LIMITED EMAIL PRE-REGISTRATION

Pre-registration Privacy Notice

Version 2026-10-11-pre-registration-v1 · Effective 11 October 2026

No account or financial service.This notice covers only the email pre-registration list. It does not authorize login, wallets, deposits, swaps, trading, transfers, withdrawals or custody.

Controller and contact

The controller for this limited pre-registration is 67.512.060 JULIO FERNANDO TEIXEIRA BATISTA, CNPJ 67.512.060/0001-64, Avenida Romeu Strazzi, 325, Sala 206, Vila Sinibaldi, São José do Rio Preto/SP, CEP 15084-010, Brazil. Privacy requests may be sent to api@hylacrypto.com.

Data, purpose and legal basis

We collect your email address and intended account type to confirm your interest, prevent duplicate entries and notify you about future onboarding availability. The legal basis for this limited processing is the consent you give on the pre-registration form.

Verification and security

We send a single-use email link. The confirmation token is stored as a one-way hash. The email address is encrypted at rest and also indexed with a keyed one-way value to detect duplicates.

Providers and international processing

Configured hosting and email providers process the minimum data needed to host this service and deliver the confirmation message. Their infrastructure may process data outside Brazil under their service terms and applicable safeguards.

Retention and your rights

A verified pre-registration is retained for up to 12 months unless you withdraw consent sooner or another legal retention duty applies. An unverified pre-registration is deleted after 7 days without activity and no later than 30 days after it was created. Expired or used confirmation records are retained only as long as needed to enforce the stated security and resend limits, then deleted. You may request confirmation, access, correction, deletion, information about sharing, or withdrawal of consent through api@hylacrypto.com.

Future onboarding

If operational onboarding becomes available, it will use a separate notice and consent. You will need to complete the applicable eligibility and identity checks and enroll Google Authenticator-compatible two-factor authentication before operational access.