TESTNET
Connect

Privacy Policy

Last updated: 24 September 2026

At Polyester, we take your privacy seriously. Please read this Privacy Policy to learn how we treat your personal data when you use the Polyester exchange, Zipper, and Polyester Scan. By using or accessing any of these services, you acknowledge the practices described below.

Your use of the services is at all times subject to the Polyester Exchange Terms of Service, the Zipper Terms of Service, and the Polyester Scan Terms of Service. Any term we use in this Policy without defining it has the meaning given in those Terms.

If you have a disability, you may request this Privacy Policy in an alternative format by contacting legal@polyester.com.

Contents

What this Privacy Policy covers

This Privacy Policy covers how we treat personal data that we gather when you access or use the Polyester website at polyester.com and its subdomains, the Polyester web and mobile applications, the Polyester APIs and hosted integrations, Zipper deposits and withdrawals, Polyester Scan, our support channels, and the Polyester moderation bot on Discord (together, the "Services"). "Personal data" means any information that identifies or relates to a particular individual, including information referred to as "personal information" or "personally identifiable information" under applicable privacy laws.

The Services do not require identity verification. We do not ask for your legal name, government identification, date of birth, or physical address, and we do not process payment cards or bank accounts. We do process wallet addresses, sign-in identities, transaction records, security data, and technical data, and much of that information can identify you or be linked to you. This Policy describes that processing plainly.

This Privacy Policy does not cover the practices of companies we do not own or control, such as the wallet software you use, the Google or email provider you sign in with, X, Discord, TradingView, or the external blockchains that record your deposits and withdrawals.

Who is responsible for your personal data

Two companies provide the Services and are responsible for your personal data.

  • Polyester Panama S.A. ("Polyester"), Suite 673, 317 PH The Century Tower, Betania, Republic of Panama, operates the Polyester website, the Platform, the APIs, the PolyEngine order books and Trading ledger, the Funding Account records, lending and borrowing, Quick Swap, Subaccounts, the Referral Program, Polyester Scan, notifications, and support. Polyester is the controller of your account, trading, security, support, Scan, and technical data.
  • Zipper Trade S.A. ("Zipper"), Suite 673, 317 PH The Century Tower, Betania, Republic of Panama, operates deposits, Zipped Asset issuance and redemption, vault custody, and external withdrawals. Zipper is the controller of deposit and withdrawal request records, sanctions and transaction-risk screening results, validator evidence, and Digital Asset Escrow records.

Polyester and Zipper share account identifiers, meaning your Owner Wallet address, your Smart Account addresses, and account and request identifiers, so that a deposit can be credited to the right account and a withdrawal can be executed for the right balance. For that shared processing they act as joint controllers under an arrangement that allocates responsibilities between them. You may exercise any right under this Policy against either company, and the contact point at the end of this Policy serves both.

Polyester Foundation, a Cayman Islands foundation company, is associated with Polyester Chain, which is a public blockchain. Records written to Polyester Chain are public and are not controlled by the Foundation, Polyester, or Zipper. Fabric Blockchain Labs, Inc., a Delaware corporation, develops software used by the Services and may process personal data on behalf of Polyester and Zipper as a service provider under contract. It does not decide how your personal data is used.

Personal data we collect

Account and sign-in data

  • Owner Wallet address. Your Owner Wallet address identifies your Master Account. If you connect an external wallet, we receive its public address and a signed message proving that you control it. We never receive its private key.
  • Embedded wallet sign-in identity. If you sign in with Google or email, an embedded wallet is created and secured by Turnkey, Inc. ("Turnkey"). We receive and store the identifier associated with your Google account or the email address you used, so that the same identity returns you to the same account. Turnkey holds the encrypted private key and the authentication records for the embedded wallet. Verification codes sent to your email are generated and delivered through Turnkey's authentication service.
  • Smart Account addresses. Each Master Account and Subaccount has a Safe smart account address on Polyester Chain, which we generate and record.
  • Profile fields you choose to add. A username, a short bio, a website, an X (Twitter) handle, a Discord handle, and an avatar image. Profile fields are optional and are visible to other users. If you verify an X or Discord handle, we receive confirmation from that platform that the handle is yours and record the verification status.
  • Account metadata. Account creation time, VIP tier, username-change cooldown, and your Subaccount structure, including the members you invite and the roles and permissions you assign.

