Privacy Policy

OmniBazaar is developed and maintained by Omni Administration Ltd., a Business Company incorporated under the laws of the British Virgin Islands, and its affiliated organization Omni Development DAO (collectively, "OMNI"). The Platform is a browser-based, decentralized application accessible globally at app.omnibazaar.com.

As a noncustodial platform, OmniBazaar does not hold user funds, control user wallets, or act as a financial intermediary. Transactions are conducted directly between users on-chain. OMNI does not have access to, or custody of, any user assets at any time.

OmniBazaar is built on a privacy-first architecture. We do not collect, store, or process:

• Passwords, private keys, or wallet seed phrases -- these exist solely within your own device and wallet
• Government-issued identification or KYC documentation, except as may be required by applicable law for specific features (see Section 7)
• Full financial account numbers, bank account details, or credit card numbers -- where and when credit card payments are made available and processed through a third-party payment processor, card data is handled by that processor under their own privacy policy and is not stored by OMNI
• Precise geolocation data beyond what you voluntarily provide in a listing
• Browsing history, behavioral profiling data, or advertising identifiers
• Any personal data that is not strictly necessary to operate the Platform

Account Recovery Notice: Because OmniBazaar does not store your password, private key, or wallet seed phrase, we are unable to assist with account recovery if you lose access to your credentials. This is a deliberate design choice consistent with our noncustodial model and a risk you accept by using the Platform.

To the limited extent necessary to operate, maintain, and secure the Platform, OMNI may collect or process the following categories of information:

3.1Account Registration Information

When you create an account, you may provide a username and an email address. Your email address is used to facilitate account access and to communicate important platform notices. We do not use your email address for unsolicited marketing without your consent.

3.2Listing Content

Any product descriptions, images, pricing, service details, or other content you submit to the marketplace is stored on or transmitted through the Platform for the purpose of displaying your listings to other users. You retain ownership of your listing content. OMNI claims no intellectual property rights over your submitted content beyond the limited license described in the Terms of Service.

3.3Transaction Records

Transactions conducted through OmniBazaar may be recorded on a public blockchain. Because blockchain transactions are inherently public and immutable, transaction data -- including wallet addresses, amounts, and timestamps -- may be permanently visible to any party with access to the relevant blockchain. OMNI does not control or have the ability to delete on-chain transaction records. See Section 5 for more detail on blockchain transparency.

3.4Technical and Usage Data

We may collect limited technical data to operate and improve the Platform, including: IP address (in pseudonymized or aggregated form), browser type and version, device type, session duration, and error logs. This data is used solely for security, fraud prevention, and platform stability purposes and is not linked to your personal identity.

3.5Communications

If you contact OMNI via support channels, we will retain records of that correspondence to the extent necessary to resolve your inquiry and comply with applicable legal obligations.

3.6Referral Attribution Data

When a user attributes their registration to an existing user through the Platform's referral program, OMNI collects and processes referral attribution data for the purpose of calculating and distributing referral commissions in accordance with the Terms of Service. This includes information about who referred whom, the sales activity of referred users relevant to commission calculations, and the timing and value of qualifying transactions. Referral attribution data is retained for the duration of the active referral relationship and for any additional period required to satisfy applicable legal or financial record-keeping obligations.

3.7Community Forum Content

If you post content in the Platform's community forums, discussion boards, or other public-facing community spaces, that content is stored on the Platform and is publicly visible to all users. Community content may include text, images, or other media you choose to share. OMNI does not claim ownership of your community content but stores it for as long as your account is active or until you delete it. Because community content is publicly visible, you should exercise caution about including any personal information in posts. Community content that is removed through automated reporting systems or OMNI enforcement action may be deleted from the Platform interface but may persist in caches, third-party indexes, or user copies.

