Protecting information.
Respecting people.
Clear principles for how Exohood Labs collects, uses, safeguards and manages personal information across its corporate platforms and communications.
Privacy, not guesswork
This notice is designed to explain practices and individual rights without making promises of absolute security or removing protections granted by law.
Scope and controller
This Privacy Policy explains how Exohood Labs Inc (referred to as “Exohood Labs”, “we”, “our” or “us”) handles personal information in connection with exohood.com, corporate enquiries, recruitment or partnership communications, and other services that link to this notice. The responsible contracting or data-controlling entity for a particular product may be identified in that product’s separate terms or privacy notice.
This notice applies to individuals acting personally or for an organisation. When we process information solely on a business customer’s instructions, the customer may be the controller and our responsibilities may instead be governed by a data-processing agreement. The relevant product notice or contract takes precedence for that processing.
- Our contact for privacy questions and requests is helpdesk@exohood.com. The corporate enquiry form is at /contact.
Information we collect
We collect information you submit, technical information generated during access, and information received from authorised counterparties or publicly accessible professional sources when reasonably necessary for business engagement.
Categories may include the following, depending on the interaction:
- Identity and contact details: name, business email, telephone, organisation, title, country and correspondence.
- Account and eligibility data: registration details, preferences, authentication records, and identity or corporate verification materials only when required for a particular service.
- Technical and security data: IP address, device type, browser configuration, timestamps, session identifiers, diagnostic logs, anti-abuse signals and approximate location inferred from network information.
- Communication content: information in emails, website forms, attachments, feedback, meeting requests and service tickets.
- Product-specific information: wallet public addresses, transaction references or service telemetry where you voluntarily use or connect to a relevant product; blockchain data can be permanently public.
Purposes and lawful grounds
We use personal information only where we have an appropriate legal basis under applicable data-protection law. The basis depends on the purpose and the individual circumstances.
Processing for enquiries, service administration, abuse prevention and legal compliance may rely on legitimate interests, steps prior to or performance of a contract, compliance with legal obligations, or consent where required. For essential communications, consent is not always the appropriate basis.
- To answer enquiries, assess potential engagements, manage relationships and provide requested services.
- To authenticate users, secure accounts, detect misuse, prevent fraud and investigate incidents.
- To keep operational records, maintain systems and fulfil applicable financial, sanctions, tax, legal or regulatory obligations.
- To measure non-essential website usage and deliver optional marketing only with the relevant consent or other lawful permission.
- To develop and improve services using appropriately restricted information and proportionate safeguards.
Cookies, measurement and visitor choice
Our websites use essential storage and, where permitted, optional analytics or experience-measurement technologies. Depending on the page and consent settings, third-party tools may include Google Analytics, Microsoft Clarity, Hotjar, HubSpot and Yandex Metrica. Their data practices and international locations are governed by their own applicable terms and notices.
Where consent is legally required, non-essential tracking should not start before the visitor opts in. Visitors must be able to decline non-essential technology without losing essential site functions. Browser controls may also restrict cookies, but they are not a substitute for required choices.
Consent previously stored by an earlier version of a website may need reassessment when the categories or vendors change. We encourage users to contact us about tracking choices or to clear site consent storage to receive the consent prompt again.
AI-assisted communications
Incoming communications may be classified, prioritised or routed through automated or AI-assisted workflows where these features are deployed. Such processing may examine the topic, urgency and intended recipient to assist human teams. Not every communication is necessarily processed by an AI model.
AI-generated classifications can be inaccurate. Staff may review or correct routing outcomes. We do not describe automated triage as a substitute for legally required human review, and we do not use website enquiry classification alone to make decisions that produce legal or similarly significant effects on individuals.
Details of communication processing are available in our Email Communications Policy. Please avoid submitting passwords, private keys, classified information or unnecessary sensitive personal data through ordinary web forms.
Marketing and professional outreach
We may send service-related messages that are necessary to fulfil a request or maintain a business relationship. We distinguish these from optional commercial updates or promotional communications.
Where applicable law requires consent for marketing, we obtain it before sending those communications. You can withdraw consent or object to direct marketing at any time through available unsubscribe mechanisms or by contacting us. Objections to direct marketing are handled separately from other requests.
Children and special-category information
Corporate services are not designed to solicit personal information from children. Where a service has an age requirement, that requirement is specified in its product terms. We do not intentionally request health data, biometric identifiers, political opinions or other sensitive categories through general enquiries.
If you submit sensitive information without a relevant request or appropriate basis, we may limit access to it, ask for clarification or delete it where lawful and practical.
Sharing and service providers
We may share necessary information with authorised Exohood teams, service providers and professional advisers who support hosting, cybersecurity, analytics, customer communications, document management, payment processing or legal compliance. Where required, processors are subject to appropriate contractual and confidentiality protections.
