Privacy Notice

“Personal Data” means information that relates to an identified or identifiable person. It does not include information that has been aggregated or de-identified so that a person can no longer reasonably be identified.

Controller: Candle Holdings Inc., a Wyoming corporation incorporated in 2026, with its principal place of business in Wyoming, United States.

Contact email: [email protected]

A. Account and identity information

• Email address and sign-in identifiers when you create or sign in to an account (email one-time codes, Sign in with Apple, Google Sign-In).
• Profile information you choose to provide: username (@handle), display name, bio, profile photo and banner image.
• Your phone number, if you verify it by SMS code. We ask for it during sign-up and again in Add Cash for US buyers, where it is used for MoonPay checkout. We ask you to verify it again after 30 days.
• Referral codes or links you use or share in connection with our referral program.

B. Wallet and blockchain information

• Wallet address and public blockchain identifiers.
• Public blockchain activity associated with your wallet address, including transaction hashes and token interactions.
• Activity you initiate through the Services that results in on-chain transactions (for example swaps, transfers, deposits, or withdrawals).

Candles is non-custodial. We do not collect or store your wallet seed phrase or private keys. Wallet credentials are managed through wallet infrastructure providers and/or remain under your control on your device.

C. Payments, funding, and on-ramp information

When you add cash, buy with Apple Pay, deposit from another app or network, or cash out, you use third-party providers: MoonPay (Add Cash and Cash out), Crossmint (Apple Pay token purchases), Coinbase (Coinbase Onramp), Flashnet (Cash App deposits) and MoonPay Commerce (deposits from other networks). These providers may collect payment details, identity verification (KYC) information and related compliance data directly, under their own privacy policies.

To start a MoonPay or Coinbase purchase we send the provider your wallet address and IP address, and for MoonPay also your email and, if verified, your phone number. We store your country, worked out from your IP address, on each Add Cash order to choose the provider and currency.

• We may receive limited order, status, and transaction metadata needed to show your purchase progress in the app and reconcile activity (for example order IDs, amounts, asset types, and completion status).

Card numbers and bank credentials are handled by those payment providers, not stored by Candles as your card vault.

D. Usage and device information

• IP address, approximate location derived from IP or device locale settings, browser or app type, operating system, device identifiers, language, and timezone.
• Logs and usage data such as screens viewed, features used, clicks, performance metrics, and error reports.
• While the app is open, it checks in with our servers about once a minute. Each check-in records the screen you are on, when you were last active, and your app version and platform. We use this to see how the app is used, to show our team how many people are online, and to help with support requests.
• Events about how you use the app, such as screens opened, sign-ins and trade results. These are first-party: they are sent only to our own servers.
• A push notification ID from OneSignal, linked to your wallet address, if you allow notifications.
• Crash and error reports from Sentry, linked to your wallet address. These reports exclude your email, IP address and request contents.
• On-device biometrics (for example Face ID) may be used to confirm sensitive actions such as revealing a recovery phrase or approving a transfer. Biometric templates stay on your device and are not collected by Candles.
• Camera access if you choose to take a profile photo or scan a wallet QR code. MoonPay’s identity check, which runs inside the app, may also ask for camera and microphone access. That data goes to MoonPay.

E. Communications

• Information you send to us, including support messages, feedback, and any content you provide through in-app support tooling.
• Our AI support assistant reads your support messages and the account details it needs to answer them (see section 6A). The chat tells you this before your first message, and sending a message means you agree. Its replies are labelled as coming from the AI assistant, and a person from our team can step in at any time.

F. Compliance and risk information (only if required)

• If required by applicable law or risk controls, we or our providers may request additional information to comply with legal obligations such as sanctions, fraud prevention, or anti-money laundering requirements.

G. Information from third parties and public sources

• Public blockchain data and other publicly available information.
• Information from authentication providers (for example Apple or Google) when you choose those sign-in methods.
• Information from service providers that support security, fraud prevention, payments, analytics, error monitoring, wallet infrastructure, and customer support.

