Privacy Policy

Effective Date: July 27, 2026

This Privacy Policy describes how Magic Labs, Inc., doing business as Newton Labs (“Newton Labs,” “we,” “us,” or “our”) collects, uses, and shares information in connection with our website located at newton.xyz (the “Website”), VaultKit, the Gateway, the Consumer App (agents.newton.xyz and staking.newton.xyz), and any other Product or Service that references this Privacy Policy (collectively, the “Services”). Capitalized terms not defined in this Privacy Policy have the meanings given in the Newton Labs Terms of Service (the “Terms of Service”).

1. Scope; Relationship to Newton Foundation, Newton Protocol, and Third-Party Wallet Infrastructure

This Privacy Policy applies only to Newton Labs's own operation of the Services. Newton Protocol is stewarded by Newton Foundation, an entity independent of and not affiliated with Newton Labs. This Privacy Policy does not describe Newton Foundation's or Newton Protocol's data practices, which are addressed in Newton Foundation's own privacy notices.

If you use the Newton Wallet option within the Consumer App, the underlying wallet infrastructure is provided by a third party unaffiliated with Newton Labs, as described in the Terms of Service. That third party's own privacy practices govern its handling of your wallet credentials, authentication data, and any information you provide to it directly.

2. Definitions

“Personal Information” or “Personal Data” means information that identifies, relates to, describes, or could reasonably be linked, directly or indirectly, with a particular individual.

“Aggregated Information” means Personal Information that has been combined with information about other individuals such that it no longer identifies or is reasonably linkable to any particular individual.

“De-Identified Information” means information that has been altered so that it can no longer reasonably be used to infer information about, or otherwise be linked to, a particular individual.

“Sensitive Personal Information” has the meaning given to that term (or the equivalent term “sensitive personal data” or “special category data”) under applicable law.

3. Information We Collect

3.1 Developer and Customer Data

If you register for a Newton Labs account, access VaultKit, use the Gateway, or otherwise interact with us as a developer or vault curator, we may collect:

Account and registration information, such as your name, email address, company name, and billing information;
Secrets, meaning API credentials or keys you upload to the Gateway for use by Newton Protocol operators during Policy evaluation;
Policy and Policy Pack configuration data you create using a Product;
Device Information, such as your IP address, device identifiers, browser and system information, and cookie identifiers;
Voluntary Information you choose to share with us, such as feedback, survey responses, or event or webinar registration details;
Usage, log, and diagnostic data relating to your access to the Services, such as API call metadata;

Secrets are limited to API credentials and related connection information used by data provider oracles during Policy evaluation (for example, an indexer API key or endpoint URL), and are distinct from the identity or KYC-related data handled through Newton Protocol's separate identity and credential mechanisms. Secrets are encrypted before they reach Newton Labs, and Newton Labs cannot read their contents. Newton Labs does not treat Secrets as Personal Information.

3.2 Consumer App Data

If you use the Consumer App, we may collect:

Your public Wallet address, whether associated with a Newton Wallet or an External Wallet;
Configuration inputs for Agent Services (for example, scheduled buy or sell parameters) and NEWT Staking activity;
Device Information, such as your IP address, device identifiers, browser and system information, and cookie identifiers;
Voluntary Information you choose to share with us, such as feedback or survey responses;
Usage and analytics data relating to your access to the Consumer App;
Contact information you provide if you contact us for support.

3.3 What We Do Not Collect

We do not collect or have access to your Private Key, seed phrase, or wallet authentication credentials, whether you use a Newton Wallet or an External Wallet. Authentication for a Newton Wallet is handled entirely by its third-party infrastructure provider, and authentication for an External Wallet is handled entirely by its provider.

3.4 Data We Process in Connection with Newton Protocol (Gateway and Data Oracle Role)

In connection with the Gateway and any data oracle or risk-scoring services we provide to support Policy evaluation, Newton Labs may process data about individuals who are not our own account holders, for example, end users of a vault curator's application. We process this data solely as necessary to provide the Gateway and related services to our developer customers, at their direction and for their purposes, and not for any independent purpose of our own. Any consent, notice, or other legal basis necessary for this processing is established through the relationship between you and the developer or vault curator whose application or vault you are using, and not through a direct relationship between you and Newton Labs.

4. How We Use Information

We use the information described in Section 3 to:

Provide, maintain, and improve the Services;
Create and manage your account and provide customer or developer support;
Communicate with you about the Services, including security or policy notices;
Detect, investigate, and prevent fraud, abuse, and security incidents;
Comply with applicable law and enforce our Terms of Service;
Conduct research and development related to the Services and other Newton Labs products;
Marketing- or promotional-communications;
Produce Aggregated Information or De-Identified Information for any purpose, including improving and developing the Services and other Newton Labs products, consistent with Section 7.2 of the Terms of Service.

