ULTRAMINT — COOKIE AND TRACKING TECHNOLOGIES POLICY

Operator: Vivaach SRL, Costa Rica
Data controller for the purposes of this Policy: Vivaach SRL
Version: v1.8 [DRAFT]
Effective date: [insert on publication]
Last updated: 24 October 2026
Canonical location: ultramint.xyz/legal/cookies

This Cookie and Tracking Technologies Policy ("Cookie Policy") explains the cookies, local storage, software development kits ("SDKs"), and similar technologies used on the ULTRAMINT interface (the "Interface"). It is a notice, not a contract term, and is not incorporated into the Terms of Service (Terms of Service §7.2(a)); it should be read together with the ULTRAMINT Privacy Policy and Terms of Service. Capitalized terms used but not defined here have the meanings given in the Privacy Policy or the Terms of Service. In this Policy, "cookies" is used broadly to include cookies, browser local and session storage, and comparable client-side technologies. Where this Cookie Policy and the Terms of Service or Privacy Policy address the same subject, the Privacy Policy and the Terms of Service control as provided in those documents.

Structure of this Cookie Policy:

• Part 1 — What We Use and Why (§1)
• Part 2 — Consent, Your Choices, and How to Manage Cookies (§2)
• Part 3 — Third-Party Services That Set or Access Cookies and Storage (§3)
• Part 4 — Compliance and Geo-Restriction Technologies (§4)
• Part 5 — Policy Updates, Contact Information, and Effective Date (§5)

---

PART 1 — WHAT WE USE AND WHY

1. What We Use and Why

1.1 Overview

(a) The Interface uses a deliberately minimal set of cookies and similar technologies. We use them only to (i) operate, secure, authenticate, and maintain the stability of the Interface, (ii) remember your interface state and consent choices, and (iii) — only with your consent — understand how the Interface is used (analytics).

(b) This Section 1 identifies each technology in use, its provider, its purpose, whether it is strictly necessary or consent-required, and its approximate retention. It also confirms what we do not use (Section 1.5) and explains that certain technologies set by our authentication provider are outside our direct control (Section 1.6).

(c) Consent is collected and managed through our consent manager (CookieYes). You can review and change your choices at any time through the cookie-preferences control available in the Interface. Strictly necessary technologies cannot be switched off, because the Interface cannot function or be kept secure without them.

1.2 Inventory of Cookies and Tracking Technologies

The following table lists every technology in use. First-party cookies, which Vivaach SRL sets, are listed by their exact name and lifetime. For technologies set by a third-party provider, the representative names and retention periods shown are set and controlled by that provider and may change; the current itemized list is maintained in, and can be reviewed through, the CookieYes cookie-preferences control in the Interface.

1.3 Strictly Necessary, Exempt, and Consent-Required

(a) Strictly necessary technologies (rows 1–11 above) are essential to provide the Interface, authenticate you and keep you signed in, secure and maintain the stability of the platform, remember your consent and interface state, carry a waitlist hand-off, an organization registration, or an MCP authorization you initiated, keep your balances fresh after a money action, and credit the partner or referral link you arrived through. Preference cookies (rows 12 and 13) store user-interface customisation for the Interface you asked to use: your time zone and the topics you follow. Under the EU and UK ePrivacy regimes all of these are exempt from prior consent, because they are strictly necessary to deliver a service you have expressly requested or store a customisation of it, and they are set without consent. They cannot be disabled through the consent manager; if you block them through your browser, parts of the Interface may not function, and times and topics fall back to defaults.

    The external-wallet connector (row 17) is a separate case: it is strictly necessary to the connection you asked for, and is not loaded at all until you ask for it. It is therefore neither a default technology nor a consent-required one in the ePrivacy sense — your own act of choosing to connect a wallet is what causes it to load, and declining to connect one means it never runs. It is not covered by, and does not appear in, the CookieYes categories, because there is nothing to pre-authorize.

(b) Consent-required technologies (the analytics category: Google Analytics 4 and the first-party acquisition cookie, rows 14 and 15 above) are not set or initialized unless and until you provide prior opt-in consent through CookieYes. You may decline analytics, and you may withdraw consent at any time through the cookie-preferences control, as easily as you gave it; withdrawal stops future processing (it does not retroactively erase data already processed by the provider, which is addressed in the Privacy Policy). Declining does not affect your ability to use the Interface.