H. Accounts from the earlier version of the app

If you used the earlier version of Candles, we moved your account to the current system. This covered your profile, phone number, trade history, referral links and rewards. We also keep a list of sign-in identifiers (sign-in provider IDs and email addresses) only to match returning users to their existing wallet. We delete that list 90 days after the move.

Mandatory vs optional data

Unless a field is marked optional, information we request may be required to provide the Services. If you do not provide required information, some features may not function or may be unavailable.

We do not track you across other companies’ apps or websites. The app has no advertising SDK, does not read your device’s advertising ID, and does not send your data to data brokers.

We use cookies and similar technologies (“Cookies”) for:

• Strictly necessary: required for the Services to function, including security and session integrity.
• Functionality: remember preferences, for example saving your one-time acknowledgement of an onboarding modal so it does not reappear.
• Performance and analytics: understand usage and improve reliability and user experience.
• Attribution: understand which sources drive traffic and usage, measured at a device or browser level, where used.

Where required by law, we will request consent before placing non-essential cookies. Under EU cookie rules, strictly necessary cookies are generally exempt, and non-essential cookies typically require prior consent.

The Candles mobile app does not use cookies. Provider pages that open inside the app, such as MoonPay, Crossmint or Coinbase, may set their own cookies under their own policies.

You can control Cookies through your browser settings. Disabling certain Cookies may cause parts of the Services to not work properly.

We use information to:

• Create and authenticate accounts, including email code and social sign-in flows.
• Provide, operate, and maintain the Services.
• Enable user-requested actions, including wallet creation, swaps, cross-chain trades, transfers, deposits, withdrawals, Add Cash and Cash out.
• Operate referral and rewards features you choose to use.
• Send push notifications you have turned on (market updates, price alerts, referral rewards). You can turn each type off in Settings.
• Provide customer support and communicate with you.
• Answer support messages with our AI assistant.
• Monitor performance, fix bugs, and improve the Services.
• Detect, prevent, and investigate fraud, abuse, and security incidents.
• Comply with legal obligations, enforce our terms, and respond to lawful requests.

Where the GDPR or UK GDPR applies, we process Personal Data when we have a lawful basis, including performance of a contract, legitimate interests, consent, and legal obligation.

We may share information in the following ways.

A. Service providers

We share information with vendors that help us operate the Services. They are permitted to process information only as instructed by us and only for the purposes we authorize, except where they act as independent controllers (for example certain payment or identity providers). Categories and examples can include:

• Hosting and storage: Amazon Web Services (servers, database, file storage) and Cloudflare (content delivery, security, IP-based country).
• Wallet infrastructure and sign-in codes: Turnkey (wallet creation and signing, and email one-time codes).
• Sign-in providers you choose: Apple and Google.
• Phone verification: Twilio (sends SMS codes).
• Trading and blockchain: Jupiter (Solana swap routing), Relay (cross-chain trades), Helius (Solana network access), Codex (market data and wallet balances).
• Funding and cash out: MoonPay, MoonPay Commerce, Crossmint, Coinbase and Flashnet, which may process payment and identity information under their own policies.
• Push notifications: OneSignal.
• Crash and error reporting: Sentry.
• AI support assistant: Anthropic (the Claude AI model). It receives your support conversation (including anything you write in it) and the account details needed to answer it: when you joined, whether you verified a phone number (not the number), your referral counts and earnings, your balances and holdings, your recent trades, deposits, withdrawals and cash outs (amounts, status, and payment or payout method), Add Cash and Cash out orders in progress, the status and rating of your earlier support chats, whether your original account signs in with Apple or email if we found one, and your phone type and app version. We don’t send it your email, phone number, username, wallet address, referral code, transaction IDs or recovery phrase. Under its commercial terms, Anthropic processes this only to provide the service to us and does not use it to train its models.

Customer support chat runs on our own servers, and our AI assistant (above) also processes it. If you are signed out, we link you to our Discord server, where Discord’s own policies apply.

B. Affiliates

We may share information within our corporate group for purposes consistent with this Privacy Notice.

C. Legal, compliance, and safety

We may disclose information to comply with law, respond to lawful requests, protect rights and safety, and investigate fraud or security incidents.

