COINOPERATED PRIVACY NOTICE

1. Information We Handle

1.1 Wallet, account, and authentication information

We process a user's public wallet address as the primary account identifier. We also process authentication signatures, short-lived nonces, session identifiers, session status, and related security information used for Sign-In With Ethereum and account access.

If a user creates or uses a 1Shot embedded wallet, the 1Shot wallet service may process public wallet information, passkey credential identifiers and public keys, encrypted wallet records, wallet settings, and related metadata as described in the 1Shot Privacy Policy. CoinOperated does not receive or store the user's private key, seed phrase, device biometric template, or passkey private key.

1.2 Plan and Delegation information

We process the information a user selects or signs when creating and managing a recurring transaction plan ("Plan"), including:

• Plan name and description
• funding and output assets and networks
• amount, frequency, scheduled dates, and status
• receiving wallet address
• slippage and charge limits
• signed Delegations and their scopes, restrictions, identifiers, and revocation status
• cancellation, deletion, or revocation requests and results.

A signed Delegation is a cryptographic authorization, not a private key. CoinOperated stores and uses it to submit transactions only within the limits that the user authorized.

1.3 Transaction and blockchain information

We process transaction requests and records, including wallet and contract addresses, transaction and relayer identifiers, transaction hashes, amounts, assets, networks, quotes, routes, price references, charges, slippage, status, timestamps, error information, and any intermediate or refunded asset associated with a partial or failed transaction.

Blockchain addresses, balances, transaction history, contract events, and other blockchain records are public. We may obtain this information directly from a blockchain or through an RPC, index, routing, oracle, or analytics service.

1.4 Contact and communications information

If a user chooses to provide it, we may process an email address, Telegram username or chat identifier, notification choices, verification status, and the content of support or other communications. Contact information is optional unless we explain that it is needed for a particular request or feature.

1.5 Device, usage, and infrastructure information

When a person visits or uses the Service, 1Shot and its infrastructure providers may process an IP address, approximate region derived from an IP address, browser and operating-system information, device or browser identifiers, referring page, requested page or endpoint, date and time, session and request identifiers, response codes, performance information, and security signals.

The Service uses essential cookies and similar technologies for authentication, security, and requested functionality. If CoinOperated uses analytics on a page, the analytics provider may receive device, browser, page, event, and approximate-location information. CoinOperated does not use this information for cross-context behavioral advertising.

1.6 Information we do not collect by design

CoinOperated does not receive or store private keys, seed phrases, device biometric templates, or passkey private keys. CoinOperated does not hold user assets in an omnibus account. We will never ask a user to send a private key or recovery secret to support.

2. Sources of Information

We receive information:

• directly from users when they configure a Plan, sign a Delegation, select a notification method, or contact us
• automatically from a browser, device, wallet, or interaction with the Service
• from public blockchains and services that read or organize public blockchain information
• from 1Shot services used to provide the embedded wallet, relayer, and transaction infrastructure
• from routing, liquidity, bridge, compliance, security, analytics, communications, and cloud providers used for the relevant interaction.

3. How We Use Information

We use information to:

• authenticate users and maintain sessions
• create, store, schedule, execute, cancel, and display Plans within signed Delegations
• obtain quotes and routes, submit transactions, track results, and display history
• calculate, disclose, collect, and reconcile charges
• send notifications a user requests
• provide support and respond to communications
• maintain, troubleshoot, secure, and improve the Service
• detect and prevent fraud, abuse, security incidents, sanctions violations, and unlawful activity
• enforce the CoinOperated Terms of Service and protect users, 1Shot, and others
• comply with law, legal process, and regulatory obligations
• complete a financing, merger, acquisition, reorganization, or sale subject to appropriate protections.

We may aggregate or de-identify information and use the resulting information for lawful business purposes. We do not attempt to reidentify information that we maintain as de-identified except to test whether de-identification measures work or as permitted by law.

4. How We Disclose Information

We may disclose information to the following categories of recipients for the purposes described in this Notice:

• 1Shot services. The 1Shot embedded wallet, relayer, quote signer, and related infrastructure process information needed to authenticate wallets and submit authorized transactions.
• Transaction services. Routing providers, decentralized exchanges, liquidity providers, bridges, token issuers, blockchains, RPC providers, indexers, and oracles may receive or expose wallet addresses, transaction parameters, and public blockchain information needed for a requested transaction.
• Infrastructure and operations providers. Cloud hosting, database, content-delivery, security, logging, analytics, communications, and support providers process information for us. Current core providers include Google Cloud and Cloudflare. LiFi provides transaction routing for supported routes.
• Compliance and security recipients. We may disclose information to providers that help screen addresses, detect fraud or security threats, and comply with sanctions or other law.
• Authorities and affected parties. We may disclose information when reasonably necessary to comply with law or valid legal process, enforce our agreements, investigate fraud or abuse, respond to a security incident, or protect rights, safety, or property.
• Transaction counterparties. We may transfer information in connection with a financing, merger, acquisition, reorganization, bankruptcy, or sale of all or part of the business, subject to applicable law.
• At a user's direction. We disclose information when a user directs a transaction, connects a third-party service, or otherwise asks us to do so.

