Privacy Policy — protocolx.io and raffle.protocolx.io
Effective date: 22 August 2026 Controller: Northlatch Labs LLC, a Wyoming limited liability company (registration filed with the Wyoming Secretary of State; the Filing ID will be published here upon approval), 5830 E 2nd St, Ste 7000 #38326, Casper, Wyoming 82609, United States · privacy@protocolx.io
This policy covers the websites at protocolx.io and raffle.protocolx.io (the "Sites"). Northlatch Labs LLC operates the Sites' web infrastructure as the software developer and is the controller of the data the Sites themselves collect. Northlatch is not the operator or sponsor of the prize vault or of any competition; where an operator, sponsor or organiser collects data from you under its own terms, it is a separate controller.
1. What we collect
- Wallet address and on-chain activity — your Sui address and the transactions you sign (deposits, withdrawals, entries, claims). These are public on the Sui blockchain and are also read and indexed by the Sites.
- Technical data — IP address and approximate location derived from it (used to apply the Excluded Jurisdictions restrictions), browser and device type, referring page, pages viewed, timestamps.
- Organiser data (raffle.protocolx.io only) — legal name, country/state, contact email, competition details, and your acceptance record of the Organiser Terms. This is displayed publicly on your competition page, as the Organiser Terms require.
- Correspondence and reports — anything sent to our email addresses, including competition reports.
- Free-entry route data — whatever the draw page asks for to issue a free entry (typically a wallet address only).
We do not collect names, government IDs or payment-card details from participants. We do not use advertising cookies, sell personal data, or share it for cross-context behavioural advertising.
2. Why and on what basis
Operating the Sites and indexing on-chain state: contract / legitimate interests. Applying geographic restrictions and sanctions screening: legal obligation and legitimate interests. Security and abuse prevention: legitimate interests. Displaying organiser details on competition pages: contract (Organiser Terms) and legal obligation (promoter identification). Handling reports: legitimate interests and legal obligation. Responding to you: legitimate interests. Legal compliance: legal obligation. Analytics: legitimate interests, using privacy-preserving analytics without cookies.
3. Blockchain data
Transactions you sign are recorded on Sui by its validators, are public and permanent, and cannot be edited or deleted by Northlatch. Data-protection rights apply to the data we hold (our index, logs, organiser records, correspondence), not to the chain.
4. Sharing
Infrastructure providers (Vercel, Cloudflare, database/indexing providers, analytics provider) under data-processing agreements; the Sui network and validators (public protocol); authorities where legally required; a designated interface operator, sponsor, or successor entity, to which the Sites' data may transfer under this policy on designation or transfer of the Protocol intellectual property.
5. International transfers
Processing occurs in the United States and other countries. For EU/UK data we rely on Standard Contractual Clauses and the UK Addendum, or an adequacy decision.
6. Retention
Index of on-chain activity: indefinitely (mirrors public chain data). Server and security logs, including geoblock logs: 90 days. Aggregated analytics: 14 months. Organiser records and Organiser Terms acceptance: duration of the competition plus 6 years. Reports and correspondence: 3 years.
7. Your rights
Access, correction, deletion, restriction, objection, portability, and complaint to a supervisory authority, as applicable where you live. Email privacy@protocolx.io; we respond within 30 days (45 for California). We will state plainly which data is on chain and outside our control. California residents: we do not sell or share personal information as defined in the CCPA.
8. Cookies
Strictly necessary only (session, security, preference). No analytics or advertising cookies.
9. Children
The Sites are not directed at anyone under 18.
10. Changes
Posted here with a new effective date; material changes take effect 15 days after posting.
11. Contact
privacy@protocolx.io · Northlatch Labs LLC, 5830 E 2nd St, Ste 7000 #38326, Casper, Wyoming 82609, United States. No EU/UK representative under Art. 27 GDPR has been appointed.