Privacy Policy

This Privacy Policy ("Policy") describes how Bishop ("we", "us", or "our") collects, uses, stores, shares, and protects your personal information when you access or use the Bishop ("Platform"). Bishop is a decentralized prediction market built on the Solana blockchain, where users trade on the probability of real-world events across politics, sports, finance, and global trends. The core Platform operates in a permissionless, non-custodial manner and does not require identity verification (KYC) to participate in prediction markets. However, Bishop also offers Bishopay — a built-in fiat on-ramp that enables users to deposit real-world money using traditional payment methods. Bishopay is subject to separate regulatory requirements described in this Policy. By registering an account or using the Platform, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein. This Policy is incorporated by reference into our Terms of Service.

1. Information We Collect

We collect information in the following categories in order to provide, maintain, and improve the Platform:

2. How We Use Your Information

We process your personal information for the following purposes, each supported by a lawful basis under applicable data protection law:

• Account Management: To create, maintain, and secure your account, including processing authentication.
• Platform Operations: To facilitate prediction market trading, process deposits and withdrawals, settle markets, and provide all core Platform functionality on our decentralized Solana-based infrastructure.
• Bishopay Fiat On-Ramp: To process fiat deposits and withdrawals via Bishopay, including converting fiat currency to USDC or Bishop Coin (BSHP), verifying payment methods, and complying with applicable payment and financial regulations.
• Compliance and Legal Obligations: To comply with applicable laws and regulations. Note: KYC/AML obligations apply specifically to Bishopay fiat transactions. The core decentralized prediction market does not require identity verification.
• Fraud Prevention and Security: To detect, investigate, and prevent fraudulent activity, market manipulation, unauthorised access, and other prohibited conduct.
• Customer Support: To respond to your enquiries, resolve disputes, and provide technical assistance.
• Communications: To send transactional notifications (trade confirmations, withdrawal alerts, security notices) and, where you have opted in, promotional communications about new features and offers.
• Analytics and Improvement: To analyse usage patterns, monitor Platform performance, conduct research, and improve our decentralized prediction market products and services.
• Personalisation: To tailor your experience on the Platform, including recommending prediction markets and displaying relevant content based on your trading history and preferences.
• Responsible Trading: To monitor trading behaviour and enforce responsible trading tools such as deposit limits and self-exclusion.
• Legal Claims: To establish, exercise, or defend legal claims arising in connection with the Platform.

3. Legal Bases for Processing

Where applicable data protection law requires a lawful basis for processing, we rely on the following:

• Contractual Necessity: Processing required to perform our contract with you, including operating your account, executing prediction market trades, and processing Bishopay fiat payments.
• Legal Obligation: Processing necessary to comply with applicable laws, including AML/KYC regulations applicable to Bishopay fiat transactions, tax obligations, and regulatory reporting requirements.
• Legitimate Interests: Processing for our legitimate business interests, including fraud prevention, Platform security, analytics, and improving our services, where such interests are not overridden by your rights.
• Consent: Processing based on your explicit consent, such as for marketing communications or optional data collection. You may withdraw consent at any time without affecting the lawfulness of prior processing.

4. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to operate and improve the Platform. The categories of cookies we use are as follows:

You can manage or disable cookies through your browser settings. Please note that disabling certain cookies may impair the functionality of the Platform. For more information, refer to your browser's help documentation.

5. Third-Party Sharing and Disclosure

We do not sell your personal information to third parties. We may share your information in the following circumstances:

• Service Providers: We share data with trusted third-party vendors who assist us in operating the Platform, including Stripe (for Bishopay fiat payment processing), cloud hosting providers, email delivery providers (Resend), analytics platforms, and customer support tools. These providers are contractually bound to process your data only on our instructions and in accordance with applicable law.
• Bishopay KYC and AML Partners: When you use Bishopay for fiat deposits or withdrawals, we share identity documents and verification data with regulated third-party KYC/AML service providers to fulfil applicable payment regulatory obligations. This applies only to Bishopay users and does not affect users who trade exclusively with USDC or Bishop Coin.
• Blockchain Infrastructure: On-chain transactions (trades, settlements, wallet interactions) are recorded on the Solana blockchain and are publicly visible by nature of the decentralized protocol. Bishop does not control or restrict access to on-chain data.
• Legal and Regulatory Authorities: We may disclose your information to law enforcement agencies, regulatory bodies, courts, or other government authorities where required by law, court order, or regulatory directive, or where we believe disclosure is necessary to protect the rights, property, or safety of Bishop, our users, or the public.
• Business Transfers: In the event of a merger, acquisition, restructuring, or sale of all or part of our business, your personal data may be transferred to the acquiring entity as part of that transaction. We will notify you of any such transfer and any changes to this Policy.
• With Your Consent: We may share your information with third parties where you have given explicit consent, such as for integration with third-party services you choose to connect to your account.
• Aggregated or Anonymised Data: We may share aggregated, anonymised, or de-identified data that cannot reasonably be used to identify you with partners, researchers, or the public for analytical or promotional purposes.