3.8Node Operator Data

Users who operate listing nodes, validator nodes, or other network infrastructure on behalf of the Platform ("Node Operators") may transmit technical operational data to the Platform in the course of node operation. This may include IP addresses, uptime metrics, node performance data, and wallet addresses associated with node rewards. This data is collected and used solely for the purpose of facilitating node reward distribution, maintaining network integrity, and improving Platform infrastructure. Node operational data is retained for as long as the node is active and for any additional period required for technical or legal compliance purposes.

3.9NFT and AI Art Minting Data

When a user mints an NFT or AI-generated artwork through the Platform, OMNI may collect and store metadata associated with that minting, including the content identifier, prompt text or creation parameters (where applicable), wallet address of the creator, timestamp, and transaction hash. This data is stored to facilitate the display and transfer of the minted asset on the Platform. Metadata associated with on-chain minting events is also recorded immutably on the relevant blockchain and is publicly visible and permanent, independent of OMNI's data practices.

OMNI uses the limited information it collects exclusively for the following purposes:

• To operate, maintain, and improve the Platform and its features
• To display your listings and facilitate transactions between users
• To communicate with you regarding your account, including security notices and material changes to our Terms or this Policy
• To detect, investigate, and prevent fraud, abuse, security incidents, or violations of our Terms of Service
• To comply with applicable legal obligations, including responding to lawful requests from governmental authorities
• To calculate and collect the platform service fee on completed transactions, as described in the Terms of Service

We do not use your information for targeted advertising, behavioral profiling, or sale to third parties under any circumstances.

OmniBazaar operates on public blockchain infrastructure, including the OmniCoin (XOM) blockchain and other supported networks. Users should be aware that:

• Wallet addresses and transaction details submitted to any public blockchain are permanently and publicly visible to anyone with access to that blockchain
• OMNI has no ability to modify, delete, or conceal on-chain data under any circumstances
• Associating a wallet address with a real-world identity is the responsibility of the user -- OmniBazaar does not link wallet addresses to personal identity data by default
• Users who choose to import listings from third-party platforms may expose additional data points through that import process and should review the privacy practices of those platforms independently
• On-chain transaction data is not subject to deletion requests, as it is technically beyond the control of any single party, including OMNI

6.1Our Approach

OmniBazaar takes a privacy-first approach to cookies and browser-based tracking. We do not use third-party tracking cookies, advertising cookies, or cross-site behavioral tracking of any kind.

6.2Browser Storage and Cookies

We may use browser local storage, session storage, and strictly necessary cookies solely as required for the Platform to function. This includes saving your session state, display preferences, and security tokens. These technologies are stored locally on your device or managed by your browser and are not used for advertising, behavioral profiling, or any purpose beyond what is required for core Platform functionality. This data is not transmitted to third parties. By using the Platform, you consent to our use of strictly necessary browser storage and cookies on these terms. You may disable cookies or clear local storage through your browser settings, but doing so may impair certain features of the Platform.

6.3No Advertising Tracking

The OmniBazaar Platform is ad-free. We do not serve advertisements to users and do not share any user data with advertising networks or data brokers.

7.1Tiered Verification

OmniBazaar uses a tiered identity verification system. Basic account access requires only a username and email address. For certain features or activity levels, users may be required to complete additional identity verification steps. For higher-level verification, the Platform integrates with Persona, a third-party identity verification service.

7.2Third-Party KYC Provider

Where Persona is used for identity verification, your identity documents and biometric data (if applicable) are processed directly by Persona under their own privacy policy and terms of service. OMNI does not store raw identity documents or biometric data. OMNI receives only the verification outcome (verified / not verified) and any information legally required to be retained for compliance purposes.

7.3Purpose Limitation

Identity verification data is used solely for the purpose of satisfying applicable regulatory requirements and maintaining platform security. It is not used for marketing, profiling, or any purpose beyond compliance and fraud prevention.

7.4Legal Basis

Where OMNI collects identity verification information, the legal basis for doing so is compliance with applicable legal obligations (including AML and KYC regulations) and, where applicable, the legitimate interests of OMNI in preventing fraud and maintaining platform integrity.