Security data

  • MFA methods. The type of each method (passkey or authenticator app), the label you give it, when it was added and last used, and the public credential identifier for a passkey. We store recovery codes only in hashed form. We never store authenticator secrets or your current codes.
  • Sessions and access events. Sign-in and sign-out times, session identifiers, browser and device type, operating system, IP address, approximate location derived from your IP address, and the security alerts generated for your account.
  • API keys. Key identifiers, public keys, the account and permissions each key is scoped to, the IP allowlists you configure, creation and last-use times, and request logs. We do not hold the private signing key for an API key.
  • Guard Signer records. Whether a managed signer exists for an account, its public address, its initialization and rotation status, and the record of approvals issued. The managed private key is held in encrypted form and is revealed to you only if you request an export.
  • Address book and whitelists. The external addresses, destination tags, and internal accounts you save or approve, and changes to whitelist requirements.
  • Subaccount audit logs. Membership, permission, API-key, and setting changes, with the acting account and the time.

Transaction and trading data

  • Trading records held by Polyester. Orders, fills, cancellations, and the fee, rebate, and reservation entries recorded for each; your Funding and Trading balances; internal transfers; lending positions, collateral, borrowings, interest, and liquidations; Quick Swap records; referral links, referred accounts, and the Reward Ledger; and the account statements and ledger exports generated for you.
  • Deposit and withdrawal records held by Zipper. The Route, amount, fee, source or destination address and tag, external transaction hash, Flow ID, validation and status history, and the Zipped Asset mint or burn associated with each request.

Screening data

Wallet addresses, transaction hashes, and the source or destination of each deposit and withdrawal are sent to Blockaid for sanctions and transaction-risk screening. We receive and retain the screening result, including any risk category and the reason for it, and any decision we make on the basis of it. Where a deposit is placed in Digital Asset Escrow, Zipper records the escrow, the Agent to whom the assets were transferred, and correspondence about it.

Support and community data

  • Support tickets. The content of your ticket, the account it relates to, the identifiers you include, and our replies. Do not include secrets in a ticket; we may redact them if you do.
  • Feature requests. Feature requests and their discussions are public. Your username and the content you post are visible to other users.
  • Discord moderation bot. In Discord servers where the Polyester moderation bot is installed, the bot processes message content and related user and server data, and keeps records of its moderation actions.
  • Correspondence. Messages you send to legal@polyester.com or through other contact channels, including review requests and complaints.

Technical data

  • Server and request logs. When you use the website, the Platform, the APIs, or Polyester Scan, our servers and our content-delivery provider record your IP address, the request URL and method, timestamps, response codes, your user agent, the referring page, and, for API calls, the key identifier and signature metadata. We use this data for security, rate limiting, abuse prevention, debugging, and capacity planning.
  • Error and performance monitoring. When the Platform encounters an error or slow performance, diagnostic data (the error, the page or API involved, browser and device type, and a pseudonymous session identifier) may be sent to an error-monitoring service.
  • Product analytics. Pseudonymous usage events (pages viewed, features used, and interaction timings) may be collected to understand how the Platform is used and to improve it. We do not use advertising identifiers and do not combine analytics data with data from advertising networks.
  • Web analytics. polyester.com uses Cloudflare Web Analytics, which measures page views and performance without cookies and without tracking you across sites.

Polyester Scan data

When you use Polyester Scan, we collect the technical data described above, your search queries, and the display settings you save. If you connect a wallet to use a Write Contract tool, we also collect the wallet address you connect and the transactions you submit. Browsing Scan does not create an account.