Third parties may independently collect information when a user interacts with them. Their processing is governed by their own terms and privacy notices. A link or integration does not mean that 1Shot controls or endorses their practices.

5. Public Blockchains

Public blockchains are designed to preserve and publicly disclose transaction records. A wallet address, receiving address, transaction, smart-contract event, balance, and related activity may be visible permanently and may be copied or analyzed by anyone. A person who connects a wallet address to an identity may be able to associate past and future activity with that person.

1Shot cannot alter, suppress, or delete a public blockchain record. A privacy request applies only to eligible information in systems that 1Shot controls.

6. Selling, Sharing, and Advertising

1Shot does not sell CoinOperated personal information for money. CoinOperated does not use personal information for cross-context behavioral advertising or targeted advertising based on activity across unaffiliated services.

The Service may use limited product analytics to understand performance and use. Before enabling analytics or advertising practices that require an opt-out or consent under applicable law, we will provide the required notice and choice. We honor legally recognized opt-out preference signals where they apply to our practices.

7. Retention

We retain information only for as long as reasonably necessary for the purposes described in this Notice. The period depends on the nature of the information, the Plan or account status, security and operational needs, legal and accounting obligations, and the need to establish or defend claims.

Active Plan information and Delegations are retained while needed to operate and document the Plan. Session records expire or are deleted through the applicable session process. Plan, transaction, acceptance, compliance, security, tax, and dispute records may be retained after a Plan is canceled when reasonably necessary for those purposes. Other information is deleted, de-identified, or made inaccessible when it is no longer reasonably needed, subject to ordinary backup rotation and legal exceptions.

Public blockchain records are not controlled by 1Shot and may remain permanently available. Information stored on a user's device remains until the user, wallet, or browser removes it. Infrastructure providers retain information according to their configurations, contractual obligations, security needs, and applicable law.

8. Security

We use administrative, technical, and organizational safeguards appropriate to the nature of the information, including access restrictions and encryption in transit. No system, wallet, smart contract, Delegation, network, or storage method is completely secure.

Users are responsible for protecting their wallets, devices, sessions, credentials, passkeys, and recovery methods. Never send a private key or recovery secret to 1Shot or anyone claiming to provide CoinOperated support.

9. Privacy Rights and Choices

Depending on where a person lives, that person may have rights to request access, correction, deletion, portability, restriction, objection, an appeal, or withdrawal of consent. A person may also have a right to complain to a privacy regulator. We will not discriminate against a person for exercising an applicable privacy right.

Requests may be sent to [email protected]. We may verify the request by asking the requester to demonstrate control of the relevant email address, wallet, or account. Do not send a private key or recovery secret. An authorized agent may submit a request where applicable, subject to verification of the agent's authority and the identity of the person making the request.

We may deny or limit a request where permitted by law, including when we cannot verify it, the information is exempt, retention is legally required, fulfillment would impair security or another person's rights, or the information is recorded on a public blockchain or controlled by an independent third party.

Users may disable optional notifications through the applicable setting or unsubscribe mechanism. Browser controls may allow a user to block or delete cookies. Blocking an essential cookie may prevent authentication or another requested function from working.

10. Legal Bases for Processing Outside the United States

Where applicable law requires a legal basis, we process personal information as needed to perform our contract with the user, comply with law, and pursue legitimate interests in providing, securing, supporting, and improving the Service and protecting 1Shot and others. We rely on consent when the relevant law requires it. A person may withdraw consent without affecting processing that was lawful before withdrawal.

11. International Transfers

1Shot operates from the United States. We and our providers may process information in the United States and other countries whose laws may differ from the laws where a user lives. Where required, we use recognized transfer mechanisms and supplementary safeguards.

12. Children

The Service is not intended for anyone under 18 or under the age of majority where that person lives. We do not knowingly collect personal information from a child through the Service. If we learn that a child provided personal information, we will take appropriate steps to delete or restrict information in systems we control. We cannot remove public blockchain records.

13. Changes to This Notice

We may update this Notice to reflect changes to the Service, our practices, or law. We will post the updated Notice and effective date and provide additional notice when appropriate. If a change requires consent, we will request it as required by law.

14. Contact

1Shot API, Inc.
2108 N St #4922
Sacramento, CA 95816
United States
[email protected]