AMIKO ARENA PRIVACY POLICY Effective Date: May 18, 2026 Last Updated: May 18, 2026

This Privacy Policy explains how Aurory Project (Sunlight Project Limited), a company incorporated under the laws of the British Virgin Islands with its registered office at 2nd Floor, Ellen L. Skelton Building, Fishers Lane, Road Town, Tortola, British Virgin Islands VG1110 ("Aurory Project", "we", "us", or "our"), collects, uses, shares, and protects personal data in connection with Amiko Arena, a Web3 PvP-only video game distributed via the Epic Games Store and through amikoarena.com that runs on the Solana blockchain. Amiko Arena features the $AURY utility token, the "Aurorians" and "Amikos" NFT collections, additional NFT collectibles, weekly $AURY rewards based on player performance, an in-Game leaderboard, and the marketplace hosted at app.aurory.io (collectively, the "Web3 Services" or the "Services").

This Policy is designed to comply with the EU General Data Protection Regulation (Regulation (EU) 2016/679, "EU GDPR"), the UK General Data Protection Regulation as it forms part of UK domestic law ("UK GDPR"), the UK Data Protection Act 2018, the U.S. Children's Online Privacy Protection Act ("COPPA"), the California Consumer Privacy Act as amended by the CPRA ("CCPA/CPRA"), and other applicable data-protection laws. Our processing of personal data through blockchain technologies takes into account the European Data Protection Board's Guidelines 02/2025 on Processing of Personal Data through Blockchain Technologies.

1. CONTROLLER AND CONTACT

1.1 Data Controller. Aurory Project is the data controller for the personal data we process in connection with Amiko Arena, except where we expressly act as a processor on behalf of another controller.

1.2 Independent Third-Party Controllers. The following parties act as separate, independent controllers of the personal data they process in connection with your use of Amiko Arena:

• Epic Games, Inc. operates the Epic Games Store, Epic Account Services, and Epic Online Services ("EOS") when you create or use an Epic Account, install or launch Amiko Arena via the Epic Games Store, or use EOS-powered features such as Achievements, Friends, Voice, Player Reports, or anti-cheat. Epic's processing is governed by the Epic Games Privacy Policy and the Epic Games Store EULA.

• Solana network validators and the Solana network itself, on which on-chain transactions for Amiko Arena are recorded. Public blockchains are decentralized; we have no control over them, and data recorded on-chain is publicly visible and persistent.

• Crypto-wallet providers (e.g., Phantom, Solflare, Backpack, Ledger, or other Solana-compatible wallets) when you create, connect, or use a wallet with Amiko Arena or app.aurory.io. Wallet providers operate under their own terms and privacy policies.

• NFT marketplaces and on-chain protocols, including the app.aurory.io marketplace (operated by us) and third-party marketplaces such as Magic Eden and Tensor, where Aurorians, Amikos, and other Aurory NFT collectibles may be listed, traded, or transferred. Third-party marketplaces operate under their own terms.

1.3 Privacy Contact. For privacy questions or to exercise your rights, contact:

• Email (general): support@aurory.io

• Email (data-subject requests): GDPR@aurory.io

• Postal: Aurory Project, 2nd Floor, Ellen L. Skelton Building, Fishers Lane, Road Town, Tortola, British Virgin Islands VG1110

1.4 EU/UK Representative. Where required by Article 27 EU GDPR or UK GDPR, we have appointed an EU/UK representative. The current representative and contact details are published at amikoarena.com.

1.5 Data Protection Officer. We have not appointed a Data Protection Officer because we are not required to do so under Article 37 GDPR. Privacy enquiries are handled by the contact at Section 1.3.

2. PERSONAL DATA WE COLLECT

2.1 Account and Identification Data

• Email address

• Display name / in-Game username

• Country / region (derived from IP, declared residency, or platform data)

• Aurory account ID

• Where you access Amiko Arena via the Epic Games Store: Epic Account ID, Epic display name, country of residence as reported by Epic, and (where you grant the relevant authorization) friends list and avatar information surfaced through Epic Online Services

• Where you access Amiko Arena via amikoarena.com: the email or social-login identifier you use to authenticate

2.2 Web3-Specific Data

This data is processed when you connect a wallet to Amiko Arena, app.aurory.io, or our other Web3 Services. By design of blockchain technology, on-chain data is publicly visible and persistent on the Solana network.

