[ DOC: PRIVACY_POLICY.md ]Beb, Inc. dba Vibechain

Last updated: October 15, 2026

This Privacy Notice explains how Beb, Inc. dba Vibechain ("Beb," "we," "us," or "our") collects, uses, discloses, and retains personal information when you use https://vibe.market, https://vibechain.com, and related web interfaces for domain registration, market activity, wallet connectivity, creator tools, referrals, rewards, and blockchain-enabled services (collectively, the "Services").

If you have questions, comments, or privacy requests, contact us at gm@vibechain.com.

1. SCOPE OF THIS NOTICE

This notice applies to personal information we process through the Services. It does not apply to third-party websites, wallets, blockchains, marketplaces, mini-apps, social networks, onramps, bridges, or other services that you access separately from us, even if they are linked through the Services.

Because the Services interact with public blockchains, some information associated with your use of the Services may become public, immutable, and widely replicated.

2. PERSONAL INFORMATION WE COLLECT

In Short: We collect information you provide directly, information collected automatically, and information from public blockchains and service providers.

Information you provide directly

Depending on how you use the Services, we may collect:

wallet addresses and blockchain account identifiers you connect, submit, or otherwise use with the Services
account and sign-in information you choose to use, such as guest login information, email address, email verification inputs, login-link verification data, or wallet-signature authentication inputs
profile information you choose to provide, such as username, bio, profile image, and optional links or handles for X, Discord, Telegram, or your website
invite codes, referral codes, waitlist or early-access submissions, support requests, bug reports, survey responses, and other communications
content, metadata, images, listings, draft content, collection settings, comments, posts, and other material you upload, mint, publish, or submit through the Services
transaction instructions, preferences, and other information you submit through the interface, including domain registration or renewal inputs, minting or trading inputs, transfer recipient details, warning acknowledgments, and funding or onboarding selections

Information we collect automatically

When you use the Services, we may automatically collect:

IP address
approximate geolocation derived from IP address
browser, device, operating system, language, and referring URL information
usage and interaction data, including page views, clicks, session events, feature usage, and referral or attribution data
cookie, local storage, session storage, SDK identifier, and similar browser or device data, including session state, invite or referral state, wallet recovery or device-share state, tutorial or warning preferences, and other client-side settings
if you opt in to native push notifications, a random installation identifier, device platform, and Expo push token. We do not attach this notification registration to your wallet, profile, or market activity
diagnostics, crash reports, performance data, fraud or abuse signals, and other security-related telemetry

For retard.market and vibe.market (including vibechain.com/market and its link pages), we use a persistent first-party visitor identifier and may link that identifier, session and interaction history, IP and device information, connected wallet addresses, verified X profile information, and public onchain activity into a unified operational and analytics profile. We record the evidence supporting each identity link and do not treat a shared IP or device alone as proof that different wallets belong to the same person.

If you enroll in an X-based points-tipping season, we also process your stable numeric X user ID, X username at enrollment, the public verification Post and command Posts you submit, the connected wallet you designate, season-specific consent and policy versions, tipping commands, allowance and points-ledger events, receipt and appeal records, eligibility and anti-abuse decisions, and opt-out or reversal status. Public reply receipts may reveal that a command was accepted or rejected and may identify the command Post. We do not ask for an X password or private wallet key.

Information from public blockchains and third parties

We may also collect or receive:

public blockchain data such as wallet addresses, token IDs, domain names, transaction hashes, timestamps, balances, listings, and transfer, mint, or registration history
information from wallet providers, wallet connectors, embedded wallet providers, mini-app platforms, RPC or indexing providers, marketplaces, onramp providers, bridge providers, or similar vendors if you choose to use them
information from analytics, diagnostics, hosting, communications, support, and security providers

Sensitive personal information

We do not intentionally request or collect sensitive personal information as defined by California law through the Services, except to the extent you voluntarily include it in free-form communications with us.

If you use embedded-wallet or wallet-recovery features, some wallet or recovery-related data may be stored locally on your device or processed by third-party wallet providers under their own terms. We do not intend to collect or store exported private keys on our servers through the Services.

3. HOW WE USE PERSONAL INFORMATION

We may use personal information to:

provide, operate, maintain, personalize, and improve the Services
authenticate users and maintain sessions, including through guest login, email verification or login links, wallet-signature authentication, session tokens, and wallet-related account state
create, display, manage, and support user profiles, posts, collections, domains, booster packs, referrals, rewards, bounties, waitlists, creator tools, and related service features
process registrations, renewals, transfers, mints, purchases, listings, and other wallet-linked or onchain actions initiated through the Services
display, index, verify, or facilitate public blockchain activity and other public content
analyze usage and measure performance, including through Amplitude and PostHog analytics
detect, prevent, investigate, and respond to abuse, fraud, bugs, outages, and security incidents, including through Sentry and related monitoring or logging tools
communicate with you about support, updates, security issues, transactions, and service messages
send optional notifications you enable, such as one daily trending pack, and maintain delivery and suppression records
comply with legal obligations, enforce our Terms, and protect our rights, users, and Services

Lawful bases for EEA, UK, and Swiss users

Where applicable, we rely on one or more of the following legal bases:

performance of a contract with you
our legitimate interests in operating, securing, and improving the Services
compliance with legal obligations
your consent, where required by law

We do not use solely automated decision-making that produces legal or similarly significant effects about you through the Services.

