STORE PRIVACY POLICY

Version 3.2 · Effective October 16, 2026 · Published at storecloud.org/privacy and storeresearch.xyz/privacy

---

THE SHORT VERSION (not part of the policy)

• We collect what we need to run STORE, verify identity where the law requires, and keep honest records.
• We never sell your personal information, and never use it for advertising that follows you across other sites.
• For U.S. buyers, we ask a few questions about accredited status. We never collect your financial documents, tax forms or account numbers.
• Your identity documents are never publicly recorded. What is publicly recorded is fingerprints: proof something happened, not who you are or what it says.
• Receipts are public so anyone can audit STORE: they show amounts and country, never your name or contact details.
• Member votes are private. Governor votes are public.
• You can see, correct, download, and delete your data, except records the law or a public record makes permanent.

---

1. WHO IS RESPONSIBLE

1.1 STORE Research Inc., a Delaware corporation, 440 N Barranca Ave #9117, Covina, CA 91723, is responsible for your personal information (the “controller”). Contact: team@storecloud.org.

1.2 If the planned STORE Association in Switzerland takes over some Services, it will become responsible for the related data. We will tell you before that happens.

2. WHAT THIS POLICY COVERS

storecloud.org, storeresearch.xyz (including the investment pages at storeresearch.xyz/invest), the STORE Protocol, and the STORE apps (STORE Pay, STORE Send, Account, Govern, Holdings, Jobs, Activity), plus our emails and support.

3. WHAT WE COLLECT

Category	Examples	Source
Account	Display name, email, username, account type, organization name	You
Identity (MID1)	Legal name, date of birth, country, verification result and reference. Your ID document images and selfie are collected and held by Persona, our identity provider; we receive the result	You, via Persona
Eligibility	Reg D or Reg S status, evidence reference, who approved it, when	You, our review
Accredited status (U.S. buyers only)	The basis you choose; an income range for each of the last two years and whether it is alone or with a spouse or partner; a net-worth range, not counting your primary home; your occupation and employer; a professional license number (CRD); an organization’s name and asset range; your signed statements; whether STORE has verified you before; our reviewer’s approval basis, note, name and date; and, only if we ask you to use one, a third-party verification letter	You; our review; the public FINRA record; VerifyInvestor (the letter only)
Organizations	Organization details and its owners of 10% or more	You
Signing records	Agreement version and fingerprint, typed name, consent to sign electronically, email-code confirmation, time, device, network (IP) address	You, our systems
Payments	Amounts, payment method, wallet addresses, wire sender name and reference; for cards, only what the processor returns (for example the last four digits)	You, Circle, card processor, banks
Holdings and ledger	Credits, tokens, grants, rewards, receipts, statements	Our systems
Wallets	Saved wallet addresses and their verification	You
Governance	Ballots you took part in; for governor votes, your choice; for member votes, only that you voted (your choice is stored privately and never made public)	You
Other people’s emails you give us	Recipients of email Drops, requests, invoices, invited accountants	You
Support and feedback	Messages, tester reports	You
Device and usage	Browser, device, IP address, pages used, errors, security events	Our systems
Cookies	See section 12	Our systems

Never collected for accredited status: financial documents, tax forms, bank or brokerage statements, account numbers, or Social Security numbers. If we ask you to verify with VerifyInvestor, you send your documents to them directly, under their own privacy policy, and we receive only their letter.

We do not knowingly collect special categories of data (such as health or religion) and ask you not to send them.

4. HOW WE USE IT, AND WHY WE ARE ALLOWED TO

Use	Legal basis
Create and run your account; provide the Services you ask for	Contract
Verify identity and eligibility; screen against sanctions; prevent fraud and money laundering	Legal obligation; legitimate interests
Confirm accredited investor status for U.S. purchases, as U.S. securities law requires. Never used for marketing	Legal obligation; contract
Record and prove signatures and transactions (Trust Receipts, Signature Receipts)	Contract; legal obligation
Approve purchases, including automatic approval (section 11)	Contract; legal obligation
Process payments and automatic returns of failed payments	Contract
Deliver email Drops, requests, and invitations to the people you name	Contract (with you); legitimate interests
Run governance ballots	Contract; legitimate interests
Statements, tax summaries, and records the law requires	Legal obligation
Security, reliability, and fixing problems	Legitimate interests
Improving STORE from usage (measured in aggregate where possible)	Legitimate interests; consent where required
Service emails (receipts, reminders, notices)	Contract
News and updates	Consent (you can opt out any time)

5. WHAT IS PUBLICLY RECORDED

5.1 STORE keeps two kinds of permanent record. Records permanently anchored on STORE are kept on STORE’s own ledger. Records publicly recorded are written as fingerprints to a public network anyone can check (Optimism, with Base as the backup; today the Optimism test network, moving to its main network before sending opens). Every signature, on agreements and governor votes, is permanently anchored on STORE and publicly recorded. A fingerprint proves a record existed unchanged; it does not reveal the record.