6. Bishopay — Fiat On-Ramp and Payment Privacy

Bishopay is Bishop's built-in fiat on-ramp that enables users to deposit real-world money (fiat currency) using Visa or Mastercard and have it automatically converted into USDC or Bishop Coin (BSHP) for use on the Platform. Bishopay is designed to make Bishop accessible to users who do not hold cryptocurrency, while preserving the decentralized nature of the underlying prediction market protocol.

Because Bishopay processes fiat currency, it is subject to regulatory requirements that do not apply to the core decentralized Platform. The following privacy considerations apply specifically to Bishopay:

• Payment Processing: All fiat payments via Bishopay are processed by Stripe, a globally trusted payment infrastructure. Your card details are encrypted end-to-end and are never stored on Bishop's servers. Stripe's own privacy policy governs the handling of your payment data.
• Identity Verification for Fiat: Users who wish to make fiat deposits or withdrawals via Bishopay are required to complete identity verification (KYC) as mandated by applicable payment and financial regulations. This is a one-time process. Users who trade exclusively with USDC or Bishop Coin are not subject to this requirement.
• Fiat Transaction Records: Records of Bishopay fiat transactions (deposit amounts, currency conversions, timestamps) are retained for a minimum of seven (7) years to comply with financial record-keeping obligations.
• Decentralized Protocol Separation: Once your fiat deposit is converted to USDC or Bishop Coin by Bishopay, all subsequent trading activity occurs on the decentralized Solana-based protocol. Bishop does not link your on-chain trading activity to your Bishopay identity data for any purpose other than fraud prevention and regulatory compliance.
• PCI-DSS Compliance: Bishopay's payment infrastructure complies with Payment Card Industry Data Security Standards (PCI-DSS). No card data is stored, processed, or transmitted outside of PCI-DSS compliant systems.

Use of Bishopay is entirely optional. Users who prefer to maintain full privacy may deposit USDC or Bishop Coin directly to their wallet without using Bishopay.

7. International Data Transfers

Bishop operates globally as a decentralized prediction market, and your personal data may be transferred to and processed in countries outside your country of residence, including countries that may not provide the same level of data protection as your home jurisdiction. Where we transfer personal data internationally, we implement appropriate safeguards to ensure your data remains protected, including:

• Standard contractual clauses approved by relevant data protection authorities.
• Adequacy decisions recognising the destination country's data protection standards.
• Binding corporate rules where applicable.
• Other legally recognised transfer mechanisms under applicable data protection law.

By using the Platform, you acknowledge and consent to the transfer of your personal data to countries outside your jurisdiction as described in this section.

8. Data Retention

We retain your personal information for as long as necessary to fulfil the purposes for which it was collected, including to provide our services, comply with legal obligations, resolve disputes, and enforce our agreements. Specific retention periods include:

• Account Data: Retained for the duration of your account and for a minimum of five (5) years following account closure.
• Bishopay KYC and Identity Documents: Retained for a minimum of five (5) years following the end of the Bishopay relationship, in accordance with applicable anti-money laundering legislation. This applies only to users who have used Bishopay for fiat transactions.
• Transaction Records: Retained for a minimum of seven (7) years to comply with financial record-keeping and tax reporting obligations.
• Communications and Support Records: Retained for up to three (3) years following the resolution of the relevant matter.
• Marketing Data: Retained until you withdraw consent or opt out of marketing communications, after which it is deleted or anonymised.
• Technical Logs: Retained for up to twelve (12) months for security and performance monitoring purposes.

When data is no longer required, we securely delete or anonymise it in accordance with our data disposal procedures. Certain data may be retained for longer periods where required by law or where we have a legitimate interest in doing so, such as in connection with ongoing legal proceedings.

9. Data Security

We implement comprehensive technical and organisational security measures to protect your personal information against unauthorised access, disclosure, alteration, loss, or destruction. Our security practices include:

• Encryption of data in transit using TLS/SSL protocols and encryption of sensitive data at rest.
• Strict access controls ensuring that only authorised personnel can access personal data on a need-to-know basis.
• Multi-factor authentication requirements for administrative access to systems containing personal data.
• Regular security assessments, penetration testing, and vulnerability scanning of our infrastructure.
• Incident response procedures to detect, contain, and remediate data security incidents promptly.
• Employee training on data protection and security best practices.
• Contractual security obligations imposed on all third-party service providers who process personal data on our behalf.
• PCI-DSS compliant payment infrastructure for all Bishopay fiat transactions processed via Stripe.

Despite these measures, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security of your data. In the event of a data breach that is likely to result in a high risk to your rights and freedoms, we will notify you and relevant authorities as required by applicable law.

