Privacy Policy

2. Read This First: What We Cannot Delete or Control

INFORMATION PUBLISHED TO A PUBLIC BLOCKCHAIN IS PERMANENT, WORLDWIDE, AND OUTSIDE ANYONE'S CONTROL, INCLUDING OURS. WE CANNOT EDIT IT, DELETE IT, HIDE IT, OR RECALL IT, AND NO REQUEST BY YOU AND NO ORDER AGAINST US CAN MAKE US ABLE TO. THIS IS A PROPERTY OF THE TECHNOLOGY, NOT A CHOICE WE HAVE MADE AND NOT A LIMIT ON OUR WILLINGNESS TO HELP.

We state this at the top rather than in the fine print because it is the single most important thing to understand about privacy on this Platform, and because it limits rights described later in this Policy. Before you post, mint, register a name, create an organization record, or submit an on-chain report, assume that what you are publishing will remain publicly readable and permanently attributable to your wallet address.

Your wallet address is pseudonymous, not anonymous. It is treated as personal information under this Policy. Anyone can view its full transaction history, and specialist analytics firms routinely link addresses to real-world identities. Section 9 explains the practical consequences.

3. Information We Collect

Information you give us directly

• Account and contact information: name, email address, and any password or multi-factor credential, where you create an account.
• Identity and compliance information, where you complete verification: legal name, email address, country, date of birth, phone number, government identification type and images of the document, and, for accreditation, financial information such as income, net worth, or a professional certification. This is collected through our verification providers and, in part, retained by us in encrypted form.
• Agreement records: your typed legal name, your wallet address, the version of the document you accepted, a timestamp, and the IP address recorded at signing, for the non-disclosure agreement, the Token Purchase Agreement, and policy acknowledgements.
• Wallet address and any label or profile information you choose to add, including a display name, avatar, and organization records.
• Support and issue reports: the description you write, plus anything you choose to attach, including screenshots and screen recordings you capture.
• Recruiting information, if you apply for a role: your name, email address, phone number, location, links you provide, and the contents of your application.
• Any other information you volunteer, including in correspondence with us.

Information collected automatically

• Device and connection data: IP address, browser user-agent string, viewport size, and general location inferred from IP.
• Usage data: pages viewed, the page path you were on, features used, the application build you were running, the blockchain network you were connected to, and timestamps.
• Diagnostic data attached to an issue report: console errors and failed network requests collected by the reporting tool at the moment you submit.
• Security and audit records: sign-in events, session activity, administrative actions, and access to gated materials such as the Data Room, each recorded with an IP address and timestamp.
• Cookies and similar technologies, as described in Section 6.

Information from third parties

• Verification results and associated identity data from our identity and accreditation verification providers.
• Payment and transaction status from our payment processor. We do not receive or store your full card number.
• Risk, sanctions, and blockchain analytics signals used to screen wallet addresses and counterparties for legal compliance.
• Publicly available blockchain data associated with your wallet address.

What we deliberately do not collect

• Your private keys, seed phrase, or recovery phrase. We never ask for them, never receive them, and cannot access your wallet. Anyone asking you for them is attempting fraud.
• The contents of your end-to-end encrypted messages. See Section 8.
• Your full payment card details, which are handled by our payment processor.
• Tax identification numbers or similar secrets through the internal workspace tooling, which records the status of a form and refuses request bodies containing such values.

4. How We Use Information

We use personal information for the following purposes.

• To provide, operate, maintain, and secure the Platform, and to make its features work.
• To verify your identity and, where applicable, your accredited investor status, and to determine your eligibility for features, including any on-chain compliance status we record.
• To comply with law, including anti-money-laundering, counter-terrorist-financing, sanctions, securities, and recordkeeping obligations, and to respond to lawful requests.
• To detect, investigate, prevent, and address fraud, abuse, security incidents, prohibited conduct, and violations of our Terms or Community Standards.
• To screen images submitted to the Platform for prohibited content, as described in Section 16.
• To provide support, to diagnose and fix defects, and to respond to your reports and questions.
• To communicate with you about your account, transactions, security, and material changes to our terms or this Policy.
• To improve the Platform, understand how it is used, and develop new features.
• To evaluate your application if you apply for a role with us.
• To establish, exercise, or defend legal claims, and to carry out a corporate transaction as described in Section 7.

