Stax Labs LLC — Privacy Policy (U.S.; Wyoming Governing Law)

1) Scope & Who This Covers

This Privacy Policy explains how Stax collects, uses, shares, and protects information when you access our websites, mobile apps, APIs, and related services (collectively, the "Service").

This Policy applies to users in the United States. If you access the Service from outside the U.S., you consent to processing in the U.S.

Educational Mission Reminder. Stax is an educational-only platform with simulated paper trading and learning features. We do not execute real securities transactions and do not provide personalized investment advice.

2) Information We Collect

We collect information from you, automatically, andfrom third parties:

a) Information You Provide

• Account information (name/alias, email, password, age range, school/organization where applicable).
• Profile and user-generated content (avatars, bios, posts, lesson answers, messages, reports, survey responses).
• Educational progress (lessons completed, quiz scores, badges, Finbucks balances/spend/earn, challenges).
• Communications (support requests, feedback, bug reports, dispute submissions).
• Payment information (handled by payment processors or app stores; we receive limited info such as transaction IDs and status).
• Sensitive data: We do not require SSN or government IDs. Do notsubmit sensitive data you don't want processed.

b) Information Collected Automatically

• Device and network (device IDs, OS, app version, language, time zone, IP address, approximate location).
• Usage and telemetry (pages/screens, taps/clicks, events, dwell time, crashes, diagnostics, performance metrics).
• Cookies/SDKs (session cookies, analytics cookies, A/B testing, error monitoring, marketing/attribution beacons).
• Simulated trading and in-app activity (Stacks viewed, positions created in simulation, Core‑4 interactions, quests).

c) Information From Third Parties

Single sign-on and app stores (Apple/Google), schools/organizations provisioning access, analytics vendors, marketing/attribution partners, and public sources (e.g., public company data).

3) How We Use Information (Purposes)

We use information to:

1. Provide the Service (accounts, authentication, lesson progression, Finbucks economy, leaderboards, social/community features).
2. Operate, secure, and debug (fraud prevention, abuse/threat detection, diagnostics, incident response).
3. Improve and develop features (A/B testing, analytics, personalization, content recommendations, UI/UX research).
4. Educational analytics (progress dashboards, skill maps, non-graded insights).
5. Communicate with you (support, product updates, policy changes, service notices).
6. Comply with law and enforce our Terms (investigate violations, respond to lawful requests).
7. Marketing & growth (attribution, re-engagement, measuring campaign performance; see "Your Choices").
8. Research & de-identification (creating aggregated or de-identified data that cannot reasonably identify you; we may use and share such data for any lawful purpose).

AI/Model Improvements. We may use de-identified content (and prompts/telemetry) to improve our educational models and features. Where required by law, we will obtain consent or provide opt-outs.

4) Legal Bases (Where Applicable)

When required (e.g., some state laws), we rely on: (i) contract (to provide the Service), (ii) legitimate interests (security, product improvement, analytics), (iii) consent(certain marketing/cookies; specific features), and (iv) legal obligations.

5) How We Share Information

We share information with:

• Service providers/Processors (hosting, analytics, error monitoring, messaging, payments, customer support).
• Affiliates (for operations, support, and consistent service experience).
• Education or organizational partners (when your access is provisioned by a school or organization; we may share usage metrics and progress as agreed).
• Marketing & attribution partners (to measure reach and performance; see "Your Choices" for opt-outs).
• Research/Academic partners (with de-identified or aggregated data).
• Legal and safety (to comply with law, enforce our Terms, protect rights, security, and users).
• Business transfers (merger, acquisition, financing, asset sale; your info may be transferred as part of the transaction).

6) Children's Privacy

The Service is for users 13+. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided personal information, contact [email protected] and we will take appropriate steps to delete it.

If you are 13–17, you must have parent/guardian consent. School-provisioned access may be governed by a separate agreement with the institution.

