Privacy Policy

DRAFT — not legal advice; have a licensed attorney review.

This Privacy Policy is a draft only. It has not been reviewed or approved by a lawyer. It should not be published or relied on until a licensed attorney has reviewed and finalized it for Summit Private Credit LLC.

• Operator: Summit Private Credit LLC (the “Company,” “we,” “us,” or “our”), a Colorado limited liability company
• State of formation / governing law: Colorado
• Contact (placeholder): [CONTACT EMAIL]
• Draft date: November 11, 2026 (revised; see the counsel flag in Section 4.1)

This Privacy Policy describes how we collect, use, and share information in connection with the web interface we operate, currently presented as the Base swap terminal (the “Interface”). It should be read together with our Terms of Service. By using the Interface, you acknowledge this policy.

1. A short summary

The Interface is a non-custodial front end for token swaps on the Base blockchain. We do not collect private keys, seed phrases, or wallet passwords, and we cannot access the contents of your wallet.

If you use the Interface, we may process:

• Wallet addresses you choose to connect or submit (for example, to prepare an unsigned transaction, register a referral payout address, or store a signed limit/DCA intent);
• Referral codes and related click or attribution records;
• Signed order intent data you submit (tokens, amounts, deadlines, signatures, and status);
• Ordinary technical logs, which typically include IP address, browser or user-agent information, request path, and timestamps; and
• Information needed to generate a shareable trade card if you request one.

We do not sell your personal information. Blockchain transactions you broadcast are public by design and cannot be made private or erased by us.

The current Interface does not include third-party advertising or product-analytics software (for example, Google Analytics, Mixpanel, or similar SDKs), and it does not set advertising cookies. That may change; if we add analytics or advertising tools, we will update this policy.

2. Who we are

Summit Private Credit LLC, a Colorado limited liability company, operates the Interface. Questions about this policy may be sent to [CONTACT EMAIL].

3. Information we collect

3.1 Information you provide or that your wallet shares with the Interface

• Wallet address. If you connect an injected wallet or ask the Interface to prepare an unsigned swap, we receive the public address you designate (the “taker” or “maker” address). We do not receive your private key.
• Referral information. If you arrive through a referral link (for example, ?ref=code), we may record the referral code, the page path, a time stamp, and an optional visitor identifier supplied by the client (in the current build, a simple label such as “local” or “manual,” not a government ID). If you register as a referrer, we store the code you choose and the payout wallet address you provide, plus the disclosed referrer share then in effect.
• Referral attributions. We may store estimated or actual swap volume and fee-split amounts associated with a referral code, including whether a record was simulated.
• Limit-order and DCA intents. If you sign and submit an intent, we store the maker address, the order terms (tokens, amounts, minimum output, deadline, fee, referrer, and related parameters), the signature, and status or evaluation notes so a keeper can later evaluate or submit the intent.
• Trade-card parameters. If you generate a shareable card, the request may include token symbols, amounts, a fee, a route label, and a time stamp so the image can be rendered.
• Communications. If you email us, we will receive the content of that message and the address you use to send it.

We do not ask you to create a traditional username-and-password account in the current Interface, and we do not collect seed phrases or private keys. Please never send those to us.

3.2 Information collected automatically

When you load pages or call our application programming interfaces, our servers and hosting environment may create ordinary access logs. Those logs typically include:

• IP address;
• date and time of the request;
• request path or referrer URL;
• browser, device, or user-agent string; and
• basic error or performance information.

The current Interface does not use advertising cookies or third-party analytics SDKs. A technical or session cookie may be used by the hosting platform or web framework if required to operate or secure the site. You can control cookies through your browser settings; disabling cookies may affect some features.

We do not currently collect precise geolocation (such as GPS). An IP address can sometimes be used to infer a rough location.

3.3 Information we do not collect from you on-chain as a custodian

We are not a custodian. Token balances, approvals, and completed swaps live on the public Base blockchain (and on any other network you use). We may read public chain data — through a public or third-party RPC endpoint — to quote routes, simulate a token safety check, or evaluate an intent. That public data is not something we can delete.