Data stored only in your browser

Your appearance, language, region, sound, notification, workspace-layout, chart, and search-history preferences are stored in your browser's local storage and cookies. They are not sent to your account. Turnkey session data for embedded wallets is also held in your browser. Clearing your browser data removes these settings and signs you out.

Personal data we do not collect

We do not collect your legal name, government identification, date of birth, physical address, photographs of you, biometric data, payment-card numbers, or bank-account details. We do not receive or store your Owner Wallet private key or seed phrase, your authenticator secret, or your API private key. A passkey's private key stays on your device or with your passkey provider. We will never ask you for any of these, and no one acting for us will ever ask for them.

Where personal data comes from

We collect personal data about you from the following sources.

  • You, when you sign in, configure your account, place orders, submit deposit or withdrawal requests, add profile fields, contact support, or otherwise use the Services.
  • Your device and browser, which send technical data automatically when you use the Services.
  • Public blockchains, which record deposits, withdrawals, and Polyester Chain transactions.
  • Turnkey, when you sign in with an embedded wallet.
  • Blockaid, in the form of screening results.
  • Wallet providers, in the form of public addresses and signed messages.
  • X and Discord, when you verify a handle, and Discord when you post in a server where the Polyester moderation bot is installed.
  • Zipper validators, who supply transaction evidence for deposits and withdrawals.
  • Other users, for example when someone invites you to a Subaccount or you join through a referral link.

How we use personal data

We use personal data for the following purposes. Where the law that applies to you requires a legal basis for processing, such as the EU or UK General Data Protection Regulation, the basis we rely on is noted with each purpose.

  • Providing the Services. Creating and operating your account; executing orders, transfers, deposits, withdrawals, loans, swaps, and referral rewards; and keeping accurate records of them. Legal basis: performance of our contract with you.
  • Complying with the law. Sanctions and transaction-risk screening; complying with sanctions law; responding to lawful requests from authorities; and retaining records required by law. Legal basis: compliance with legal obligations, and, where no legal obligation applies to us directly, our legitimate interest in preventing the Services from being used for sanctions evasion or crime.
  • Securing the Services and your account. Authentication, MFA, session management, security alerts, whitelists, API-key controls, rate limiting, and detecting fraud, market manipulation, exploits, and abuse. Legal basis: performance of our contract with you and our legitimate interest in protecting users and the Services.
  • Supporting you. Providing support, handling review requests and complaints, and resolving disputes. Legal basis: performance of our contract with you and our legitimate interest.
  • Sending service messages. Sign-in codes, security alerts, transactional notifications, and service notices. Legal basis: performance of our contract with you. Browser and push notifications are sent only with your permission.
  • Displaying your public profile. Showing the optional profile fields you configure. Legal basis: your consent, which you may withdraw at any time by removing the fields.
  • Improving the Services. Understanding how the Services are used, diagnosing errors, and improving performance and features. Legal basis: our legitimate interest in maintaining and improving the Services.
  • Moderating our Discord community. Enforcing channel rules and providing community information through the Polyester moderation bot. Legal basis: our legitimate interest in keeping our community channels safe and useful.
  • Operating Polyester Scan. Legal basis: our legitimate interest and performance of the Scan Terms.
  • Protecting our rights. Establishing, exercising, or defending legal claims, and completing business transfers. Legal basis: our legitimate interest and compliance with legal obligations.

We do not use personal data for advertising or to train AI models, we do not sell it, and we do not send marketing communications. The only messages we send are the sign-in codes, security alerts, transactional notifications, and service notices you need to use the Services safely. We will not collect additional categories of personal data or use personal data for materially different or unrelated purposes without giving you notice.