D. Business transfers

If we are involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, information may be transferred as part of that transaction.

Your use of digital assets may be recorded on a public blockchain. Public blockchains are intended to immutably record transactions and may be subject to forensic analysis that can enable re-identification when combined with other data. We do not control decentralized networks and generally cannot erase, modify, or alter data recorded on-chain.

We may process and store information in countries other than where you live, including the United States. Where required, we use appropriate safeguards for cross-border transfers, such as transfer mechanisms recognized under applicable law. The UK ICO describes mechanisms used for restricted transfers under Article 46, including use of the UK IDTA or Addendum where applicable.

We retain information as long as necessary to fulfill the purposes described in this Privacy Notice, including to comply with legal, regulatory, accounting, or reporting requirements. Retention depends on the amount, nature, sensitivity, and purpose of the data, as well as legal requirements.

Specific periods:

• Usage events: deleted after 180 days.
• Our AI support assistant’s records (what it decided and drafted for each message): deleted after 180 days.
• Server logs: kept for 30 days.
• Database backups: kept for 7 days.
• The screen and last-active fields: overwritten at each check-in.
• Sign-in identifiers from the earlier version of the app: deleted 90 days after the move.
• Account data (profile, trades, Add Cash and Cash out orders, support messages): kept until you delete your account.

Because blockchain data is public and typically immutable, we may not be able to delete information recorded on-chain.

We use reasonable administrative, technical, and physical safeguards designed to protect information. No method of transmission or storage is fully secure. You are responsible for safeguarding your devices and wallet credentials. We will never ask for your seed phrase.

A. Account deletion

You can delete your Candlesaccount in the app under Settings > Legal and privacy > Delete account (when signed in). Deletion removes your profile (email, phone, username, display name, bio, photos), your trade, Add Cash and Cash out history, support messages and portfolio history. If you sign in with Apple, deletion also revokes Candles’ access to your Apple ID. Some records stay after deletion:

• Usage events linked to your account: until they are deleted after 180 days.
• Referral rewards your trades earned for the person who invited you: kept, without your name.
• Backups and server logs: until they expire (7 and 30 days).
• Records held by providers such as MoonPay, Crossmint, Coinbase, Twilio, Turnkey and Anthropic: kept under their own policies.
• Your self-custodial wallet and its on-chain history are not ours to delete.

We cannot delete your account while you hold $1 or more in your wallet, a trade or withdrawal is still settling, or referral rewards are still being paid to you. This gives you time to move your funds first.

If you cannot access the app, use our account deletion page or email [email protected] from the email on your account and request deletion.

B. AI answers in support

Our AI assistant may answer your support messages first. Before your first message, the support chat tells you that your messages and account details are processed by our service providers, including AI providers, and sending a message means you agree. If you’d rather talk to a person, ask in the chat and our team takes over. Each AI reply has a thumbs up and a thumbs down: a thumbs down reports it, and a person from our team takes over the chat.

C. EEA and UK rights

Where applicable, you may have rights to access, correct, delete, restrict processing, object, and request portability of your Personal Data, and to withdraw consent where processing is based on consent.

D. California rights (CCPA and CPRA)

If you are a California resident, you may have rights including the right to opt out of the sale or sharing of personal information, plus rights to correct and delete, subject to legal exceptions. We do not sell personal information for money.

How to exercise your rights

Use in-app account deletion where available, visit our account deletion page, or email us at [email protected] with (i) enough information to identify you and (ii) the request you are making. We may request information to verify your identity. Verification information is used only for verification.

Complaints

If you believe we have not handled your information appropriately, contact us and we will investigate and respond within a reasonable time. You may also have the right to lodge a complaint with your local data protection authority.

The Services may contain links to, or embed, third-party websites and services (including authentication, wallet, payment, support, and analytics providers). Those third parties may collect information under their own privacy policies. We are not responsible for their privacy practices. We encourage you to read their privacy policies before using their services.

For questions about this Privacy Notice or your information, contact us at [email protected]. Candle Holdings Inc. is incorporated in Wyoming, United States.