Privacy Policy

1. Information We Collect

To operate the Exchange and provide a secure trading environment, we collect information directly from you, automatically through your use of the Platform, and from third-party service providers.

1.1 Information You Provide to Us Directly — Account Data: Name, email address, phone number, and physical address. Profile Data: XloudID usernames, profile images, and brand/creator descriptions. Transaction Data: Details of the Utility Assets you mint, list, purchase, or sell, including bid/ask parameters and historical portfolio performance. Communications: Information you provide when contacting our AI customer support, disputing a transaction, or communicating with other users on the Platform.

1.2 Information Collected Automatically — Device & Usage Data: IP address, operating system, browser type, device identifiers, mobile network information, and app interaction data (such as time spent on Brand Terminals or specific Utility Assets). Kinematic & Behavioral Data: As part of the XloudID security protocol, we collect kinematic data (such as touch surface area, swipe speed, and path curvature) to verify human interaction, authenticate logins, and prevent automated bot access.

1.3 Information from Third Parties (Stripe) — Identity & Financial Data: To comply with Know Your Customer (KYC) and Anti-Money Laundering (AML) laws, our payment processor, Stripe, collects government-issued identification (e.g., driver's licenses, passports) and banking details. XloudOne does not directly store your raw KYC documents or full credit card numbers on our servers; we only receive verification status tokens and limited payment method data (e.g., the last four digits of a card) from Stripe.

2. Biometric Data Policy (XloudID)

Xapitol utilizes advanced authentication to secure financial trades. If you opt-in to biometric login (such as Apple FaceID, TouchID, or the XloudID proprietary kinematic/biometric signature):

Hardware-Level Security: Standard facial and fingerprint data is processed natively on your device via Apple’s Secure Enclave or Android’s TrustZone. XloudOne cannot access, extract, or store your raw facial scans or fingerprint maps.

Kinematic Signatures: Any proprietary gesture or kinematic data collected by XloudID is mathematically hashed and encrypted. It is used strictly for fraud prevention and authentication during the execution of atomic swaps. We do not sell, lease, or share this data with third parties.

3. How We Use Your Information

We use the collected information for the following business and commercial purposes:

Platform Operation: To facilitate atomic swaps, manage the Xapitol ledger, and render your digital vault.

Financial Settlement: To process payments, deduct applicable Exchange Transaction Fees (including the eight percent (8%) fee disclosed in our Terms of Service unless a different rate is shown at checkout), and route fiat payouts to sellers.

Market Integrity: To calculate the Brand Utility Index (BUI) and display real-time, aggregated (and anonymized) market data on Brand Terminals.

Security & Fraud Prevention: To enforce our Terms of Service, detect scalping bots, prevent wash trading, and execute fraud-related account freezes.

Customer Support: To resolve disputes, manage refunds, and operate our AI-assisted helpdesk.

Compliance: To comply with IRS tax reporting, OFAC sanctions monitoring, and law enforcement requests.

4. How We Share Your Information

We do not sell your personal data to data brokers or ad networks. We only share your information in the following circumstances:

With Third-Party Service Providers: We share necessary data with infrastructure partners (e.g., Supabase for database hosting, Stripe for KYC/payments) who are contractually bound to protect your data.

With Other Users (Public Market Data): When you list or purchase a Utility Asset, the transaction data (price, timestamp, asset ID) becomes part of the public market ledger to calculate the Brand Utility Index. Your specific legal identity remains hidden, but your XloudID username and public wallet address may be visible to the counterparty.

With Issuers/Brands: If you purchase a Utility Asset (such as a festival ticket or physical product), we may share necessary fulfillment data (such as your name or redemption QR code) with the original brand or contractor so they can render the service.

For Legal Compliance: We will disclose your information if legally required to do so by a subpoena, court order, or government request (e.g., FinCEN or the IRS), or to protect the safety, rights, or property of XloudOne or the public.

5. Data Retention & Security

5.1 Security Protocols: We implement enterprise-grade technical and organizational measures to secure your data, including end-to-end encryption for kinematic signatures, secure cloud environments, and strictly controlled API access. However, no electronic transmission over the internet or information storage technology can be guaranteed to be 100% secure.

5.2 Retention Periods: We retain your personal data only as long as your account is active or as necessary to fulfill the purposes outlined in this policy. Certain financial records, transaction histories, and KYC verification logs are retained for a minimum of five (5) to seven (7) years to comply with federal tax and anti-money laundering regulations, even if you delete your account.

6. Your Privacy Rights & Choices

Depending on your state of residence (e.g., California, Virginia, Colorado), you may have specific rights regarding your personal data:

Right to Access: You may request a copy of the personal information we have collected about you.

Right to Deletion: You may request that we delete your account and personal data, subject to legal and regulatory retention exemptions (such as retaining trade history for IRS compliance).

Right to Correction: You may update your account details within the Platform settings at any time.

Opting Out of Communications: You may opt out of promotional emails by clicking the "unsubscribe" link. You cannot opt out of critical transactional emails (e.g., fraud alerts, trade settlement receipts, or ToS updates).

To exercise these rights, please contact our privacy team at the address provided in Section 9.

7. Children's Privacy

As strictly enforced in our Terms of Service, the Platform is not intended for individuals under eighteen (18) years of age. We do not knowingly collect personally identifiable information from children. If we discover that a user under 18 has registered an account and bypassed our KYC verification, we will immediately freeze the account, refund any non-fraudulent fiat funds, and delete the associated data.

8. Modifications to This Privacy Policy

We reserve the right to update this Privacy Policy as our technology (including AI and XloudID capabilities) evolves or as legal requirements change. We will notify you of material changes via an in-app notification or email. Your continued use of the Platform after the effective date constitutes acceptance of the revised policy.

9. Contact Information

If you have questions, concerns, or requests regarding this Privacy Policy, our data practices, or our compliance with biometric privacy laws, please contact our legal and privacy team:

XloudOne / Xapitol Privacy Team

Corporate Registration: Commonwealth of Virginia

Operational Headquarters: Charlotte, North Carolina, USA

Email: legal@xloudone.com

Support: support@xloudone.com