Legal

Verdict Privacy Policy

Version 2026-11-03 · Last updated 3 November 2026

This Privacy Policy explains how Verdict Markets Inc. ("Verdict", "we", "us") collects and uses personal data. It covers our websites at verdict.exchange and its subdomains, our mobile apps, our APIs and connectors, and our support channels (together, the "Services"). Terms with capital letters that are not defined here have the meanings in our Terms of Use.

1. Who we are and how to contact us

Controller: Verdict Markets Inc., a Delaware corporation, 251 Little Falls Drive, Wilmington, Delaware 19808, United States. We are the controller of the personal data described in this policy.

Privacy contact: privacy@verdict.exchange

2. What this policy does not cover

Verdict is non-custodial, and several services you use alongside us are run by other companies under their own privacy policies. They are separate controllers, and we do not control how they process your data:

Lighter, the trading venue where your orders are matched and settled;
Privy, when it authenticates you and secures your Embedded Wallet;
on-ramp, off-ramp or bridge providers, including any identity checks they run;
your external wallet provider, such as MetaMask or Rabby;
the app stores (Apple and Google);
public blockchains.

Privy also acts for us as a service provider for sign-in, as described in Section 6.

3. The personal data we collect

Category	What it includes	Where it comes from
Wallet and venue identifiers	Wallet addresses (Embedded and external); Lighter account index; trading-key public keys; public positions, orders and trades linked to those addresses	You, when you connect; the Venue; public blockchains
Sign-in data	Email address; or the account identifier, name, email and profile image that Google or X shares when you choose that sign-in method; Privy user ID	You, through Privy
Location and eligibility data	IP address; the country and region we infer from it; the result of the eligibility check; your attestation that you are 18+ and not a Restricted Person	Your device and our hosting provider; you
Terms acceptance records	Wallet address; Terms version and its SHA-256 hash; the signed message and signature; site; time; nonce; the country inferred at the time	You, when you sign
Device, usage and diagnostics data	Pages and screens viewed; events such as "order placed" or "terms accepted" (without the wallet address); browser, OS, app version; language; performance metrics; error reports with personal details removed; the referring website's domain	Your device, through our analytics tool
Security and rate-limit data	IP address; request metadata; abuse signals	Your device and our hosting provider
Support and communications	Your messages to us, your contact details, attachments, and our replies; email preferences	You
Deposit status	For cash deposits through our card payment provider: transaction reference, amount, currency, status and destination Wallet. We do not receive your identity documents.	The card payment provider
Referral data	Invite codes; who referred whom (by Wallet); qualifying activity; reward amounts and payout Wallet	You; the Venue; our systems
Preferences and features	Followed teams, alerts, notification settings, share links you create	You
Integrity data	Trading patterns, linked accounts and other information relevant to suspected Prohibited Conduct	Our systems; the Venue; public data; reports from others
Mobile app data	Push-notification token; device model and OS; app version; crash data	Your device and the app store push services
Profiles and comments (when launched)	Username, avatar, bio, comments, reactions, reports and moderation history	You; other users

We do not ask for your name, date of birth, address or identity documents to use the Services. We do not knowingly collect special-category data. Please do not include it in support messages or comments.

4. Why we use your data, and our legal bases

The legal bases below apply where the EU GDPR or the UK GDPR applies to you.

Purpose	Data used	Legal basis
Provide the Interface: connect your Wallet, show balances and positions, prepare orders for you to sign, send notifications you ask for	Wallet and venue identifiers; sign-in data; preferences; mobile app data	Contract (Art. 6(1)(b))
Record your acceptance of the Terms and show that you accepted them	Terms acceptance records	Contract; legitimate interests in being able to prove the agreement (Art. 6(1)(f))
Check eligibility and enforce restricted jurisdictions	Location and eligibility data; Terms acceptance records	Legal obligation where Sanctions or other law requires it (Art. 6(1)(c)); otherwise legitimate interests in complying with Venue terms and the law of other countries
Operate and resolve Verdict Markets, handle market disputes and Settlement Error claims	Wallet and venue identifiers; dispute submissions	Contract; legitimate interests
Detect and prevent manipulation, insider trading, fraud, multi-accounting and abuse; protect the Services	Integrity data; security data; wallet and venue identifiers	Legitimate interests in market integrity and security; legal obligation where applicable
Run the referral program and pay rewards	Referral data	Contract
Answer support requests	Support and communications	Contract; legitimate interests
Understand and improve the Services, fix errors	Device, usage and diagnostics data	Legitimate interests. This analytics tool is cookieless and builds no profiles
Send product news and offers by email	Email address	Consent (Art. 6(1)(a)), which you can withdraw at any time
Moderate profiles and comments (when launched)	Profiles and comments	Contract; legitimate interests; legal obligation (for example, notice-and-action duties)
Comply with law, respond to lawful requests, establish or defend legal claims	Any relevant data	Legal obligation; legitimate interests

Where we rely on legitimate interests, we have balanced our interests against your rights. You can ask us for details of that assessment, and you can object (see Section 9).

Automated decisions. Our eligibility check decides automatically whether the Interface allows you to trade, based on your inferred location. We use it to comply with law and the Venue's terms. If you believe a decision is wrong, contact us. A person will review it.