Sanctions screening and automated decisions

Every deposit and withdrawal is screened automatically before it is processed, and Owner Wallets and destination addresses may be screened at other times. Screening compares addresses and transactions against sanctions lists and blockchain-analytics risk indicators supplied by Blockaid. A screening result can lead to an automated decision to decline a transaction, restrict an account, or place a deposit into Digital Asset Escrow, as described in the Terms of Service.

Where a decision is based on a sanctions-list match, we are required by law to act on it. Where a decision is based on a risk indicator that is not a sanctions-list match, you have the right to ask a person to review the decision, to present information about the transaction, and to contest the outcome. To request a review, contact legal@polyester.com with the account, Flow ID, or transaction hash involved. Screening providers can return incorrect or outdated results, and we will correct a decision that we determine was based on an incorrect result.

Liquidation of a borrowed position is an automated decision made by the risk engine on the basis of your account's collateral and borrowings and current prices, as described in Schedule C of the Exchange Terms. It is necessary for the performance of the lending contract you enter into when you borrow.

Public blockchain data

Deposits and withdrawals are recorded on the external blockchains involved. Smart Account deployments, Funding Account movements, Zipped Asset mints and burns, whitelist changes, and other on-chain actions are recorded on Polyester Chain. These records are public, permanent, and replicated by every node on the network. Polyester Scan indexes and displays them, and so do other explorers. Anyone who knows your Owner Wallet or Smart Account address can see the on-chain activity associated with it.

Neither Polyester, Zipper, nor the Foundation can edit, delete, or restrict access to records on a blockchain. The rights described later in this Policy cannot be exercised over on-chain records, but they can be exercised over the off-chain records we hold that link on-chain addresses to your account.

Your Trading Account balances, orders, fills, fees, lending positions, permissions, sessions, and complete financial ledger are recorded on Polyester's private ledger and are not written to any blockchain.

How we share personal data

We share personal data only as described in this section. We do not sell personal data, we do not share it with advertising networks or data brokers, and we do not share it for any third party's marketing.

  • Between Polyester and Zipper. Polyester and Zipper share account identifiers and deposit and withdrawal request data with each other as needed to credit deposits, execute withdrawals, apply screening decisions, and handle support and review requests.
  • Service providers. These parties process personal data on our behalf under contracts that restrict their use of it to the services they provide to us. They include:
    • Turnkey, Inc. provides embedded wallet infrastructure and sign-in authentication. Turnkey holds encrypted embedded-wallet keys, sign-in identities, and authentication logs. Its handling of that data is also described in its own privacy policy.
    • Cubist, Inc. provides vault key management and transaction signing for Zipper. Cubist receives transaction intents consisting of the chain, asset, amount, and destination. It does not receive your account identity.
    • Blockaid provides sanctions and transaction-risk screening. Blockaid receives wallet addresses and transaction data. It may retain screening data and use it to maintain and improve its blockchain-intelligence services under its own terms. It does not receive your sign-in identity or profile.
    • OpenAI and other AI providers process Discord messages and related data as needed to provide the moderation bot's features. They process that data under their applicable terms and privacy policies.
    • Cloudflare, Inc. provides hosting, content delivery, security, and cookieless web analytics.
    • Cloud infrastructure, database, and email-delivery providers host our systems and deliver service messages.
    • Error-monitoring and product-analytics providers receive the diagnostic and pseudonymous usage data described above.
    • Professional advisers, auditors, and insurers receive personal data under confidentiality obligations where needed.

The TradingView charting library runs in your browser and stores chart settings locally. It does not receive your account data from us. A current list of service providers that process personal data is available on request to legal@polyester.com.

