Cactus Privacy Policy

Last Updated: July 24, 2026

We take privacy seriously. The purpose of this document is to provide you with information on ScopeLift’s, a Pennsylvania company ("ScopeLift," the "Company," "us," "our," and "we"), use of your personal data in accordance with applicable law, including, but not limited to, the California Consumer Privacy Act (as amended), other applicable U.S. state privacy laws, and, in respect of any EU or UK data subjects, the EU and UK General Data Protection Regulation (together, the "Data Protection Legislation").

If you access or use the Platform, ScopeLift will ask for, collect, and store Personal Data about you (your "Personal Data"). We would not be able to provide the Platform without the Personal Data you provide us, which is why we want you to know that we take our responsibility to protect your Personal Data very seriously.

This document (our "Privacy Policy") explains how we collect and use your Personal Data, how and with whom we share your Personal Data, and how we protect your Personal Data. This Privacy Policy applies to our website located at tally.xyz and the Platform, and is subject to the Cactus Terms of Service available at https://terms.tally.xyz.

If you do not want us to collect Personal Data from you or share Personal Data with any third parties or otherwise disclose your Personal Data, you should not use or access the Platform. By accessing or using the Platform, you consent to the collection, use, and disclosure of your Personal Data as described in this Privacy Policy.

1. Personal Data We Collect

In the table below, we provide the list of categories of Personal Data that ScopeLift has collected within the last twelve months, along with examples, sources, and purposes for collection:

Categories of Personal Data Examples Sources of Personal Data Purposes for Personal Data Collection
Consumer Records Name, address, other personally identifiable information, public wallet address. User-provided; public blockchain. Connecting self-hosted wallets to our Platform. Creating user accounts. Performing KYC/AML where required under Applicable Law.
Internet or Other Electronic Network Activity Information Browser type, IP address, computer or mobile device unique ID number, operating system, referring and exit pages, device event information. Consumer indirectly (e.g. from activity on the Platform). Analytics. Advertising and marketing. To keep our Platform safe and secure. Improve our Platform.
Geolocation Data Approximate location based on IP address. Consumer indirectly (e.g. from activity on the Platform). Analytics. Determine your eligibility to access the Platform.

2. Personal Data Shared with Third Parties

Except as described in this Privacy Policy and unless otherwise expressly authorized by you in writing, ScopeLift will never share, sell, or communicate your Personal Data to or with anyone for any reason. We only share and disclose your Personal Data with the following third parties:

Categories of Third Parties Why We Share Your Personal Data Is Personal Data Shared for a Business Purpose?
Purchasers of Our Business We may share or transfer your Personal Data in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company. We may also share Personal Data with our service providers and vendors who perform services on our behalf, subject to appropriate contractual obligations of confidentiality and data protection. Yes
Law Enforcement We may share your Personal Data where we have a good-faith belief that doing so is necessary to comply with applicable laws, regulatory requirements, or legal process, to respond to legal or governmental requests or demands for information, to enforce our agreements, policies, procedures and terms of service, to investigate potential violations thereof, to protect our rights, property, or safety, and to protect ourselves, our customers, or the general public from illegal or harmful activities. No

3. Cookies and Trackers

We also use cookies and other activity tracking tools to help the website work better. These tools allow us to:

We use cookies and trackers to assign you a unique identifier so we can record:

You can block cookies at any time using your web browser settings, but doing so may limit your browsing experience and your ability to use certain features of the website. We do not currently respond to "Do Not Track" or DNT browser signals or any other mechanism that automatically communicates your choice not to be tracked online.

4. How Long Do We Keep Your Personal Data?

We keep your Personal Data for as long as is necessary to fulfill the purposes outlined in this Privacy Policy. Even after we delete your Personal Data, we can retain copies of information about you for a period of time that is consistent with applicable law, applicable statute of limitations or as we believe is reasonably necessary to comply with applicable law, regulation, legal process, or governmental request, to collect fees owed, to resolve disputes, to address problems with our services, to assist with investigations, to enforce our Terms or other applicable agreements or policies, or to take any other actions consistent with applicable law.

If you ever decide to stop using our Platform, you can request we delete your Personal Data by contacting support at https://www.tally.xyz/support. We expect to delete your personal data (at the latest) once there is no longer any legal or regulatory requirement or legitimate business purpose for retaining your personal data.

5. California Privacy Rights

As a California consumer, you have the following choices regarding our use and disclosure of your Personal Data subject to certain limitations under the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA"):

To submit a request to exercise any of the rights described above, you may contact us at https://www.tally.xyz/support or send a letter with your request to our address. We may verify your identity before responding to your request.

Consumer Request by an Authorized Agent. If any authorized agent submits a consumer request under the CCPA on your behalf, we require the authorized agent to submit the following information so that we can confirm their authority to act on your behalf:

6. Your Data Protection Rights Under the GDPR

If you are a resident of the European Economic Area or the United Kingdom, you have the following data protection rights:

8. International Data Transfers

Due to the international nature of our business, your Personal Data may be transferred to jurisdictions that do not offer equivalent protection of personal data as under the Data Protection Legislation. In such cases, we will process Personal Data or procure that it be processed in accordance with the requirements of the Data Protection Legislation.

In particular, we may store and process your Personal Data in the United States. If you use the Platform from outside the United States, you consent to the transfer of your Personal Data to, and the storage of your Personal Data in, the United States, which may have different data protection rules than in your country, and Personal Data may become accessible as permitted by law in the United States.

9. Automated Decision-Making

We will not take decisions producing legal effects concerning you, or otherwise significantly affecting you, based solely on automated processing of your personal data, unless we have a lawful basis for doing so under applicable law and have implemented suitable measures to safeguard your rights.

10. How We Protect Your Privacy

We are committed to protecting the privacy and confidentiality of your Personal Data. We limit access to your Personal Data to our authorized employees or agents and we contractually require our business partners and service providers to limit their use of your Personal Data. We also maintain commercially reasonable physical, technical, and administrative safeguards designed to protect your Personal Data. However, no method of transmission over the Internet or method of electronic storage is completely secure, and we cannot guarantee absolute security of your Personal Data.

12. Children's Privacy

The Platform is not intended for children. We do not knowingly collect, use, sell, or share any Personal Data from anyone under the age of 16. If we become aware that a child under the age of 16 has provided Personal Data to us, we will delete it. We do not market products or services for use by children.

13. Changes to This Privacy Policy

We may change this Privacy Policy from time to time to reflect changes in our practices concerning the collection, use, and sharing of Personal Data. The revised Privacy Policy will be effective immediately upon posting to the website. We may also notify you of material changes through the website or through email, but we are not obligated to do so. Your continued use of the Platform after any changes to this Privacy Policy constitutes your acceptance of such changes, so please check this Privacy Policy periodically for updates.

14. Contact Us

If you have any questions or concerns about this Privacy Policy, please contact us at https://www.tally.xyz/support.