Privacy Notice

This Privacy Notice is part of the Gambit Terms of Service. Words used here have the same meaning as in those terms, and the terms are incorporated into this notice.

This notice describes how EMBR DEV PTE. LTD., a private limited company incorporated in Singapore, and its affiliates ("Gambit," "we," "us") handle information in connection with the websites at gambit.trading and app.gambit.trading and the associated tools (the "Services"). EMBR DEV PTE. LTD. is the controller of personal data described here.

The Services are an interface for viewing information and preparing transactions you confirm. They are not an exchange, broker, or custodian. Outside sites and venues linked from the Services, including the Hyperliquid interface at app.hyperliquid.xyz, have their own privacy terms.

If you do not agree with this notice, do not use the Services. We may update it as the Services or the law change. If a change materially affects your privacy rights, we will provide notice consistent with the significance of the change. The date at the top of this page is the date of the latest version.

The blockchain

Blockchains record data in linked blocks that are designed to be difficult to alter and that are copied across many nodes. There is no single operator who can edit or delete that record. A transaction you confirm can write your wallet address and related activity onto a public ledger. That data is visible to anyone and generally cannot be erased. This limits rights such as erasure, objection, and restriction for information that has already been recorded on-chain. Whether to transact, and whether to share a public address with us, is your decision. If you need those rights to remain fully available, do not transact on a public blockchain.

Individuals under 18

The Services are not for anyone under 18. We do not knowingly collect personal data from anyone under 18. If we learn that we have, we will delete it from our systems where we can. We cannot delete information already recorded on a public blockchain. If you are a parent or guardian and believe a child has provided information, contact us at legal@embrlabs.fun.

Information you and others provide

We collect information you provide when you use the Services, including:

• account and contact details you choose to give us, such as an email address;
• wallet addresses and public keys you connect or authorize;
• if you approve an agent key, its public address, an encrypted copy of the key, and records of the orders sent with it. When you trade manually, your browser creates a session key named Gambit that you approve. That key stays in your browser and signs only the orders you submit. We do not set an expiry on that approval. You can revoke it on Hyperliquid;
• if you link Telegram, your Telegram user ID and the messages you send the bot. We send alerts back through Telegram;
• messages, instructions, files, and settings you submit to the assistant, and the tickets prepared from them;
• records of transactions you confirm, including orders and related on-chain activity; and
• support messages and other communications with us.

We do not ask you to submit a government identification number, a copy of a passport or driver's license, or similar identity documents to use the interface. Do not put private keys, seed phrases, passwords, or government identifiers into the assistant. Messages to the assistant are not confidential or privileged.

We also collect how you use the Services: features you open, actions you take, and the time and frequency of that activity. Other people can cause us to receive information about you when they use the Services in a way that refers to your wallet or account, for example a transfer.

Device information and cookies

We and our providers collect information from the browsers and devices you use, and we may associate that information across devices you use with the same account. This includes:

• device operations, such as whether a window is in the foreground, which can help distinguish people from automated traffic;
• device and cookie identifiers;
• network data such as IP address, language, time zone, and connection information; and
• information needed to deliver a push notification, if you turn notifications on.

Cookies remember you and record how you interact with the Services. If you have an account, we may link that usage to other information we hold. You can refuse or delete cookies in your browser. Some parts of the Services may not work if you do. We use cookies to keep you signed in, remember preferences, and understand usage. We use Google Analytics and Vercel Analytics for that usage measurement. You can opt out of Google Analytics with the Google Analytics opt-out add-on. We do not sell cookie data to data brokers.

Browser "Do Not Track" signals are not standardized, and the Services do not respond to them.

Information stored on-chain and on our systems

A confirmed transaction can store, on a public blockchain, wallet addresses, the transaction itself, and token balances. That information is public and is not something we can delete.

On our own systems we store wallet addresses you connect, records of transactions associated with your use, IP address, and transaction identifiers, so we can operate the Services, debug problems, and provide support.

How we use information

• to provide the Services, including preparing information and tickets for you to review and sending an instruction after you confirm it;
• to operate the assistant, which means sending your messages and related context to third-party model providers;
• to develop, test, and troubleshoot the Services;
• to measure how the Services are used, including through analytics providers;
• to verify activity, detect abuse, and protect the security of the Services;
• to screen for sanctions and similar restrictions where we are required or choose to do so;
• to communicate with you about the Services, this notice, and the Terms of Service, and to answer you when you contact us; and
• to enforce the Terms of Service.