We do not use your personal information to make decisions that produce legal or similarly significant effects about you without human involvement, other than as described in Section 16.

5. Legal Bases for Processing

Where data protection law requires us to identify a legal basis, we rely on the following.

• Performance of a contract: to provide the Platform and the features you ask for, and to administer agreements you enter into with us.
• Compliance with a legal obligation: identity verification, sanctions screening, securities and financial recordkeeping, and responding to lawful requests.
• Legitimate interests: securing the Platform, preventing fraud and abuse, diagnosing defects, understanding usage, and defending legal claims, in each case balanced against your rights.
• Consent: where we ask for it, including for certain cookies and optional communications. You may withdraw consent at any time, without affecting processing already carried out.
• Substantial public interest or legal claims: where we process sensitive information such as government identification, to the extent permitted for identity verification and legal compliance.

6. Cookies, Analytics, and Similar Technologies

We use cookies, browser local storage, and similar technologies for the following purposes.

• Strictly necessary: to keep you signed in, to maintain your session, to remember interface preferences, and to protect against abuse. The Platform cannot function correctly without these.
• Analytics: to understand how the public marketing website and the web application are used, including which pages and features people use, so we can improve them.

Our public marketing website uses Google Analytics 4, which sets cookies and shares usage data with Google. It loads for all visitors to that website. The web application uses Google Analytics 4 too, on every page except the pages for reporting intimate images shared without consent, where it never runs. In the web application it records which pages you open and which features you use: for example that a post was made or liked, a message was sent, a group or contact was added, an organization was created, media was minted, listed, or bought, a name was registered, a verification fee was paid, or a transfer was confirmed. With these it may record the network used (Ethereum or Base), the kind of media, and, for a Media Marketplace purchase or a verification fee, the amount in US dollars. It never records the content of a message or post, who you contacted or followed, the name you registered, or the amount you sent in a transfer. Before a page address is sent to Google we remove wallet addresses, registered names, and content identifiers from it, and an address that is not one of the application's own pages is sent as a placeholder, so your wallet address is not shared with Google through analytics. Our Android app also uses Google Analytics for Firebase. It records the app's own events, such as installs, opens, and updates, and, from app version 0.55.0, the same page and usage information described above for the web application shown inside the app. The app does not collect your device's advertising identifier or its Android ID for analytics.

You can control cookies through your browser settings, including blocking or deleting them, and you can opt out of Google Analytics using the browser add-on Google provides. Blocking strictly necessary cookies will break sign-in and other core functions. We do not currently respond to browser Do Not Track signals, because no common standard for honouring them exists. Where we are required to honour an opt-out preference signal such as Global Privacy Control, we do so as described in Section 13.

7. How We Share Information

WE DO NOT SELL YOUR PERSONAL INFORMATION, AND WE DO NOT SHARE IT FOR CROSS-CONTEXT BEHAVIOURAL ADVERTISING.

We share personal information only as described below.

• Service providers acting on our instructions, including identity verification, accredited investor verification, payment processing, cloud hosting and storage, email delivery, content screening, blockchain data and node providers, and analytics. They may use the information only to provide their service to us.
• Professional advisers, including lawyers, auditors, accountants, and insurers, where necessary and subject to confidentiality.
• Regulators, law enforcement, and other authorities, where we believe in good faith that disclosure is required by law or legal process, or is necessary to protect rights, safety, or property. Where we are permitted to notify you, and it is prudent to do so, we will.
• A counterparty in a merger, acquisition, financing, reorganization, or sale of all or substantially all of our assets, or in the context of insolvency, in which case personal information may transfer as a business asset. We will require the recipient to honour this Policy or give notice of any material change.
• Other users and the public, where you choose to make information public, including anything you publish on-chain, your public profile, and your wallet address.
• With your consent or at your direction, for anything not listed above.

