Privacy Policy

This Privacy Policy applies to information processed in connection with Tulipa's websites, accounts, investment products, portfolio features, communications, and related services.

It does not govern the independent privacy practices of third-party providers, financial institutions, infrastructure providers, communications services, or other external services that may be used in connection with Tulipa. Where a third party processes information under its own terms, its privacy policy will apply to that processing.

The information Tulipa collects depends on how you interact with the platform.

When you create or maintain a Tulipa account, we may process information such as:

• name or account identifier;
• email address;
• authentication credentials in protected form;
• account status;
• account preferences;
• registration or invitation information; and
• security-related account records.

Passwords should be stored using appropriate cryptographic protection and are not intended to be retained in readable form.

When you participate in Tulipa products, we may process information associated with your investment activity, including:

• deposits;
• withdrawals;
• account balances;
• portfolio positions;
• investment allocations;
• transaction history;
• ownership units;
• product participation;
• historical portfolio values; and
• other records necessary to administer your account and investments.

These records may be retained as part of Tulipa's financial and operational recordkeeping even after a particular transaction or investment has been completed.

Where required for access, Early Access participation, security, regulatory compliance, or operational review, Tulipa may request additional information necessary to determine eligibility or verify account activity. The nature and extent of this information may vary depending on the applicable product, jurisdiction, or legal requirement.

If you contact Tulipa, we may process:

• your contact information;
• the content of your message;
• support requests;
• correspondence history; and
• information voluntarily provided as part of the communication.

When you access Tulipa, our systems and service providers may automatically process limited technical information, including:

• IP address;
• browser and device information;
• operating system;
• requested pages or resources;
• access time;
• referring page;
• network information;
• application or server logs;
• security events; and
• error or diagnostic information.

This information may be used to operate Tulipa, maintain security, diagnose technical issues, and prevent abuse.

Certain Tulipa features may use identifiers that are intentionally designed to be publicly visible. For example, Tulipa may display a public account identifier or limited ownership-related information in features intended to provide transparency around a product or portfolio.

Public identifiers should not be treated as confidential information.

Tulipa does not intend to publicly disclose private account credentials, personal contact information, private transaction records, or other information that is not expressly designated for public display. Users should nevertheless understand that information displayed through public-facing platform features may be viewed, recorded, or referenced by others.

Tulipa may process information for purposes including:

• creating and maintaining user accounts;
• authenticating users;
• processing deposits and withdrawals;
• maintaining portfolio and transaction records;
• administering investment products;
• calculating account balances and ownership positions;
• managing product capacity;
• maintaining financial and operational records;
• providing Early Access or other restricted features;
• communicating with users;
• responding to support requests;
• maintaining platform security;
• detecting fraud, abuse, or unauthorized activity;
• monitoring platform reliability;
• diagnosing technical problems;
• improving Tulipa's products and services;
• maintaining internal financial controls;
• complying with applicable legal or regulatory requirements; and
• protecting the rights, security, and integrity of Tulipa and its users.

Tulipa does not intend to collect personal information that is unrelated to the operation, security, administration, or legitimate development of the platform.

Tulipa maintains records necessary to accurately reflect investment ownership, deposits, withdrawals, balances, allocations, and transaction history. Certain financial records may need to be retained for longer periods than ordinary account or technical information because they may be necessary for:

• financial accounting;
• reconciliation;
• dispute resolution;
• audit purposes;
• fraud prevention;
• regulatory compliance; or
• maintaining the integrity of historical investment records.

A request to delete personal information may therefore not always result in the deletion of records that Tulipa is required or reasonably needs to retain. Where appropriate, information may instead be restricted, archived, or separated from active account use.

Tulipa may use cookies or similar technical mechanisms where necessary to:

• maintain authenticated sessions;
• protect account security;
• remember essential preferences;
• prevent abuse;
• support application functionality; and
• maintain reliable service delivery.

Tulipa may also introduce analytics or performance-measurement technologies where appropriate. Where applicable law requires consent for non-essential cookies or similar technologies, Tulipa should provide the necessary choices before such technologies are used.

Tulipa does not rely on advertising trackers as a necessary part of its investment operations.

Tulipa may share limited information with service providers where reasonably necessary to operate the platform. These providers may support functions such as:

• hosting and infrastructure;
• databases;
• communications;
• security;
• authentication;
• data storage;
• monitoring;
• financial operations;
• market data;
• analytics; or
• other technical and operational services.

Service providers are expected to process information only for legitimate purposes associated with the services they provide.

