providers, WalletConnect, blockchain networks, third-party AI applications, MCP clients, and other websites or applications, process information under their own privacy notices and terms. AgentDEX does not control their independent processing. You should review the privacy information provided by each third-party service you choose to use.

8. International Processing and Transfers

FOTNMC is established in Hong Kong. The Services are available through the internet and rely on service providers and blockchain infrastructure that may operate in Hong Kong, the United States, the European Economic Area and other jurisdictions. Accordingly, Personal Data may be processed outside the country or territory in which you are located.

Where required by applicable law, we take reasonable steps designed to ensure that international transfers are subject to appropriate contractual or other safeguards. Privacy and data-protection laws in a recipient jurisdiction may differ from those in your jurisdiction.

9. Retention

We retain Personal Data only for as long as reasonably necessary for the purposes described in this Notice, including to provide the Services, maintain security and operational records, resolve disputes, enforce agreements, and comply with legal obligations. Retention periods vary depending on the type of information, the nature of the relevant activity, security requirements, applicable limitation periods and legal requirements.

We may retain wallet-linked account, trading and transaction records for as long as the relevant account or relationship remains active and for a reasonable period afterwards. Authentication, technical, security, analytics and support records may be retained for different and generally shorter or configuration-dependent periods. Backup copies may remain for a limited period after deletion from active systems.

Public blockchain records are not controlled by AgentDEX and ordinarily cannot be altered or deleted. We may also be required or have a legitimate need to retain certain off-chain records of blockchain or trading activity even after a request to delete other Personal Data.

When Personal Data is no longer reasonably required, we will delete, anonymise or securely isolate it, subject to technical and legal limitations.

10. Security

We use reasonable administrative, technical and organisational measures designed to protect Personal Data against unauthorised or accidental access, disclosure, alteration, loss, misuse or destruction. Access to Personal Data is limited according to operational need, and we use service providers that support the security and operation of the Services.

No system, internet transmission, wallet, smart contract or method of storage is completely secure. We therefore cannot guarantee absolute security. You are responsible for securing your wallet, devices, API keys, authentication credentials and MCP-client configuration, and for reviewing any message or transaction before signing or approving it.

11. Your Rights and Choices

Depending on the law applicable to you, you may have rights to:

• request access to Personal Data we hold about you;
• request correction of inaccurate or incomplete Personal Data;
• request deletion or restriction of certain processing;
• object to certain processing based on legitimate interests;
• receive certain Personal Data in a portable format;
• withdraw consent where processing is based on consent; and
• complain to a competent privacy or data-protection authority.

These rights are not absolute and may be limited by applicable law, the rights of others, security requirements, our need to establish or defend legal claims, and the technical characteristics of blockchain systems.

Because AgentDEX does not ordinarily know your conventional identity, we may need information reasonably sufficient to locate the relevant records and verify that you are entitled to exercise rights in relation to them. This may include asking you to demonstrate control of a relevant wallet by signing a verification message. We will never ask you to disclose a private key or seed phrase.

To exercise a privacy right, contact us using Section 14 below. If you are in Hong Kong, you may also contact the Office of the Privacy Commissioner for Personal Data. If another data-protection law applies to you, you may contact your local supervisory authority.

12. Third-Party Services and Public Blockchains

This Notice applies only to processing controlled by FOTNMC. It does not govern the independent activities of third-party wallets, wallet-connection tools, blockchains, block explorers, AI applications, MCP clients, browser extensions, websites or services that you choose to use with AgentDEX.

Transactions submitted to a public blockchain may be permanently visible to anyone and may be copied, indexed or analysed by third parties. Neither FOTNMC nor any other person can generally delete or modify information recorded on a public blockchain.

13. Children

The Services are not intended for persons under 18 years of age, and we do not knowingly collect Personal Data from children. If you believe that a person under 18 has provided Personal Data to us, please contact us so that we can take appropriate action.

14. Contact Us

For privacy questions, requests or complaints, contact us through the official AgentDEX support channel identified at https://agentdex.xyz, or write to:

Please do not send private keys, seed phrases or unnecessary sensitive information in any communication.

15. Changes to this Notice

We may update this Notice from time to time to reflect changes to the Services, our practices or applicable law. We will publish the updated version through the Services and change the "Last updated" date above. Where required by applicable law, we will provide additional notice of material changes.