(c) The legal bases and data categories for the processing carried out through these technologies, and the third-party processors involved, are described in the Privacy Policy. This Cookie Policy governs the technologies; the Privacy Policy governs the underlying personal-data processing.

1.4 CookieYes — How Consent Is Controlled

(a) CookieYes is our consent-management platform. It presents the cookie banner, records your choices, and acts as the gate for consent-required technologies — in particular, no analytics technology initializes unless analytics consent has been granted through CookieYes.

(b) The CookieYes consent record is itself a strictly necessary technology (row 5): without it we could not remember or honor your choices. You can reopen the CookieYes preferences control at any time to review categories, see the current itemized cookie list, and change or withdraw consent.

(c) Google Consent Mode. When you accept the Analytics category, Google Analytics 4 loads with analytics storage granted and with advertising storage, ad user data, and ad personalization denied; those advertising signals are never granted, whatever you choose. When you withdraw analytics consent, analytics storage returns to denied, no further events are sent, and the _ga, _ga_PTBMX5T7LQ, and ultramint_acq cookies are deleted from your browser.

1.5 What We Do NOT Use

(a) We do not use, set, or permit on the Interface, and we do not participate in:

    (i) advertising or marketing cookies, ad-targeting, ad-measurement, or ad-retargeting technologies;

    (ii) cross-site or cross-context tracking, tracking pixels, or third-party advertising tags;

    (iii) any first-party device-fingerprinting SDK;

    (iv) the sale or sharing of personal information for cross-context behavioral advertising within the meaning of the CCPA/CPRA — because no advertising or cross-site tracking technologies are used, we do not "sell" or "share" personal information through cookies; and

    (v) push-notification services or feature-flag services that target individual users.

(b) The absence of these technologies is a deliberate design choice. If this ever changes, this Cookie Policy and the CookieYes categories will be updated, and any new non-essential technology will be added on a consent-required basis before it is set.

1.6 Magic.link — Outside Our Direct Control

(a) Magic.link is our authentication and embedded-wallet provider and the primary identity processor. To sign you in and maintain your wallet session, Magic.link sets and reads its own cookies and/or browser storage and issues the DID token used to authenticate you.

(b) Those technologies are necessary for you to sign in and use the Interface, and they are distinct from the first-party session cookie in row 2, which Vivaach SRL sets and controls, and are therefore strictly necessary in function. However, Magic.link's cookie and storage behavior is determined and controlled by Magic.link, is governed by Magic.link's own privacy and cookie documentation, and is outside Vivaach SRL's direct control. We do not set, and cannot fully configure or remove, the cookies and storage that Magic.link uses for authentication. For details of Magic.link's practices, refer to Magic.link's own privacy policy, referenced in our Privacy Policy.

1.7 The Funding Providers — Loaded Only If You Use Them

(a) Two providers exist on the Interface solely so that you can put money into the embedded Wallet that Magic.link creates for you. Neither is part of signing in, and neither is part of placing, holding, or settling a position.

    (i) Reown (AppKit / WalletConnect) — the external-wallet connector (row 17). Its code and its browser storage are loaded on first use only, when you press the connect control on the deposit screen. Until then nothing from Reown is requested, executed, or stored. Once loaded, it writes keys to your browser's local storage to remember the connected wallet and hold the connection session open.

    (ii) Onramper — the card and local-payment checkout (row 18). It is not embedded in the Interface: the checkout opens in a new tab on Onramper's own site. Cookies set there are set by Onramper and its payment and identity-verification partners, under their policies, on their domain, and are outside this Cookie Policy and outside our control.

(b) Connecting an external wallet does not make it your account and does not make it a signer. It is a funding route. Your account identity and every position you take remain tied to the embedded Wallet held through Magic.link. Disconnecting the external wallet, or clearing the connector's storage, has no effect on your account, your positions, or your balances. The processing of personal data by each of these providers, including Onramper's status as an independent controller rather than our processor, is described in the Privacy Policy (§§3.1(i)–(j)).