• Solana wallet public address. A wallet public address is treated as personal data under EU/UK GDPR when it is, or can be, linked to an identifiable natural person (consistent with EDPB Guidelines 02/2025 and CNIL guidance).

• On-chain transaction data publicly available on the Solana blockchain (e.g., $AURY token balances, holdings of Aurorians, Amikos, and other Aurory NFT collectibles, mint records, transfers, sales, and marketplace transactions).

• Wallet-association data linking your Solana wallet address to your Aurory account.

• Signature data (cryptographic signatures used to prove control of a wallet and authorize transactions).

• $AURY reward data, including weekly distribution records, claim status, and the player-performance inputs used to calculate your allocation (playtime in Amiko Arena, win/loss results, number of Aurorians/Amikos/collectibles held, leaderboard score and placement).

• Leaderboard data, including your in-Game username, score, rank, and match results. Leaderboard data is displayed publicly inside Amiko Arena and on amikoarena.com / app.aurory.io.

• Marketplace activity on app.aurory.io, including listings, bids, purchases, and sales of NFTs priced in $AURY.

• Residency / jurisdictional declarations you make to confirm eligibility to use the Web3 Services.

We do not custody your wallet, we do not hold your private keys or seed phrase, and we cannot reverse, cancel, or modify on-chain transactions on Solana.

2.3 Transaction Data (off-chain)

Records of any transactions to which we are a party and which occur off-chain (e.g., support-related credits, manual corrections, or compliance-related reversals where technically possible). Amiko Arena does not use the Epic Games payment mechanism for any offers; all $AURY, NFT, and marketplace transactions occur on-chain via your wallet.

2.4 Gameplay and Technical Data

• In-Game progression, statistics, inventory, PvP match history

• Device and system information: operating system, hardware identifiers, GPU/CPU model, drivers, language settings, crash logs, performance telemetry

• IP address, log files, session timestamps

• Anti-cheat telemetry, including on-chain monitoring (see Section 4)

2.5 Communications and Support Data

• Messages you send to support, including via email or in-Game forms

• Bug reports, screenshots, and attachments you submit

• In-Game text or voice chat content where moderation, safety, or anti-cheat features apply. We do not record voice chat for retention purposes unless flagged for safety review.

2.6 Marketing and Research Data (only where permitted)

• Newsletter subscriptions and preferences

• Survey responses and playtest feedback you choose to provide

2.7 Cookies and Similar Technologies (amikoarena.com and app.aurory.io)

• Strictly necessary cookies for site operation

• Preference cookies (where you opt in)

• Analytics cookies (where you opt in)

A separate cookie banner on amikoarena.com and app.aurory.io describes the specific cookies and lets you manage your choices.

We do not knowingly collect special categories of personal data (Article 9 GDPR). We do not currently perform identity-verification (KYC/AML) checks. If KYC/AML becomes legally required for specific $AURY-related operations (for example, under future MiCA, FATF travel-rule, or equivalent obligations), we will publish supplemental information before collection begins.

3. PURPOSES AND LEGAL BASES

We process personal data on the following purposes and legal bases under Article 6 GDPR:

Purpose

Legal Basis

Account creation, gameplay, matchmaking, in-Game progression, customer support

Performance of a contract (Art. 6(1)(b))

Connecting your Solana wallet, retrieving your on-chain inventory (Aurorians, Amikos, collectibles), enabling on-chain transactions, distributing $AURY rewards, operating the app.aurory.io marketplace

Performance of the Web3 Terms you have accepted (Art. 6(1)(b))

Calculating weekly $AURY distributions based on playtime, wins, NFT holdings, and leaderboard placement

Performance of contract (Art. 6(1)(b)); legitimate interests in operating a fair rewards system (Art. 6(1)(f))

Operating and publishing the leaderboard

Performance of contract (Art. 6(1)(b)); legitimate interests in providing competitive features (Art. 6(1)(f))

Verifying your eligibility to use the Web3 Services (age, residency, sanctions screening of wallet addresses)

Legal obligation; legitimate interests in preventing access from restricted jurisdictions and sanctioned addresses (Art. 6(1)(c), 6(1)(f))

Security, fraud prevention, anti-cheat, account-integrity enforcement

Legitimate interests in keeping the Services safe and fair, and the legitimate interests of other players (Art. 6(1)(f)); compliance with platform and legal obligations (Art. 6(1)(c))

Service improvement, analytics, bug fixing, performance monitoring

Legitimate interests; consent where required by ePrivacy/PECR for non-essential cookies (Art. 6(1)(f), 6(1)(a))

Marketing communications

Consent (Art. 6(1)(a)); you may withdraw consent at any time

Responding to legal requests, defending legal claims, regulatory compliance

Legal obligation; legitimate interests (Art. 6(1)(c), 6(1)(f))

Where we rely on legitimate interests, we have conducted a balancing assessment and you may request a summary by contacting us at GDPR@aurory.io.

