Abstract and Migration Hub Privacy Policy

This page reproduces the Privacy Policy included in the Migration Hub Terms of Service dated October 6, 2026. References below to the “Migration Terms” mean that document, and references expressly identified as sections of those terms use its section numbering. Reading or acknowledging this Privacy Policy does not constitute acceptance of the Migration Terms.

1. Who We Are and What This Policy Covers

This Privacy Policy explains how Cube, Inc., a Delaware corporation (“Cube,” “we,” “us,” “our”), handles personal information in connection with the Abstract blockchain (“Abstract”), the Abstract Global Wallet and related account features, the Abstract Portal at https://abs.xyz, the bridge interface at https://bridge.abs.xyz, related websites, interfaces, software development kits (“SDKs”), and tools provided by Cube, participation programs and account activity records administered by Cube (including XP, points, streaks, and badges), the Migration Hub, and related information, support, operational communications, recordkeeping, migration, wind-down, or discontinuation (the “Covered Services”). This policy forms part of the same document as the Migration Hub Terms of Service and may be read independently. References to sections of this Privacy Policy refer to its separately numbered sections below. It replaces earlier Cube privacy policies and notices for the Covered Services from its effective date, subject to the qualifications below. Our contact information appears in Section 12 of this Privacy Policy. Where applicable data-protection law uses that term, Cube is a controller for processing whose purposes and means it determines. The Abstract Foundation is a separate Cayman Islands foundation company. Each entity’s data-protection role depends on its actual processing activities; inclusion as a protected party under the Migration Terms does not determine that role.

This policy covers information collected through the Covered Services and existing information retained or used for their operation, migration, support, compliance, wind-down, and other purposes described here. It is the current controlling Cube privacy notice for that processing. Earlier notices do not continue as separate governing policies, but prior collection circumstances, binding commitments, choices, and applicable law may restrict how previously collected information can be used. We will obtain any notice, consent, or other authorization required before a changed use or disclosure. Independent wallets, bridges, networks, applications, and other entities may have their own policies for their separate processing; Cube does not replace those policies without authority. We will identify relevant providers and links before their use. Acknowledging this policy through the single acceptance process does not supply a specific privacy consent that applicable law requires separately.

2. Information We Collect and Its Sources

Account and contact information. Information you or an authorized authentication provider supply, such as an email address, account identifier, connected wallet address, authentication status, and wallet or account associations needed to use a feature. We do not need your seed phrase, private key, or recovery secret for support; do not send them to us.

Transactions and activity. Source and destination wallet addresses, transaction hashes, networks, assets and amounts, route and quote details, fees, transaction status, and relevant service usage, historical transaction activity, and account activity records, such as points, streaks, and badges where recorded for your account. Sources may include you, public blockchains, explorers, existing Abstract records lawfully available to us, and relevant providers. Public availability does not mean information is never personal information. Linking a wallet to an account or another wallet can make activity identifiable.

XP information. XP information recorded through the existing account process and associated account identifiers. Sources include existing Abstract account records and the providers supporting that process. We process this information to administer the existing account records and fulfill the recordkeeping commitment in Section 7.3 of the Migration Terms or the corresponding commitment in the Abstract Portal Terms of Service, as applicable. We retain the record in a reasonably retrievable form to preserve information about past participation. Its possible use for verification or recognition by an independent project is subject to Sections 3 and 4 below. Retention is described in Section 7 of this Privacy Policy.

Device and usage information. IP address, approximate location inferred from it, browser and device information, request times, pages or features used, errors, security events, and cookie or similar identifiers where deployed. Hosting, security, and analytics providers may collect this information for us. Section 6 of this Privacy Policy explains tracking choices.

Compliance and support information. Requests, correspondence, documents you choose to submit, investigation records, and screening results obtained from public records or compliance providers. Where needed and lawful for a particular compliance check, we may request additional identity or residency information and explain the requirement.

Agreement and preference records. Versions of notices and terms presented, acceptance wording and timestamps, account or wallet associations, consent and withdrawal records, privacy choices, opt-outs, and communications needed to demonstrate what was agreed or disclosed. We receive information directly from you, automatically through the Covered Services, and from the sources identified above. We do not require information unrelated to the stated purposes.

