Privacy Policy

This policy explains what personal information ALTOKEN collects, why we collect it, who we share it with, how long we keep it and what choices you have. It applies to our website (www.altoken.io), our web app (app.altoken.io) and our mobile app.

1. The short version

• We collect what we need to open your account, verify your identity, let you invest and meet the law, mainly anti-money-laundering rules.
• We don't sell your personal information.
• Your card details go to Stripe and never reach ALTOKEN. We never see your wallet's recovery phrase or keys.
• Your wallet address and token movements are public on the Solana blockchain. Nobody can erase them, including us.
• Analytics cookies are set only if you accept them. Our other page statistics use no cookies.
• To use your rights, write to support@altoken.io.

2. Who is responsible for your information

ALTOKEN Financial Operadores S.A.C. ("ALTOKEN", "we", "us"), a company incorporated in Peru, with taxpayer number (RUC) 20615542637 and its registered address at Las Castañitas 138, Urb. El Palomar, San Isidro, Lima, Peru, is responsible for the personal information described in this policy.

When you invest in an offering, the issuer of that offering (the company that owns the property) also receives some of your information, because it is the company you invest with. The issuer is responsible for how it uses that information under the offering documents and the law.

3. What we collect and why

What we collect depends on how you use ALTOKEN. The information we need to open your account, verify your identity and carry out your investments is required: without it, we can't provide those services. The rest, such as your investor preferences and marketing choices, is optional.

Visiting our website or app

• What: your IP address, browser and device type, the pages you visit, your language and your cookie choice.
• Why: to show the site in your language, keep it secure, block bots and abuse, and count visits.
• More detail: we use cookie-free page statistics from Vercel. We use PostHog analytics only if you accept cookies. In the signed-in app, it hides the text and values on screen and doesn't record sessions. See section 10.

Newsletter, waitlist and contact forms

• What: your email address, and, when you give them, your name, country and message.
• Why: to answer you, keep you informed or invite you when we open. You can unsubscribe at any time.

Website chat assistant

• What: the messages you type and your IP address.
• Why: your messages are sent to Inception, the company whose AI model (Mercury) writes the answers. We don't store the conversation. We use your IP address only to limit how many messages can be sent. Please don't type personal or financial details into the chat.

Your account and signing in

• What: your email address, sign-in codes, your password if you set one (stored only in scrambled form), your passkeys (we keep only the public part), your two-step verification setup (stored encrypted), and session details such as IP address, device and time of sign-in.
• Why: to let you in securely, detect suspicious sign-ins and protect your account.

Your investor profile

• What: your name, date of birth, nationality, country of residence, address, phone number, tax residency and, if you give it, your tax ID; your language and display preferences; and, if you complete them, your investor type, risk tolerance and investment horizon.
• Why: to check that you can invest, meet anti-money-laundering and tax rules, fill in your documents and show you suitable offerings and disclosures.

Identity checks

• What: photos of your ID document and a selfie, the details on your ID, the result of the face match, basic device information and, in the mobile app, your approximate location during the check, plus the results of sanctions and watch-list screening.
• Who: Persona collects this for us. We receive the result (approved, rejected or needs review) and the details we need to keep records.
• Why: the law requires us to verify everyone who invests and to prevent fraud and money laundering. Your selfie and face match are biometric data: we use them only to confirm that you are the person on the ID, and only with your consent.
• A person can review an automated decision. Ask us at support@altoken.io.

Your wallets

• What: your wallet addresses, the wallet type, and the one-time messages you sign to prove a wallet is yours.
• Why: to deliver your tokens and distributions to the right wallet and to protect you when a wallet changes. We email you about every change.
• Face ID and passkey wallets: Turnkey keeps the wallet's keys, and only your passkey can use them. When you export your recovery phrase, it is shown inside Turnkey's secure frame. ALTOKEN never sees your keys or your recovery phrase.

Investing

• What: your orders, the amounts, the offering, your payment status, payment references from Stripe (not your card number), USDC transaction IDs, refunds, card disputes, token deliveries and the distributions you receive.
• Why: to carry out your investment, keep the issuer's register of investors, show you your history, handle refunds and disputes, and meet accounting, tax and anti-money-laundering rules.

Signing documents

• What: your name, email address, the documents you sign and the signing record (who signed, when and how).
• Who: DocuSign, once electronic signing is live.
• Why: to create a valid record of your agreement with the issuer.

Recovering a lost wallet

• What: a new identity check, your request and the approvals given by ALTOKEN administrators and the issuer's signers.
• Why: to make sure tokens only go back to their real owner.

Support and emails

• What: the messages you send us and records of the emails we send you (for example, whether they were delivered).
• Why: to help you and to send you the messages you need, such as sign-in codes and order updates.

Issuers and the people behind them

• What: company details, the names, dates of birth, nationalities and ownership shares of owners and controlling persons, company identity checks, documents about the company and the property, the issuer's wallet, and the identity of the issuer's team members.
• Why: to check who is behind each offering, meet anti-money-laundering rules and publish offerings. When an issuer opens its Stripe account, Stripe collects the details it needs directly.

Security and audit records

• What: records of important actions, such as sign-ins, changes to your account, approvals and administrator actions, with the time, IP address and device.
• Why: to keep the platform secure, investigate problems and show regulators and auditors what happened.

4. Legal bases

We use your information only when the law allows it:

• To perform our contract with you: your account, investments, wallets, documents and the messages you need.
• To meet legal obligations: identity checks, sanctions screening, anti-money-laundering records, tax and accounting records, and requests from authorities.
• For our legitimate interests, balanced against your rights: security, fraud prevention, bot protection, improving the platform and cookie-free statistics.
• With your consent: analytics cookies, marketing emails and biometric data for identity checks. You can withdraw consent at any time; it doesn't affect what we did before.