4. ANTI-CHEAT AND ANTI-FRAUD PROCESSING

Amiko Arena uses anti-cheat technology, including (where applicable) Epic Anti-Cheat (EAC) via Epic Online Services and on-chain monitoring designed to detect bot-controlled wallets, multi-account exploits in $AURY distribution, and other manipulations of the leaderboard or rewards system.

Anti-cheat processing may include scanning of memory, processes, and files relevant to the Game while it is running, and analyzing on-chain behavior, to detect cheats, exploits, and unauthorized modifications. The output of such processing may include hashes, process names, event metadata, and wallet-level behavior patterns. Findings may result in match-level interventions, leaderboard adjustments, $AURY-reward forfeiture, account sanctions, or referral to Epic.

Where a third-party vendor is used, that vendor acts as our processor under a written data-processing agreement.

5. WEB3 SERVICES: ADDITIONAL DISCLOSURES

5.1 Blockchain Immutability and Persistence. Once data is written to the Solana blockchain (including your wallet address, $AURY transfers, NFT mints, and NFT transactions), it is publicly visible and remains on-chain for as long as Solana operates. We cannot delete, modify, or reverse on-chain entries.

5.2 How We Limit On-Chain Personal Data. Consistent with EDPB Guidelines 02/2025 and CNIL guidance, we minimize on-chain personal data:

• We store personal data off-chain wherever possible. Only the minimum identifiers required for the Web3 feature to function (e.g., your wallet public address, NFT ownership records, $AURY balances) are written on-chain.

• We do not write your email address, real name, or other off-chain identifiers to the Solana blockchain.

• Where we link on-chain data to your Aurory account in our own off-chain systems, that off-chain link is deletable on request (see Section 9.3).

5.3 $AURY Token Rewards. $AURY is the utility token associated with Amiko Arena. We process your wallet address, leaderboard score, playtime, win/loss data, and NFT holdings to calculate weekly $AURY distributions. Token transfers are recorded on Solana and persist there. You are solely responsible for any tax reporting associated with $AURY rewards. We make no representation about the future value of $AURY and you should not acquire $AURY for investment purposes.

5.4 NFTs (Aurorians, Amikos, Collectibles). NFTs are minted to and held in your Solana wallet. We do not custody NFTs. When you list, transfer, or sell an NFT, the transaction is conducted on-chain through a wallet, smart contract, and a marketplace (the app.aurory.io marketplace operated by us, or third-party marketplaces such as Magic Eden or Tensor). For sales on third-party marketplaces, the marketplace operator processes personal data as an independent controller under its own privacy policy.

5.5 app.aurory.io Marketplace. When you use the app.aurory.io marketplace, we process your wallet address, listing data, bid and offer data, and completed-transaction data. Royalty fees due to us are deducted on-chain via smart contract.

5.6 Leaderboard. Your in-Game username, score, rank, and match results are published on the in-Game leaderboard and on amikoarena.com / app.aurory.io. Leaderboard data is publicly visible. If you do not wish to appear on the leaderboard, do not participate in ranked play in Amiko Arena.

5.7 Regulatory Evolution. The regulatory regime applicable to blockchain technology, crypto-assets, NFTs, and play-to-earn tokens is evolving (including the EU Markets in Crypto-Assets Regulation (MiCA), FATF travel-rule requirements, and equivalent regimes in other jurisdictions). Where new regulatory obligations require us to collect additional personal data, we will update this Policy and notify affected users before such collection begins.

5.8 Eligibility and Restricted Jurisdictions. Access to Amiko Arena and our other Web3 Services is restricted by age (18+) and residency. To enforce these restrictions, we may process IP-based geolocation, declared residency, and sanctions-screening results derived from your wallet address. The Restricted Jurisdictions list is published in our Terms of Service.