Tulipa may also disclose information where reasonably necessary to:

• comply with applicable law;
• respond to lawful governmental or regulatory requests;
• enforce Tulipa's agreements or policies;
• investigate fraud or security incidents;
• protect Tulipa, its users, or third parties;
• establish, exercise, or defend legal claims; or
• support a legitimate corporate restructuring, financing, acquisition, or transfer of business operations.

Any such disclosure should be limited to information reasonably necessary for the relevant purpose.

Tulipa may depend on third-party infrastructure, communications providers, data providers, financial services, or other external services. When you interact directly with an independent third party, that provider may collect or process information according to its own privacy policy.

Tulipa cannot control all processing performed independently by third parties and encourages users to review the privacy practices of services with which they interact.

Tulipa seeks to retain personal information only for as long as reasonably necessary for the purpose for which it was collected. Retention periods may differ depending on the type of information. For example:

• technical logs may be retained for operational or security purposes;
• account information may be retained while an account remains active;
• communications may be retained where relevant to support or dispute history; and
• financial and transaction records may be retained for longer periods where necessary for accounting, reconciliation, regulatory, legal, or audit purposes.

Information may also be retained where necessary to establish, exercise, or defend legal claims or prevent fraud and abuse.

Tulipa applies technical and organizational measures intended to protect information against unauthorized access, alteration, disclosure, misuse, or destruction. These measures may include:

• access controls;
• authentication safeguards;
• protected credential storage;
• restricted access to production systems;
• infrastructure security;
• monitoring;
• logging;
• backup procedures; and
• other controls appropriate to the nature of the information being processed.

Access to sensitive information should be limited to systems, personnel, or service providers that reasonably require it. However, no internet-connected system, database, or method of electronic storage can be guaranteed to be completely secure.

Tulipa therefore cannot guarantee that unauthorized access, cybersecurity incidents, or other security failures will never occur.

Tulipa and its service providers may operate infrastructure in different countries. As a result, personal information may be processed or stored outside the country in which you reside.

Where required by applicable law, Tulipa will seek to use appropriate mechanisms or safeguards for international transfers of personal information. Privacy and data-protection standards may differ between jurisdictions.

Depending on where you live and the law applicable to your information, you may have rights including the ability to request:

• confirmation that your personal information is being processed;
• access to your personal information;
• correction of inaccurate information;
• deletion of eligible information;
• restriction of certain processing;
• objection to certain processing;
• withdrawal of consent where processing relies on consent;
• portability of eligible information; or
• information about how your personal data is used.

These rights are not absolute and may be subject to legal, financial, security, operational, or recordkeeping requirements. For example, Tulipa may be unable to delete transaction records where those records are necessary to maintain accurate financial history or comply with applicable obligations.

Tulipa may request reasonable verification before fulfilling a privacy request in order to protect account information from unauthorized disclosure.

Closing a Tulipa account does not necessarily result in immediate deletion of all information associated with the account. Certain data may remain necessary for:

• transaction history;
• financial reconciliation;
• regulatory requirements;
• legal obligations;
• fraud prevention;
• security;
• dispute resolution; or
• maintaining the integrity of Tulipa's financial records.

Where information no longer needs to remain associated with an active account, Tulipa may archive, restrict, anonymize, or delete it where appropriate.

Tulipa is not intended for children.

Tulipa does not knowingly offer investment products or account participation to individuals who do not meet applicable age or eligibility requirements. If Tulipa becomes aware that personal information has been collected from an individual who was not legally eligible to provide it, appropriate steps may be taken in accordance with applicable law.

Tulipa may be required to retain, review, or disclose information where necessary to comply with applicable laws, regulations, legal proceedings, financial obligations, or requests from authorized authorities.

Where legally permitted, Tulipa will seek to limit such processing or disclosure to what is reasonably necessary.

Tulipa's products, technology, infrastructure, and legal obligations may evolve over time. This Privacy Policy may therefore be updated periodically to reflect changes in:

• information practices;
• platform functionality;
• service providers;
• security practices;
• legal requirements; or
• Tulipa's operations.

When material changes are made, the effective date will be updated. Where required by applicable law, additional notice or consent may be provided.

Questions regarding this Privacy Policy or requests concerning personal information may be submitted through Tulipa's official contact channels.

Where necessary, Tulipa may request additional information to verify the identity and authority of the person making a privacy request before disclosing, changing, or deleting account-related information.

Tulipa seeks to collect and retain only the information necessary to operate the platform responsibly, maintain accurate financial records, protect users, and meet legitimate operational and legal obligations.

Personal information should not become a product in itself. It should remain a controlled resource used only where there is a legitimate reason for Tulipa to process it.