PRIVACY POLICY

Last Updated: June 2026

This Privacy Policy ("Policy") explains how Kapex Pay DAO LLC ("Company", "we", "us", or "our"), registered within the Catawba Digital Economic Zone (CDEZ), collects, protects, uses, and retains technical and personal data through our website https://kapexpay.com.

1. DATA COLLECTION UNDER THE PRE-OPERATIONAL CORE

While operating in our PRE_OPERATIONAL environment, the Platform does not collect sensitive financial credentials, banking tokens, or government identification documentation. We limit data collection to server-level technical parameters required to ensure systemic integrity, accounting security, and cyber-defense, including:

• Internet Protocol (IP) addresses and device metadata.
• Server log files and interaction time stamps.
• Raw payload events sent via integration test webhooks.

2. LEGAL BASIS FOR PROCESSING & GLOBAL ALIGNMENT (GDPR & CCPA)

We process technical metadata under the following legal foundations recognized globally:

• Legitimate Interest: Processing server logs and IP strings is strictly necessary to maintain the cryptographic integrity of our ledger double-entry system, perform transaction reconciliations, and prevent Distributed Denial of Service (DDoS) attacks.
• Compliance: Retaining technical data allows the Platform to compile the CDEZ Reports by Date needed to comply with the transparency rules of our zone authority.

In alignment with the General Data Protection Regulation (GDPR) of the European Union and the California Consumer Privacy Act (CCPA/CPRA), we guarantee that this data is never rented, sold, or shared for commercial advertising purposes.

3. SECURITY, INTEGRITY AND IDEMPOTENCY

All incoming data and platform webhooks are processed with rigorous security standards. Technical logs are locked against modification to ensure internal ledger audit accuracy. We implement idempotency checking on webhook tables to prevent transaction entry manipulation, storing data within a secure MySQL database structure with restricted administrative access.

4. USER RIGHTS AND JURISDICTION

Users accessing the platform from jurisdictions with protected privacy frameworks retain the rights of access, rectification, and data portability where technically applicable. Given our immutable double-entry structure (`ledger_entries`), transaction hashes and server logs tied to cryptographic reconciliations cannot be expunged due to regulatory bookkeeping compliance. Any data disputes are governed by the sovereign regulations of the Catawba Digital Economic Zone, North Carolina, USA.