1. Definitions
As used in this Privacy Policy, the following terms have the meanings set forth below: 1.1 “The Company,” “BM.XYZ,” “We,” and “Us” refer to the website https://bm.xyz (the “Website” or “Platform”), the BM.XYZ decentralized applications, APIs, and related services dedicated to onchain digital asset trading and related financial activities on BM Chain. 1.2 “Digital Asset” means a digital representation of value (also referred to as “cryptocurrency,” “virtual currency,” “digital currency,” “crypto token,” “crypto asset,” or “digital commodity”) based on cryptographic protocols, which may be (i) centralized or decentralized, (ii) closed or open-source, and (iii) used as a medium of exchange and/or store of value. 1.3 “Services” means services offered on the Website, through BM.XYZ interfaces, APIs, mobile web experiences, and any related BM ecosystem products that link to this Policy. 1.4 “User” means any person who visits, explores, connects a wallet to, signs up for, or otherwise accesses our Services. For convenience, Users are also referred to as “you” or other second-person forms. 1.5 “User Account” means a user-accessible trading identity associated with our Services, including without limitation a connected self-custodial wallet address, an embedded wallet created through email or social login providers, API credentials, and related session or authorization records. BM.XYZ does not take custody of your private keys for self-custodial wallets. 1.6 “Personal Information,” “Personal Data,” or “your data” means any information relating to you as an identified or identifiable natural person, including but not limited to your name, email address, location data, online identifier, or factors specific to your physical, economic, cultural, or social identity.2. Purpose
BM.XYZ is a non-custodial, wallet-based platform. We do not operate a traditional account KYC program. We do not require government ID, proof of address, SSN, biometric verification, or other traditional KYC documents to use the core Services.
3. Collection of Personal Information
3.1 — Information you provide
3.1 — Information you provide
BM.XYZ may collect Personal Information that you voluntarily submit, including:
- Email address — if you sign in with email (e.g., via Privy or similar providers)
- Support and feedback content — messages, bug reports, and attachments you send to us
- API metadata — labels or notes you assign to API keys (if applicable)
- Communications preferences — marketing opt-in/out choices where offered
3.2 — Information collected automatically or from third parties
3.2 — Information collected automatically or from third parties
BM.XYZ may also collect, receive, and use the following information to monitor, secure, and improve the Platform:
- Location information: IP address, domain name, referring URL, browser type and version, time zone, browser plug-ins, operating system, and platform (used for security, abuse prevention, and approximate geolocation for eligibility checks under our Terms of Use)
- Log information: Device-specific data, system activity, pages visited, full URLs, clickstream data, date and time, response times, download errors, visit duration, page interactions (scrolling, clicks, mouse-overs), and navigation methods
- Account and trading information: Wallet addresses, orders, trades, balances, funding payments, referral or builder-code relationships, and other transactional metadata associated with your use of the Services
- Correspondence: Information you provide in written communications, including customer support and bug reports
- Blockchain data: Public onchain data we may analyze, including transaction timestamps, transaction IDs, digital signatures, amounts, and wallet addresses on BM Chain and related networks
- Marketing and analytics partners: Campaign interaction data and usage analytics from partners that help us measure and improve the Services
- Cookies and similar technologies: As described in Section 9
- Third-party login providers: If you use email or social login (e.g., via Privy), we may receive your email address, authentication identifiers, and embedded wallet address from that provider
- Infrastructure partners: Information from hosting, analytics, bridge, and other vendors involved in delivering the Services
3.3. Incomplete Onboarding
Information you provide while using BM.XYZ may be retained even if you do not complete wallet connection, Enable Trading, or onboarding.3.4. Information About Others
If you provide Personal Information about another individual, you represent that you have obtained their consent to disclose it to us and that they consent to our collection, use, and disclosure under this Privacy Policy.4. Use of Personal Information
BM.XYZ uses Personal Information for the following business purposes:- To create, maintain, and secure your access to BM.XYZ (wallet connection, email login, API keys, and trading sessions)
- To provide, operate, and improve our Services
- To provide customer support and respond to inquiries
- To customize your experience and improve functionality based on feedback and usage patterns
- To maintain statistics on Service usage
- To enable device-based settings you authorize (e.g., camera or photos where a feature such as PnL sharing requires them)
- To facilitate transactions you initiate (your information will not be sold or transferred to unrelated third parties for their own marketing without your consent, except as needed to complete a transaction you request)
- To send service communications, security alerts, and — with your consent or where permitted — marketing or promotional messages
- To research, develop, and innovate new features
- To promote the safety, security, and integrity of our Services and Users, including abuse detection and enforcement of our Terms of Use
- To preserve, review, and share information with law enforcement when required by applicable law
- To fulfill other purposes disclosed in our Terms of Use or otherwise communicated at the point of collection
5. Sharing of Personal Information
BM.XYZ works with service providers, partners, affiliates, and other third parties to provide our Services. We may share information as follows:- Affiliates: Information may be transferred among companies and personnel affiliated with the BM ecosystem as needed to operate the Services.