---

PART 2 — CONSENT, YOUR CHOICES, AND HOW TO MANAGE COOKIES

2. Consent, Your Choices, and How to Manage Cookies

2.1 How Consent Works at Your First Visit

(a) When you first visit the Interface, our consent manager (CookieYes) presents a cookie banner. Before you make any choice:

    (i) Strictly necessary technologies load immediately, without consent, because the Interface cannot function or be kept secure without them. These are: the Magic.link authentication and embedded-wallet session, the first-party session cookie, the Cloudflare security/WAF cookies and the Turnstile check, the CookieYes consent record itself, the short-lived waitlist hand-off, organization-registration, and MCP authorization cookies when you use those flows, the money-freshness marker after a money action, the partner-code cookie when you arrive through a partner link, and session-based interface state. The time-zone and interests preference cookies are also set without consent (§1.3(a)). No banner consent is required for these, and they cannot be switched off through the consent manager (§§1.2–1.3). The external-wallet connector is not among them — it loads only if and when you choose to connect a wallet (§1.7).

    (ii) Consent-required technologies do NOT load until you opt in. Analytics does not initialize unless and until you grant analytics consent through CookieYes. This gating is enforced in code, not merely as a matter of policy — if you take no action, or decline, no analytics technology is initialized, no analytics script (including Google's gtag.js) is requested, and nothing is set.

(b) You are free to accept or decline the consent-required category. Declining does not affect your ability to access or use the Interface. No consent-required technology is treated as accepted by inaction, by continued browsing, or by scrolling.

2.2 Withdrawing or Changing Your Consent at Any Time

(a) You may review, change, or withdraw your consent at any time — as easily as you gave it — through the CookieYes cookie-preferences control, which is available in the Interface (for example, via the "Cookie Preferences" or equivalent link). Opening that control lets you see the current categories and the itemized cookie list and toggle the consent-required category on or off.

(b) Withdrawing analytics consent stops analytics from initializing or collecting further data going forward, and deletes the _ga, _ga_PTBMX5T7LQ, and ultramint_acq cookies from your browser. Withdrawal operates prospectively: it does not, by itself, erase data already collected before withdrawal. Your separate rights in respect of previously collected personal data, including access and erasure requests and the limits on those rights, are described in the Privacy Policy.

(c) Because consent is stored in the CookieYes consent record (a strictly necessary technology), clearing your cookies or local storage will also clear your saved consent choices, and the banner will be presented again on your next visit.

2.3 Managing Cookies and Local Storage Through Your Browser

(a) Independently of CookieYes, you can use your browser settings to block, delete, or clear cookies and local/session storage at any time, and to set the browser to notify you when cookies are set. The method varies by browser; consult your browser's help documentation.

(b) What clearing storage does: it will remove interface state, your time-zone and interests preferences, your sign-in session, any pending waitlist hand-off or organization-registration continuation, any external-wallet connection you had made, and your saved consent choices, so you may need to re-authenticate (sign in again via Magic.link), reopen the original organization registration link, reconnect your session, reconnect any external wallet you fund from, re-set your interface preferences, and respond to the cookie banner again on your next visit.

(c) What clearing storage does NOT do: clearing cookies or local storage, or blocking non-essential technologies, does not affect your on-chain positions, balances, settled outcomes, or your eligibility to use the Platform. Those are determined on the blockchain and by the Terms of Service and Prohibited Jurisdictions Policy, not by client-side storage. Blocking strictly necessary technologies through your browser, however, may prevent you from signing in or may cause parts of the Interface to malfunction.

2.4 Your Cookie Choices Do NOT Affect On-Chain Data

(a) You should understand a fundamental feature of the Platform's Web3 architecture: your cookie and consent choices have no effect on data recorded on the blockchain.

(b) All on-chain activity — including your wallet address, stakes, positions, and settled outcomes — is recorded publicly and permanently on the Blockchain. That data:

    (i) is not a cookie or a tracking technology, is not set or controlled through CookieYes, and is not subject to cookie consent;

    (ii) cannot be deleted, suppressed, withdrawn, or hidden by declining or withdrawing cookie consent, by clearing your browser storage, or by any other client-side action; and

    (iii) is irreversible and outside the control of Vivaach SRL once recorded, because the blockchain is a public, decentralized ledger.