OMNI does not sell, rent, or trade user information to third parties. We may share limited information only in the following circumstances:

8.1With Other Users

Listing content, usernames, and any information you make public through the Platform is, by its nature, shared with other Platform users. Exercise caution about what personal information you include in public-facing listings or communications.

8.2Service Providers

OMNI may engage limited third-party service providers to assist with platform operations, including hosting, security monitoring, and identity verification (see Section 7). Any such providers are contractually bound to use information only as necessary to provide services to OMNI and not for any independent commercial purpose.

8.3Legal Compliance and Law Enforcement

We may disclose information where required to do so by applicable law, regulation, court order, or valid governmental request, or where we believe in good faith that disclosure is necessary to protect the rights, safety, or property of OMNI, our users, or the public. OMNI reserves the right -- and, where legally required, the obligation -- to cooperate with law enforcement agencies and regulatory authorities in connection with investigations into fraud, money laundering, sanctions violations, or other illegal activity.

8.4Business Transfers

In the event of a merger, acquisition, restructuring, or sale of Omni Administration's or ODDAO's assets, user information may be transferred as part of that transaction. We will endeavor to provide advance notice of any such transfer through the Platform or via the contact information associated with your account.

OmniBazaar is designed as a noncustodial, peer-to-peer platform and does not function as a money services business, financial institution, or payment processor. However, we are committed to operating responsibly within applicable legal frameworks globally.

To the extent required by applicable law, OMNI reserves the right to implement identity verification, transaction monitoring, reporting obligations, or other compliance measures. Users are solely responsible for their own compliance with anti-money laundering (AML), counter-terrorism financing (CTF), and sanctions regulations applicable in their jurisdictions.

OMNI complies with applicable sanctions programs administered by the U.S. Office of Foreign Assets Control (OFAC) and equivalent international authorities. OMNI reserves the right to block, restrict, or terminate access for users located in or associated with sanctioned jurisdictions or sanctioned persons, and to report suspicious activity to relevant authorities as required by law.

OMNI retains data only for as long as reasonably necessary to fulfill the purposes described in this Policy, or as required by applicable law. Because OmniBazaar collects minimal personal data by design, the practical scope of data retention is limited:

• Account information (username, email) is retained for the duration of your account and for a reasonable period thereafter to comply with legal obligations
• Listing content you post on the Platform will generally remain available until you remove it or your account is terminated
• Support correspondence is retained for the period necessary to resolve your inquiry and any related legal obligations
• Technical and usage data is retained in aggregated or pseudonymized form for platform improvement purposes
• Referral attribution data is retained for the duration of the active referral relationship and for any additional period required by applicable legal or financial record-keeping obligations (see Section 3.6)
• NFT minting metadata is retained for as long as the minted asset is displayed on the Platform and for any additional period required by applicable law; on-chain minting records are permanent and cannot be deleted by OMNI (see Section 3.9)
• On-chain transaction data is permanent by the nature of blockchain technology and cannot be deleted by OMNI or any other party

Upon request, OMNI will delete or anonymize personal data we hold about you to the extent technically feasible and not otherwise required to be retained by law. Requests for deletion may be submitted through the support channels described in Section 19.

OMNI takes reasonable and appropriate technical and organizational measures to protect the limited data it holds against unauthorized access, loss, destruction, or alteration. Our noncustodial architecture minimizes the volume of sensitive data we hold, which in turn significantly reduces the risk profile compared to custodial platforms.

User-to-user messaging on the Platform is end-to-end encrypted. OMNI does not have the technical ability to access, read, or retain the content of messages exchanged between users. No system is completely secure, and we cannot guarantee the absolute security of information transmitted through or stored in connection with the Platform. You are responsible for maintaining the security of your own account credentials, private keys, wallet access, and device security.

In the event of a data security incident affecting user information that we hold, OMNI will endeavor to notify affected users in accordance with applicable law, including any mandatory breach notification requirements.