We may also disclose limited information to regulators, courts, law enforcement or counterparties where legally required or necessary to establish, exercise or defend legal claims. In a corporate restructuring or business transfer, relevant information may be disclosed subject to lawful safeguards and notice where required.
We do not treat disclosure to a processing or communications infrastructure provider as permission for unrelated use of the information. Vendor identity and roles may vary by product, country and deployment.
International data transfers
Exohood products, personnel and service providers can operate across jurisdictions. Personal information may therefore be accessed, hosted or processed in a country different from where it was collected.
Where restricted transfers are subject to the UK GDPR, EU GDPR or similar laws, we assess the applicable transfer mechanism and use lawful safeguards as required, which may include an adequacy decision, standard contractual clauses, UK International Data Transfer Agreement or UK Addendum, or another permitted mechanism.
You may request information about the safeguards relevant to your data, subject to security, confidentiality and legal limitations.
Retention, deletion and legal holds
We retain personal information for no longer than is necessary for the relevant purpose, taking into account the nature of the engagement, account status, security requirements, disputes, statutory retention periods and legal or regulatory obligations. Different records may follow different retention schedules.
Enquiries may be deleted or de-identified after the purpose has concluded, while contracts, verification records, transaction records and incident logs may need to be retained longer. If a lawful preservation obligation applies, deletion can be suspended for the necessary period.
Backup copies may remain for a limited restoration cycle before secure replacement or erasure. We do not promise immediate removal from public blockchains, legally archived records or third-party systems outside our control.
Security and incident response
We use security measures intended to protect personal information, proportionate to the systems and risks involved. Depending on deployment, these may include encrypted network transport, access restrictions, logging, monitoring, controlled privileges, secure development practices and incident response procedures.
No internet service, email workflow or blockchain interaction can be represented as absolutely secure. We cannot guarantee uninterrupted confidentiality, availability or protection against every attack. Where a notifiable breach occurs, we assess the applicable notification obligations and take appropriate action.
Individual privacy rights
Subject to jurisdiction and applicable exceptions, you may have rights to access your personal information, request correction or deletion, restrict processing, obtain portable copies of eligible information, object to certain processing, or withdraw consent without affecting processing that was lawful before withdrawal.
We may ask for reasonable verification before acting on a request and may decline or partially fulfil requests where legal exemptions apply. We will respond within the period required by applicable law and explain the outcome where required.
You may lodge a complaint with the competent supervisory authority, including the UK Information Commissioner’s Office where UK law applies, or a relevant EU/EEA authority where appropriate.
Automated decisions and human review
Routine filtering, classification, fraud signals or spam handling may be automated. We assess whether any deployment makes decisions based solely on automation with legal or similarly significant consequences.
Where such decision-making is lawfully deployed, we will provide the additional information and review procedures required by applicable law, which may include rights to request human intervention, express a point of view and contest the decision.
Public blockchains and connected wallets
Blockchain networks are public or independently operated. If you connect a wallet or interact with an on-chain service, wallet addresses, smart-contract interactions, balances and transaction histories may become visible to third parties and persist independently of Exohood.
Please consider privacy implications before making transactions. Exohood cannot unilaterally erase records maintained by public consensus networks. Product-specific disclosures may apply to exchange, token, investment or custody-related interactions.
Third-party services and embedded content
Our websites link to projects, documentation, social networks and third-party services. External destinations may use their own technologies, privacy notices and legal terms. A link does not establish that we control, endorse or guarantee their information-security or data-handling arrangements.
When a user leaves our domain or uses a third-party wallet, hosting system or service provider, the third party’s arrangements may apply independently.
Business customers and confidentiality
For enterprise deployments, the parties may sign separate nondisclosure, information-security and data-processing agreements defining responsibilities, instructions, subcontractors, audit arrangements and retention. In the event of a conflict over customer-controlled data, the applicable signed agreement governs to the extent stated in that agreement.
Confidentiality does not prevent legally compelled disclosure, disclosures necessary for security incident response, or processing that applicable law otherwise requires or permits.
Changes to this notice
We may revise this Privacy Policy when products, service providers, practices or legal requirements change. The revision date identifies the version displayed. Where a change requires additional notice or consent, we will provide it through an appropriate channel before the relevant processing begins.
Historical versions may be requested when reasonably available. This notice does not reduce rights conferred by mandatory data-protection law.
Contact, requests and escalation
Write to helpdesk@exohood.com with “Privacy Request” in the subject or use exohood.com/contact. Describe the service involved and the right you want to exercise. Do not include account passwords, recovery phrases or private wallet keys.
For communications-processing enquiries, use ai@exohood.com. We will direct requests to the responsible team or contracting entity as appropriate.
Need clarification?
Send your question to the responsible team. We will help identify the applicable service terms, privacy controls or legal contact.