5. Who we share it with

We don't sell your personal information. We share it only with:

• The issuer of an offering you invest in: your identity, contact details, order, payment status, holdings and signed documents, so it can keep its register of investors and meet its own legal duties.
• Our related company DDPAY Wallet LLC (United States), which holds ALTOKEN's Stripe platform account: the references and amounts of card payments, so the platform fee can be collected and accounted for.
• Service providers that work for us under contract and only on our instructions (section 6).
• Authorities such as regulators, tax authorities, financial intelligence units and courts, when the law requires it.
• Professional advisers such as lawyers and auditors, who must keep it confidential.
• A buyer or successor, if ALTOKEN or its business is sold or merged. We will tell you if that happens.

6. Our service providers

Provider	What it does for us	What it receives
Persona	Identity checks and sanctions screening	ID photos, selfie, ID details, device information
Stripe	Card payments (on the issuer's own Stripe account)	Card and payment details (you give them to Stripe directly), order reference
DocuSign	Electronic signatures, once live	Name, email address, the documents you sign
Turnkey	Face ID and passkey wallets	Your passkey's public part and its name (based on your email address), wallet addresses
Resend	Sending our emails	Email address, the content of our emails
Supabase	Database hosting	The information in your account
Upstash	Queues, temporary data and rate limits	IP addresses, technical identifiers
Vercel	Hosting our website and app, cookie-free page statistics	IP address, browser and page data
Google Cloud	Hosting our API (São Paulo, Brazil)	The information in your account, as it passes through the API
Cloudflare (R2)	Storing property images	Property images and files we publish; not your account data
PostHog	Product analytics, only if you accept cookies	Pages visited and clicks (in the app, with on-screen text hidden)
Arcjet	Bot and abuse protection	IP address, request details
Inception	The AI model behind the website chat assistant	The messages you type in the chat
Helius	Access to the Solana network	Wallet addresses and transactions we read or send

When you pay by card, Stripe also processes your payment for the issuer and may use some information for its own purposes, such as fraud prevention, under its own privacy policy. The same applies to Persona and Turnkey where their own policies say so.

7. International transfers

Some of our providers store or process information outside your country, including in the United States, and our API runs in Brazil. When we transfer your information, we use contracts and other safeguards that the law requires, so it keeps a similar level of protection.

8. The blockchain is public

Your tokens and USDC live on the Solana blockchain. Anyone can see a wallet address, its balances and its transactions, and they stay there permanently. We don't put your name or other personal details on the blockchain. But anyone who knows that a wallet is yours can see what it holds and what it has done.

We can't change or delete information on the blockchain, so the rights to correct or delete information don't reach it. We can delete the link between your account and your wallet address from our own systems when the law allows.

9. How long we keep it

• While your account is open: we keep the information we need to provide the service.
• After you close your account: we keep identity-check records, transaction records and related documents for as long as anti-money-laundering law requires, and accounting and tax records for as long as those laws require. We may also keep information we need to handle a dispute or legal claim.
• Marketing: until you unsubscribe.
• Cookie choice: 12 months, then we ask again.
• Chat assistant: we don't store conversations.

When we no longer need information, we delete it or make it anonymous. Identity providers such as Persona keep their copies under their own retention rules and our instructions.

10. Cookies and analytics

We use a small number of cookies and similar technologies:

• Essential: to keep you signed in, protect your account, remember your language and remember your cookie choice. These don't need consent.
• Analytics: PostHog runs only after you accept cookies. It counts the pages you visit and what you click. In the signed-in app, it hides the text and values on screen and doesn't record sessions.
• Cookie-free statistics: Vercel counts page visits and measures loading speed without cookies.

You can change your choice at any time with "Cookie settings" at the bottom of the website. Our Cookie Policy has the details.

11. How we protect it

We encrypt information in transit, store sensitive secrets encrypted, limit who on our team can see personal information, require two people to approve sensitive actions and keep audit records. No system is perfectly secure. If a breach affects your information, we will tell you and the authorities as the law requires.

12. Your rights

Depending on where you live, you can ask us to:

• tell you what information we have about you and give you a copy;
• correct information that is wrong or incomplete;
• delete your information, when we don't have to keep it by law;
• stop or limit using it, or object to how we use it;
• send it to you or to another company in a common format;
• have a person review an automated decision, such as an identity check;
• withdraw a consent you gave.

How to use your rights: write to support@altoken.io from the email address on your account. We may ask you to confirm your identity first. We will answer within the time the law sets.

What you can do yourself:

• update your profile in Settings in the app;
• choose which emails you receive in your notification settings, and unsubscribe from marketing emails at any time;
• change your cookie choice with "Cookie settings" on the website;
• delete your account in the ALTOKEN mobile app (Account, then Delete account). If you have never verified your identity or invested, we delete your account and its data. Otherwise we close it and keep the identity and investment records the law requires; write to us if you want us to delete the rest.

If you're not happy with our answer, you can complain to the data protection authority where you live. In Peru, that is the National Authority for Personal Data Protection (Autoridad Nacional de Protección de Datos Personales).

13. Children

ALTOKEN is only for adults. We don't knowingly collect information from anyone under 18. If we learn that we have, we delete it.

14. Changes to this policy

We will update this policy when our services or the law change. If a change matters to you, we will tell you by email or in the app before it takes effect. The date at the top shows the latest version.

15. Contact us

• Email: support@altoken.io
• Post: ALTOKEN Financial Operadores S.A.C., Las Castañitas 138, Urb. El Palomar, San Isidro, Lima, Peru