7) Cookies, SDKs, and Tracking

We and our partners use cookies, web beacons, pixels, and mobile SDKs to operate the Service, remember preferences, analyze usage, personalize content, and measure marketing effectiveness. You can manage cookies in your browser and mobile settings. Blocking cookies may impair functionality.

We currently do not respond to "Do Not Track" (DNT) signals.

8) Data Retention

We keep information only as long as necessary to fulfill the purposes described above and to comply with legal, accounting, or reporting requirements. We may anonymize or aggregate data and retain it for analytics and product improvement.

9) Your Privacy Rights (U.S. State Laws)

Depending on your state (e.g., CA/CPRA, CO, CT, VA, UT, and others), you may have rights to:

• Know/Access the categories and specific pieces of personal information we collected.
• Delete personal information (subject to legal exceptions).
• Correct inaccurate personal information.
• Opt out of (i) "sale" of personal information and (ii)"sharing" for cross-context behavioral advertising/targeted advertising.
• Limit the use/disclosure of sensitive personal information (if applicable).
• Appeal a denial of your request (where required by law).

How to Exercise Your Rights

Email [email protected] with the subject "Privacy Request" and tell us which right(s) you want to exercise. We will verify your request (e.g., email verification or additional info). You may designate an authorized agent, subject to verification.

To opt out of sale/sharing/targeted advertising, (1) adjust your in-app privacy settings (if available), (2) use device-level ad controls, and (3) email [email protected] requesting"Do Not Sell or Share My Personal Information."

We will not discriminate against you for exercising your rights.

California Notices (CPRA). We provide additional CPRA disclosures upon request, including metrics on requests received/granted/denied (if applicable).

10) Security

We use reasonable technical and organizational measures to protect information; however, no method of transmission or storage is 100% secure. You use the Service at your own risk. Promptly notify us if you suspect unauthorized access.

11) International Users

If you access the Service outside the U.S., you understand that your information may be transferred to, stored in, and processed in the United States (and other countries where we or our providers operate), which may have different data protection laws than your country. By using the Service, you consent to these transfers.

12) Third-Party Sites and Services

The Service may link to third-party sites or integrate third-party services. Their privacy practices are governed by their policies; we are not responsible for them. Review their policies before providing personal information.

13) Changes to This Policy

We may update this Policy from time to time. If changes are material, we will provide notice (e.g., in-app or email). The updated Policy becomes effective on the posted Effective Date. Continued use of the Service indicates acceptance.

14) Contact Us

15) Governing Law; Venue; Interpretation

This Policy and any disputes relating to privacy are governed by the laws of the State of Wyoming, without regard to conflict-of-laws principles, and subject to the arbitration provisions in our Terms of Service. If any provision is held invalid or unenforceable, the remainder remains in effect. Headings are for convenience only.

16) U.S. State Privacy Disclosures (Summary of Categories)

Below are the categories of personal information we may collect, the sources, purposes, and types of recipients. This chart is designed to satisfy U.S. state privacy laws (e.g., CPRA).

* "Sold/Shared" is defined by state privacy laws and does not necessarily mean money is exchanged. You can opt out as described in §9.

17) Do Not Sell or Share My Personal Information (How-To)

To exercise a sale/sharing opt-out, email [email protected] with the subject"Do Not Sell or Share My Personal Information." Include your account email and relevant device identifiers (if available). You may also use device-level ad controls and, where provided, in-app privacy settings.

18) Nevada and Virginia Notices

• Nevada: We do not currently "sell" covered information as defined by Nevada law. Nevada residents may submit a sale opt-out request to [email protected].
• Virginia: If we deny your request, you may appeal by replying to our decision email with "Appeal" in the subject. If your appeal is denied, you may contact the Virginia Attorney General.

19) School/Organization Accounts

If your access is provisioned by a school or organization, that institution may control certain settings and receive usage metrics under a separate agreement. Institutional notices may also apply.

20) No Investment Advice; Educational-Only Reminder

All analytics, Core‑4 scores, "Stacks," suggestions, and messages are educational only. They are not personalized financial advice. See our Terms of Service for full disclaimers and dispute resolution.