Lace Privacy Policy

Last updated: June 27, 2025

Thank you for choosing to be part of our community at Input Output Global, Inc. (“IOG”, “we”, “us”, or “our”). This Lace Privacy Policy applies to all information that can be used to identify you such as your email or IP address ("Personal Data") that is collected through the Lace.io website, the Lace wallet browser extension and the Lace mobile app (when available) (collectively, the "Lace Products").

Personal Data collected through IOG‘s other websites (including, without limitation, for Lace Product technical support), browser extensions or plug-ins or any other mobile apps, products, services, sales, marketing or events is excluded from the scope of this Lace Privacy Policy and will be collected in accordance with the IOG Privacy Policy, found here.

We are committed to protecting your Personal Data. In this Lace Privacy Policy, we describe what Personal Data we collect, how we collect, use, store and share your Personal Data and what rights you have in relation to it.

Please read this Lace Privacy Policy carefully. If there are any terms in this Lace Privacy Policy that you do not agree with, please discontinue access to and use of the Lace Products.

1. Collection and Use of Data

IOG collects several types of information, including Personal Data, for various purposes to provide and improve the Lace Products for your use.

While using the Lace Products, IOG may collect the following types of data (some of which constitutes Personal Data) for the following purposes:

● Email Address - We collect this only if you opt in to “Stay in the Loop” on the Lace.io website to receive Lace Product updates and news (e.g., changes to the Lace Products). You may opt out of receiving these communications by following the unsubscribe link or instructions provided in any email sent to you by IOG.

● Cookie Data - We deploy functionality cookies to enable features of the Lace Products and optional analytics cookies to analyze usage patterns, as further described in our Cookie Policy. Functional cookies are required, analytics cookies are optional. These cookies are placed on your device when you access or use the Lace Products, allowing us to collect certain data to improve functionality and user experience. As a non-custodial wallet, we do not use cookies to access or store your private keys, seed phrases or blockchain transaction data.

● Anonymized Usage Data - We collect anonymized usage data to improve user experience without identifying you. Anonymized usage data may include interactions within the Lace Products (e.g., feature adoption and error logs) or how you may be using the Lace Products.

● IP Address - We may collect IP address data to:

● Provide localization/language services (e.g., regional settings), ensuring the Lace Products are tailored to your region and language preferences.

● Troubleshoot errors related to regional infrastructure, networking or performance, using your IP address to identify and resolve issues specific to your location.

● Enable/disable locale-specific products or features, using your IP address to ensure the Lace Products function appropriately in your region (e.g., disabling unavailable third-party services).

● Comply with legal requirements (e.g., block users from sanctioned jurisdictions).

Where permitted under applicable law (e.g., with your prior consent under GDPR), IOG may process your contact information that you share with us for direct marketing purposes (e.g., event invitations, newsletters) and to carry out customer satisfaction surveys, in each case also by email. You may opt out of the processing of your contact information for these purposes at any time by submitting a request here, by writing to dataprotection@iohk.io or by using the opt-out mechanism provided in the respective communication you received.

2. Legal Basis under General Data Protection Regulation (GDPR)

For a citizen or resident of a member country of the European Union (EU) or the European Economic Area (EEA), the legal basis for collecting and using Personal Data described in this Lace Privacy Policy depends on the Personal Data being collected and the specific context in which it is collected as described below:

IOG may process your Personal Data because:

● You have given us permission to do so (e.g., by opting into receiving newsletters) (GDPR Article 6(1)(a))

● IOG needs to perform a contract with you (e.g., providing Lace Product functionality based on your usage) (GDPR Article 6(1)(b))

● IOG has to comply with applicable law (e.g., blocking access from sanctioned jurisdictions) (GDPR Article 6(1)(c))

o Please note that in some cases, the legal basis for IOG processing Personal Data may (in addition or instead) be that you have consented (GDPR Article 6(1)(a))

● IOG has legitimate interests to do so (e.g., improving Lace Products through anonymised usage data) (Article 6(1)(f) General Data Protection Regulation)

Generally, the legitimate interests pursued by IOG in relation to our use of your Personal Data is the efficient performance or management of our business relationship with you, including:

● Enhancing user experience through localization and language services, troubleshooting regional issues and enabling/disabling locale-specific features, all of which rely on IP address data to ensure the Lace Products function effectively for you; and

● Improving the Lace Products through analysis of anonymized usage data, which may include pseudonymized IP addresses to understand regional usage patterns and performance.

When we rely on legitimate interests, we assess that our interests are not overridden by your rights and freedoms. We pseudonymize IP addresses where possible to minimize impact on your privacy, and we retain IP addresses only for as long as necessary for these purposes. You have the right to object to this processing (see ‘Rights Under GDPR‘ below), and we will stop processing your data unless we can demonstrate compelling legitimate grounds.