5.9 Third-Party Web3 Services. Amiko Arena relies on third-party wallets, the Solana blockchain network, third-party marketplaces (Magic Eden, Tensor), Epic's anti-cheat and online services where applicable, and other infrastructure providers. These third parties are independent of Aurory Project and operate under their own terms and privacy policies.

6. RECIPIENTS AND DISCLOSURES

We share personal data only with the following categories of recipients:

6.1 Epic Games, Inc., as an independent controller of Epic Account, Epic Games Store, and Epic Online Services data, and as a recipient of account-integrity, anti-cheat, and platform-operation information necessary for distribution of Amiko Arena via Epic. Because Amiko Arena does not use Epic's payment mechanism (per Epic's Blockchain Technology Guidelines), Epic does not process any Amiko Arena transaction or payment data on our behalf.

6.2 Crypto-wallet providers, NFT marketplaces (Magic Eden, Tensor, others), and Solana-network infrastructure providers, as independent controllers.

6.3 Hosting and infrastructure providers (cloud hosting, content delivery, database services, RPC providers for Solana) acting as our processors.

6.4 Customer-support tooling providers acting as our processors.

6.5 Analytics, crash-reporting, and telemetry providers acting as our processors.

6.6 Anti-cheat vendors, on-chain analytics, and sanctions-screening vendors acting as our processors.

6.7 Professional advisors (legal, audit, tax) under duties of confidentiality.

6.8 Authorities, courts, or other parties where required by law, to protect our rights, or to address fraud, security, or safety concerns.

6.9 Acquirers or successors in connection with a corporate transaction (merger, sale, financing, reorganization), subject to confidentiality.

In addition, on-chain personal data (your wallet public address, $AURY balance, Aurorian/Amiko/collectible holdings, transaction records, leaderboard outputs) is by design publicly visible to anyone with access to the Solana blockchain.

We do not sell personal data, and we do not "share" personal data for cross-context behavioral advertising as those terms are defined under U.S. state privacy laws.

7. INTERNATIONAL DATA TRANSFERS

Aurory Project is established in the British Virgin Islands and uses service providers located in the United States, the European Economic Area, the United Kingdom, and other jurisdictions. Where we transfer personal data of EU, EEA, or UK residents to a country that has not received an adequacy decision, we rely on appropriate safeguards under Article 46 GDPR, including the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, supplemented by additional measures where necessary.

You acknowledge that the Solana blockchain is decentralized and operated by globally distributed validators. We have no control over the geographic location of on-chain data once written. A copy of the relevant safeguards for off-chain transfers is available on request from GDPR@aurory.io.

8. RETENTION

We retain personal data only for as long as necessary for the purposes set out in this Policy:

• Account data (off-chain): for the duration of your account, plus up to two (2) years of inactivity, after which the account and associated off-chain personal data are deleted or anonymized, unless a longer period is required by law or to defend legal claims.

• Wallet-to-account association (off-chain): kept while the wallet is linked to your account, plus the retention period above; on request, we will sever the off-chain link (we cannot delete on-chain records).

• On-chain personal data: persists on the Solana blockchain for as long as Solana operates; we have no ability to delete it. See Section 9.3.

• Leaderboard records: archived for the duration of the relevant competitive season and reasonable historical-record retention.

• Off-chain transaction records: as required by applicable accounting and tax law (typically 5–10 years).

• Anti-cheat and security records: up to seven (7) years where reasonably necessary to detect repeat offenders and defend legal claims.

• Support communications: up to three (3) years from closure of the ticket.

• Marketing data: until you withdraw consent or after 24 months of inactivity, whichever is earlier.

• Cookies: as described in the cookie banner on amikoarena.com and app.aurory.io.

9. YOUR RIGHTS

If you are located in the EU, EEA, UK, or another jurisdiction granting equivalent rights, you have the right to:

• Access your personal data and receive a copy

• Request rectification of inaccurate data

• Request erasure ("right to be forgotten"), subject to Section 9.3 below

• Restrict or object to processing, including processing based on legitimate interests

• Data portability for data processed by automated means on the basis of consent or contract

• Withdraw consent at any time, without affecting the lawfulness of prior processing

• Lodge a complaint with your local supervisory authority (in the UK, the Information Commissioner's Office at ico.org.uk; in the EU, your national Data Protection Authority; in France, the CNIL)

To exercise your rights, email GDPR@aurory.io with subject line "SAR: user" (access) or "Delete: User" (erasure). We will respond within one (1) month and may request information to verify your identity.