3.4 Simulated or dry-run records

Some builds store simulated trades and dry-run keeper evaluations locally so the Interface can be tested without broadcasting a transaction. Those records may include the same categories of quote, fee, and wallet-address data described above.

4. How we use information

We use the information described above to:

• operate, quote, route, and improve the Interface, including split routing across Uniswap v3 and Aerodrome on Base;
• display disclosed interface fees and, when enabled, collect those fees through a fee-router contract;
• operate the referral program (tracking codes, registering payout addresses, and attributing a disclosed share of the interface fee);
• store and evaluate signed limit and DCA intents for possible keeper execution;
• generate trade cards you request;
• provide informational token safety-check results;
• secure the Interface, prevent abuse or fraud, and debug errors;
• comply with law, including sanctions screening where we choose or are required to apply it, and respond to lawful requests; and
• communicate with you if you contact us.

We do not use your information to provide investment advice.

4.1 Aggregated usage data, analytics, and our own trading decisions

> ⚠ FLAG FOR COUNSEL — new disclosure added November 11, 2026. Do not publish until reviewed. Questions for counsel are listed at the end of this subsection.

We may combine information about how the Interface is used into aggregated, de-identified statistics — for example, total quote and swap volume by token pair, route or venue usage, fee-tier totals, referral-program totals, popular tokens, and time-of-day activity. Aggregated statistics are grouped across many users and are not linked to a wallet address, IP address, referral code, or other identifier of any individual user.

We may use those aggregated, de-identified statistics:

• for analytics, to understand and improve the Interface, plan capacity, and measure the referral program; and
• to inform our own trading and investment decisions. Summit Private Credit LLC and its affiliates may trade digital assets, including tokens available through the Interface, for their own account.

What we will not do. We will never use an individual user's pending or not-yet-executed activity — including a quote request, an unsigned transaction we prepared for you, a signed limit-order or DCA intent that has not been filled or cancelled, or a transaction you are about to submit — to trade ahead of, alongside, or against that user, and we will not share that individual activity with anyone for that purpose. Our trading decisions draw only on aggregated, de-identified statistics and on public information (including public blockchain data).

When we keep de-identified data, we take reasonable measures so that it cannot reasonably be linked back to an individual, we publicly commit not to try to re-identify it, and we require any recipient of it to make the same commitment. Information about completed transactions that is already public on a blockchain is not covered by this paragraph; anyone, including us, can see it (see Section 5).

Counsel review questions (remove before publication):

1. Is this disclosure sufficient and appropriately prominent, or should the operator's own-account trading also be disclosed in the Terms of Service and near the swap button?
2. Does using aggregated flow data for proprietary trading raise conflict-of-interest, market-manipulation, front-running, or "unfair or deceptive practice" concerns under federal law (FTC Act §5, CFTC/SEC rules where any traded asset may be a commodity or security) or Colorado law, even with the pending-order prohibition?
3. Does "aggregated, de-identified" meet the Colorado Privacy Act and other state definitions of de-identified data, given that on-chain activity can sometimes be linked to wallets? Are minimum aggregation thresholds, time delays, or internal information barriers needed?
4. Should the Company adopt and document an internal policy (who can access aggregate data, delay before use, logging/audit, no access to the pending-intent store by anyone making trading decisions)?
5. Does the referral program or any partner agreement restrict this use?

5. On-chain data is public

If you (or a keeper acting on a signed intent) submit a transaction to Base or another public network, the transaction, your wallet address, token amounts, the fee-router contract interaction, and any referral payout are typically visible to anyone with access to the blockchain, forever. Block explorers, RPC providers, and analytics firms may collect and republish that data. We cannot make public chain data private and cannot honor a deletion request for data that lives only on a blockchain.

6. How we share information

We do not sell personal information, and we do not share it for cross-context behavioral advertising.

