Privacy Policy
Version 1.2 | Effective date: 15 September 2026 | Last updated: 9 October 2026
1. Who we are
This Privacy Policy (the "Policy") explains how 4Lark Co., Ltd., a company incorporated in the Cayman Islands (Company No. 422395) ("PLUX", "we", "us" or "our"), collects, uses, stores, shares and otherwise processes personal information when you use the PLUX mobile application, website and related services (together, the "Services").
4Lark Co., Ltd.
Suite 102, North Sound Road, George Town, Grand Cayman KY1-9006, Cayman Islands
Privacy enquiries: [email protected]
We are the data controller of the personal information described in this Policy. Third parties that provide services to us (for example, our custody, blockchain infrastructure and technology service providers) act as our processors or, where stated, as independent controllers of the information they receive.
Please read this Policy carefully. By using the Services, you acknowledge that you have read and understood it. Where applicable law requires your consent for a particular processing activity, we will request it separately. If you do not agree with this Policy, please do not use the Services.
2. Scope
This Policy applies to all users of the Services, wherever they are located. If the law of your country or region grants you additional rights, Section 14 applies in addition to the rest of this Policy.
This Policy does not apply to:
- websites, applications or services operated by third parties, even if you reach them through the Services; or
- the PLUX Wallet service operated in the Republic of Korea, which is governed by its own privacy policy.
3. Information we collect
3.1 Information you provide to us
| Category | Examples | When collected |
|---|---|---|
| CategoryAccount registration | ExamplesEmail address or mobile phone number; password (stored in hashed form); referral code; language and display currency preferences | When collectedWhen you create or manage your account |
| CategorySecurity settings | ExamplesVerified email address and phone number | When collectedWhen you configure security features |
| CategoryAddress book | ExamplesBlockchain addresses and labels you save | When collectedWhen you add a recipient |
| CategoryReferral programme | ExamplesYour referral code and referral link; for users you refer, their user ID and sign-up date | When collectedWhen you use the referral feature |
| CategorySupport and communications | ExamplesThe content of messages you send us, and any attachments | When collectedWhen you contact us |
If you provide us with personal information about another person (for example, a recipient in your address book), you confirm that you are entitled to do so and that the person has been informed of this Policy.
3.2 Information collected automatically
| Category | Examples |
|---|---|
| CategoryDevice information | ExamplesDevice model, operating system and version, app version, browser or user-agent string, unique device identifiers, language settings |
| CategoryLogin and security records | ExamplesIP address, login date and time, country or region estimated from your IP address, device used, login method, failed login attempts |
| CategoryTransaction records | ExamplesDeposits, withdrawals, Earn product subscriptions and redemptions, including amounts, assets, blockchain addresses and transaction hashes |
| CategoryUsage information | ExamplesScreens viewed, features used, interactions with notifications, crash reports and performance data |
| CategoryCookies and similar technologies | ExamplesOn our website, we use cookies and similar technologies to keep you signed in, remember your preferences and understand how the website is used. You can control cookies through your browser settings; disabling them may affect some features. |
3.3 Information we receive from third parties
- IP geolocation provider — the country or region estimated from your IP address.
- Public blockchains — transaction data that is publicly recorded on the relevant blockchain.
3.4 Information we do not collect
We do not knowingly collect personal information from anyone under 18 years of age (Section 12), and we do not collect your precise device location.
4. How we use your information
| Purpose | Information used |
|---|---|
| PurposeProviding the Services | Information usedCreating and maintaining your account; processing deposits, withdrawals and Earn subscriptions and redemptions — using account, transaction, device and security information |
| PurposeLegal compliance | Information usedComplying with anti-money laundering (AML), counter-terrorist financing (CTF), sanctions, tax and other legal obligations — using account, transaction and device information |
| PurposeAccount security and fraud prevention | Information usedDetecting unauthorised access, fraud and suspicious activity; managing your sessions and devices — using login records, device information, security settings and transaction records |
| PurposeCommunicating with you | Information usedSending transaction notifications, security alerts and service announcements; responding to support requests — using contact details and account information |
| PurposeReferral programme | Information usedOperating and administering referrals and related rewards — using referral codes and referred user IDs |
| PurposeImproving the Services | Information usedAnalysing usage, diagnosing and fixing errors, developing new features — using usage and device information, aggregated or pseudonymised where possible |
| PurposeMarketing | Information usedInforming you about PLUX products, promotions and events, where permitted by law or with your consent — using contact details and usage information |
| PurposeLegal purposes | Information usedResponding to lawful requests from regulators, law enforcement and courts; establishing, exercising or defending legal claims; enforcing our terms — using any relevant information |
We do not sell your personal information.