  • Zipper validators. Independent validator operators receive the transaction evidence needed to validate each deposit and withdrawal, meaning the source or destination address, amount, Route, confirmations, and screening result. Validators do not receive your sign-in identity or profile.
  • Escrow Agent. Where a deposit is placed in Digital Asset Escrow, Zipper shares the transaction details and the screening result with the independent Agent that holds the assets and, where you ask for a review, the information you provide.
  • Affiliates. Polyester and Zipper may share personal data with Polyester Foundation and Fabric Blockchain Labs, Inc. where those entities provide development, operational, or security services to the Services, subject to the same restrictions that apply to service providers.
  • Legal obligations and safety. We disclose personal data where we are required to do so by law, regulation, court order, or a lawful request from a law-enforcement, sanctions, tax, or regulatory authority, including authorities outside your country; where disclosure is necessary to establish, exercise, or defend legal claims; where disclosure is necessary to investigate or prevent fraud, market manipulation, exploits, or threats to the security of the Services or the safety of any person; and, in the case of a request from a tax authority or government agency, where we choose to respond to a lawful request even if we are not compelled to. We will tell you about a request for your personal data where we are permitted to do so and where doing so would not compromise an investigation.
  • Business transfers. If Polyester or Zipper is involved in a merger, acquisition, reorganization, or sale of assets, personal data may be transferred to the successor, which will be bound by this Policy until it is changed as described below. We will make reasonable efforts to notify you before your personal data becomes subject to different privacy practices.
  • Parties you authorize. Your public profile, feature requests, and referral links are visible to other users. Members you add to a Subaccount can see that account's balances and activity according to their role. Ledger exports you download are under your control.

Data that is not personal data

We may create aggregated, de-identified, or anonymized data from the personal data we collect, including by removing information that makes the data identifiable to a particular person. We may use and share such data for our lawful business purposes, including to analyze, build, and improve the Services, provided that we will not share it in a manner that could identify you.

International transfers

Polyester and Zipper are established in Panama. Personal data is stored and processed in Panama, the Cayman Islands, the United States, and the countries where our service providers and validators operate, and the laws of those countries may differ from the laws where you live. Where personal data about a person in the European Economic Area, the United Kingdom, or Switzerland is transferred to a country that has not been found to provide adequate protection, we rely on standard contractual clauses approved by the relevant authority or on another lawful transfer mechanism, and we apply supplementary measures where required. You may request a copy of the relevant clauses from legal@polyester.com.

Tracking tools and browser storage

The website and the Platform use a small number of cookies and browser-storage entries. All of them are necessary for the Services to work or store your own preferences. We do not use advertising cookies, cross-site tracking cookies, or third-party analytics cookies, and we do not supplement the data we collect with data from third-party cookies.

  • Session and authentication storage keeps you signed in, protects against cross-site request forgery, and holds the embedded-wallet session for Google and email sign-in. Set by Polyester and Turnkey.
  • Security cookies help Cloudflare distinguish legitimate visitors from automated attacks and enforce rate limits. Set by Cloudflare.
  • Preference and layout storage holds your appearance, language, region, sound, notification, workspace, chart, and search-history settings in your browser only. Set by Polyester and by the TradingView charting library.
  • Web analytics is provided by Cloudflare Web Analytics, which measures page views and performance without cookies and without identifying you.

You can control cookies and local storage through your browser settings. Blocking or clearing necessary storage will sign you out and reset your preferences, and may prevent embedded-wallet sign-in from working. Because we do not track you across other websites, we do not respond differently to "Do Not Track" browser signals; we treat a Global Privacy Control signal as described under "State law privacy rights" below.

Data security and retention

We protect personal data with physical, technical, and organizational measures appropriate to the type of data and how we process it. These include encryption of data in transit and at rest; hardware-isolated secure enclaves and trusted execution environments for embedded-wallet keys (operated by Turnkey) and for Zipper vault keys (operated by Cubist); hashed storage of recovery codes; signed and replay-protected API requests; MFA and fresh step-up requirements for sensitive actions; role-based access controls, logging, and review of staff access to production systems; separation of the private Trading ledger from public-facing systems; independent validation of deposits and withdrawals; and security reviews of critical components. No method of transmitting or storing data is completely secure, and we cannot guarantee that unauthorized access will never occur. If a breach affecting your personal data occurs, we will notify you and the relevant authorities where the law requires it.