3. Retention of Data

IOG will retain your Personal Data only for as long as is necessary for the purposes set out in this Lace Privacy Policy. Specifically:

● IP addresses collected to block users from sanctioned jurisdictions will be kept for ten years in accordance with the United States‘ Office of Foreign Assets Control requirements.

● IP addresses collected for any other reason are retained only for the duration necessary to fulfill the purposes outlined, after which they are pseudonymized or deleted.

● Usage data will be retained for two years.

● Email addresses and cookie data will be kept until you withdraw your consent.

Additionally, IOG may retain and use your Personal Data for longer periods of time to the extent necessary to comply with our legal obligations (for example, if IOG is required to retain your Personal Data to comply with applicable laws), resolve disputes and enforce legal agreements and policies.

4. Transfer Of Data

Your information, including Personal Data, may be transferred to - and maintained on - computers located outside of your state, province, country or other governmental jurisdiction where the data protection laws may differ from those from your jurisdiction.

IOG will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this Lace Privacy Policy and no transfer of your Personal Data will take place to an organization or a country unless there are adequate controls in place including the security of your Personal Data and other information.

5. Disclosure Of Data

IOG may disclose your Personal Data in good faith belief that such disclosure is necessary to:

● To comply with a legal obligation

● To protect and defend the rights or property of IOG

● To prevent or investigate possible wrongdoing in connection with the Lace Products

● To protect the personal safety of users of the Lace Products or the public

● To protect against legal liability

Except as required by law or as described herein, IOG does not sell, rent or share your Personal Data with third parties for their own purposes.

Disclosure of Personal Data Within The EU

Insofar as we employ the services of service providers to implement or fulfill any tasks on our behalf (such as cloud hosting providers or analytics services), the contractual relations will be regulated in writing according to the provisions of the European General Data Protection Regulation (EU-GDPR) and the Federal Data Protection Act (new BDSG). These providers receive anonymized or aggregated data only and are contractually obligated to protect your Personal Data.

Disclosure of Personal Data Outside of The EU

Insofar as you have selected and consented to this in the form, your data will be disclosed to our offices within the network of affiliated companies outside of the European economic area for the processing of your enquiry. These offices are legally obligated to abide by the EU-GDPR. Furthermore, between the legally autonomous companies in the network of affiliated companies, written agreements exist for the processing of data on commission, based on standardized contract stipulations.

6. Security Of Data

We use reasonable technical and organizational methods to safeguard your Personal Data. However, please note that these security measures are not a guarantee that your Personal Data may not be accessed, disclosed, altered or destroyed by breach of such measures.

Whilst we will use all reasonable efforts to safeguard your information, you acknowledge that data transmissions over the internet cannot be guaranteed to be 100% secure and for this reason, we cannot guarantee the security or integrity of any Personal Data that is transferred from you or to you via the internet and as such, any information you transfer to IOG is done at your own risk.

Where we have given you (or where you have chosen) a password which enables you to access the Lace Products or certain parts of the Lace Products, you are responsible for keeping this password confidential. We ask you not to share a password with anyone.

If we learn of a security system breach, we may attempt to notify you electronically so that you can take appropriate protective steps. If you provided your email address to us, then you agree that we can communicate with you electronically regarding security, privacy and administrative issues relating to your use of the Lace Products. We may post a notice on the Lace Products if a security breach occurs. Depending on where you live, you may have a legal right to receive notice of a security breach in writing.

7. Rights Under General Data Protection Regulation (GDPR)

If you are a citizen or resident of a member country of the European Union (EU) or the European Economic Area (EEA), you have certain data protection rights. IOG aims to take reasonable steps to allow you to correct, amend, delete or limit the use of your Personal Data. If you wish to be informed what Personal Data IOG holds about you and if you want it to be removed from our systems, please contact us by submitting a request or by submitting a request here or by writing to dataprotection@iohk.io.

In certain circumstances, you have the following data protection rights:

●The right to access. You have the right to request information concerning the Personal Data we hold.

●The right of rectification. You have the right to have your Personal Data rectified if that information is inaccurate or incomplete.

●The right to object. You have the right to object to your Personal Data being used for a particular purpose and you can exercise these rights, for example, via an unsubscribe link at the bottom of any email.

●The right of restriction. You have the right to request that IOG restricts the processing of your Personal Data.

●The right to data portability. You have the right to be provided with a copy of the Personal Data in a structured, machine readable and commonly used format.

●The right to withdraw consent. You also have the right to withdraw your consent at any time where IOG relied on your consent to process your Personal Data.

●The right to data deletion. You have the right to ask us to delete your data, though we may need to keep some for legal reasons.