(c) Declining or withdrawing cookie consent therefore limits only the off-chain, client-side technologies described in this Cookie Policy. It does not, and cannot, affect the public and permanent on-chain record. The consequences of this permanence for your personal data, and the limits it places on data-deletion rights, are described further in the Privacy Policy.

2.5 EU / UK Residents — Disclosure for Completeness

(a) The Platform is not offered to, and does not knowingly serve, residents of the European Union or the United Kingdom (or other Restricted Jurisdictions), as set out in the Prohibited Jurisdictions Policy and the Terms of Service (§4). The consent mechanics described in this Cookie Policy are provided for transparency and completeness, and to address any edge case in which a visitor reaches the Interface, and do not constitute an offering of the Platform to, or a representation that the Platform is available in, the EU, the UK, or any other Restricted Jurisdiction.

(b) Nothing in this Cookie Policy waives, narrows, or creates an exception to the jurisdictional prohibitions in the Prohibited Jurisdictions Policy or the Terms of Service.

---

PART 3 — THIRD-PARTY SERVICES THAT SET OR ACCESS COOKIES AND STORAGE

3. Third-Party Services That Set or Access Cookies and Storage

3.1 Overview

(a) Some of the technologies described in Part 1 are provided by independent third-party service providers. Where such a provider processes personal data on our behalf, it does so as a processor under a data-processing agreement ("DPA") and under its own published privacy and cookie policies. Several of the services below (the RPC provider, IPinfo, Anthropic, and the other providers that host the UM Kernel's AI judges) are not cookie-based; they are disclosed here for full transparency about data that leaves the Platform (Sections 3.2 and 3.4). One of them — Onramper — is not our processor at all but an independent controller that decides for itself what it collects and why (§1.7; Privacy Policy §3.1(i)).

(b) The table in Section 3.2 identifies, for each provider, its role, the data it receives, whether it involves a strictly necessary or consent-required technology (or a non-cookie data flow), and where you can find that provider's own privacy/cookie policy.

3.2 Third-Party Processor Disclosure

Note on links and retention. The references below point to each vendor's own published privacy/cookie policy; the current links are maintained in the ULTRAMINT Privacy Policy. Each provider's data-retention period is governed by that provider's own terms, not by Vivaach SRL (see Section 3.3).

3.3 We Do Not Control Third-Party Vendors' Cookie or Retention Practices

(a) Each third-party provider listed above is an independent controller or processor that operates under its own privacy, cookie, and data-retention policies. Except to the extent expressly agreed in an applicable data-processing agreement (DPA) between Vivaach SRL and that provider, Vivaach SRL does not control, and is not responsible for, how a provider sets, reads, or manages its own cookies or storage, or how long that provider retains data.

(b) In particular, and as stated in Part 1 (§1.6), Magic.link's cookie and storage behavior is determined and governed by Magic.link's own policies and is outside Vivaach SRL's direct control. Likewise, Cloudflare, the RPC provider, and Anthropic each retain data for periods set by their own terms, not by Vivaach SRL. Your rights in respect of data held by these providers, and how to exercise them, are described in the Privacy Policy.

(c) We select providers on the basis of, and hold them to, contractual data-protection commitments where applicable; but this Cookie Policy does not, and cannot, override or supersede a provider's own policies as they apply to data that provider independently controls.

3.4 Non-Cookie Data Flows Disclosed for Transparency

(a) The following are not cookie or client-side tracking technologies and are included solely so that you have a complete picture of data that leaves the Platform:

    (i) RPC / node provider. When you initiate a transaction, your wallet address and the transaction's data (stake, market, and outcome) are transmitted to the Platform's RPC / node infrastructure provider so that the transaction can be submitted to, or read from, the blockchain. You acknowledge that this transmission occurs on each transaction call, including on eligibility pre-checks for transactions that are subsequently rejected, and that the provider handles that data under its own retention policy. This flow is inherent to interacting with a public blockchain and is not controlled by cookie settings.

    (ii) Anthropic (AI market-creation assistant). If you use the AI assistant in the create-market interface, the text you type into that interface is transmitted to Anthropic to generate the response, and is retained at Anthropic's discretion under its own terms. Only what you type is sent; the assistant is engaged only when you choose to use it.

