PRIVACY POLICY

Last Updated: July 27, 2026

1. Introduction

Eclipse Pay Inc. ("Eclipse Pay," "we," "us," or "our") is a corporation registered in the State of Colorado, United States, licensed as a Money Services Business (MSB) under registration number 31000335734442 and Entity ID 20261852398.

We are a private on/off-ramp platform serving High-Net-Worth Individuals ("HNWIs" or "Clients"). We are committed to absolute privacy and discretion for our Clients while maintaining full compliance with U.S. regulatory requirements.

This Privacy Policy describes how we collect, use, disclose, and protect information in connection with our stablecoin (USDC and USDT) conversion and settlement services (the "Services").

This Privacy Policy is designed to comply with applicable privacy laws, including:

• Applicable U.S. federal privacy laws, including the Gramm-Leach-Bliley Act (GLBA) where applicable
• Applicable U.S. state privacy laws, including the California Consumer Privacy Act (CCPA) as amended by the CPRA, and the Colorado Privacy Act (CPA)
• The Bank Secrecy Act (BSA) and FinCEN regulations regarding information collected for AML purposes

2. Information We Collect

2.1 Client Identity Information

In accordance with AML/KYC obligations, we collect:

• Full legal name, date of birth, and nationality
• Government-issued identification (passport, driver's license, state ID)
• Social Security Number (SSN) or Individual Taxpayer Identification Number (ITIN)
• Residential address and contact information (email, phone)
• Biometric data (facial recognition and liveness detection) collected via SumSub
• Photographs and scans of identification documents

2.2 Financial and Net Worth Information

To verify HNWI status and conduct due diligence:

• Documentation of net worth (bank statements, investment portfolios, asset valuations)
• Documentation of annual income (tax returns, W-2s, 1099s, financial statements)
• Source of wealth and source of funds documentation
• Bank account information for USD settlement (account number, routing number, bank name)
• Wallet addresses for Stablecoin delivery

2.3 Transaction Information

• Transaction amounts, dates, and timestamps
• Stablecoin types involved (USDC, USDT)
• Source and destination wallet addresses
• Source and destination bank account information
• Conversion rates and fees applied
• Transaction purpose and supporting documentation
• Chainalysis wallet risk scores and blockchain analytics results

2.4 Authorized Representative Information

Where a Client has designated an Authorized Representative:

• Full legal name and date of birth
• Government-issued identification
• Contact information
• Power of attorney or other authorization documentation
• Relationship to the Client
• SumSub identity verification results

2.5 Technical and Usage Information

• IP addresses and device information
• Browser type and operating system
• Access logs and session data
• Website and platform usage analytics
• Communications with Eclipse Pay (emails, calls, support tickets)
• Relationship Manager interaction records

2.6 Information from Other Sources

• Sanctions and watchlist screening results (via SumSub)
• PEP (Politically Exposed Persons) screening results (via SumSub)
• Adverse media screening results (via SumSub)
• Blockchain analytics data related to wallet addresses (via Chainalysis)
• Public records and court records
• Credit bureau or risk assessment data
• Financial institution reference checks
• Elder financial abuse and vulnerable person risk indicators from screening databases (via SumSub and Chainalysis)

2.7 Vulnerable Person and Elder Financial Abuse Indicators

In connection with our commitment to protecting Vulnerable Persons, we may collect and process:

• Transaction patterns and behavioral indicators consistent with Elder Financial Abuse
• Information regarding Clients who may be subject to undue influence, coercion, or exploitation
• Reports or flags generated by our transaction monitoring system related to potential exploitation
• Information regarding Authorized Representatives whose behavior raises exploitation concerns
• Information from external sources (e.g., adult protective services databases, law enforcement alerts) where legally available

3. How We Use Your Information

3.1 Providing the Services

• Processing on-ramp, off-ramp, and conversion Transactions
• Verifying client identity and HNWI status (KYC)
• Managing Client Accounts and Relationship Manager assignments
• Same-day USD settlement to U.S. bank accounts
• Communicating about Transactions and the Services

3.2 Compliance and Regulatory Obligations

• Conducting AML transaction monitoring
• Screening against sanctions and PEP lists via SumSub
• Conducting blockchain analytics via Chainalysis
• Filing regulatory reports (SARs to FinCEN, OFAC reports)
• Responding to lawful requests from regulatory and law enforcement authorities
• Maintaining records as required by U.S. law (minimum 5 years)
• Fulfilling obligations under the BSA, FinCEN regulations, and OFAC sanctions regimes
• Detecting, investigating, and reporting suspected Elder Financial Abuse and exploitation of Vulnerable Persons

3.3 Risk Management and Security

• Assessing and managing risk
• Detecting and preventing fraud
• Investigating suspicious activity
• Securing the platform against unauthorized access
• Monitoring wallet addresses for exposure to illicit activity via Chainalysis
• Monitoring for indicators of Elder Financial Abuse and vulnerable person exploitation

3.4 Business Operations

• Improving and developing the Services
• Internal analytics and reporting
• Customer support and Relationship Manager service delivery
• Anonymized and aggregated reporting

3.5 Legal Basis for Processing

As a U.S. MSB, our processing of Client information is primarily driven by legal and regulatory obligations under:

• The Bank Secrecy Act and FinCEN regulations (AML/KYC compliance)
• OFAC sanctions regulations
• Colorado MSB regulations
• Applicable state privacy laws

4. How We Share Your Information

4.1 Regulatory and Law Enforcement Authorities

We may disclose information to:

• FinCEN (Financial Crimes Enforcement Network, U.S.)
• OFAC (Office of Foreign Assets Control, U.S.)
• Colorado Division of Securities
• IRS (Internal Revenue Service) for tax reporting purposes
• Other regulatory bodies with jurisdiction over our operations
• Law enforcement agencies pursuant to lawful requests, court orders, or legal process
• Adult Protective Services agencies (U.S. state-level) where we suspect Elder Financial Abuse orexploitation ofa Vulnerable Person

We are legally prohibited from informing you when a Suspicious Activity Report has been filed about you.

4.2 Service Providers and Partners

We share information with third parties who help us provide the Services:

• SumSub — KYC/identity verification, sanctions screening, PEP screening, adverse media checks
• Chainalysis — Blockchain analytics, wallet risk scoring, transaction tracing
• Banking partners and payment processors (for USD settlement)
• Segregated custody providers (for Stablecoin custody)
• Cloud infrastructure and hosting providers
• Professional advisors (legal, accounting, audit)

These providers are bound by confidentiality obligations and are only permitted to use information for the purpose of providing services to us.

4.3 Corporate Transactions

In the event of a merger, acquisition, asset sale, or other business transaction, information may be transferred as part of that transaction, subject to confidentiality obligations.

4.4 With Your Consent

We may share information with third parties with your consent or at your direction, including your financial advisor or family office (subject to verification).

4.5 Required by Law

We may disclose information when required by law, regulation, or legal process, or to protect the rights, property, or safety of Eclipse Pay, our Clients, Vulnerable Persons, or others.

4.6 Privacy Commitment

Except as required by law or regulation, Eclipse Pay does not:

• Sell Client information to third parties
• Share Client identities or Transaction details publicly
• Disclose Client relationships to external parties
• Use Client information for marketing to non-Clients

5. Data Security

We employ industry-leading security measures to protect Client information, including:

• Encryption of data in transit (TLS) and at rest (AES-256)
• Access controls and role-based permissions with least-privilege principles
• Multi-factor authentication for all internal systems
• Regular security assessments and penetration testing
• Employee training on data protection, AML obligations, and Elder Financial Abuse awareness
• Incident response and breach notification procedures
• Segregation of duties and comprehensive audit logging
• Secure data storage with segregated custody for digital assets
• Periodic security audits by independent third parties

Despite these measures, no system is completely secure. In the event of a data breach, we will notify affected individuals and regulators as required by applicable law.

6. Data Retention

We retain information in compliance with U.S. regulatory requirements:

• Client KYC records: Minimum 5 years after the end of the client relationship (per BSA requirements)
• Transaction records: Minimum 5 years after the transaction date (per BSA requirements)
• SARs and related records: Minimum 5 years after filing (per FinCEN requirements)
• Elder Financial Abuse reports and related investigation records: Minimum 5 years
• Tax-related records: As required by IRS regulations
• Technical and usage data: Retained as needed for security and operational purposes

After the retention period, information is securely destroyed or anonymized.

7. Your Privacy Rights

7.1 CCPA/CPRA Rights (California)

Where applicable, you have the right to:

• Know what personal information is collected and how it is used
• Request deletion of personal information
• Request a copy of personal information
• Opt out of the sale or sharing of personal information
• Limit use of sensitive personal information
• Not be discriminated against for exercising privacy rights

7.2 Colorado Privacy Act Rights (Colorado)

As a Colorado-based entity, Colorado residents have the right to:

• Access their personal data
• Correct inaccurate personal data
• Delete personal data
• Obtain a copy of their personal data in a portable format
• Opt out of targeted advertising, sale of personal data, and certain profiling

7.3 How to Exercise Your Rights

To exercise any of these rights, contact us using the information in Section 10. We will respond within the timeframe required by applicable law.

7.4 Limitations

Certain information may not be accessible or erasable where:

• It is required to be retained by law (e.g., AML records, SAR filings)
• It is subject to a legal hold or investigation
• Erasure would prevent us from fulfilling regulatory obligations
• It is necessary for the establishment, exercise, or defense of legal claims
• It involves records of suspected Elder Financial Abuse that must be retained under mandatory reporting laws

8. Cookies and Tracking Technologies

Our website may use cookies and similar technologies to:

• Enable core website functionality
• Remember preferences and settings
• Analyze website traffic and usage
• Detect and prevent fraud and abuse

You can manage cookie preferences through your browser settings.

9. Children's Privacy

The Services are not directed to individuals under 18. We do not knowingly collect information from minors.

10. Contact Us

For privacy questions, requests, or complaints, please contact:

Eclipse Pay Inc.

Attention: Compliance / Privacy Officer

Colorado, United States

Entity ID: 20261852398

MSB Registration No.: 31000335734442

---

This Privacy Policy is provided as a draft for review by legal counsel and does not constitute legal advice. Please have qualified counsel review and customize this document before publication.