Global privacy notice

1. Controller and scope

CMM SMART AI SOLUTIONS LLC is the controller for data processed to operate Air Battle. Address: 30 N Gould St Ste N, Sheridan, Wyoming 82801-6317, USA. Privacy: support@air-battle.com. Match support: support@air-battle.com. Company website: https://cmmsmartaisolutions.com. This notice covers the air-battle.com landing and play.air-battle.com game; wallets, networks and external services have their own notices. For matters concerning CMM SMART AI SOLUTIONS LLC itself, use support@cmmsmartaisolutions.com.

Registration: Wyoming Secretary of State, Filing ID 2026-002030841. Type: Limited Liability Company - Domestic. Address: 30 N Gould St Ste N, Sheridan, Wyoming 82801, USA. Air Battle privacy contact: support@air-battle.com. CMM SMART AI SOLUTIONS LLC corporate contact: support@cmmsmartaisolutions.com.

2. Data, sources and identification

Landing visits serve first-party files; the server and hosting provider may receive IP address, timestamp, requested resource and connection information. The landing radar and calculator run locally without a wallet. No newsletter form or active Google tools were found in the audited version.

The game processes public wallet address, network, session identifiers, sign-in challenges/signatures, optional profile, alias, selected badge, preferences and match data: room, opponent, turns, positions, outcomes, entries, prizes, refunds and transaction references. A sign-in signature does not disclose private keys or by itself authorize fund transfers. Sources are the user, their wallet, network/RPC services and server checks. Public addresses or hashes can remain personal data where activity can be linked to an individual.

3. Purposes and legal bases

Sign-in, requested matches, deposit/payment verification and support: performance of the requested service or precontractual steps, where that legal basis applies. Security, abuse prevention, result integrity and legal claims: assessed legitimate interests limited to necessity, or a specific legal duty. Accounting and lawful authority requests rely on identified obligations, not a general justification to retain everything indefinitely.

Public profile/ranking is a separate voluntary choice that can be hidden; the list does not publish a wallet by default. Optional analytics, advertising and nonessential personalization require separate prior consent if introduced. Where local law does not recognize legitimate interests or requires another authorization, the relevant local basis must be used. Optional tracking is not a condition of service. Privacy acknowledgment is not advertising consent.

4. Networks, contracts and public data

Air Battle has separate markets: Base (8453), native USDC with 6 decimals; BNB Smart Chain (56), Binance-Peg token displayed as USDT with 18 decimals; World Chain (480), USDC with 6 decimals. A match does not combine funds across networks. Addresses, amounts and authorized transactions are visible according to the relevant blockchain and may be copied by explorers and other participants.

Do not place names, email, phone, documents or support narratives in transactions. The company cannot promise deletion of replicated public blockchain history; it handles rights over data it controls and explains the technical and legal limits of each request. Such limits do not remove minimization duties or justify adding unnecessary personal data onchain.

5. Wallets, World ID and sponsorship

A chosen connection may contact Reown/WalletConnect, Coinbase/Base Account or World App. Reown analytics and Base Account telemetry/automatic attribution are configured off. A requested connection may require provider storage and communications; each SDK version/device must be checked rather than treating everything it does as necessary.

World ID returns cryptographic proofs, a session identifier and a nullifier-derived digest for verification and replay protection; audited game code does not request iris images or biometric documents. This does not describe or replace processing by World under its own notice. World ID is not a wallet or complete age/residence verification. World App signing is separate. A gas sponsor may receive account, contract, function, network, operation and limits; this does not give it access to support tickets.

6. Support, contact and communications

Tickets associate verified wallet/match context with name, email, phone, category, subject, a 250–5000 character description, status and administrator notes. They are used to investigate and reply to the supplied email. The 48-business-hour support target does not replace statutory privacy-rights deadlines. The current form requires a phone number; necessity must be documented or the field made optional before public release.

Do not share keys, recovery phrases, access codes, card data or intimate information. Tickets are not used as a marketing list. Necessary service communications do not require a marketing checkbox. A future newsletter must have separate enrollment, specific notice and an unsubscribe link in each message; it is not active in the audited version.

7. Recipients and limited access

Services planned or used, depending on the feature: IONOS (hosting), self-hosted Supabase (database), Reown and Coinbase Wallet (wallet connections), World App and World ID (wallet and verification), Google Analytics (only with analytics consent) and Google Tag Manager (disabled), and Discord (external community link). For further information about Air Battle providers and applicable safeguards, email support@air-battle.com. For corporate matters concerning CMM SMART AI SOLUTIONS LLC, email support@cmmsmartaisolutions.com.

Reown Inc. provides Reown connection services. Its policy describes processing of IP addresses, wallet addresses and technical connection metadata. This does not mean Air Battle receives all data processed across Reown services. Official policy: https://reown.com/privacy-policy. Terms: https://reown.com/terms-of-service.

Coinbase Wallet and Coinbase Wallet Account: their policy identifies Coinbase Bermuda Technologies Limited as controller in applicable jurisdictions. Coinbase Developer Platform and Paymaster are separate services; the applicable terms and entity must be confirmed for the operator account. Wallet policy: https://wallet.coinbase.com/privacy-policy. General Coinbase policy: https://www.coinbase.com/legal/privacy.

World App: Tools for Humanity terms identify Tools for Humanity Corporation outside the EU, EFTA and UK, and Tools for Humanity GmbH in those regions. World ID is a protocol with different providers; not all processing is attributed to a single entity. Terms: https://www.toolsforhumanity.com/legal. Privacy: https://www.toolsforhumanity.com/legal/privacy-notice. Protocol information: https://world.org/legal/world-id-user-terms-and-privacy.

