Privacy Policy

This policy covers visits to esx.io, the current Join-the-Launch interface and the inactive Contact form. It does not govern future ESX accounts, applications, payments, investment transactions, project workspaces or other platform services. Separate or updated notices will be provided before those services process personal data.

ESX — Entertainment Stock Exchange is currently a pre-incorporation business project intended to be operated through a U.S.-based company following incorporation. Intended operating jurisdiction: United States.

The final incorporated operating entity, controller identity, registered address and other legally required company information will be published following incorporation and before production personal-data processing or services requiring those disclosures are activated.

No incorporated ESX company, legal form or U.S. state of formation is represented as existing or confirmed by this policy.

The data involved depends on how a visitor uses the website. The current implementation does not provide user accounts, authentication, payments, investment transactions or persistent project activity.

• Website delivery: technical request information needed to deliver and protect the site, which can include an IP address, request time, requested URL, referrer, browser or device information, protocol and response status.
• Join the Launch, only when enabled: email address, optional audience-interest classification, Double Opt-In confirmation status and related service metadata where applicable.
• Contact: no submitted inquiry data at present because the form is inactive and prevents submission.

Web hosting infrastructure receives technical request data to return pages, maintain availability and help protect the service. The final production hosting provider, processing locations, log contents and retention settings must be confirmed against the deployed service before production approval.

Based on the current website source, ESX has not configured non-essential analytics, advertising technology, tracking pixels, third-party embeds, external fonts or site-authored use of cookies, localStorage, sessionStorage or IndexedDB. Deployed infrastructure may behave differently and will require a production runtime review.

The website contains a server-side Double Opt-In integration with Brevo, but public production signup is disabled. If the flow is approved and enabled later, a visitor may voluntarily submit an email address and may choose an audience-interest classification for ESX launch communications, platform updates, project announcements and related consented communications.

The available interest categories are Creator / Producer, Fan, Investor, Studio / Industry Professional and Institutional / Professional User. A category describes communications interest only. It is not investor accreditation, investment status, eligibility, suitability, financial classification or a determination that any opportunity is available.

After submission, Brevo would request confirmation through a Double Opt-In email. Marketing consent must be voluntary, specific, informed, affirmative and withdrawable. It is separate from Contact inquiries, account creation and platform access, and platform access will not be conditioned on marketing consent.

Consent may be withdrawn and campaign unsubscribe mechanisms may be used. Withdrawal does not affect processing that was lawful before withdrawal. The final consent record, retention procedure and legal basis require approval before enablement.

The current Contact form is a non-submitting interface. Its button is disabled, implicit submission is prevented, and information entered into it is not sent to ESX, Brevo or another contact service and is not stored by the website.

This policy will be updated before a contact backend, email delivery provider, CRM, ticketing service or database is connected. Contact inquiries will remain separate from marketing consent.

Technical request data is used to deliver, maintain and protect the website. The applicable legal basis and required disclosures depend on the final controller, applicable law and deployed hosting arrangement and will be confirmed before production approval.

If Join the Launch is enabled, its defined purpose will be the consented communications described at signup after Double Opt-In confirmation. The purpose will not be silently expanded or bundled with Contact, account creation, platform access or investment eligibility.

If launch signup is enabled, email, optional audience interest and confirmation-related metadata will be sent server-side to Brevo for the Double Opt-In and communications workflow. Brevo's contractual role, data-processing agreement, subprocessors and account configuration require provider and legal review before enablement.

The final production hosting arrangement is not established by the current website source. Its provider identity and relevant privacy details will be confirmed against the deployed service. ESX does not sell personal data or disclose it for advertising under the current implementation.

Residents of certain U.S. states may have additional privacy rights under applicable state privacy laws. Where those laws apply to ESX, applicable rights and disclosures will be provided and honored.

This policy does not claim that a particular state privacy statute or statutory threshold currently applies. Applicability will be assessed for the future U.S.-based operating entity, its actual processing and the people it serves.

A future U.S.-based ESX operating entity and its hosting, communications or other service providers may process data in the United States or other countries, including through transfers outside the European Economic Area.

Where required, ESX intends to use an applicable lawful transfer mechanism and appropriate safeguards. No EU-only hosting, adequacy status, Data Privacy Framework certification, Standard Contractual Clauses or other specific safeguard is represented as established until the final provider contracts, subprocessors, processing locations and legal treatment have been reviewed.

No approved fixed retention periods are established. Technical-log retention must be confirmed with the final hosting provider and operational owner.

If launch signup is enabled, subscription data is expected to be kept while the subscription or consent remains active, then removed or suppressed as appropriate after unsubscribe or withdrawal. Limited records may need to be retained to document consent, an objection or compliance with law. Final periods and operating procedures require approval before enablement.

Where applicable under the GDPR or other applicable data-protection law, individuals may have rights of access, rectification, erasure, restriction, portability and objection. They may also withdraw consent and lodge a complaint with a competent supervisory authority.

These rights are subject to applicable legal conditions and exceptions. The competent supervisory authority and legally sufficient rights-request process will be identified after the operating entity, establishment and applicable law are confirmed.

• Object at any time to processing for direct marketing, where that right applies.
• Withdraw marketing consent using the campaign unsubscribe mechanism or the approved privacy-contact route once it is active.
• Request access, correction, deletion, restriction or portability where applicable.

ESX does not claim to be established in the European Union or European Economic Area and has not named an EU representative.

If the future U.S. operating entity becomes subject to an obligation to appoint an EU representative under applicable data-protection law, ESX will appoint an appropriate representative and update this Privacy Policy before the relevant processing is expanded.

ESX intends to use reasonable technical and organizational safeguards appropriate to the website and the data involved. No internet service can promise absolute security. Security statements will remain aligned with the deployed architecture and provider arrangements.

The current website does not perform solely automated decision-making that produces legal or similarly significant effects. The optional audience-interest value, form validation, spam honeypot and interface behavior are not used to determine investment eligibility or make legally significant decisions.

An approved children or minimum-age policy has not yet been established. ESX serves broad entertainment audiences, while any future account, marketing or financial participation may be subject to distinct age, consent and eligibility requirements.

An appropriate policy will be adopted before services intended for accounts, participation or investment are introduced. This policy does not invent an age threshold.

This policy may be updated when website operation, providers, the operating entity, legal requirements or ESX services change. The date above identifies the current interim version. Material changes will be communicated in an appropriate manner where required.

privacy@esx.io is the operational ESX privacy contact for privacy questions and data-subject requests.

The general Contact form is currently non-submitting and should not be used for privacy requests. Final incorporated controller details and any applicable supervisory-authority information will be added after incorporation and legal review.