5. Blockchain data is public

Wallet addresses, Venue accounts, orders, trades and settlements are recorded on public blockchains or Venue systems that anyone can read. We cannot change or delete them. If you link your identity to a Wallet address, for example in a profile or a comment, others may connect that address to you.

6. Who we share data with

Service providers (processors). These providers act on our instructions under data processing terms:

Category	Service	Location of processing
Hosting and infrastructure providers	Website and API hosting, logs, location headers, databases, storage and caching	United States, Japan and a global edge network
Privy (Privy Inc.)	Sign-in, Embedded Wallet infrastructure	United States
Analytics provider	Product analytics and error reports (cookieless)	United States
Email provider	Transactional and opted-in email	United States
Wallet-connection service	Connecting external wallets	Global relay network
Font provider	Loading web fonts	United States
Apple and Google	Mobile push notifications	United States

Affiliates. We share data with our affiliate that operates Verdict Markets (the Market Operator named in the Market Rules), as needed to operate and resolve those markets, handle market disputes and Settlement Error claims, and run the referral program.

Independent third parties. We share data with the following, each acting under its own policy:

the Venue, as needed to route your orders, register deposit addresses, operate markets, and report suspected Prohibited Conduct;
resolution services and independent reviewers, when a market dispute you submit must be reviewed;
card payment providers, when you start a cash deposit;
sports and event integrity bodies, where we suspect manipulation or insider trading.

Authorities. We share data with courts, regulators and law enforcement where the law requires it or where we believe in good faith that disclosure is necessary to prevent fraud, harm or illegal activity.

Corporate transactions. If we are involved in a merger, acquisition, financing or sale of assets, data may pass to the other party under confidentiality obligations.

We do not sell personal data. We do not use it for targeted advertising, and we do not share it for cross-context behavioural advertising.

7. International transfers

We are based in the United States, and our providers process data in the United States, Japan and other countries. These countries may not offer the same level of protection as your own. Where EU or UK law requires it, we protect transfers by the following means, and you can ask us for a copy of the safeguards:

the European Commission's Standard Contractual Clauses;
the UK International Data Transfer Addendum;
the EU-US or UK-US Data Privacy Framework, where a provider is certified;
other lawful mechanisms.

8. How long we keep data

Data	Retention
Terms acceptance records	While you use the Services, and six (6) years after your last use
Raw IP addresses in access and security logs	90 days
Eligibility results (country or region, outcome)	With the related acceptance record or reward record
Analytics events	24 months; after that, only aggregated data
Support messages	3 years after the request is closed
Referral and reward records	6 years after payment, for accounting and tax
Integrity investigation records	6 years after the investigation closes
Profiles and comments	Until you delete them or ask us to delete your profile. Removed content and moderation records are kept for 6 months, to handle appeals
Marketing email address	Until you unsubscribe or withdraw consent

We may keep data for longer where the law requires it, or to establish, exercise or defend legal claims. Blockchain data is outside our control (see Section 5).

9. Your rights

Depending on where you live, you may have the right to:

access your personal data;
correct it;
delete it;
restrict or object to our use of it;
receive it in a portable format;
withdraw consent at any time.

To exercise a right, email privacy@verdict.exchange. If your request concerns data linked to a Wallet, we may ask you to sign a message with that Wallet to prove that it is yours. We will respond within one month, or within any shorter period that the law sets. We may extend that period where the law allows. We will not charge a fee unless a request is manifestly unfounded or excessive.

Some data we cannot delete, for example blockchain records, or records we must keep under Section 8. Where that applies, we will tell you.

You also have the right to complain to a data-protection supervisory authority. In the EU, that is the authority in the country where you live or work, or where the issue arose. In the UK, it is the Information Commissioner's Office. We would welcome the chance to deal with your concern first.

10. Cookies, local storage and similar technologies

Strictly necessary. We use cookies and browser or app storage that the Services need in order to work. They keep you signed in through Privy, maintain your Wallet connection, protect sign-in and terms-signature challenges, remember your settings, and keep cached market data on your device. These do not need your consent.

Analytics. Our analytics tool runs in cookieless mode. It does not set analytics cookies and builds no individual profiles. If your browser sends a Do Not Track signal, we do not collect analytics events.

No advertising trackers. We do not use advertising cookies, advertising pixels or the mobile advertising identifier.

You can clear cookies and local storage in your browser or device settings. If you do, you may be signed out and lose your settings.

11. Mobile apps

The apps use the following:

Push notifications, only if you allow them. The app sends us a push token, which we use to deliver alerts. You can turn notifications off in your device settings.
Biometric unlock (Face ID, Touch ID or Android biometrics), if you turn it on. It is handled entirely by your device's operating system. We never receive your biometric data.
Diagnostics. App version, device model, OS and crash data, which we use to fix errors.

You can delete your Verdict profile from inside the app, or by contacting us. Deleting it removes the off-chain data we hold about you, subject to Section 8. It does not affect your Wallet, your Venue account or blockchain records.

12. Security

We protect personal data with technical and organisational measures. They include encryption in transit, access controls, the principle of least privilege, logging and vendor review. No system is fully secure. You are responsible for keeping your Wallet, devices and sign-in methods secure. We will never ask for your private key or seed phrase.