Google Analytics 4 measures visits only after analytics consent. Measurement ID G-6HSKB559FW is used directly, without loading the GTM container or Google Ads. Advertising consent parameters remain denied. Google may process browser/session identifiers and technical connection data; we do not send wallets, emails, phone numbers, room codes or match IDs. Page context excludes queries, fragments and referrers. Google terms: https://business.safety.google/adsprocessorterms/. Transfers: https://business.safety.google/adsdatatransfers/.

The source configures public RPCs for Base (mainnet.base.org), BNB Smart Chain (bsc-dataseed.bnbchain.org) and World Chain through Alchemy (worldchain-mainnet.g.alchemy.com/public). An RPC receives requests and technical connection data; a wallet may use its own infrastructure. The Alchemy legal center identifies Alchemy Insights, Inc.: https://legal.alchemy.com/.

IONOS Inc. provides VPS hosting, with the data center in the United States. The operator identifies IONOS as the provider of the official mailboxes. Supabase is used as self-hosted software; using it alone does not imply data hosting by Supabase Cloud. Discord opens as an external link and has its own privacy policy: https://discord.com/privacy. For further information about providers and applicable safeguards, email support@air-battle.com.

8. International transfers

The company is in the United States. Hosting country alone does not identify every destination: support, subprocessors, providers and networks may process data elsewhere. We do not claim the company or every provider is Data Privacy Framework certified. That mechanism may be used only for recipients actually certified, within its scope and while the relevant adequacy decision remains effective; otherwise appropriate safeguards, such as applicable standard contractual clauses and additional measures, must be assessed.

UK transfers require assessment of an IDTA/Addendum and transfer risk; Swiss transfers require relevant adaptations. Brazil requires a recognized mechanism, including ANPD clauses where appropriate; EU clauses do not automatically replace it. Canada requires accountability for providers and transparency; Argentina and Mexico have their own rules. Cookie consent is not blanket authorization for transfers or publishing personal data on public chains.

9. Retention and deletion

Operator-approved criterion: retain data only as long as needed to provide the service, handle issues and meet actually applicable obligations and limitation periods. Support tickets and emails are retained while handling the issue and afterwards only for a justified need; profiles during the service relationship and while necessary; financial match records for applicable accounting, tax or claims periods. Those periods are not automatically extended to unnecessary conversations or profile data. Legal holds are limited to affected records with restricted access. Privacy law does not prescribe one universal period for all these categories.

Retention is determined by the record purpose, the duration of the requested service, issue resolution and applicable legal obligations or claims periods. A claim may justify restricted retention of affected records. Unnecessary data is deleted or anonymized; keeping financial evidence does not imply indefinite retention of conversations or profiles. Blockchain transactions are public and cannot be erased by Air Battle. Analytics is used only with consent and stops generating new sends when withdrawn.

10. Cookies, choices and GPC

The landing and game load Google Analytics only after you allow the analytics category and the choice is recorded. Before that, no Google tag or cookieless pings are sent. Advertising, personalization and GTM remain disabled.

“Privacy settings” lets you review or change choices at any time. Optional categories default off; unavailable categories are identified. GPC disables advertising sale/sharing in this browser. The audited configuration does not sell or share information for cross-context behavioral advertising. Necessary communications for a requested function are not thereby advertising sales. Wallets, signatures, email, phone and match secrets are not sent to analytics or advertising.

11. Your rights and how to exercise them

Write to support@air-battle.com with the requested right and enough context to locate records. Rights may include access, correction, deletion, objection, restriction, portability, consent withdrawal and decision review where applicable. Verification is proportionate; never provide a private key. Rejecting cookies or applying GPC does not require identification. Authorized agents must establish authority where appropriate. Exercising rights does not result in a penalty.

EEA/UK requests normally receive a response within one month, subject to a lawful explained extension. California access/correction/deletion requests normally within 45 calendar days, with any permitted extension; opt-outs do not wait for that deadline. Brazil, Canada, Mexico and Argentina have their own rights/deadlines. Shorter applicable deadlines take priority. You may complain to your competent authority, including an EEA authority, ICO, California CPPA/Attorney General, ANPD, Canadian OPC/provincial authority, the current Mexican authority or AAIP. This list does not restrict your rights.

12. Automated decisions and review

The server applies published rules to turns, deadlines, results, limits and payment checks. Blockchain confirmation is not human adjudication of a complaint. If an automated decision significantly affects you, you may ask support for an explanation and human review, without limiting additional applicable safeguards.

World ID verification and wallet signing alone do not establish civil identity, legal age or residence. Advertising based on financial profiles or support narratives is not used.

13. Children and sensitive data

Paid-entry/prize matches are directed only to people meeting the applicable legal age. Optional tracking of children will not be designed or their advertising consent requested. If improperly processed child data is identified, we assess required deletion or restriction.

Support does not request health data, sexual orientation, personal documents or biometric images. Do not include them. Any future flow requiring sensitive categories or additional verification needs its own assessment, notice and basis before activation.

14. Security and notice changes

We apply role-based access controls and session protection. No system eliminates all risk. Breaches will be assessed and notified according to applicable obligations and deadlines.

Scheduled effective date: 11/20/2026 at 12:00 PM UTC. Material changes will be communicated and a new choice obtained before activating optional purposes requiring consent. Previously accepted versions and receipts retain their original content.