Automated processing. We use automated systems for sanctions screening, fraud detection and transaction monitoring. Where a decision based solely on automated processing would have a legal or similarly significant effect on you, you may request human review of that decision, subject to applicable law.
Aggregated and de-identified information. We may create aggregated or de-identified information that can no longer reasonably be linked to you, and we may use and share such information for any purpose.
5. Legal bases for processing
Where applicable law requires us to have a legal basis for processing your personal information, we rely on the following:
- Performance of a contract — to provide the Services you have requested under our Terms of Service.
- Legal obligation — to comply with AML/CTF, sanctions, tax, record-keeping and other regulatory requirements.
- Legitimate interests — to secure the Services, prevent fraud, improve our products and communicate with you, where those interests are not overridden by your rights and freedoms.
- Consent — for marketing communications and any other processing for which consent is required by law. You may withdraw consent at any time; withdrawal does not affect the lawfulness of processing carried out before withdrawal, and may mean that we can no longer provide certain Services to you.
6. How we share your information
We share personal information only as described below.
| Recipient | Purpose |
|---|---|
| RecipientCustody, liquidity and blockchain infrastructure providers | PurposeExecuting deposits and withdrawals; safeguarding digital assets |
| RecipientBlockchain analytics providers | PurposeScreening blockchain addresses for illicit-finance risk |
| RecipientTechnology service providers | PurposeCloud hosting, software development and maintenance, analytics, crash reporting, push notifications and customer support tools |
| RecipientAffiliated companies | PurposeOperating and supporting the Services under standards no less protective than this Policy |
| RecipientRegulators, law enforcement and courts | PurposeWhere required by law, regulation, legal process or an enforceable governmental request, or where we believe disclosure is necessary to protect our rights, your safety or the safety of others |
| RecipientBusiness transfers | PurposeIn connection with a merger, acquisition, financing, restructuring or sale of all or part of our business or assets, subject to appropriate confidentiality protections |
Service providers may use your personal information only to provide services to us and are bound by contractual confidentiality and security obligations.
Other users. When you share your referral code, users who sign up with it will see that code.
Public blockchains. Transactions on public blockchains are, by their nature, public and permanent. Blockchain addresses and transaction details recorded on a blockchain are visible to anyone and cannot be altered or deleted by us.
7. International transfers
We operate from the Cayman Islands. Your personal information is stored on servers located in Singapore and may be accessed by our service providers and affiliated companies in other countries for the purposes described in this Policy, including software development, customer support and compliance.
Where we transfer personal information out of a jurisdiction that restricts international transfers (including the Cayman Islands, the European Economic Area and the United Kingdom), we rely on safeguards recognised under the law of that jurisdiction — such as standard contractual clauses, an adequacy decision, or your explicit consent — and we require recipients to protect your information in a manner consistent with this Policy.
8. How long we keep your information
We retain personal information only for as long as necessary to fulfil the purposes described in this Policy, after which we delete or anonymise it. The following retention periods apply unless a longer period is required by law:
| Category | Retention period |
|---|---|
| CategoryAccount information | Retention periodFor the life of your account, and thereafter as required below |
| CategoryTransaction records, and other records required under AML/CTF law | Retention periodFive (5) years from the closure of your account or the date of the relevant transaction, whichever is later, as required by applicable AML/CTF regulations |
| CategoryLogin and device records | Retention periodTwenty-four (24) months from the date of the record |
| CategorySupport communications | Retention periodThree (3) years from the closure of the request |
| CategoryMarketing preferences | Retention periodUntil you withdraw consent or object |
We may retain information for a longer period where required by law, by a regulator or court, or where reasonably necessary to establish, exercise or defend legal claims.