We may also disclose aggregated or de-identified information that cannot reasonably be used to identify you. Where we do, we will maintain and use it in de-identified form and will not attempt to re-identify it, except to test that de-identification is effective.

8. End-to-End Encrypted Communications

DEEP Mail, our direct and group messaging feature, is end-to-end encrypted. Messages are encrypted on your device using keys derived from and held by your wallet. We do not hold those keys.

WE CANNOT READ YOUR MESSAGE CONTENT. WE CANNOT DECRYPT IT, CANNOT RECOVER IT IF YOU LOSE YOUR KEYS, CANNOT PRODUCE IT IN RESPONSE TO A LEGAL REQUEST, AND GENERALLY CANNOT MODERATE IT.

This protects you, and it also limits what we can do for you. If you lose access to your wallet, your message history is permanently unreadable, by you and by us.

Encryption protects content, not metadata. Information such as sender and recipient addresses, timing, message size, and any on-chain anchoring record may be publicly visible on a blockchain even though the content is not. Encryption also does not protect you against a compromised device, a compromised wallet, a recipient who chooses to disclose what you sent, or a screenshot.

Attachments screened in your browser before sending are screened locally on your device. Those images are not transmitted to us for that purpose.

9. Public and Permanent On-Chain Information

Some Platform features write information to a public blockchain. That includes posts and reports on the social feed, profile and organization records, registered names, media and collectible records, compliance status flags, and the transactions themselves.

Once written, this information has the following properties.

• It is public. Anyone in the world can read it, without our involvement and without our knowledge.
• It is permanent. It cannot be edited or deleted by us, by you, or by anyone else.
• It is replicated. Copies exist on independent computers worldwide and in the databases of third parties who index blockchains.
• It is attributable. It is permanently associated with the wallet address that submitted it.

Where we operate moderation controls, they affect how content appears in OUR interface only. Content that is limited, quarantined, or removed from our interface remains on the blockchain and remains publicly accessible by other means.

Consequently, a request to delete, correct, or restrict personal information can be honoured only for the systems we control. It cannot be honoured on a blockchain. Where we hold an off-chain copy or index of on-chain data, we can act on our copy, and we will, but doing so does not affect the underlying record. We consider the act of publishing on-chain to be your decision, made with notice, and we ask you to treat it as irreversible.

10. International Data Transfers

We are based in the United States and our infrastructure and service providers are located primarily in the United States. If you access the Platform from outside the United States, your information will be transferred to, stored in, and processed in the United States and other countries whose data protection laws may differ from, and may be less protective than, those of your own country.

Where we transfer personal information out of the European Economic Area, the United Kingdom, or Switzerland, and the law requires a transfer mechanism, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses, together with additional measures where necessary. You may request information about the safeguards we apply by contacting us.

Public blockchain data is, by design, replicated worldwide and is not subject to any transfer mechanism. See Section 9.

11. How Long We Keep Information

We keep personal information only as long as necessary for the purposes described in this Policy, and then delete or de-identify it, unless a longer period is required or permitted by law. In practice this means the following.

• Account and profile information: for as long as your account is active, and for a reasonable period afterwards to resolve disputes and enforce our agreements.
• Identity and compliance records, including verification documents: retained for a defined period after verification, currently five years by default, to satisfy anti-money-laundering and securities recordkeeping obligations. This period is set by law and policy rather than by preference, so we generally cannot delete these records on request while the obligation runs.
• Agreement records, including signature, wallet address, version, timestamp, and IP address: retained for the life of the agreement and for so long afterwards as claims may be brought.
• Support and issue reports, including attached screenshots and screen recordings: retained under a defined retention horizon set when the report is created, after which the report and its attachments are purged.
• Security, audit, and access logs: retained for a period appropriate to their purpose, including the ability to investigate incidents.
• Recruiting information: retained for the recruitment process and for a reasonable period afterwards, unless you ask us to delete it sooner.
• On-chain information: permanent, and outside our control. See Section 9.