9.1 Wallet-based requests. For requests relating to a wallet, you must demonstrate control of the wallet (typically by signing a challenge message). We cannot act on a wallet-related request from someone who cannot prove control of that wallet.

9.2 U.S. State Rights. Residents of California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, and other U.S. states with comprehensive privacy laws have analogous rights (access, deletion, correction, opt-out of sale/sharing, opt-out of targeted advertising, opt-out of certain profiling). The same contact channels apply, and we do not discriminate against you for exercising these rights.

9.3 Erasure and Blockchain Limitations. Consistent with EDPB Guidelines 02/2025, technical impossibility cannot be invoked to refuse a GDPR erasure request, but it can shape what erasure means in practice. Where you request erasure of Web3-related data:

• We will delete the off-chain records we control (your Aurory account, the link between your wallet address and that account, off-chain copies of on-chain data, leaderboard records associated with your username, support tickets, marketing data, etc.) subject to lawful retention exceptions.

• We cannot delete data already written to the Solana blockchain (including $AURY transfer history, NFT mints, NFT transactions, and your wallet's public on-chain history). The on-chain record remains, but once we sever the off-chain link, that on-chain record is no longer directly linkable to you through our systems. This implements the EDPB's recommended approach of rendering on-chain data effectively unlinkable rather than physically deleted.

• You acknowledge this limitation when you choose to use Amiko Arena.

10. CHILDREN

Amiko Arena and our other Web3 Services are not available to anyone under 18; use of the Web3 Services requires you to confirm you are at least 18 (or the age of majority in your jurisdiction if higher) and to reside outside any Restricted Jurisdiction listed in our Terms of Service.

We do not knowingly collect personal data from children under 13 (or under the applicable digital-consent age in your jurisdiction). If you are a parent or guardian and believe your child has provided personal data without your consent, please contact GDPR@aurory.io and we will delete the data in accordance with COPPA.

11. SECURITY

We implement appropriate technical and organizational measures, including encryption in transit, access controls, logging, vulnerability management, smart-contract audits (for Amiko Arena and app.aurory.io), and vendor due diligence, to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. No system is completely secure; in the event of a personal data breach affecting your rights and freedoms, we will notify you and the relevant supervisory authority as required by Articles 33 and 34 GDPR.

You are responsible for the security of your wallet, seed phrase, and private keys. We cannot recover lost keys, and a compromise of your wallet may result in the irreversible loss of $AURY, Aurorians, Amikos, and other NFT collectibles.

12. AUTOMATED DECISION-MAKING

We do not make decisions producing legal or similarly significant effects on you based solely on automated processing within the meaning of Article 22 GDPR. Anti-cheat sanctions, automated $AURY-reward calculations, leaderboard placement, and automated sanctions/blocklist screening of wallet addresses may inform our decisions, but material account actions involve human review or established appeal channels via support@aurory.io.

13. THIRD-PARTY SERVICES

Amiko Arena depends on third-party services. Those services have their own privacy policies, which we encourage you to review:

• Epic Games: legal.epicgames.com/epicgames/privacy-policy and legal.epicgames.com/en-US/store/eula

• Phantom Wallet: phantom.com/privacy

• Solflare: solflare.com/privacy

• Backpack: backpack.app/privacy

• Magic Eden: magiceden.io/privacy-policy

• Tensor: tensor.trade/privacy

• Solana Foundation: solana.org

This list is illustrative and may change. We are not responsible for the privacy practices of third parties.

14. CHANGES TO THIS POLICY

We may update this Policy from time to time. The "Last Updated" date at the top reflects the most recent revision. Material changes will be notified through the Game, the Epic Games Store store page, the amikoarena.com and app.aurory.io websites, in-Game notices, or by email where appropriate. Continued use of the Services after the effective date of an update constitutes acceptance of the updated Policy, except where additional consent is required by law.

15. CONTACT

Aurory Project (Sunlight Project Limited) 2nd Floor, Ellen L. Skelton Building Fishers Lane, Road Town, Tortola British Virgin Islands VG1110

• General: support@aurory.io

• Privacy / data-subject requests: GDPR@aurory.io

• EU/UK Representative: see amikoarena.com for current details