5. How We Share Information

We may share information described in Section 3 with:

Service providers who perform services on our behalf, such as cloud hosting, analytics, and customer support providers, subject to confidentiality and data protection obligations;
Newton Protocol operators, limited to the Secrets necessary for Policy evaluation as described in the Terms of Service;
Professional advisors, regulators, or law enforcement where required by law or to protect our rights or the safety of our users;
The third-party wallet infrastructure provider in connection with the Newton Wallet;
A successor entity in connection with a merger, acquisition, reorganization, or sale of assets, which will assume the rights and obligations described in this Privacy Policy.

6. Cookies and Tracking Technologies

The Website and Consumer App may use cookies and similar tracking technologies to operate the Services and to understand how they are used.

7. Your Choices

You may update your account information by contacting us at the address in Section 11. You may control cookies and similar tracking technologies through your browser or device settings. You may opt-out of any marketing- or promotional-communications from Newton Labs by utilizing the “unsubscribe” or similar functionality.

8. Data Retention and Security

We retain information described in Section 3 for as long as necessary to provide the Services, comply with legal obligations, resolve disputes, and enforce our agreements. We use administrative, technical, and physical safeguards designed to protect information from unauthorized access, use, or disclosure. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Certain information cannot be deleted once recorded, including transaction and Staking activity recorded on a public blockchain. Where you exercise a deletion or erasure right described in Section 12 or Section 13, we will delete the applicable information from our own systems where feasible, but cannot alter or remove immutable on-chain records.

9. Children's / Minimum Age Policy

The Services are not directed to individuals under 18 years of age (or the age of legal majority in your jurisdiction), and we do not knowingly collect Personal Information from individuals under that age. If you believe a child has provided us with Personal Information, please contact us at the address in Section 11.

10. Changes to This Policy

We may modify this Privacy Policy at any time by posting the modified policy on the Website. Modifications are effective when posted. Your continued use of the Services after a modification is posted constitutes your acceptance of the modified policy.

11. Contact Information

Questions about this Privacy Policy may be directed to [email protected].

12. U.S. State Privacy Notice

This Section 12 supplements the rest of this Privacy Policy and applies to residents of U.S. states with comprehensive privacy laws, including the California Consumer Privacy Act, as amended by the California Privacy Rights Act (the “CCPA”), and similar laws in other states such as Colorado, Connecticut, Virginia, and Utah (collectively, “U.S. State Privacy Laws”). Rights and terminology vary by state; this Section uses CCPA terms for convenience, and the rights below are extended to residents of other states to the extent required by their applicable law.

12.1 Categories of Personal Information We Collect

In the preceding twelve (12) months, we have collected the following categories of Personal Information, as defined by the CCPA:

Identifiers (name, email address, IP address, device identifiers, wallet address);
Commercial information (billing information, transaction activity, Staking activity, and Agent Services configuration);
Internet or other electronic network activity information (browser and system information, cookie identifiers, usage, log, and analytics data);
Professional or employment-related information (company name, role, for developer accounts);
Geolocation data (approximate, derived from IP address);
Other information you voluntarily provide (feedback, survey responses, event or webinar registration details, and the content of your support communications with us).

Secrets, as described in Section 3.1, are not treated as Personal Information and are not included in the categories above.

12.2 Your CCPA Rights and Choices

a. Right to Know. You have the right to request that we disclose the categories and specific pieces of Personal Information we have collected about you, the categories of sources, the business or commercial purpose for collecting it, and the categories of third parties with whom we share it.

b. Right to Delete. You have the right to request that we delete Personal Information we have collected from you, subject to certain exceptions.

c. Right to Opt-Out of Sale or Sharing of Personal Information. We do not sell or share Personal Information for money. (as those terms are defined under CCPA)

d. Right to Correct. You have the right to request that we correct inaccurate Personal Information we maintain about you.

e. Right to Limit Use and Disclosure of Sensitive Personal Information. You have the right to limit our use and disclosure of Sensitive Personal Information to purposes necessary to perform the Services.

f. Right to Non-Discrimination. We will not discriminate against you for exercising any of your rights under this Section 12.

g. Right to Opt Out of Profiling. Where applicable under your state's law, you have the right to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects concerning you.

h. Exercising Your Rights. You may exercise your rights by contacting us at the address in Section 12.4. We will verify your request using information associated with your account or otherwise reasonably available to us, and will respond within the time required by applicable law.

i. Right to Appeal. Where applicable under your state's law, if we decline to act on your request, you have the right to appeal our decision. We will respond to an appeal within the time required by applicable law, and will explain in writing the reasons for our decision.

j. Authorized Agent. You may designate an authorized agent to exercise these rights on your behalf, subject to our ability to verify the agent's authority and your identity.