You should also help protect your data by safeguarding your Owner Wallet and its recovery method, your sign-in identity, your MFA devices and recovery codes, your API private keys, and any keys you export; by limiting access to your devices and browser; and by signing out when you have finished.

We keep personal data for as long as necessary for the purposes described in this Policy and, after that, for the period required by law. Account, transaction, deposit, withdrawal, lending, referral, and screening records are kept for the life of the account and for five years after the account is closed or last used, so that we can respond to lawful requests, resolve disputes, and meet record-keeping obligations; records subject to an ongoing investigation, legal hold, or escrow are kept until the matter is resolved. Security and access logs, session records, and API request logs are kept for twelve months from the event, unless they are needed for an ongoing investigation or dispute. Support tickets and correspondence are kept for three years after the ticket is closed. Discord message content and related moderation records are kept for up to ninety days after collection or creation, and are deleted sooner when no longer needed, unless longer retention is required by law. Error-monitoring and product-analytics data is kept for ninety days in identifiable or pseudonymous form and only as aggregated statistics after that. Cloudflare Web Analytics data is aggregated, and we retain no per-visitor record. Profile fields are kept until you remove them or the account record is deleted. Data stored in your browser stays until you clear it.

On-chain records are permanent and outside our control. When a retention period ends, we delete the personal data or anonymize it so that it can no longer be linked to you.

Personal data of children

The Services are not directed to, and may not be used by, anyone under the age of 18. We do not knowingly collect or solicit personal data from anyone under 18. If you are under 18, please do not attempt to create an account or send any personal data about yourself to us. If we learn that we have collected personal data from a person under 18, we will deactivate the account and delete the data we are able to delete as quickly as possible. If you believe that a person under 18 may have provided us with personal data, please contact us at legal@polyester.com.

Your rights and choices

Depending on where you live, you may have some or all of the following rights over the personal data we hold about you. We offer the following to everyone, regardless of location, except where a right is limited by law or by the nature of blockchain records.

  • Access. You can ask whether we process personal data about you and request a copy of it. Much of your account, transaction, and security data is available directly in the Platform, including through account statements and ledger exports.
  • Correction. You can ask us to correct inaccurate personal data. You can edit profile fields, address-book entries, and settings yourself; contact us for anything else.
  • Deletion. You can ask us to delete personal data. We will delete data that we are not required to keep and anonymize the rest. We cannot delete blockchain records, and we must keep the transaction, screening, and account records described under "Data security and retention" for the periods stated there. The Platform does not currently offer self-service account closure; you may ask us to deactivate your account, and you should withdraw your Digital Assets first.
  • Portability. You can ask for a copy of the personal data you provided to us in a structured, machine-readable format. Ledger exports and API access provide this for account data.
  • Objection and restriction. You can object to processing based on our legitimate interests, and ask us to restrict processing while a request is being considered. You may opt out of product analytics by contacting us. Cloudflare Web Analytics does not identify individual visitors.
  • Withdrawal of consent. Where processing is based on your consent, such as public profile fields or browser and push notifications, you can withdraw it at any time without affecting processing that took place before withdrawal.
  • Human review of automated decisions, as described under "Sanctions screening and automated decisions".
  • Complaint. You can lodge a complaint with a data-protection authority. We would appreciate the chance to address your concern first.

To exercise a right, contact legal@polyester.com. Because the Services do not collect identity documents, we verify requests by asking you to sign a message with the Owner Wallet that controls the account, or to send the request from a signed-in session or from the sign-in identity associated with the account. We respond within one month, or within any shorter period required by the law that applies to you, and may extend that period where a request is complex. We do not charge for requests unless they are manifestly unfounded or excessive. In some circumstances we may not be able to comply fully with a request, for example where it would jeopardize the rights of others or is not required by law, but we will still respond and tell you why. We will not treat you differently for exercising a right.