4. COOKIES AND SIMILAR TECHNOLOGIES

In Short: We use cookies, local storage, session storage, and similar technologies for authentication, preferences, analytics, diagnostics, and wallet-related functionality.

We currently use or allow technologies reasonably described as:

essential cookies or storage used to keep you signed in, maintain security, or remember service preferences
session or authentication technologies that vary by interface. For example, some Mint flows set an authentication cookie after wallet-based authentication, while some vibechain flows store a browser token and related session state in local storage
wallet-related storage used by embedded wallets, wallet connectors, invite or referral flows, and wallet recovery or device-share mechanisms you choose to use
analytics and diagnostics tools, including Amplitude, PostHog, and Sentry, that may use cookies, local storage, SDK identifiers, or similar technologies to understand usage, measure performance, troubleshoot issues, and help protect the Services
preference and user-experience storage, such as tutorial completion flags, warning dismissals, funding-modal preferences, and similar settings

You can usually control cookies and similar technologies through your browser settings and device controls. Disabling some technologies may affect functionality. Depending on your jurisdiction and the interface you use, additional consent or choice rights may apply to non-essential technologies.

5. HOW WE DISCLOSE PERSONAL INFORMATION

In Short: We disclose personal information to service providers, public blockchains, counterparties you direct us to interact with, and when required by law.

We may disclose personal information to:

service providers and contractors that help us with hosting, infrastructure, analytics, diagnostics, customer support, communications and push-notification delivery, wallet connectivity, embedded wallet services, image or file handling, fraud prevention, and security
blockchain networks, RPC providers, indexers, wallet providers, marketplaces, onramp providers, bridge providers, mini-app platforms, and other ecosystem participants where disclosure is inherent in or necessary for onchain activity or features you choose to use
other users or the public when information is part of public profiles, public content, public listings, or public blockchain activity
affiliates, acquirers, investors, lenders, or counterparties in an actual or proposed financing, merger, acquisition, reorganization, bankruptcy, or sale of assets
regulators, law enforcement, courts, and other parties when required by law or reasonably necessary to protect rights, safety, and the Services

6. CALIFORNIA AND OTHER U.S. STATE PRIVACY DISCLOSURES

This section supplements the rest of this notice for residents of California and other U.S. states with applicable privacy laws.

Categories of personal information collected in the preceding 12 months

Depending on how you use the Services, we may have collected the following categories:

identifiers, such as wallet addresses, usernames, account identifiers, cookie or local-storage identifiers, device identifiers, IP address, and email address if you provide one
California customer records information, such as contact information or similar account information you submit to us
commercial information, such as records of registrations, renewals, mints, purchases, listings, rewards, referrals, and interactions with service features
internet or other electronic network activity information, such as usage, browsing, crash, performance, attribution, and device interaction data
geolocation data, such as approximate location derived from IP address
visual or similar information, to the extent you upload profile images, artwork, or similar content
user-generated content or other information you submit through the Services
inferences, to the limited extent we infer preferences from service interactions for product analytics, feature improvement, or abuse prevention

We do not intentionally collect or use sensitive personal information to infer characteristics about you.

Sources of personal information

We collect personal information:

directly from you
automatically from your browser, device, and use of the Services
from wallet providers, wallet connectors, mini-app providers, service providers, and analytics or diagnostics providers
from public blockchains and related public data sources

Business and commercial purposes

We collect and use personal information for the purposes described in Section 3 above.

Categories of personal information disclosed for a business purpose in the preceding 12 months

Depending on how you use the Services, we may have disclosed identifiers, customer-record information, commercial information, internet or electronic network activity information, approximate geolocation, visual information, user-generated content, and limited inferences to service providers, blockchain or wallet infrastructure providers, and other users or the public where disclosure is inherent in public features or public blockchain activity.

Categories of recipients

We may disclose relevant categories of personal information to:

hosting and infrastructure providers
analytics and diagnostics providers
wallet, embedded-wallet, blockchain, marketplace, mini-app, onramp, and bridge service providers
support, communications, security, legal, and compliance providers
counterparties, affiliates, or transaction participants as described in this notice
government authorities or other parties when required by law

We do not sell personal information for money. We do not knowingly share personal information for cross-context behavioral advertising. We do not currently use the Services to display third-party ads based on cross-context behavioral advertising. If that changes, we will update this notice and provide any rights and opt-out mechanisms required by law.

