Opinion Foundation Privacy Policy

Last Updated: February 26, 2026

Opinion Foundation ("Opinion," "we," "us," or "our") is committed to handling information about you in a transparent, minimal, and security‑conscious way. This Privacy Policy explains what information we collect when you visit or use our website and related services, why we collect it, how we share it, and what choices and rights you may have.

If you interact with blockchain features, please note that blockchain transactions and wallet addresses may be publicly visible and may be difficult or impossible to delete once recorded on‑chain.

Scope and applicability

This Privacy Policy applies to:

• the Opinion Foundation website located at opinion.foundation (the "Website"); and
• any online services we operate or make available that link to this Privacy Policy, including newsletters, event registrations, grant or funding applications, community programs, and similar initiatives (collectively, the "Services").

This Privacy Policy does not apply to third‑party websites, products, services, wallets, exchanges, or social platforms that we do not control, even if they are linked to from our Website.

Information we collect

We may collect the following categories of information, depending on how you interact with us:

Personal Data

Examples may include:

• identifiers and contact details (such as name, email address, phone number, organization, role, country/region);
• application and program information (such as grant/funding proposals, project descriptions, attachments, and related communications);
• event registration and participation information (such as RSVP details, attendance confirmation, and feedback);
• communications content (such as questions or messages submitted via email or forms);
• compliance information (only if required for a specific program), such as identity verification information needed to comply with sanctions, anti‑fraud, or other legal requirements.

We do not request your wallet seed phrase or private keys. Please do not share those with anyone.

Usage Data

When you access our Website, our servers and service providers may automatically collect:

• IP address (and/or a truncated or pseudonymized form), device identifiers, browser type, operating system, language settings;
• pages viewed, time spent, referring URL, clickstream data;
• security and diagnostics logs.

Cookies and similar technologies

We may use cookies, pixels, SDKs, and similar technologies for:

• strictly necessary functions (e.g., security, load balancing, session management);
• preferences (e.g., remembering settings);
• analytics (e.g., understanding aggregated Website performance);
• marketing/advertising effectiveness measurement.

You can control cookies through your browser settings. If we deploy non‑essential cookies, we will present a cookie banner and allow you to manage preferences through a "Cookie Settings" link.

Third‑party data

We may receive information from third parties where permitted, for example:

• social media or developer platforms where you engage with our public pages;
• event partners or program partners, if you register through them or authorize them to share information with us;
• service providers assisting with compliance checks (where applicable).

On‑chain and public blockchain data

If the Services enable blockchain interactions, we may collect or observe:

• wallet addresses;
• transaction hashes, timestamps, and other transaction metadata; and
• publicly available on‑chain information related to your interactions with the blockchain.

Important: Public blockchains are typically operated by decentralized third parties. On‑chain information may be public and may be immutable. We generally cannot delete or modify on‑chain records, and certain privacy rights may be technically limited for on‑chain data.

Legal bases for processing

Where a specific data protection law applies (such as GDPR‑style laws), we rely on one or more of the following legal bases, as appropriate:

• Consent (e.g., optional cookies; newsletter subscriptions; certain community communications)
• Contract / steps at your request (e.g., processing an application you submit; providing Services you request)
• Legal obligation (e.g., sanctions screening or other compliance requirements where applicable)
• Legitimate interests (e.g., securing and improving our Website; preventing fraud; ensuring network and information security; responding to communications)
• Vital interests / public task (rare; only where applicable under law)

Purposes of processing

We may use the information we collect to:

• provide, operate, and maintain the Website and Services;
• administer programs (including grants, events, and community initiatives);
• communicate with you (including responding to requests and sending operational notices);
• send newsletters or updates you request (and process unsubscribes);
• monitor and improve Website performance and user experience;
• protect the security and integrity of our systems, prevent misuse, and detect fraud;
• comply with applicable law, enforce our terms, and protect our rights and the rights of others.

Sharing and disclosure of information

We may share information in the following circumstances:

Service providers and processors

We may share information with vendors that help us operate the Services, such as:

• hosting and cloud providers;
• analytics and security providers;
• communications and email delivery providers;
• customer support tools;
• professional advisors (auditors, legal counsel) as needed.

These providers are authorized to process information only for the purposes we specify and subject to appropriate contractual safeguards.

Analytics providers

If we use analytics, we may share limited usage data with analytics providers (and configure settings to reduce collection where feasible, such as IP anonymization).

Legal requests and protection of rights

We may disclose information if we believe disclosure is required by law or necessary to:

• comply with legal process or binding governmental requests;
• enforce applicable terms;
• investigate and prevent fraud, security incidents, or technical issues; or
• protect the rights, property, or safety of Opinion, our users, or others.

Corporate transactions

We may share information in connection with a merger, acquisition, reorganization, asset sale, financing, or similar transaction, including during due diligence.

Aggregated or de‑identified information

We may share information that is aggregated or de‑identified so it cannot reasonably be used to identify you.

International transfers and safeguards

We may process and store information in multiple countries. Where cross‑border transfers are restricted by law, we will use appropriate safeguards, which may include:

• adequacy decisions recognized by relevant authorities;
• the European Commission's Standard Contractual Clauses (SCCs);
• UK transfer mechanisms such as the IDTA or the Addendum (where applicable); and/or
• other lawful transfer mechanisms recognized by applicable law.

You may contact us to request information about available safeguards.

Data retention

We retain information only as long as reasonably necessary for the purposes described in this Privacy Policy, including:

• to provide the Services and maintain our relationship with you;
• to comply with legal obligations;
• to resolve disputes and enforce agreements; and
• to maintain security logs and records for risk management.

Retention periods may vary depending on the type of data and the purposes for which it is processed. Where feasible, we will delete, de‑identify, or anonymize data at the end of retention periods.

On‑chain data note: Blockchain records may persist indefinitely and may not be deleted by us.

Your rights and how to exercise them

Depending on your location, you may have certain rights regarding your personal data, such as:

• access and obtaining a copy;
• correction of inaccurate information;
• deletion (subject to legal requirements and technical feasibility);
• restriction of processing;
• objection to processing (especially where based on legitimate interests);
• data portability (where applicable);
• withdrawal of consent (where processing is based on consent);
• submitting complaints to a data protection authority (where available under law).

To exercise your rights, contact us using the details in the "Contact details" section below. To protect your privacy and security, we may verify your identity before responding.

Security measures

We implement reasonable technical and organizational safeguards designed to protect information against unauthorized access, loss, misuse, alteration, or disclosure. These measures may include access controls, encryption in transit, logging and monitoring, vendor risk management, and staff training. However, no method of transmission or storage is perfectly secure, and we cannot guarantee absolute security.

Children's data

The Services are not directed to children. You must be at least the age of majority in your jurisdiction and at least 18 years old to use Services that involve blockchain features, grants, or other programs unless we explicitly state otherwise. If we learn that we have collected personal data from a child in violation of applicable law, we will take steps to delete or de‑identify the information, subject to legal obligations.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time. We will post the updated version with a new "Last Updated" date. If changes are material, we may provide additional notice as required by applicable law.

Contact details

For questions, requests, or complaints about privacy, please contact:

Opinion Foundation info@opinion.foundation