    (iii) Providers hosting the UM Kernel's AI judges (Tavily, Amazon Bedrock, Anthropic, Google Vertex AI). AI markets and Custom Source Markets are resolved by the UM Kernel's AI judges. Resolving such a market transmits the market question, its resolution criteria, any creator-named source URL, and the evidence to one or more of the providers named above. Where a market is judged by more than one AI judge, the same evidence may be transmitted to more than one provider. No wallet address, position, stake, account identifier, or email is transmitted, and the market question and criteria are in any event publicly displayed on the market card. This flow occurs at resolution time whether or not you took a position in the market.

    (iv) Resend (application email). The Platform uses Resend to send copies of notices in your in-app notification tray and Town invitations addressed to your email. Resend receives your email address and the message itself. The messages carry no tracking pixel and no instrumented links, so neither Resend nor Vivaach SRL learns whether you opened one or followed a link in it, and this flow adds no client-side storage of any kind. Your account settings control notification topics and can stop all notification mail; those switches do not suppress a Town invitation another user explicitly addresses to you. Notices remain in your in-app tray either way. See the Privacy Policy §§1.2.6, 1.3.7 and 3.1(k).

    (v) IPinfo (geolocation). When you take an action that requires an eligibility determination, ULTRAMINT's backend sends the IP address of the request, and nothing else, to IPinfo, which returns a country, a region where available, and whether the address belongs to a VPN, proxy, Tor, or hosting network. See Part 4 and the Privacy Policy §3.2.

    (vi) CoinMarketCap (images). Where the Interface shows a crypto asset's logo, your browser loads it directly from CoinMarketCap's image servers, which therefore receive your IP address and ordinary request metadata. See the Privacy Policy §3.1(n).

(b) None of these flows is affected by, or subject to, your cookie-consent choices, and none can be suppressed through the CookieYes preferences control or by clearing your browser storage — notification email is switched off in your account settings rather than in the consent manager, for the reason just given. On-chain transaction data is, in addition, public and permanent as described in Section 2.4 and the Privacy Policy.

3.5 No Sale or Sharing With Advertising Networks or Data Brokers

(a) Vivaach SRL does not sell, rent, trade, or otherwise disclose your personal information, cookie data, or storage data to, and does not use on the Interface:

    (i) any advertising network, ad exchange, or ad-measurement or ad-targeting provider;

    (ii) any data broker or data-enrichment/appending service; or

    (iii) any social-media pixel, tag, or tracking integration.

(b) The third-party providers listed in Section 3.2 receive data only to perform the specific function described (authentication, analytics-with-consent, security/CDN and bot protection, geolocation, consent management, blockchain connectivity, image delivery, or AI assistance and resolution), and not for advertising, cross-context behavioral targeting, or onward sale. Consistent with Part 1 (§1.5), the Platform does not "sell" or "share" personal information for cross-context behavioral advertising within the meaning of the CCPA/CPRA.

3.6 Relationship to the Privacy Policy

(a) This Section addresses third-party providers in their capacity as sources of cookies, storage, and data flows. The complete processor table, the categories of personal data, the legal bases for processing, international-transfer safeguards, and your data-subject rights are set out in the Privacy Policy, which governs the underlying personal-data processing. In the event of conflict between this Cookie Policy and the Privacy Policy as to personal-data processing, the Privacy Policy controls.

---

PART 4 — COMPLIANCE AND GEO-RESTRICTION TECHNOLOGIES

4. Compliance and Geo-Restriction Technologies

4.1 Geographic Restriction Enforcement

(a) To comply with the Prohibited Jurisdictions Policy and the Terms of Service (§4), the Platform enforces geographic restrictions on access. To do this, your IP address is processed each time you take an action that requires an eligibility determination, so that access from, or associated with, a Restricted Jurisdiction can be identified and refused.