12. How We Protect Information

We maintain technical and organisational measures designed to protect personal information, including encryption of sensitive identity information at rest, encryption in transit, access controls and role separation, multi-factor authentication for administrative access, session timeouts, append-only audit logging of administrative actions, network restrictions on administrative interfaces, and monitoring and alerting.

NO METHOD OF TRANSMISSION OR STORAGE IS COMPLETELY SECURE. WE CANNOT AND DO NOT GUARANTEE THE SECURITY OF YOUR INFORMATION, AND YOU PROVIDE IT AT YOUR OWN RISK.

You are responsible for the security of your own wallet, private keys, recovery phrase, devices, and credentials. Most losses in this industry result from a compromised user device or a user disclosing their recovery phrase, and no measure we take can prevent that.

If a breach of security affecting your personal information occurs, we will notify you and the relevant authorities where required by law and within the time limits the law sets.

13. Your Rights and Choices

Subject to the limits in Section 9 and to applicable law, you may ask us to do the following with the personal information we hold in the systems we control.

• Access: confirm whether we process your information and obtain a copy of it, together with information about how we use it.
• Correct: correct information that is inaccurate or incomplete.
• Delete: delete information, subject to our legal retention obligations and to our need to establish or defend legal claims.
• Portability: receive certain information in a portable, machine-readable format, or have it transmitted to another controller where technically feasible.
• Restrict or object: restrict or object to certain processing, including processing based on legitimate interests.
• Withdraw consent: where processing is based on consent, withdraw it at any time.
• Opt out: opt out of marketing communications at any time, using the unsubscribe link or by contacting us. We will still send you service, security, and legal messages.

To exercise a right, contact legal@usse.io. We will verify your request before acting on it, which for a request about a wallet address may include asking you to sign a message with that wallet, since a wallet signature is the only reliable proof of control. We will respond within the period the applicable law requires. We will not discriminate against you for exercising a privacy right.

An authorized agent may submit a request on your behalf where the law allows, with proof of authorization. If we decline a request in whole or in part, we will tell you why, and you may appeal by replying to our response, where the law provides a right of appeal.

14. United States State Privacy Rights

If you are a resident of California, Virginia, Colorado, Connecticut, Utah, or another state with a comprehensive privacy law, you have the rights described in Section 13, to the extent that law applies to you and to us.

California

Under the California Consumer Privacy Act as amended by the California Privacy Rights Act, we disclose the following about the preceding twelve months. The categories of personal information we collect are: identifiers, including name, email address, IP address, and wallet address; personal information categories listed in the California Customer Records statute, including name, phone number, and financial information; characteristics of protected classifications, to the extent date of birth is collected for age and identity verification; commercial information, including transaction and purchase records; internet or other network activity, including usage and diagnostic data; geolocation data inferred from IP address; professional or employment-related information, where you apply for a role; and sensitive personal information, being government identification and, where collected for accreditation, financial information.

We collect these categories from the sources, and use them for the purposes, described in Sections 3 and 4, and we disclose them for a business purpose to the categories of recipient described in Section 7. We use and disclose sensitive personal information only for the purposes permitted without a right to limit, namely to perform the services you request, to verify identity, to comply with law, and to prevent fraud and abuse.

WE HAVE NOT SOLD PERSONAL INFORMATION, AND HAVE NOT SHARED IT FOR CROSS-CONTEXT BEHAVIOURAL ADVERTISING, IN THE PRECEDING TWELVE MONTHS. WE DO NOT KNOWINGLY SELL OR SHARE THE PERSONAL INFORMATION OF ANYONE UNDER SIXTEEN.

You have the right to know, to delete, to correct, to limit the use of sensitive personal information where that right applies, to opt out of sale or sharing, and not to be discriminated against for exercising these rights. We honour the Global Privacy Control browser signal as a valid opt-out request where required. To exercise a right, contact legal@usse.io.

Other states

Residents of other states with comprehensive privacy laws have equivalent rights of access, correction, deletion, portability, and opt-out of targeted advertising, sale, and certain profiling, together with a right to appeal a refused request. We do not conduct targeted advertising or profiling that produces legal or similarly significant effects, other than as described in Section 16.

