Last Updated: February 5, 2026 Rosestar SASU ("Rosestar", "we", "us", or "our") is committed to protecting your personal information and your right to privacy. We are a company registered in Paris, France (European Union), and provide our Services to users worldwide. If you have any questions or concerns about this policy, please contact us at privacy@rosestar.io. When you use https://rosestar.io ("Site"), our mobile applications, or any related services (collectively the "Services"), you trust us with your personal information. This Privacy Policy explains what information we collect, how we use it, and what rights you have. Platform Role. Rosestar operates strictly as a technical infrastructure provider. Rosestar does not own any allocation of Creator Tokens, does not own or control liquidity positions, and does not participate in token speculation. Rosestar's revenue is derived solely from service fees for platform usage. Creators own 100% of the token economics for their Creator Tokens. This distinction is relevant to understanding how we process and use data related to token transactions. By accessing and using our Services, you accept the terms of this Privacy Policy. If you do not agree, please discontinue use of our Services. 1. WHAT INFORMATION DO WE COLLECT? Personal Information You Provide: Account Information - To use the Services, you must create or connect a digital wallet ("Wallet"). You may provide your email address, create a username, and add profile information. You may also verify social media accounts (Twitter/X, TikTok, Farcaster) by linking them to your Wallet. Turnkey provides wallet infrastructure and authentication services but does not control user funds. Transaction Data - We record transactions your Wallet performs on Rosestar, including token purchases, sales, and transfers. These are associated with your wallet's public address. User-Generated Content - Photos, videos, music, comments, messages, and other content you create or upload, including associated metadata (timestamps, location if enabled, formatting). Customer Support - Information you provide when contacting support. Automatically Collected Information: - Device data (IP address, device ID, browser type, operating system) - Usage data (how you interact with Services, click patterns, session duration) - Performance data (crash logs, diagnostics) - Location data (general area; precise location only if you authorize) Technical data such as device identifiers, approximate location, and diagnostic data may be processed by our infrastructure and analytics providers for security, performance, and reliability purposes. 2. BLOCKCHAIN AND WALLET DATA IMPORTANT: Rosestar operates on public blockchain networks. You should understand: Public Visibility - Transactions you perform on the Solana blockchain are publicly visible and permanently recorded. Anyone can view your wallet address, transaction history, token holdings, and onchain activity. Blockchain networks are decentralized and operated by third parties. We do not control how blockchain data is stored, accessed, indexed, or used by others. Pseudonymity, Not Anonymity - Wallet addresses are pseudonymous identifiers. When you link your wallet to your Rosestar account (email, profile, social accounts), that wallet address becomes associated with your identity. Under privacy regulations including GDPR, wallet addresses linked to identifiable users may constitute personal data. Permanent Records - Content or transactions recorded on blockchain cannot be deleted or modified, even if we remove them from our interface. Once you confirm a blockchain transaction, it is irreversible. We cannot edit, delete, or reverse any information stored on a blockchain. Third-Party Indexing - Blockchain explorers, analytics companies, and other third parties independently index and analyze public blockchain data. We have no control over their activities. Data Minimization Limits - While we minimize personal data collection where possible, blockchain interactions inherently create permanent public records. Consider carefully what information you choose to publish onchain. Blockchain Analytics - We may use blockchain analytics providers to monitor transaction patterns, assess risk, detect fraud, and ensure platform integrity. These providers may link wallet addresses to identity information from various sources. 3. CREATOR CONTENT AND PRIVACY Content Visibility: - Public posts, profiles, and token pages are visible to all users and indexed by search engines - Direct messages between users are private and are accessed by Rosestar only when necessary for moderation, abuse prevention, legal compliance, or to respond to user reports - We may review content to enforce our Terms of Service and respond to reports Metadata - When you upload content, we may collect and store metadata including file information, timestamps, and device data. Content Storage - We use cloud storage and content delivery providers to host and deliver media content. Content Moderation - Rosestar does not permit illegal or explicit pornographic content. Content moderation rules are defined in our Terms of Service. We reserve the right to review any content on our platform to ensure compliance with our policies, respond to legal requests, and address reported abuse. 