9. Security
We implement technical and organisational measures designed to protect your personal information against unauthorised access, loss, alteration and disclosure. These include encryption in transit and at rest, hashed password and passcode storage, two-factor authentication, and access controls that limit who within our organisation and our service providers may access your information.
No system is completely secure. You are responsible for keeping your login credentials and passcode confidential. If you suspect unauthorised access to your account, please notify us immediately at [email protected]. If a security incident affecting your personal information occurs, we will notify you and the relevant authorities where required by law.
10. Your rights
Subject to applicable law, you have the right to:
- Access the personal information we hold about you and receive information about how we process it.
- Correct personal information that is inaccurate or incomplete. Certain information can be updated directly in the app under Account and Security Center.
- Delete your personal information. You may request deletion of your account and personal information by contacting us at [email protected]. After verifying your identity, we will delete or anonymise your information within the period required by applicable law, except where we are required or permitted to retain it (Section 8). Information recorded on a public blockchain cannot be deleted.
- Restrict or object to certain processing, including processing for direct marketing purposes.
- Data portability — receive certain personal information in a structured, commonly used and machine-readable format.
- Withdraw consent at any time where processing is based on your consent.
- Lodge a complaint with a supervisory authority in your jurisdiction.
To exercise any of these rights, contact us at [email protected]. We may ask you to verify your identity before responding. We will respond within the time required by applicable law and, in any event, generally within 30 days. We may decline requests that are manifestly unfounded or excessive, or where retention is required by law, and we will explain the reason for any refusal.
11. Marketing and notifications
Service notifications. The app sends push notifications for transaction confirmations, security alerts and service announcements. You can manage notification preferences in the app settings and in your device settings. Security and service communications are not marketing and cannot be opted out of while you hold an account.
Marketing communications. Where permitted by law, we may send you information about PLUX products, promotions and events by email, SMS or push notification. You may opt out at any time by following the unsubscribe instructions in the message, adjusting your notification settings, or contacting us at [email protected].
12. Children
The Services are not intended for, and may not be used by, anyone under 18 years of age. We do not knowingly collect personal information from minors. If you believe that a minor has provided us with personal information, please contact us and we will delete it.
13. Third-party services and links
The Services may contain links to third-party websites and services. We are not responsible for the privacy practices of third parties, and this Policy does not apply to their processing of your information. We encourage you to review their privacy policies before providing them with any information.
14. Additional information for specific regions
European Economic Area, United Kingdom and Switzerland. You have the rights described in Section 10 under the General Data Protection Regulation (GDPR), the UK GDPR and the Swiss Federal Act on Data Protection. Our legal bases for processing are described in Section 5. You may lodge a complaint with your local data protection authority.
United States. Depending on your state of residence, you may have the right to know, access, delete and correct your personal information, and to opt out of the sale or sharing of personal information for targeted advertising. We do not sell personal information and do not share it for cross-context behavioural advertising.
Japan. Where the Act on the Protection of Personal Information applies to our handling of your personal information, we comply with its requirements, including those relating to the provision of personal information to third parties and cross-border transfers.
Cayman Islands. We are subject to the Data Protection Act (as revised) of the Cayman Islands. You may lodge a complaint with the Office of the Ombudsman of the Cayman Islands.
15. Changes to this Policy
We may update this Policy from time to time to reflect changes in our practices, the Services or applicable law. We will notify you of material changes through the app or by email before they take effect. The "Last updated" date at the top of this Policy indicates when it was last revised. Your continued use of the Services after a change takes effect constitutes your acceptance of the revised Policy.
16. Contact us
If you have questions, concerns or requests relating to this Policy or our handling of your personal information, please contact us:
4Lark Co., Ltd.
Suite 102, North Sound Road, George Town, Grand Cayman KY1-9006, Cayman Islands
Email: [email protected]
© 2026 4Lark Co., Ltd. All rights reserved. This Policy is issued in English. If it is translated into other languages, the English version prevails in the event of any inconsistency.