12.3 Changes to This Notice

We may update this Section 12 from time to time consistent with Section 10.

12.4 Contact Information

548 Market St., PMB 31387, San Francisco, California 94104-5401
[email protected]
+1 (707) 653-5739

13. European (GDPR/UK) Addendum

This Section 13 (this “Addendum”) supplements the rest of this Privacy Policy and applies to individuals in the European Economic Area, the United Kingdom, and Switzerland, to the extent their Personal Data is subject to the General Data Protection Regulation, the UK GDPR, or Swiss data protection law (collectively, “European Data Protection Law”).

13.1 Types of Personal Data We Collect

See Section 3 of this Privacy Policy.

13.2 Legal Bases for Processing

We process your Personal Data on the following legal bases, as applicable:

a) Your Consent. Where you have given consent, for example to receive marketing communications, if applicable.

b) Contractual Necessity. Where processing is necessary to perform the Terms of Service or to take steps at your request before entering into them.

c) Legitimate Interests. Where processing is necessary for our legitimate interests, such as securing the Services, preventing fraud, and improving our products, provided those interests are not overridden by your rights.

d) Legal Obligation. Where processing is necessary to comply with applicable law, including sanctions and anti-money laundering obligations described in the Terms of Service.

13.3 How We Share Your Personal Data

See Section 5 of this Privacy Policy.

13.4 How We Store and Protect Your Personal Data

See Section 8 of this Privacy Policy.

13.5 Your Data Protection Rights

Subject to applicable law and certain exceptions (e.g., see Section 8 regarding immutable blockchain records), you have the right to: access your Personal Data; request rectification of inaccurate Personal Data; request erasure of your Personal Data; restrict or object to our processing of your Personal Data; request portability of your Personal Data; withdraw consent where processing is based on consent; and not be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning you or similarly significantly affects you.

Policy evaluation performed using Newton Protocol is conducted entirely through automated processing. No individual Policy evaluation is reviewed by a person before an Attestation is produced or before a transaction is approved or blocked. Where a Policy implements a legally required control, such as sanctions or anti-money laundering screening, it relies on that processing being authorized by the law requiring the control, consistent with the safeguards that law provides, rather than on a right to obtain human intervention in an individual evaluation. Where a Policy is not itself legally required, for example a spend limit, allowlist, or other configuration chosen by a developer or vault curator, the ability to offer human intervention, or to contest a specific evaluation, may be limited or unavailable given the automated design of Newton Protocol.

13.6 International Transfers of Personal Data

The Services are hosted and operated in the United States (“U.S.”) through Newton Labs and its service providers, and if you do not reside in the U.S., laws in the U.S. may differ from the laws where you reside. By using the Services, you acknowledge that any Personal Data about you, regardless of whether provided by you or obtained from a third party, is being provided to Newton Labs in the U.S. and will be hosted on U.S. servers, and you authorize Newton Labs to transfer, store and process your information to and in the U.S., and possibly other countries. In these cases, we transfer your Personal Data through the use of appropriate safeguards as required by European Data Protection Laws.

13.7 How to Complain

You have the right to lodge a complaint with your local data protection supervisory authority. Please refer to our contact information below.

13.8 Updates to This Addendum

We may update this Addendum from time to time consistent with Section 10.

13.9 Our Contact Information

Please reach out to [email protected] for any questions, complaints, or requests regarding this European Addendum, and include in the subject line “European Data Protection Request.”

If you are located in the EU, United Kingdom, Lichtenstein, Norway, Iceland, or Switzerland, you may use the following information to contact our representative:

Dr. Axel Freiherr von dem Bussche, LL.M. (L.S.E.)
Rechtsanwalt Fachanwalt für Informationstechnologierecht
Assistant: +49 40 36803-229
Direct: +49 40 36803-129
Mobile: +49 16 090169-493
Email: [email protected]
With:
Taylor Wessing Partnerschaftsgesellschaft mbB
Address: Hanseatic Trade Center, Am Sandtorkai 41, 20457 Hamburg
Tel: +49 40 36803-0
Fax: +49 40 36803-280
Site: https://www.taylorwessing.com/