(b) How the location is determined. ULTRAMINT's backend looks up the IP address of the request with IPinfo, a geolocation provider acting as our processor, and receives a country, a first-level region where available, and anonymizing-network signals. That determination governs access to authenticated actions. Cloudflare's country signal is used alongside it, and only where the network edge itself corroborates it: a country stated in a request header is accepted only when it matches what the edge independently attributes to the connection, and is discarded where it does not or where the edge could not place the connection at all. A request with no corroborated country has no country for this purpose, and a stated one cannot be used to obtain access. Where the location cannot be determined, an action that requires it is refused.

(c) No geo-blocking cookie is set. The control operates on each request itself, not through a cookie stored on your device, and Vivaach SRL sets no cookie to perform it.

4.2 VPN and Proxy / Circumvention Detection

(a) The Platform applies VPN, proxy, Tor, and hosting-network detection, using IPinfo's signals at ULTRAMINT's backend together with Cloudflare's threat signals at the network edge, to identify connections that use tools designed to disguise or misrepresent your true location. Your IP address is processed for this purpose; no detection data is stored by Vivaach SRL beyond the short-lived, in-memory determination described in Section 4.4.

(b) Detection of a VPN, proxy, Tor, or hosting network results in refusal of every non-public action, consistent with the strict prohibition on circumvention in the Prohibited Jurisdictions Policy (§5). Public pages remain viewable.

(c) You acknowledge that no geolocation or anonymizer-detection technology is perfect. These controls are provided on a best-efforts basis and are not warranted to detect every impermissible access; a failure to detect or refuse a particular access does not authorize your use of the Platform or waive any provision of the Prohibited Jurisdictions Policy or the Terms of Service (Terms of Service §4.5(d)).

4.3 Strictly Necessary for Legal Compliance — No Consent Required

(a) The processing described in this Section is strictly necessary for the Platform's legal and regulatory compliance and for the security and integrity of the Platform. It is not an analytics, advertising, or user-profiling technology.

(b) Because this processing is strictly necessary to enforce the Platform's eligibility and geographic restrictions and to comply with applicable law, it does not require, and is not gated by, cookie consent under the EU/UK ePrivacy frameworks, and it cannot be switched off through the CookieYes consent manager. It applies to all connections regardless of consent choices. You consent to this processing as a condition of access, as set out in the Terms of Service (§4.5(c)).

4.4 Vivaach SRL Does Not Store Geo-Blocking Data Directly

(a) The IP address and the determinations used for geo-restriction and circumvention detection are not persisted by Vivaach SRL for this purpose. ULTRAMINT's backend submits the address to IPinfo and holds the result only in memory, for a short time, keyed so that it does not contain the address (Privacy Policy §3.1(a)). Cloudflare's request logs are retained for the period stated in the Privacy Policy (§3.1(a)).

(b) This Section describes the geolocation and circumvention processing only. The Platform's separate, application-level enforcement of eligibility on each authenticated action, and the data signals involved, are described in the Terms of Service (§4.5) and the Prohibited Jurisdictions Policy; the associated personal-data processing and your rights are described in the Privacy Policy.

4.5 Future Compliance Features (Not Active at Launch)

(a) The following compliance features are not active at launch and are not represented as being in operation:

    (i) identity verification / "Know Your Customer" (KYC);

    (ii) sanctions or watchlist screening; and

    (iii) on-chain wallet-provenance or wallet screening (for example, via TRM Labs, Chainalysis, or an equivalent provider).

(b) The Platform reserves the right to introduce any of these features in the future (as set out in the Terms of Service §4.8 and the Prohibited Jurisdictions Policy). If and when any such feature is introduced, this Cookie Policy and the Privacy Policy will be updated to describe it, and any associated processing or technology will be disclosed, before that feature goes live. Nothing in this Section represents that any such feature is currently deployed.

---

PART 5 — POLICY UPDATES, CONTACT INFORMATION, AND EFFECTIVE DATE

5. Policy Updates, Contact Information, and Effective Date

5.1 Updates to This Cookie Policy

(a) The Platform may update or amend this Cookie Policy at any time, in its sole discretion, to reflect changes in the technologies we use, in our providers, or in applicable law or regulatory guidance.

(b) Each version of this Cookie Policy is dated. When we make a change, we will update the "Effective date" and "Last updated" fields at the top of this Cookie Policy, and the version in effect at the time of your access or action governs that access or action.