We may share information:

• With service providers that help us host, log, or operate the Interface (for example, a hosting provider, or a public Base RPC endpoint such as the official public Base RPC). Those parties process information on our behalf or as independent operators of infrastructure you also interact with.
• With market-data and search providers you trigger through the Interface. For example, token search, prices, and charts may be requested from public sources such as DexScreener. Those providers may receive the token or query you searched and ordinary request metadata, and their own privacy policies apply.
• With public protocols and networks. Unsigned or signed transactions you approve are sent, at your direction, to Uniswap v3, Aerodrome, our fee-router contract (if deployed), and the Base network. Those systems are public or third-party-controlled.
• With Across Protocol, if you use the cross-chain zap. To quote a bridge, the Interface sends Across the tokens, amount, chains, and the depositor/recipient wallet address you supply. A disclosed integrator app fee on the bridge leg is collected by Across and paid to our address on Base; Across's own policies apply.
• With Coinbase, if you choose "Buy with card (Coinbase)." When that feature is enabled, our server asks Coinbase for a one-time session token, sending your connected wallet address, the asset and network (Base), and your IP address, as Coinbase requires. You then complete the purchase on a Coinbase-hosted page under Coinbase's own terms and privacy policy; Coinbase handles identity verification (KYC) and payment. We do not receive your card details or identity documents and earn no fee from Coinbase for those purchases.
• With referrers, only as the program requires. A referrer may see aggregated click or attribution statistics for their code. Payouts, when live, occur on-chain to the address the referrer registered.
• For legal reasons, including to comply with applicable law, a valid legal process, or to protect the rights, safety, or property of the Company, our users, or the public, including in connection with sanctions or fraud prevention.
• In a business transfer, such as a merger, acquisition, financing, or sale of assets, subject to appropriate confidentiality and this policy’s principles.

Your wallet software, browser, and any extension you use may collect information under their own policies. We do not control those products.

7. Retention

We retain off-chain records only as long as reasonably needed for the purposes above, including to operate referrals and open intents, maintain security and audit trails, resolve disputes, and meet legal or accounting obligations.

Typical categories:

• Server and access logs: retained for a limited operational period (for example, weeks to months) unless needed longer for security or legal reasons.
• Referral registrations, clicks, and attributions: retained while the program is active and for a reasonable period afterward for accounting and fraud prevention.
• Signed intents: retained while open, and for a reasonable period after expiry, fill, or cancellation.
• Simulated-trade records in test builds: retained for development and debugging and may be deleted when no longer needed.
• Correspondence: retained as needed to complete your request and keep a business record.

When we no longer need off-chain personal information, we will delete or de-identify it, except where retention is required by law or needed to resolve a dispute. On-chain data cannot be deleted by us.

8. Security

We use reasonable administrative and technical measures appropriate to a non-custodial web interface. No method of transmission or storage is completely secure. You are responsible for securing your own wallet, devices, and keys. A transaction you sign is typically irreversible once confirmed.

9. Your choices and rights

Depending on where you live (including under Colorado privacy law, if and when it applies to us), you may have rights to request access to, correction of, or deletion of certain personal information we hold off-chain, or to appeal a decision on a request. To make a request, contact [CONTACT EMAIL]. We may need to verify your request (for example, by confirming control of a wallet address or email). We will not honor a request to delete information we must keep by law, or information we do not control, including public blockchain records.

You can also:

• decline to connect a wallet, in which case some features will not work;
• avoid referral links or not register a payout address;
• refrain from submitting signed intents or requesting trade cards; and
• stop using the Interface.

We do not “sell” personal information as that term is commonly used, and we do not use or share it for targeted advertising in the current Interface. If that changes, we will update this policy and provide any required opt-out.

10. Children

The Interface is not directed to children under 18 (or the age of majority in your jurisdiction), and we do not knowingly collect personal information from them. If you believe we have done so, contact us and we will take appropriate steps to delete off-chain information we control.

11. International visitors

We are organized in Colorado in the United States. If you access the Interface from another country, you understand that your information may be processed in the United States and in any other location where we or our service providers operate, where privacy laws may differ from those in your home country.

12. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the date at the top of this page. Material changes will be indicated by posting the updated policy on the Interface (and, where required, by additional notice). Your continued use of the Interface after an update is posted means you acknowledge the revised policy.

13. Contact

Questions, requests, or complaints about this Privacy Policy may be sent to [CONTACT EMAIL].

Summit Private Credit LLC, a Colorado limited liability company — draft Privacy Policy for the Base swap terminal. Not legal advice. Not for publication until attorney review is complete and the contact placeholder ([CONTACT EMAIL]) is filled in.