OmniBazaar is a global platform supporting users across more than 30 countries and 10 languages. By using the Platform from any jurisdiction, you consent to the collection and processing of any information you provide in accordance with this Policy, subject to the mandatory data protection laws of your jurisdiction.

Users in certain jurisdictions have additional rights regarding their personal data under applicable law. The sections below describe those rights for the most significant regulatory frameworks. If you are located in a jurisdiction not specifically addressed below but which has applicable data protection legislation, you may still have rights under that legislation. Please contact us at the address in Section 19 to inquire about or exercise any such rights.

13.1Applicability

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, the General Data Protection Regulation (GDPR) or equivalent local legislation applies to our processing of your personal data. OMNI processes personal data of EEA users on the following legal bases:

• Performance of a contract: processing necessary to provide the Platform services you have requested
• Legitimate interests: processing necessary for fraud prevention, platform security, and the operation and improvement of the Platform, where those interests are not overridden by your data protection rights
• Legal obligation: processing necessary to comply with applicable law, including AML, KYC, sanctions, and tax reporting obligations
• Consent: where we rely on consent as a legal basis (for example, for non-essential communications), you may withdraw that consent at any time

13.2Your GDPR Rights

As an EEA, UK, or Swiss resident, you have the following rights with respect to personal data we hold about you:

• Right of access: you may request a copy of the personal data we hold about you
• Right to rectification: you may request correction of inaccurate or incomplete personal data
• Right to erasure: you may request deletion of your personal data where we no longer have a lawful basis to retain it, subject to our legal obligations and the technical limitations of on-chain data
• Right to restriction: you may request that we restrict processing of your personal data in certain circumstances
• Right to data portability: you may request that we provide your personal data in a structured, machine-readable format
• Right to object: you may object to processing based on legitimate interests, including for direct marketing purposes
• Rights related to automated decision-making: you have the right not to be subject to decisions based solely on automated processing that produce significant legal or similarly significant effects

13.3How to Exercise Your Rights

To exercise any of the rights described above, please contact us using the contact information in Section 19. We will respond to your request within 30 days, or within any shorter period required by applicable law. We may need to verify your identity before processing your request.

13.4International Data Transfers

If you are located in the EEA or UK, your personal data may be transferred to and processed in countries outside the EEA, including the British Virgin Islands. Where such transfers occur, OMNI will ensure that appropriate safeguards are in place in accordance with applicable data protection law, including, where applicable, the use of standard contractual clauses or equivalent transfer mechanisms approved by the relevant authority.

13.5Right to Complain

If you believe we have not handled your personal data in accordance with applicable law, you have the right to lodge a complaint with the supervisory authority in your country of residence or place of work. A list of EEA supervisory authorities is available on the European Data Protection Board website at edpb.europa.eu.

14.1Applicability

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), may provide you with additional rights regarding your personal information. This section supplements the rest of this Privacy Policy and applies solely to California residents.

14.2Categories of Personal Information Collected

In the preceding 12 months, OMNI may have collected the following categories of personal information from California residents: identifiers (such as username and email address); internet or other electronic network activity information (such as pseudonymized IP address, browser type, and session data); and commercial information (such as transaction records). We do not sell or share personal information as those terms are defined under the CCPA.

14.3Your CCPA Rights

California residents have the following rights under the CCPA and CPRA:

• Right to know: you have the right to request disclosure of the categories and specific pieces of personal information we have collected about you, the categories of sources from which it was collected, the business or commercial purpose for collecting it, and the categories of third parties with whom we share it
• Right to delete: you have the right to request deletion of personal information we have collected about you, subject to certain exceptions
• Right to correct: you have the right to request correction of inaccurate personal information we maintain about you
• Right to opt out of sale or sharing: we do not sell or share your personal information as defined under the CCPA, so this right is not applicable; however, you may contact us to confirm our practices
• Right to limit use of sensitive personal information: to the extent we collect sensitive personal information as defined under the CPRA, you have the right to limit its use to what is necessary to provide the Platform services
• Right to non-discrimination: we will not discriminate against you for exercising any of your CCPA rights