5.2 Material and Non-Material Changes

(a) Material changes. Where a change is material — for example, the introduction of a new consent-required technology, a new category of processing, or a change that materially affects your choices or rights — the Platform will provide a notice in the Platform interface (and/or by another means the Platform reasonably selects) when the change takes effect, and where the change introduces a consent-required technology, the consent banner will ask for your choice again before that technology is used.

(b) Non-material changes. Corrections, clarifications, formatting changes, updated links, and other non-material edits may be made without prior notice and take effect upon posting. Updating the itemized cookie list maintained through the CookieYes preferences control (for example, where a provider renames a cookie) is a non-material change.

(c) Nothing in this Section limits any additional notice the Platform is required to give, or any consent it is required to obtain, under applicable law or under the Terms of Service (§7.3). Where a new consent-required technology is introduced, it will not be set or initialized until consent is obtained, regardless of the notice given (§2.1).

5.3 Versioning and Archived Prior Versions

(a) This Cookie Policy is published at a stable, versioned location — https://ultramint.xyz/legal/cookies — on the Platform's own domain, and is not hosted on any third-party platform.

(b) Each superseded version is versioned, dated, and archived, and remains accessible at https://ultramint.xyz/legal/cookies/versions, so that you can review the version that applied at any given time.

5.4 Continued Use Constitutes Acceptance

(a) Your continued access to or use of the Platform after a change to this Cookie Policy takes effect constitutes your acceptance of the revised Cookie Policy. If you do not agree to a revised Cookie Policy, you must stop using the Platform.

(b) Acceptance of this Cookie Policy does not, by itself, grant consent to any consent-required technology; such consent is obtained separately through CookieYes and may be declined or withdrawn as described in Part 2, regardless of your acceptance of this Cookie Policy.

5.5 Contact Information

(a) This Cookie Policy is issued by, and the data controller for the purposes described in it is:

Vivaach SRL, a legal entity registered in Costa Rica
[registered address to be inserted]
Email: legal@ultramint.xyz
Security reports: engineering@fermah.xyz

(b) For any question, request, or complaint relating to cookies, tracking technologies, or this Cookie Policy — including questions about consent or the technologies described in Parts 1–4 — you may contact us at legal@ultramint.xyz. Requests concerning your personal data more generally, and the exercise of any data-subject rights, are handled as described in the Privacy Policy.

5.6 Governing Law

(a) This Cookie Policy is a notice and is not incorporated into the Terms of Service. To the extent any question about it arises, it is governed by, and construed in accordance with, the laws of Costa Rica, and is subject to the governing-law and dispute-resolution provisions of the Terms of Service (§6.5–6.6). In the event of conflict between this Cookie Policy and the Terms of Service or the Privacy Policy as to personal-data processing, the Privacy Policy and the Terms of Service control as provided in those documents.

5.7 EU / UK Rights — Disclosed for Completeness

(a) As stated in Section 2.5, the Platform is not offered to, and does not knowingly serve, residents of the European Union or the United Kingdom or other Restricted Jurisdictions. The consent mechanics and the cookie- and data-related rights referenced in this Cookie Policy and the Privacy Policy are described in a manner aligned with the GDPR and UK GDPR for transparency and completeness, and do not constitute an offering of the Platform in, or a representation that the Platform is available in, the EU, the UK, or any other Restricted Jurisdiction, and do not waive the Prohibited Jurisdictions Policy or the Terms of Service (§4).

---

Cross-references: ULTRAMINT Privacy Policy (full processor table, legal bases, retention, international transfers, data-subject rights, on-chain permanence); Terms of Service §4 (eligibility), §4.5 (geolocation through IPinfo and Cloudflare; anonymizer detection; enforcement on authenticated actions; consent to processing), §4.8 (reserved KYC/AML rights), §5 (third-party infrastructure), §6.5–6.6 (governing law and disputes), §7.2 (canonical locations and versioning), §7.3 (amendments and notice), §7.14 (registered address); Prohibited Jurisdictions Policy (geofencing, circumvention ban, EU/UK and other Restricted Jurisdictions, reserved KYC/sanctions/wallet screening). First-party cookies are listed by exact name and lifetime in §1.2; names and retention periods of third-party technologies are provider-controlled and maintained in the CookieYes preferences control.