3. Why We Use Information

We use information to authenticate users; operate, support, secure, and wind down the functions we provide in connection with the Covered Services; show available routes and relevant balances; prepare and route authorized transactions; monitor and troubleshoot transfers; answer support requests; communicate operational deadlines and service changes; detect fraud, abuse, security incidents, and prohibited transactions; meet applicable legal obligations; administer existing account and activity records where needed for those purposes; maintain agreement and preference records; and establish, exercise, or defend legal claims. A service notice is distinct from optional promotional messaging. We may also use retained XP information to respond to an appropriately authorized verification request relating to a program independently offered by another project, subject to the conditions in Section 4 below. No such program or use is guaranteed.

Where a legal basis is required, we rely on performance of a contract or steps you request before contracting only for processing objectively necessary to provide the requested service; applicable legal obligations for processing required by law; and legitimate interests, where recognized and subject to the required balancing of rights, for proportionate security, fraud prevention, service administration, and legal-claims handling. We rely on consent where required, including for optional tracking or marketing. We will explain the relevant basis for additional processing at collection. A foreign-law obligation is not automatically a legal-obligation basis under European or UK law. We do not treat a purpose as necessary merely because it is described in the Migration Terms.

Where processing depends on consent, you may withdraw it through the relevant control or by contacting us; withdrawal does not affect prior lawful processing. Declining optional processing will not prevent access to unrelated core functions. If information is necessary to provide a requested feature or satisfy a legal requirement and you do not provide it, that feature may be unavailable; we will explain the requirement and consequences.

4. When We Disclose Information

We disclose information as reasonably necessary to hosting, security, authentication, wallet, bridge, transaction, analytics, compliance, communications, and support providers for the stated purposes; to the Foundation or relevant affiliates for their actual, disclosed administrative or other functions connected with the Covered Services; and to professional advisers and insurers for appropriate business or legal purposes. Providers acting on our behalf are subject to applicable contractual restrictions and safeguards. A provider acting as a separate controller is responsible for its own disclosed processing; that does not remove our responsibility for our own disclosures.

We may disclose information to comply with a binding legal requirement or lawful process; investigate fraud or security incidents; protect lawful rights, property, or safety; or establish, exercise, or defend claims, subject to applicable law and proportionality. We may disclose relevant information during a proposed or completed business transfer, reorganization, or wind-down subject to appropriate confidentiality and safeguards; a recipient remains subject to applicable law and any required notice or consent for changed uses. These provisions do not authorize unrestricted transfers of user information.

A recordkeeping provider may store and administer retained XP records on Cube’s behalf, subject to applicable contractual restrictions and safeguards. Such custody does not by itself authorize the provider to use the records for its own program. If an independent project later proposes to recognize past participation, we may consider limited verification or disclosure of relevant XP information and associated account or wallet identifiers under separate arrangements. Before sharing, we will tell affected users who will receive what information and why, establish an applicable lawful basis, and obtain any consent required by law. An independent project using information for its own program is responsible for its separate processing and program terms. Accepting the Terms does not authorize unrestricted disclosure or replace consent that must be obtained separately.

Public blockchain disclosures are addressed separately below.

5. Public Blockchain Records

When you authorize an onchain transaction, wallet addresses, transaction details, and other submitted data may become publicly accessible, be copied by others, and persist on networks outside our control. Connecting an account to a wallet or associating wallets may reveal relationships between them. Do not put confidential or unnecessary personal information into an onchain field.

We generally cannot change or erase a confirmed record on an independently operated public blockchain or copies held by others. This technical limitation does not eliminate our duties concerning information we control, including offchain account associations, support records, and hosted data. We will assess a rights request on its facts and explain any legally permitted limitation. Ending Migration Hub or explorer access does not remove publicly replicated blockchain records.

6. Cookies, Analytics, and Marketing Choices

Cookies and similar technologies may be used for authentication, security, preferences, and service operation. Nonessential analytics or advertising technologies, if used, will be identified and enabled only with the choice or consent required by applicable law. You may use the available privacy controls for the relevant Covered Service and relevant browser controls; disabling essential storage may affect a requested feature. We will honor legally recognized opt-out preference signals where applicable.

We will seek any consent required for promotional messages and provide an effective unsubscribe mechanism. Operational notices may still be sent where lawful.

7. Retention, Wind-Down, and Security

We retain personal information only for as long as reasonably necessary for the disclosed purposes, taking account of service availability, transaction completion, support needs, applicable limitation periods, legal retention duties, and properly scoped preservation obligations. We do not retain every category indefinitely merely because a dispute is possible. Access is limited according to role, and we use reasonable technical and organizational measures appropriate to the information and risks. No system can guarantee absolute security.