State law privacy rights

California resident rights

If you are a California resident, the California Consumer Privacy Act gives you the rights to know, delete, correct, and port the personal information we hold about you, and to opt out of the sale or sharing of personal information. In the preceding twelve months we have collected the categories of personal information described under "Personal data we collect" (identifiers, commercial information, internet and network activity, geolocation derived from IP address, and the profile information you choose to provide) from the sources described under "Where personal data comes from", for the purposes described under "How we use personal data", and have disclosed them to the categories of recipients described under "How we share personal data". We do not sell personal information, we do not share it for cross-context behavioral advertising, and we do not use or disclose sensitive personal information for purposes other than those permitted by law. We do not knowingly collect personal information from persons under 16. You may designate an authorized agent to make a request on your behalf; we will require proof of the agent's authority and verification of your identity as described above. We honor Global Privacy Control signals as a request to opt out of sale or sharing, which does not change our practices because we do neither.

Other state rights

Residents of other states with comprehensive privacy laws have similar rights of access, correction, deletion, portability, and opt-out, and the right to appeal a decision on a request. You may exercise these rights, and appeal a decision, by contacting legal@polyester.com.

European Union and United Kingdom data subject rights

If you are in the European Union, the United Kingdom, Iceland, Liechtenstein, Norway, or Switzerland, you may have additional rights under the General Data Protection Regulation, the UK GDPR, or the Swiss Federal Act on Data Protection. Polyester and Zipper are the controllers of your personal data as described under "Who is responsible for your personal data". If there is any conflict between this section and any other part of this Policy, the part that is more protective of your personal data applies.

We process personal data only where we have a lawful basis. The bases we rely on for each purpose are stated under "How we use personal data": performance of our contract with you, compliance with legal obligations, our legitimate interests, and, for public profile fields and browser and push notifications, your consent. Where we rely on legitimate interests, we have assessed that those interests are not overridden by your rights, taking into account the limited categories of personal data involved and the security and compliance purposes they serve. When we process personal data because it is necessary to perform our contract with you, failing to provide that data will mean that you cannot use the parts of the Services that require it.

You have the rights of access, rectification, erasure, restriction, portability, objection, and withdrawal of consent described under "Your rights and choices", together with the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects, except where the decision is necessary for a contract with you or is authorized by law, in which case you have the right to human review as described under "Sanctions screening and automated decisions". You also have the right to lodge a complaint with the supervisory authority of your country. A list of EU supervisory authorities is available at https://edpb.europa.eu/about-edpb/board/members_en, and the UK authority is the Information Commissioner's Office at https://ico.org.uk.

Transfers of personal data outside the European Economic Area, the United Kingdom, and Switzerland are described under "International transfers".

Changes to this Privacy Policy

We may change this Privacy Policy from time to time to reflect changes in the Services, our practices, or the law. We will post the updated Policy at polyester.com/privacy-policy with a new "Last updated" date. Where a change materially affects how we use personal data already collected about you, we will give notice through the Platform or by email to a sign-in identity we hold for you before the change takes effect, and where the law requires it we will ask for your consent. If you use the Services after a change takes effect, the updated Policy applies to you. Use of personal data is subject to the Privacy Policy in effect at the time it is collected. Prior versions are available on request.

This Privacy Policy replaces the Privacy Policy last updated 18 March 2025, which was published by Fabric Blockchain Labs, Inc.

Contact information

If you have any questions or comments about this Privacy Policy, the ways in which we collect and use your personal data, or your choices and rights, please contact us at:

Email: legal@polyester.com

Address: Polyester Panama S.A. and Zipper Trade S.A., Suite 673, 317 PH The Century Tower, Betania, Republic of Panama, marked for the attention of the Privacy Contact.

The same contact point acts for both Polyester Panama S.A. and Zipper Trade S.A.