Privacy written around the product we actually run.

Who controls your information

SerumX, Inc. is responsible for personal information processed through Serum. Contact support@xserumx.com for privacy questions or requests. This Policy applies to xserumx.com, Serum accounts, the trading and launch terminals, Beaky, support, and related beta operations.

Information we collect

• Account data: email, internal user ID, role, account status, password hash, creation time, and last-login time.
• Security data: passkey public credentials and device metadata, two-factor secrets, session and verification records, security events, rate-limit identifiers, IP-derived hashes, and user-agent data.
• Wallet and transaction data: public wallet addresses, Turnkey identifiers, balances, token holdings, transaction signatures, trades, transfers, fees, launch activity, strategies, watchlists, and audit records.
• Product data: settings, tour state, loaded markets, automation state, support messages, invite applications, errors, and diagnostic events.
• Beaky data: prompts, recent conversation context sent for a response, strategy drafts, confirmations, and resulting automation state. Browser chat history may also be stored locally on your device.
• Public data: blockchain, token, market, and wallet information obtained from public networks and market-data providers.

Do not submit sensitive personal information to Beaky or support. We do not need government IDs, payment-card numbers, health data, or private wallet seed phrases to provide normal Serum access.

How we use information

We use information to create and secure accounts; authenticate users; provide wallet, trading, automation, launch, AI, and support features; calculate and collect disclosed fees; prevent abuse and fraud; debug incidents; enforce agreements; comply with law; and improve reliability and usability. We do not sell personal information or use it for cross-context behavioral advertising.

Where applicable law requires a legal basis, we process information to perform our contract with you, comply with legal obligations, protect legitimate security and operational interests, and, where specifically requested, based on consent that you may withdraw.

How information is shared

We share only what is reasonably needed with infrastructure and service providers such as Railway for hosting, Turnkey for wallet infrastructure, OpenAI for Beaky responses, email-delivery providers, Solana RPC and market-data providers, decentralized exchanges, and security or support vendors. Blockchain transactions and public wallet addresses are public by design and may be permanently visible to anyone.

We may disclose information when required by law, to protect rights and safety, to investigate misuse, or as part of a financing, merger, acquisition, reorganization, or asset transfer subject to appropriate protections. We do not give third parties your data for their own direct marketing.

AI processing

When you message Beaky, Serum sends the prompt and limited recent context needed to generate a response to OpenAI. Requests are configured not to be stored by the model provider where supported. Strategy and execution records needed to operate or audit a confirmed plan remain in Serum. Do not include secrets, seed phrases, or unnecessary personal details.

Retention

We retain account and acceptance records while your account is active and as reasonably needed afterward for security, disputes, legal compliance, and audit integrity. Short-lived verification codes expire in about 15 minutes; sessions and security challenges expire on their configured schedules. Operational, transaction, fee, and audit records may be kept for up to seven years where reasonably needed for financial, legal, or security records. Public blockchain data cannot be deleted by Serum.

Local Beaky history remains on the device until cleared by the user, browser storage is cleared, or Serum’s retention controls remove it. We delete or de-identify other information when it is no longer needed, subject to backups and legal preservation requirements.

Security and international processing

Serum uses technical and organizational safeguards including hashed passwords, protected sessions, passkeys, two-factor authentication, encrypted custody controls, access restrictions, rate limits, and audit logging. No system is perfectly secure, so you must protect your devices and credentials and promptly report suspected compromise.

Serum and its providers may process information in the United States and other countries whose laws differ from yours. Where required, we use an appropriate transfer mechanism and safeguards for international transfers.

Your choices and privacy rights

You may request access, correction, deletion, restriction, objection, or a portable copy of eligible personal information by emailing support@xserumx.com. You may also withdraw consent where processing relies on consent and complain to your local data-protection authority. Rights vary by location and may be limited by identity verification, security, legal retention, transaction integrity, or other lawful exceptions.

Serum does not currently respond to browser “Do Not Track” signals because it does not use cross-site behavioral advertising. California residents may request the categories, sources, purposes, recipients, and specific pieces of eligible personal information and request correction or deletion. Serum does not sell or share personal information as those terms are used for California cross-context behavioral advertising rights.

Children

Serum is not directed to anyone under 18 and accounts are limited to adults. We do not knowingly collect personal information from children. If you believe a minor provided information, contact us so we can review and delete it where appropriate.

Updates and contact

We may update this Policy as Serum and applicable law change. Material updates will be posted with a new effective date and may require renewed acknowledgement. Contact support@xserumx.com for questions, requests, or concerns. We will verify requests before releasing or deleting account data.