Account associations and migration records are retained while needed for requested features, pending transactions, and related support, then deleted or de-identified unless a defined legal or other disclosed need remains. For a user entitled to the XP recordkeeping commitment under the Migration Terms or Abstract Portal Terms of Service, Cube retains the existing XP record and associated account identifiers offchain until six calendar months after the Service Discontinuation Date for the Abstract blockchain, subject to a valid deletion request that Cube is required to honor or earlier deletion required by applicable law or a binding privacy commitment. The same retention period applies whichever agreement was accepted first; accepting both does not restart it. Record retention does not promise continued display or user-interface access. After that period, XP information is deleted or de-identified unless a defined legal or other disclosed need requires further retention. Support and screening records are retained for resolution and applicable compliance or claims requirements. Security logs are retained for a period proportionate to investigating and preventing incidents. Terms, notice, consent, and opt-out records may be retained for the relevant enforcement or claims period, with periodic review. Public versions of documents can be retained without publishing user identities.

Discontinuation of the Migration Hub or Abstract blockchain does not automatically require deletion of every record or justify keeping every record indefinitely. Where deletion is appropriate, we delete or de-identify information, subject to lawful, limited preservation and backup cycles. Backup data awaiting deletion remains protected and restricted from ordinary use. Privacy requests remain available through Section 12 of this Privacy Policy after service closure.

8. International Processing

Cube is based in the United States, and the Foundation is organized in the Cayman Islands. Information may be processed where the relevant personnel and providers operate. Those jurisdictions may have different data-protection laws.

Where required, we will use a lawful transfer mechanism and appropriate safeguards before a restricted transfer, such as an applicable adequacy decision, approved standard contractual clauses and supplementary measures, or the appropriate UK transfer instrument. Any reliance on a consent or other exception will meet the applicable conditions. For other jurisdictions, we will comply with applicable comparable-protection, notice, consent, localization, or transfer requirements. Use the contact details in Section 12 of this Privacy Policy to request information about the safeguards applicable to your information and a copy where required, with necessary confidential information redacted.

9. Your Rights and Requests

Depending on applicable law and our processing, you may have rights to know or access personal information and obtain a copy; correct inaccurate information; request deletion; obtain portability; restrict or object to processing, including certain processing based on legitimate interests; withdraw consent; opt out of sale, sharing, targeted advertising, or certain profiling; limit qualifying uses of sensitive information; and appeal a refusal where an appeal right applies. These rights are subject to applicable conditions and exceptions. We will explain a refusal or limitation and available review or complaint options where required.

Submit a request to [email protected]. We may request information reasonably necessary to verify identity, wallet control where relevant, or an authorized agent’s authority, using a method proportionate to the request. Do not send private keys or recovery secrets. We will respond within the applicable legal period and explain any permitted extension. We will not unlawfully discriminate or retaliate against you for exercising privacy rights. You may complain to the competent data-protection authority or other regulator. Where provided by law, you may appeal by contacting [email protected].

10. Children

Some users may be minors. We handle personal information relating to minors in accordance with applicable law. Where a particular collection, use, or disclosure requires verified parental consent, we will obtain that consent before the processing occurs, unless a lawful exception applies. Acceptance of the Migration Terms does not replace that consent. A parent or guardian may contact us using the details in Section 12 of this Privacy Policy about a child’s information or applicable access, deletion, or consent rights. If we learn that information has been collected without consent required by law, we will take the legally required corrective action.

11. Changes to This Policy

We will date each version and provide notice of material changes through the Official Channels identified in Section 21 of the Migration Terms and through direct communications where required by law or otherwise appropriate and available before the changes take effect or as otherwise required by law. We will provide any required notice at or before collection and obtain consent where a new purpose or disclosure requires it. A posted update, continued use, or contractual acceptance does not override an earlier binding privacy commitment or supply consent that applicable law requires us to obtain separately. Dated versions of this document, including this Privacy Policy, will remain available through the same page as these Migration Terms.

12. Privacy Contact and Post-Closure Requests

Cube, Inc.
Privacy requests and questions: [email protected]
Appeals, where applicable: [email protected]
Post-closure privacy contact: [email protected]

We will maintain a functioning privacy contact for as long as we retain personal information subject to continuing obligations, and provide notice of a material contact or responsible-entity change where required. The Migration Terms’ arbitration and liability provisions do not waive privacy rights or regulatory remedies that cannot lawfully be waived.