Where the law requires a legal basis, we rely on one or more of the following: your consent, performance of our contract with you, a legal obligation, or our legitimate interests in operating, securing, and improving the Services and preventing fraud and abuse.

Assistant outputs and any ticket prepared for you are not a decision we make about your money. An order is sent only after you confirm it. Autonomous order placement is not part of the Services. We do not make solely automated decisions that produce legal or similarly significant effects without that confirmation.

AI providers and training

To generate assistant responses, we send message content and related context to one or more third-party model providers. As of the date of this notice, that traffic is routed through OpenRouter, which may forward a request to an underlying provider such as Anthropic or OpenAI. Those providers process the content under their own terms.

We do not use the content of your messages or other content you submit to train or fine-tune models. If that changes, we will update this notice, give in-product notice before the change, and, where the law requires it, obtain consent or offer a way to opt out before using your content that way. We may use aggregated or de-identified data that cannot reasonably be linked to you to develop and evaluate the Services.

Third-party collection

Providers collect or receive information as needed to run the Services. They include:

• Privy, for authentication and wallet access
• Hyperliquid, when you choose to view or confirm activity on that venue
• OpenRouter and upstream model providers, for the assistant
• Amazon Web Services, for infrastructure
• Vercel, for hosting and analytics
• Google, for Google Analytics
• Telegram, if you link it, for your Telegram user ID, the messages you send the bot, and the alerts we send you
• Tiger Data (Timescale Cloud), for the database that stores Service data, and professional advisers such as lawyers and auditors

You can ask for a current list of processors at legal@embrlabs.fun. A fiat on-ramp, if offered, is a third-party service with its own privacy terms. Review those terms before you use it.

Sharing

We share information about you in these cases:

• with service providers and professional advisers, only as needed to operate the Services and meet obligations to you and to regulators, and only while that need continues;
• with our affiliates, for the purposes in this notice;
• with a buyer or successor in a merger, financing, reorganization, or similar transaction;
• with government authorities, including regulators, when we believe in good faith that the law, legal process, or a law-enforcement request requires or justifies it;
• when we believe access is reasonably necessary to detect or prevent fraud or security issues, enforce the Terms of Service, defend a legal claim, or protect rights and safety; and
• with a third party you direct us to connect, such as a wallet or venue.

Service providers are required to protect personal data and to use it on our instructions. The Services can link to third-party sites. Those sites are not covered by this notice.

International transfers

We and our providers operate in more than one country. Your information may be processed in the United States and in other countries where you do not live. When we transfer personal data out of the European Economic Area, the United Kingdom, or another place that restricts transfers, we use an appropriate safeguard such as Standard Contractual Clauses where the law requires one.

Retention

We keep personal data for as long as we need it to provide the Services, comply with law, resolve disputes, and enforce the Terms of Service. That includes order and recommendation records, including records from agent-wallet use or from auto-execute before that feature was limited. When we no longer need it, we delete or de-identify it, except for information on a public blockchain, which we cannot delete, and information the law requires us to keep. To ask us to delete information we hold, email legal@embrlabs.fun with enough detail for us to find the data.

Your rights

Depending on where you live, you may have the right to access, correct, delete, or restrict personal data, to receive it in a portable format, to object to processing based on legitimate interests, to withdraw consent where we rely on consent, and to complain to a supervisory authority. Those rights are subject to exceptions, including records we must keep by law and records on a public blockchain.

Email legal@embrlabs.fun to exercise a right. We may need to verify your identity, and we will respond within the time the law requires.

Opt-out

To stop marketing messages, use the unsubscribe link in the message or email legal@embrlabs.fun. We still send service messages, including notices of changes to the Terms of Service or this notice, and messages the law requires.

Security

We encrypt personal data at rest and in transit, and we use other measures designed to protect it against accidental loss, unauthorized access, alteration, and disclosure. We limit access to people who need it for their work and who are bound to keep it confidential. We have a process for suspected breaches and will notify you and regulators when the law requires it. No method of storage or transmission is completely secure.

Contact

Questions about this notice: legal@embrlabs.fun.

Changes

We may change this notice by posting a new version on this page. Check the date at the top for the latest version.