4. HOW DO WE USE YOUR INFORMATION? We use your information to: - Provide, operate, and improve the Services - Process transactions and maintain transaction records - Verify account ownership and integrity (such as email, wallet ownership, and linked social accounts) and prevent fraud - Communicate with you about the Services - Enforce our Terms of Service - Comply with legal obligations - Respond to law enforcement and regulatory requests - Conduct research and analytics to improve our platform 5. COMPLIANCE, MONITORING, AND INVESTIGATIONS Regulatory Compliance - As a platform facilitating financial transactions, we are committed to compliance with applicable laws and regulations. We may: - Monitor transactions for suspicious activity - Implement anti-money laundering (AML) and know-your-customer (KYC) procedures as required by applicable law - Flag and investigate potentially fraudulent or illegal activity - Maintain compliance logs and records as required by law - Report suspicious activity to relevant authorities Cooperation with Authorities - We cooperate with law enforcement, regulatory bodies, and government agencies when legally required or when we believe in good faith that disclosure is necessary to prevent harm, investigate violations, or protect our rights. Retention of Compliance Data - We retain transaction records, compliance logs, and related data for the periods required by applicable law, which may exceed our standard retention periods. 6. WHO DO WE SHARE YOUR INFORMATION WITH? Service Providers - Third-party vendors who help us operate the Services (hosting, analytics, email, customer support, compliance providers, blockchain infrastructure, cloud storage and content delivery providers). Blockchain Analytics Providers - Companies that analyze blockchain data for fraud prevention, risk assessment, and compliance purposes. Business Transfers - In connection with any merger, acquisition, or sale of assets. Legal Requirements - When required by law, court order, or government request, or when we believe disclosure is necessary to protect rights, safety, or property. We do not sell your personal information. 7. COOKIES AND TRACKING We use cookies, local storage, and similar technologies to: - Maintain your session and preferences - Analyze usage patterns - Improve performance and security You can manage cookie settings through your browser. Disabling cookies may affect functionality. 8. DATA SECURITY We implement technical and organizational security measures to protect your information. However, no system is completely secure. We cannot guarantee absolute security of your data. 9. INTERNATIONAL DATA TRANSFERS Rosestar SASU is based in Paris, France (European Union). Because we provide the Services worldwide, your information may be processed in countries other than your country of residence, including the United States and other jurisdictions where our service providers operate. If you are located in the European Economic Area, United Kingdom, or Switzerland, we use appropriate safeguards for international transfers when required by applicable law (such as Standard Contractual Clauses and other contractual protections with our processors). 10. AGE RESTRICTIONS Rosestar is intended only for individuals 18 years of age or older. We do not knowingly collect personal information from anyone under 18. If we learn that we have collected personal data from a minor, we will take steps to delete it promptly. If you believe a minor has provided us with personal information, please contact us at privacy@rosestar.io. 11. YOUR PRIVACY RIGHTS Depending on your jurisdiction, you may have rights to: - Access your personal data - Correct inaccurate information - Request deletion of your data - Restrict or object to processing - Data portability - Withdraw consent European Users (GDPR) - If you are in the EEA, you have the rights listed above. Rosestar SASU is the data controller. Our legal bases for processing include: consent, contract performance, legitimate interests, and legal obligations. You may lodge complaints with your local supervisory authority. California Users (CCPA/CPRA) - California residents may request access to, deletion of, and information about personal data collected. We do not sell personal information as defined under the CCPA. Blockchain Limitations - We cannot modify or delete information stored on public blockchains, regardless of any deletion request. This is a technical limitation of blockchain technology. To exercise your rights, contact privacy@rosestar.io. 12. YOUR CONTROLS AND CHOICES - Email: Unsubscribe from marketing emails via the link in each email - Account: Delete content or request account closure by contacting us - Cookies: Manage through browser settings - Mobile: Adjust tracking and location settings on your device 13. DATA RETENTION AND ACCOUNT DELETION We retain personal information as long as necessary to provide Services, comply with legal obligations, resolve disputes, and enforce agreements. When users request account deletion, we delete or anonymize their off-chain account data (such as profile and email). Blockchain wallets and onchain data remain accessible on the blockchain and are not controlled or deleted by Rosestar. Compliance records may be retained for extended periods as required by law. 14. THIRD-PARTY LINKS Our Services may contain links to third-party websites or services. We are not responsible for their privacy practices. Review their policies before providing information. 15. UPDATES TO THIS POLICY We may update this Privacy Policy periodically. Material changes will be communicated via the Services or email. Continued use after changes constitutes acceptance. 16. CONTACT US For privacy questions, data requests, or concerns: Privacy: privacy@rosestar.io Support: support@rosestar.io Legal: legal@rosestar.io Rosestar SASU Paris, France European Union