Shine the Light

California residents may request information about disclosures of personal information to third parties for their direct marketing purposes. We do not make such disclosures.

15. European Economic Area, United Kingdom, and Switzerland

This Section applies if and to the extent the General Data Protection Regulation, the UK GDPR, or Swiss data protection law applies to our processing of your personal information.

United States Secured Exchange, Inc. is the controller of the personal information described in this Policy. Our legal bases are set out in Section 5, your rights in Section 13, retention in Section 11, and transfers in Section 10.

You have the right to lodge a complaint with your local supervisory authority, and with the Information Commissioner's Office in the United Kingdom. We would ask you to contact us first at legal@usse.io so we have the opportunity to resolve the matter.

16. Automated Screening and Decision-Making

We use automated processing in two places, and we describe both so that neither is a surprise.

• Eligibility and compliance gates. Whether you may access a feature can depend on your verification status, sanctions and risk screening results, and any compliance status recorded for your wallet. An automated check may block a feature or a transaction. A person reviews adverse compliance decisions before any on-chain compliance status is granted or refused, and you may contact us to contest an outcome and ask for a human review.
• Image screening. Images submitted through the Platform may be screened automatically for prohibited content, including sexually explicit material. Screening may run in your browser or on our servers, depending on the feature. Where screening runs on our servers, we retain a cryptographic hash of the image and the resulting labels for audit purposes, not the image itself, except where the image is stored for the feature you are using. Screening is a best-efforts safeguard and not a guarantee, and a screening result may be wrong. You may contest an outcome by contacting us.

We do not use automated processing to evaluate your personal characteristics for advertising or scoring purposes.

17. Children's Privacy

THE PLATFORM IS FOR ADULTS ONLY. IT IS AVAILABLE ONLY TO PERSONS AT LEAST 18 YEARS OLD. THE PLATFORM IS NOT DIRECTED TO CHILDREN, AND WE DO NOT KNOWINGLY COLLECT PERSONAL INFORMATION FROM ANYONE UNDER 18.

The Platform is not directed to children. It is available only to persons aged eighteen or over, and we do not knowingly collect personal information from anyone under eighteen.

If we learn that we have collected personal information from a person under eighteen, we will delete it from the systems we control promptly. If you believe a child has provided us with personal information, contact legal@usse.io.

Please note the limit in Section 9: if a person published information to a public blockchain, we can remove it from our interface but cannot remove it from the blockchain.

18. Third-Party Services, Wallets, and Links

The Platform depends on and links to services operated by third parties, including wallet providers, blockchain node and remote procedure call providers, identity and accreditation verification providers, payment processors, fiat on-ramp providers, content screening services, cloud infrastructure providers, and analytics services.

When you use one of these, you are interacting with that third party, and its own privacy policy governs. We do not control how they collect or use information. Connecting a wallet, in particular, may expose information to your wallet provider and to the node providers that serve your requests, including your IP address and the addresses you query.

We are not responsible for the privacy practices, security, or content of any third party. We encourage you to read their policies before you use them.

19. Changes to This Policy

We may update this Policy from time to time. When we do, we will update the "Last updated" date at the top of this page, and, where a change is material, we will provide additional notice through the Platform or by another reasonable means before it takes effect.

Your continued use of the Platform after an updated Policy takes effect means you acknowledge it. Where the law requires your consent for a change, we will ask for it. Prior versions are available on request.

20. How to Contact Us

For privacy questions, to exercise a right, or to raise a concern, contact legal@usse.io. For general support, contact support@usse.io. We aim to acknowledge privacy requests promptly and to respond within the period the applicable law requires.

• Legal name: United States Secured Exchange, Inc.
• Entity type: Delaware C-Corporation
• Principal office: 1441 East 30th Avenue, PMB #115, Hutchinson, KS 67502
• Registered agent: A Registered Agent, Inc., 8 The Green STE A, Dover, DE 19901
• Privacy and legal: legal@usse.io
• Support: support@usse.io