Privacy Notice

Who we are

Memetic Machines operates War Machine. For data-protection purposes we act as the controller of personal data described in this notice unless we state otherwise for a specific processing activity.

Scope

This notice covers personal data collected through the public landing site, waitlist onboarding, authenticated product accounts, email preference pages, and related support channels.

Enterprise customers requiring a Data Processing Agreement should contact us at the address below.

Data we process

Depending on how you interact with the service, we may process:

• Account identifiers: email address, Web3Auth user identifiers, and linked wallet addresses.
• Waitlist and profile data: questionnaire answers, funnel version, cohort or queue metadata, and referral codes you use or share.
• Authentication and security data: session tokens, verification status, and fraud-abuse signals.
• Communications data: product and transactional email delivery status, marketing consent records where you opt in, and unsubscribe or preference tokens.
• On-chain and wallet data: public wallet addresses, transaction identifiers, market positions, claims, and settlement-related records where product features require them.
• Technical data: IP address, browser type, device signals, and server logs needed for security and operations.
• Landing analytics data: page views, referrers, browser and device information, approximate country, and basic waitlist funnel events collected through Umami Cloud. These events do not include email addresses, wallet addresses, referral codes, or questionnaire answers.

Landing analytics

We use Umami Software, Inc. (Umami Cloud) to measure landing-site traffic and waitlist funnel performance. Umami provides privacy-focused analytics and its default tracker does not use analytics cookies.

The analytics data we collect through Umami is limited to usage and device categories such as pages viewed, referrers, browser, operating system, device type, approximate country, and basic funnel events that we define. We do not send account identifiers, email addresses, wallet addresses, referral codes, or questionnaire answers to Umami.

Where applicable, we rely on our legitimate interests in understanding and improving the landing site, balanced against your privacy rights. For more information about Umami's processing practices, see https://umami.is/privacy.

Why we process data

We process personal data to:

• Create and manage waitlist and product accounts.
• Authenticate you and protect the platform from abuse.
• Operate referral, rewards, and access programs described in product documentation.
• Send service messages required for account security and waitlist operations.
• Send optional product or newsletter email only when you have opted in separately from legal acceptance.
• Administer markets, claims, refunds, settlement records, and product access where those features are available.
• Improve reliability, debug incidents, and meet legal or regulatory obligations.
• Measure landing traffic and waitlist funnel performance separately from authenticated account records in our application database.

Legal bases (EEA/UK)

Where GDPR or UK GDPR applies, we rely on one or more of: performance of a contract (account and waitlist services), legitimate interests (security, fraud prevention, and service improvement balanced against your rights), consent (optional marketing email), and legal obligation where required.

You may withdraw marketing consent without affecting core account functions, subject to messages we must send for security or legal compliance.

Processors and sharing

We use service providers that process data on our instructions, including identity and wallet authentication (Web3Auth), email delivery and webhook providers, cloud hosting, database infrastructure, and landing analytics providers such as Umami Software, Inc. / Umami Cloud (https://umami.is/privacy).

We do not sell your personal data. We may disclose data if required by law, to protect rights and safety, or in connection with a merger or acquisition subject to appropriate safeguards.

We may share limited account, wallet, fraud-prevention, or operational data with providers when needed to authenticate users, deliver email, prevent abuse, process support requests, maintain infrastructure, or operate blockchain-related product functions.

Public blockchains

Some product features may interact with public blockchain networks. Public wallet addresses, transaction hashes, token movements, and smart-contract events may be visible to anyone and may remain available even if we delete or restrict data in our own systems.

Do not connect a wallet or submit on-chain transactions if you do not want the associated public blockchain activity to be observable or linked to your account activity.

Security

We use reasonable technical and organizational measures designed to protect personal data, including access controls, logging, provider security controls, and operational review. No system is perfectly secure, and we cannot guarantee that unauthorized access, loss, or misuse will never occur.

You are responsible for maintaining the security of your email account, wallet, device, and authentication credentials.

Retention

We retain personal data for as long as needed to provide the service, honor your choices, resolve disputes, enforce agreements, and comply with law.

Consent records, account-security logs, referral records, market and settlement records, and transaction records may be retained longer where needed for audit, dispute resolution, compliance, fraud prevention, or accounting.

When data is no longer required, we delete or anonymize it subject to backup cycles, immutable public blockchain records, and legal holds.

International transfers

We and our processors may process data in countries other than your own. Where required, we implement appropriate safeguards such as standard contractual clauses after counsel review.

Your rights

Depending on your location, you may have rights to access, correct, delete, restrict, or object to certain processing, and to data portability or withdrawal of consent.

To exercise rights, contact [email protected]. You may also use email preference links where provided. You may lodge a complaint with your local supervisory authority.

U.S. state privacy rights

Depending on your U.S. state of residence and whether applicable thresholds are met, you may have rights to know, access, correct, delete, or receive a copy of certain personal information, and to opt out of certain targeted advertising, sale, sharing, or profiling uses.

We do not sell personal data or use landing analytics for cross-context behavioral advertising. We may create, use, sell, or license our own market analysis, aggregated insights, de-identified data, or other outputs that do not identify you. If our personal-data practices change, we will update this notice and provide any required choice mechanism.

Automated processing

We may use automated signals to detect abuse, evaluate fraud risk, administer access, route support, or prioritize product operations. Where required by law, you may request information about or human review of decisions that produce legal or similarly significant effects.

Children

The service is not directed to children below the minimum age required in their jurisdiction. We do not knowingly collect data from such children.

Changes to this notice

We may update this notice. The effective date at the top will change when we publish revisions. Material changes may be communicated through the product or email where appropriate.

Contact

Privacy inquiries and data-subject requests: [email protected].