10. Your Privacy Rights

Depending on your jurisdiction, you may have the following rights in relation to your personal data. We are committed to honouring these rights in accordance with applicable law:

• Right of Access: You have the right to request a copy of the personal data we hold about you and information about how we process it.
• Right to Rectification: You have the right to request correction of inaccurate or incomplete personal data we hold about you.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, or where you withdraw consent. This right is subject to our legal retention obligations, particularly for Bishopay fiat transaction records.
• Right to Restriction of Processing: You may request that we restrict the processing of your personal data in certain circumstances, such as while a dispute about accuracy is resolved.
• Right to Data Portability: Where processing is based on consent or contract and carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format.
• Right to Object: You have the right to object to processing based on our legitimate interests, including profiling, and to opt out of direct marketing at any time.
• Rights Related to Automated Decision-Making: You have the right not to be subject to decisions based solely on automated processing, including profiling, that produce significant legal or similarly significant effects, unless such processing is necessary for a contract or authorised by law.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

To exercise any of these rights, please contact our Privacy Team at privacy@bishop.exchange. We will respond to your request within 30 days. We may need to verify your identity before processing your request. In some cases, we may be unable to fulfil your request due to legal obligations or other legitimate grounds, in which case we will explain the reasons.

11. Children's Privacy

The Platform is strictly intended for users who are 18 years of age or older (or the legal age of majority in their jurisdiction, whichever is higher). We do not knowingly collect, solicit, or process personal information from individuals under the age of 18. If you are under 18, you must not use the Platform or provide any personal information to us. If we become aware that we have inadvertently collected personal data from a person under 18, we will take immediate steps to delete that information from our systems and close any associated account. If you believe a minor has provided us with personal information, please contact us immediately at privacy@bishop.exchange.

12. Third-Party Links and External Services

The Platform may contain links to third-party websites, applications, or services that are not operated or controlled by Bishop. This Policy does not apply to those third-party services. We have no control over and assume no responsibility for the content, privacy practices, or security of any third-party sites or services. We encourage you to review the privacy policies of any third-party services you access through the Platform before providing any personal information.

Third-party services integrated into the Platform, such as Stripe (for Bishopay fiat payments) and analytics providers, operate under their own privacy policies. By using these integrated services, you are also subject to their respective privacy terms.

13. Marketing Communications and Preferences

With your consent, we may send you promotional emails, push notifications, and in-platform messages about new features, prediction markets, promotions, and other updates related to the Platform. You can manage your communication preferences at any time by:

• Updating your notification settings in your account profile.
• Clicking the "unsubscribe" link in any marketing email we send you.
• Contacting our support team at support@bishop.exchange.

Please note that even if you opt out of marketing communications, we will continue to send you transactional and service-related messages that are necessary for the operation of your account, such as trade confirmations, withdrawal notifications, and security alerts. These communications cannot be opted out of while your account remains active.

14. Regulatory Compliance

Bishop is a decentralized prediction market protocol. The core Platform does not require identity verification (KYC) to participate in prediction markets, consistent with the permissionless nature of decentralized finance. However, Bishopay — our built-in fiat on-ramp — is subject to regulatory obligations applicable to fiat payment processing. These obligations include:

• Bishopay Identity Verification (KYC): Users who wish to make fiat deposits or withdrawals via Bishopay are required to verify their identity as mandated by applicable payment regulations. This is a one-time process and applies only to Bishopay users.
• Anti-Money Laundering (AML): We monitor Bishopay fiat transactions for signs of money laundering, terrorist financing, and other financial crimes. We are required to report suspicious activity to relevant authorities without notifying the subject of the report.
• Sanctions Screening: We screen Bishopay users against international sanctions lists and may be required to freeze or restrict accounts identified as matching sanctioned individuals or entities.
• Tax Reporting: We may be required to collect and report certain financial information to tax authorities in applicable jurisdictions in connection with Bishopay fiat transactions.

Processing carried out for regulatory compliance purposes in connection with Bishopay is based on our legal obligations and cannot be restricted or objected to. Failure to provide required information may result in restrictions on Bishopay access. The core prediction market remains accessible without these requirements.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. We will notify you of material changes by posting the updated Policy on the Platform and updating the "Last updated" date at the top of this page. For significant changes that materially affect how we process your personal data, we will provide more prominent notice, which may include an email notification to the address associated with your account. Your continued use of the Platform after the effective date of any changes constitutes your acceptance of the revised Policy. If you do not agree to the revised Policy, you must stop using the Platform and may request account closure. Changes to this Policy do not affect your rights and obligations under our Terms of Service.

16. Contact Us and Data Protection Enquiries

If you have any questions, concerns, or complaints about this Privacy Policy, our data processing practices, or wish to exercise your privacy rights, please contact our Privacy Team:

We will acknowledge your request within 5 business days and aim to resolve all privacy enquiries within 30 days. If you are not satisfied with our response, you may have the right to lodge a complaint with the relevant data protection supervisory authority in your jurisdiction. For questions relating to your account, trading activity, or general platform usage, please also refer to our Terms of Service.