5.2 Never publicly recorded: your ID documents, your legal name, your email, your member vote choice, your card details, or anything you tell us about your accredited status (income, net worth, occupation, employer, or license).

5.3 After launch, STORE token transfers to and from wallets are publicly recorded, as with any token.

5.4 A public record is permanent. We cannot delete it, even if you ask. That is why we keep personal details out of it.

5.5 Public receipts. STORE is publicly auditable. Every transaction has a public Trust Receipt that anyone can open and verify. It shows the transaction type, time, status, amounts, and the country of the account, along with the checks passed and the public record. For U.S. purchases it shows only “Reg D, verified”; how you were verified is kept in your private record and shown only to you. It never shows your name, email, address, identity documents, wallet details beyond what is publicly recorded, or anything you wrote in a survey or form.

6. WHO WE SHARE IT WITH

6.1 We never sell your personal information and never share it for cross-site advertising.

6.2 Service providers, only as needed, under contract: Persona (identity), Circle (USDC), our card processor, BitGo (custody), our banks (wires), VerifyInvestor (accredited-investor verification, only when we ask you to use it; your documents go to them directly), email delivery (for example Postmark), hosting and security providers. A current list is available on request at team@storecloud.org. When you give us a license number, we check it on FINRA’s public record; we share nothing about you to do so.

6.3 Other users, as you direct: for example a person you send a Drop to sees your display name; a payer sees a “recently changed” notice on a username.

6.4 The law: when required by valid legal process, or to protect people from harm, we disclose what is required and, where allowed, tell you.

6.5 The STORE Association: if it takes over Services (section 1.2).

6.6 A business transfer: if STORE is merged or sold, under this policy.

7. INTERNATIONAL TRANSFERS

We process data in the United States and may in Switzerland and the EU. For transfers from the EU, UK, or Switzerland we use recognized safeguards such as standard contractual clauses.

8. HOW LONG WE KEEP IT

Data	Kept for
Account data (not publicly recorded)	Until you close your account, then deleted within 90 days, except as below
Identity and eligibility records	As long as the law requires after the relationship ends (typically 5 to 10 years)
Accredited-status answers, the reviewer’s basis and note, and any verification letter	Kept with your purchase for the legal retention period. If no purchase is completed, deleted with your account data
Signed agreements and signing records	For the life of the agreement plus the legal retention period
Transaction and tax records	As long as tax and financial law requires (typically 7 to 10 years)
Recipient emails for unclaimed Drops	Until the Drop is claimed, cancelled, or returned, plus 90 days
Device and security logs	Up to 12 months, longer if needed for an investigation
Public records	Permanent (section 5)

9. SECURITY

We protect data with encryption in transit and at rest, access controls, separation of identity data, audit logs, and email-code confirmation for signatures. No system is perfectly secure. If a breach affects your data, we will tell you and the authorities as the law requires.

10. YOUR RIGHTS

10.1 Depending on where you live, you can ask to: see your data; correct it; delete it; receive a copy you can take elsewhere; restrict or object to some uses; withdraw consent; and not be subject to certain automated decisions.

10.2 Limits: we cannot delete public records, and we must keep some records the law requires. We will tell you when a limit applies.

10.3 How: in the Account area, or email team@storecloud.org. We will confirm your identity first and answer within the time the law sets (for example 30 days in Switzerland and the EU, 45 days in California). You may use an authorized agent. If we say no, you can appeal by replying to our answer.

10.4 California: you have the right to know, delete, and correct, and to opt out of sale or sharing. We do not sell or share personal information as those words are defined, and we do not use sensitive personal information beyond what the law permits. We will not treat you differently for using your rights.

10.5 EU, UK, Switzerland: you may complain to your data protection authority, including Switzerland’s Federal Data Protection and Information Commissioner.

11. AUTOMATED DECISIONS

11.1 Some decisions are automatic: approving later SAFT purchases once your eligibility is recorded, sanctions re-checks, fraud signals, and holds for review. They are checks, not profiling for marketing.

11.3 Accredited status is always decided by a person on our team, never automatically. Reusing an earlier verification requires your fresh confirmation.

11.2 You can ask for a person to review any automated decision that significantly affects you, and to explain it, at team@storecloud.org.

12. COOKIES

12.1 Essential cookies keep you signed in and secure. They are always on.

12.2 Analytics cookies help us improve STORE. Where the law requires consent (for example in the EU, UK, and Switzerland), we ask first, and you can withdraw consent at any time by emailing team@storecloud.org.

12.3 We do not use advertising cookies.

13. CHILDREN

STORE is for people 18 and older. We do not knowingly collect data from anyone under 18, and we delete it if we learn we have.

14. EMAILS

Service emails (receipts, reminders, security, agreement notices) are part of the Services. News and updates are optional; unsubscribe in any email.

15. CHANGES

We will give notice of material changes by email and in the Services before they take effect. Each version is published with its own number and fingerprint; past versions stay available.

16. CONTACT

team@storecloud.org · STORE Research Inc., Attention: Privacy, 440 N Barranca Ave #9117, Covina, CA 91723. English controls over any translation.