Privacy policy

This Privacy Policy describes how TierraDex, Inc. ("we," "us," or "our") collects, uses, shares, and protects personal information when you use our platform at tierradex.com (the "Platform"). We are committed to protecting your privacy and handling your data with transparency. This policy applies to all Users who access or use the Platform, including investors, issuers, and visitors.

1.1. INFORMATION YOU PROVIDE: • Account information: full name, email address, password • Identity verification (KYC): government-issued ID, date of birth, address, Social Security Number or Tax ID (where required by law) • Financial information: investment amounts, transaction history, wallet addresses • Profile data: account preferences, notification settings, role selection • Communications: messages sent through the Platform, support requests, AI chat history 1.2. INFORMATION COLLECTED AUTOMATICALLY: • Device information: browser type, operating system, device identifiers • Usage data: pages visited, features used, click patterns, session duration • Network data: IP address, approximate location (city/region level) • Cookies and similar technologies: session tokens, authentication cookies, analytics identifiers 1.3. INFORMATION FROM THIRD PARTIES: • KYC/AML verification providers: identity verification results, risk assessments • Blockchain data: public XRPL transaction records, wallet balances, trust line information • Authentication providers: if you sign in via third-party services

We use the information we collect for the following purposes: 2.1. SERVICE DELIVERY: To create and manage your account, process transactions, manage your portfolio, execute trades, distribute payments, and provide custodial wallet services. 2.2. COMPLIANCE: To perform KYC/AML verification, comply with securities regulations, respond to legal requests, and prevent fraud, money laundering, and other illegal activities. 2.3. SECURITY: To protect the Platform and its Users from unauthorized access, detect suspicious activity, and maintain audit logs of sensitive operations (e.g., wallet key access). 2.4. COMMUNICATION: To send transaction confirmations, account notifications, security alerts, and (with your consent) marketing communications about new offerings or features. 2.5. IMPROVEMENT: To analyze usage patterns, diagnose technical issues, and improve the Platform's features, performance, and user experience. 2.6. AI ASSISTANT: To power the Jarvis AI assistant. Chat messages are processed by our AI provider (Anthropic) and are not used to train AI models. Chat history is retained for your convenience and may be reviewed for quality assurance.

We do not sell your personal information. We may share information in the following circumstances: 3.1. SERVICE PROVIDERS: With trusted third-party providers who perform services on our behalf, including: • Cloud infrastructure (hosting, database, storage) • KYC/AML verification services • Payment processing and blockchain infrastructure • AI processing (Anthropic — for Jarvis chat functionality) • Analytics and monitoring 3.2. LEGAL OBLIGATIONS: When required by law, regulation, subpoena, court order, or governmental authority. This includes disclosing wallet addresses, transaction histories, and identity information to securities regulators, tax authorities, or law enforcement. 3.3. ASSET ISSUERS: Limited information (wallet address, token holdings, investor status) may be shared with asset issuers for the purpose of managing distributions, governance, and regulatory compliance related to their offerings. 3.4. BUSINESS TRANSFERS: In connection with a merger, acquisition, or sale of all or substantially all of our assets, your information may be transferred to the acquiring entity. 3.5. WITH YOUR CONSENT: We may share information for other purposes with your explicit consent.

4.1. We implement commercially reasonable security measures to protect your personal information, including: • AES-256-GCM encryption for sensitive data (wallet keys, credentials) • HTTPS/TLS encryption for all data in transit • Row-level security (RLS) policies in our database • Server-side transaction signing (private keys never leave the secure server environment) • Access-controlled administrative endpoints with audit logging • Security headers (X-Frame-Options, CSP, X-Content-Type-Options) 4.2. Despite our efforts, no method of transmission over the Internet or method of electronic storage is 100% secure. We cannot guarantee absolute security and are not liable for breaches beyond our reasonable control. 4.3. You are responsible for maintaining the confidentiality of your account credentials and for any activity under your account.

5.1. We retain your personal information for as long as your account is active or as needed to provide the Services. 5.2. After account termination, we retain certain information as required by law, including: • Transaction records: minimum 7 years (tax and securities compliance) • KYC/AML records: minimum 5 years after account closure (Bank Secrecy Act) • Audit logs: minimum 3 years 5.3. We may retain anonymized or aggregated data indefinitely for analytics and product improvement purposes. 5.4. Blockchain transactions are permanent and immutable. XRPL transaction records cannot be deleted as they are part of the public ledger.

6.1. Depending on your jurisdiction, you may have the following rights: • ACCESS: Request a copy of the personal information we hold about you. • CORRECTION: Request correction of inaccurate or incomplete information. • DELETION: Request deletion of your personal information, subject to legal retention requirements. • PORTABILITY: Request your data in a structured, machine-readable format. • OPT-OUT: Opt out of marketing communications at any time. • RESTRICTION: Request restriction of processing in certain circumstances. 6.2. CALIFORNIA RESIDENTS (CCPA/CPRA): You have the right to know what personal information we collect, request deletion, opt out of the sale of personal information (we do not sell your data), and not be discriminated against for exercising your rights. 6.3. To exercise any of these rights, contact us at privacy@tierradex.com. We will respond within 30 days (or 45 days for complex requests, with notice).

7.1. We use the following types of cookies: • ESSENTIAL: Authentication tokens, session management, security features. These cannot be disabled. • FUNCTIONAL: User preferences, language settings, recently viewed items. • ANALYTICS: Usage patterns, page views, feature engagement (used to improve the Platform). 7.2. We do not use third-party advertising cookies or cross-site tracking. 7.3. You can manage cookie preferences through your browser settings. Disabling essential cookies may prevent you from using the Platform.

The Platform is not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected information from a person under 18, we will take steps to delete it promptly.

9.1. Our Platform is operated from the United States. If you access the Platform from outside the US, your information will be transferred to and processed in the United States. 9.2. By using the Platform, you consent to the transfer of your information to the United States, which may have different data protection laws than your country of residence.

10.1. We may update this Privacy Policy from time to time. Material changes will be communicated via email or in-platform notification at least fifteen (15) days before taking effect. 10.2. The "Effective Date" at the top of this policy indicates when it was last revised. 10.3. Continued use of the Platform after changes take effect constitutes acceptance of the revised policy.

For privacy-related inquiries, requests, or complaints: Email: privacy@tierradex.com Mail: TierraDex, Inc., Knoxville, TN For general support: support@tierradex.com