14.4How to Submit a CCPA Request

To submit a verifiable consumer request under the CCPA, please contact us using the information in Section 19. We will respond within 45 days of receiving a verifiable request, or within any extended period permitted by law. We may need to verify your identity before processing your request. You may designate an authorized agent to submit a request on your behalf; authorized agents must provide written authorization from you and may be required to verify their own identity.

14.5Opt-Out Confirmation

In accordance with applicable CCPA regulations, if you submit an opt-out request regarding any data practice, OMNI will provide visible confirmation that your request has been processed within 15 business days.

Users in other jurisdictions with applicable data protection or privacy legislation may also have rights with respect to their personal data. The following is a non-exhaustive list of jurisdictions whose residents may have relevant rights and are encouraged to contact us to inquire:

• Canada (PIPEDA and provincial privacy legislation, including Quebec Law 25)
• Australia (Privacy Act 1988 and Australian Privacy Principles)
• Brazil (Lei Geral de Proteção de Dados -- LGPD)
• Japan (Act on the Protection of Personal Information -- APPI)
• South Korea (Personal Information Protection Act -- PIPA)
• India (Digital Personal Data Protection Act -- DPDPA)
• Other jurisdictions with applicable privacy or data protection legislation

OMNI is committed to responding in good faith to data rights requests from users in all jurisdictions where applicable law grants such rights. Please contact us at the address in Section 19 to submit any such request.

The Platform may contain links to third-party websites, services, or applications, including imported listings sourced from external platforms and third-party prediction market platforms aggregated within the Predictions feature. OMNI is not responsible for the privacy practices of any third-party service, and this Privacy Policy does not apply to any third-party sites or services. When a user interacts with the Predictions feature, OmniBazaar acts as an intermediary that connects users to third-party prediction market platforms and routes financial transactions in connection with that activity. In the course of facilitating this connection and transaction routing, limited data -- including session identifiers, referral tokens, transaction details, and related technical information -- may be transmitted to the relevant third-party prediction market platform. OmniBazaar does not control or influence the prediction markets themselves and is not a party to any prediction market contract. Users should review the privacy policies of any third-party prediction market platform they access through the Predictions feature.

We encourage users to review the privacy policies of any third-party services they access through or in connection with the Platform. The inclusion of a link or integration does not constitute an endorsement of that service or its privacy practices by OMNI.

The Platform is intended for users who are at least eighteen (18) years of age. OmniBazaar does not knowingly collect personal information from individuals under the age of 18. If we become aware that a minor has provided personal information through the Platform, we will take steps to delete that information and terminate the associated account as promptly as reasonably practicable.

Parents or guardians who believe their child may have provided personal information to OmniBazaar should contact us promptly through the support channels described in Section 19.

OMNI reserves the right to update or modify this Privacy Policy at any time. When material changes are made, we will notify users through one or more of the following methods: a prominent notice displayed within the Platform interface, a notification sent to the contact information associated with your account, or an updated "Last Updated" date at the top of this document.

Your continued use of the Platform following the effective date of any revised Policy constitutes your acceptance of the changes. If you do not agree to the revised Policy, you should discontinue your use of the Platform. We encourage you to review this Policy periodically.

If you have questions, concerns, or requests regarding this Privacy Policy or the handling of your information -- including requests to exercise any of the data rights described in Sections 13, 14, or 15 -- please contact us at:

Omni Administration Ltd. / Omni Development DAO

British Virgin Islands

support@omnibazaar.com

omnibazaar.com

We will endeavor to respond to all privacy inquiries within 30 days of receipt. For requests submitted under specific data protection legislation with mandatory response timelines, we will comply with those timelines as required by applicable law.