Privacy rights

Depending on applicable law and subject to exceptions, you may have the right to:

know or access categories and specific pieces of personal information
correct inaccurate personal information
delete personal information
receive a portable copy of personal information
opt out of the sale, sharing, targeted advertising, or certain profiling of personal information
limit certain uses of sensitive personal information
not be discriminated against for exercising privacy rights

How to submit a request

To submit a privacy rights request, email gm@vibechain.com with the subject line "Privacy Request." Please describe your request and provide enough information for us to verify it, such as information reasonably necessary to match your request to your account, wallet, or prior communications. Authorized agents may submit requests on your behalf where applicable law allows.

If we deny your request, you may appeal by replying to our decision email or by emailing gm@vibechain.com with the subject line "Privacy Appeal."

7. DO NOT TRACK AND SIMILAR SIGNALS

On vibe.market, we honor Do Not Track and Global Privacy Control: when your browser sends either signal, our first-party analytics recorder does not run. Elsewhere in the Services, we do not currently respond to browser Do Not Track signals. We do not knowingly allow third parties to collect personal information through the Services about your online activities over time and across third-party websites for their own cross-context behavioral advertising purposes through the Services, although service providers may collect device, usage, or diagnostic information on our behalf to provide analytics, security, or infrastructure services.

8. INTERNATIONAL TRANSFERS

We and our service providers may process personal information in the United States and other countries that may have different data protection laws from your jurisdiction. Where required, we will use appropriate safeguards for international transfers.

9. DATA RETENTION

In Short: We retain personal information for as long as reasonably necessary for the disclosed purposes, including security, legal, and operational needs.

Examples of our current retention approach include:

contact information, waitlist submissions, and support communications: for as long as needed to respond, maintain records of the issue or request, and comply with legal obligations
authentication and session data: until the session ends, the token or cookie expires, you log out, or the data is otherwise replaced or removed, plus any additional period reasonably needed for security logs, backups, fraud prevention, or dispute resolution. For example, some Mint auth cookies may last up to 180 days unless cleared sooner, while some vibechain browser tokens or local-storage items remain until deleted, replaced, or expired
profile information, uploaded images, creator content, and similar account-linked material: for as long as the account or content remains active and for a reasonable period afterward for backups, abuse prevention, legal compliance, and dispute resolution
transaction, referral, invite, reward, domain registration, and related account records: for as long as needed to operate the feature, maintain business and tax records, comply with legal obligations, and address disputes, fraud, or abuse
analytics, diagnostics, and security logs: for as long as needed for operations, abuse prevention, troubleshooting, and compliance, subject to provider settings and internal review
native push registrations: while the installation remains opted in; disabling the feature or an invalid-device response removes the registration. Per-campaign delivery records expire after 35 days
retard.market first-party visitor, interaction, IP, device, wallet, verified-X, and derived onchain profile records: currently without automatic expiration, subject to applicable privacy rights, legal obligations, security needs, and the technical limits of public blockchain data
X points-tipping verification Posts and raw provider payloads: retained only for the short operational period stated for the applicable program; stable participant consent, command hashes, append-only ledger events, receipts, reversals, appeals, audits, and season manifests may be retained for the life of the program and afterward as reasonably necessary to explain balances, prevent duplicate awards and abuse, resolve disputes, and meet legal or accounting obligations. Opting out stops future participation but does not erase public X Posts, immutable audit records, backup copies awaiting rotation, or records we must retain; you may separately delete your Posts through X and submit a privacy request to us
public blockchain data: potentially indefinitely, because blockchain records are public and generally cannot be altered or deleted by us

We may retain information longer where required by law, to establish or defend legal claims, or to prevent fraud or abuse.

10. SECURITY

We use reasonable technical and organizational measures designed to protect personal information. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for safeguarding your wallets, devices, private keys, seed phrases, exported wallet credentials, and login credentials.

11. CHILDREN

The Services are not directed to children. We do not knowingly collect personal information from children under 13, and we do not knowingly permit account or transaction use by persons under 18 through the Services. If you believe a child provided personal information to us, contact gm@vibechain.com.

12. EEA, UK, AND SWISS PRIVACY RIGHTS

If data protection law in your jurisdiction applies, you may have rights to access, correct, erase, restrict, object to certain processing, withdraw consent, and request data portability, subject to applicable limitations. You may also lodge a complaint with your local supervisory authority.

13. PUBLIC BLOCKCHAIN NOTICE

Because the Services interact with public blockchains, some information may be public, immutable, and widely replicated, including wallet addresses, domain names, token identifiers, timestamps, transaction hashes, and related transaction history. Even if you ask us to delete personal information, we generally cannot alter or delete information already written to a public blockchain.

14. THIRD-PARTY SERVICES

The Services may link to or integrate with third-party wallets, embedded wallet providers, mini-app platforms, marketplaces, social-sharing tools, onramps, bridges, and websites. Their privacy practices are governed by their own terms and notices, not this one. If you use third-party wallet export, social sign-in, or payment or onramp functionality, those providers may collect information directly from you or your device.

15. CHANGES TO THIS NOTICE

We may update this notice from time to time. We will change the "Last updated" date when we do. If required by law, we will provide additional notice for material changes.

16. CONTACT US