Please note that IOG may ask you to verify your identity before responding to such requests.

Blockchain Data and Your Rights: Transaction data, such as public keys and wallet addresses, is stored permanently on the blockchain, a decentralized ledger beyond IOG‘s control. Under GDPR, this data may be considered personal if linked to you, but rights like erasure or rectification cannot apply due to the blockchain‘s immutability. For data we control, you can exercise your GDPR rights, such as requesting deletion, by submitting a request here or by writing to dataprotection@iohk.io.

You have the right to complain to a Data Protection Authority about our collection and use of your Personal Data. For more information, please contact your local data protection authority in the EU or EEA.

8. California Residents

If you are a California resident, you have certain rights with respect to your Personal Data pursuant to the California Consumer Privacy Act of 2018 (“CCPA”). This section applies to you.

We are required to inform you of: (a) what categories of information we collect about you, including during the preceding 12 months; (b) the purposes for which we use your Personal Data, including during the preceding 12 months; and (c) the purposes for which we share your Personal Data, including during the preceding 12 months.

You have the right to: (i) request a copy of the Personal Data; (ii) request that we delete your Personal Data; and (iii) opt out of the sale of your Personal Data. You can limit the use of tracking technologies, such as cookies, by following instructions outlined in our Cookie Policy or by submitting a request here or by writing to dataprotection@iohk.io.

We will not discriminate against any consumer for exercising their CCPA rights. If you would like to exercise any of these rights, please submit a request here or by writing to dataprotection@iohk.io.

9. Service Providers & Newsletter

IOG may employ third-party companies and individuals to facilitate the Lace Products, to provide the Lace Products on our behalf, to perform website-related services or to assist us in analyzing how the Lace Products are used ("Service Providers").

These Service Providers have access to your Personal Data only to perform these tasks on our behalf and are obligated not to disclose or use it for any other purpose.

Newsletter

If you would like to receive our newsletter, we require a valid email address and your consent to receive this newsletter. No additional data is collected or is only collected on a voluntary basis. We only use this data to send the requested information and do not pass it on to third parties.

We will, therefore, process any data you enter onto the contact form only with your consent per Article 6(1)(a) of the General Data Protection Regulation. You can revoke consent to the storage and use of your data and email address for sending the newsletter at any time, e.g., through the "unsubscribe" link in the newsletter. The data processed before we receive your request may still be legally processed.

The data provided when registering for the newsletter will be used to distribute the newsletter until you opt out of your subscription, at which point said data will be deleted within a reasonable amount of time. Data we have stored for other purposes (e.g., email addresses for members areas) remain unaffected.

Newsletter Tracking

Newsletter tracking (also referred to as Web beacons or tracking pixels) is used if users have given their explicit prior consent. When the newsletter is dispatched, the external server can then record certain data related to the recipient, such as the time and date the newsletter is retrieved, the IP address or details regarding the email program (client) used. The name of the image file is personalized for every email recipient by a unique ID being appended to it. The sender of the email notes which ID belongs to which email address and is thus able to determine which newsletter recipient has just opened the email when the image is called.

You may revoke your consent at any time by unsubscribing to the newsletter. This can be done by using the unsubscribe link in the newsletter. You may also submit a request here or by writing to dataprotection@iohk.io.

10. Links To Other Products

The Lace Products may contain links to other products that are not operated by IOG. If you click on a third-party link, you will be directed to that third party's site. You're advised to review the privacy policy of each non-IOG site you decide to visit.

IOG has no control over and assumes no responsibility for the content, privacy policies or practices of any third-party product or service.

11. Changes To This Lace Privacy Policy

IOG may update this Lace Privacy Policy from time to time. Such changes will be posted on this page. The effective date of such changes will be as of the "Last updated" date at the top of this Lace Privacy Policy. You are advised to review this Lace Privacy Policy periodically for any changes. Changes to this Lace Privacy Policy are effective when they are posted on this page.

12. Data Privacy Contact

You can reach our data protection officer by submitting a request here or by writing to dataprotection@iohk.io.

13. Contact by E-mail or Contact Form

When you contact us by e-mail or through a contact form, we store the Personal Data you provide (e.g., your email address, possibly your name and telephone number) so we can answer your questions. Insofar as our contact form requests information that is not required for contacting you, we have marked those fields as optional. The information requested by us serves to substantiate your inquiry and improve the handling of your request. Your message may be linked to various actions taken by you on or within the Lace Products. Information collected will be used to provide you with support relating to your inquiry and to better understand your feedback. A statement of this information is expressly provided on a voluntary basis and with your consent. As far as this concerns information about communication channels (such as e-mail address or telephone number), you also agree that we may, where appropriate, contact you via this communication channel to answer your request.