- Linked third-party services: When you use third-party wallets, bridges, login providers, or websites linked through our Services, those providers may receive information you or we share with them. Their terms and privacy policies govern their handling of your data.
- Professional advisors and authorities: We may share information with advisors or law enforcement when required to comply with law, regulation, court order, or legal process, or to detect, investigate, prevent, or address fraud, abuse, or security issues.
- Asset transfer or corporate transaction: If we buy, sell, merge, reorganize, or undergo a change of control, User information may be transferred as part of that transaction.
- Third-party service providers: We share information with vendors who process data on our behalf under contractual obligations consistent with this Policy (e.g., hosting, analytics, email delivery, customer support tools, authentication providers).
6. Protection of Personal Information
We adopt appropriate physical, electronic, technical, and managerial measures to protect Personal Information, including:- Physical measures: Restricted access to records and media containing Personal Information
- Electronic measures: Encrypted storage and access-controlled systems where appropriate
- Technical measures: Encryption in transit (e.g., TLS), authentication controls, monitoring, and other industry-standard safeguards
- Managerial measures: Access limited to authorized personnel subject to confidentiality obligations
- Other measures we deem necessary to protect Personal Information
7. Data Retention
We retain information as needed to provide Services, comply with legal obligations, resolve disputes, and protect our or others’ interests. Retention periods vary by data type. Factors include when information was collected, whether it remains necessary to provide Services, and whether we must retain it for security, tax, or litigation purposes. When information is no longer needed, we delete or anonymize it where feasible. You may request deletion as described in Section 10, subject to legal retention requirements.8. Children’s Personal Information
The Website and Services are not directed to persons under 18. We do not knowingly collect Personal Information from anyone under 18. If you are under 18, do not use the Services or submit Personal Information. If we learn that we have collected Personal Information from a user under 18, we will take steps to delete that information and may restrict access to the associated wallet or account.9. Cookies
Cookies and similar technologies (including pixels, local storage, SDK identifiers, and tags) help us operate, secure, and improve BM.XYZ.9.1. What We Use
- Strictly necessary: Required for core functionality such as session management, security, load balancing, and abuse prevention. Disabling these may break parts of the Services.
- Performance: Help us measure traffic, errors, and feature usage so we can improve stability and speed.
- Functional: Remember preferences such as language, display settings, or market favorites stored in combination with local storage.
- Targeting / measurement: Where enabled, help us measure campaigns and show relevant BM.XYZ communications on our Platform or partner sites. Third-party ad or analytics partners may set their own cookies subject to their policies.
9.2. Duration
Session cookies expire when you close your browser. Persistent cookies remain until they expire or you delete them.9.3. Your Choices
You may decline non-essential cookies through browser settings or in-product controls where offered. Blocking cookies may affect functionality.10. Rights With Respect to Your Personal Information
Depending on your jurisdiction, you may have rights regarding your Personal Information, including:- Access and portability: Request a copy of Personal Information we hold about you
- Rectification: Request correction of incomplete or inaccurate data
- Deletion / erasure: Request deletion, subject to legal retention obligations (see Section 7)
- Withdraw consent: Where processing is consent-based, withdraw consent; this may limit our ability to provide certain Services
- Object or restrict processing: Object to certain processing based on legitimate interests or for direct marketing
- Non-discrimination: We will not discriminate against you for exercising applicable privacy rights