CRYPTO HEARTS LLC PRIVACY POLICY

Last Updated: August 29, 2026

Effective Date: August 29, 2026

This Privacy Policy describes how Crypto Hearts LLC ("Crypto Hearts," "we," "us," or "our"), a Wyoming limited liability company doing business as Heart.Fi, collects, uses, shares, and protects personal information when you use the Heart.Fi platform at heart.fi and our mobile applications (the "Platform"). By using our Platform, you acknowledge that you have read and understood this Privacy Policy.

WHAT CHANGED. Heart.Fi now offers custodial stablecoin wallets and fiat deposits and withdrawals, operated by a regulated custody partner. That means we — and our partners — collect and process identity verification data (including government identity documents and a biometric liveness check) and banking data, and we are subject to anti-money-laundering and sanctions obligations that constrain how long we keep that data and when we must disclose it. Sections 1, 3, 4, 6, 7, and 10 cover this.

Contact Information:

• Email: info@heart.fi
• Mailing Address: Crypto Hearts LLC, Wyoming, USA

We collect information in four categories: information you provide directly, identity and financial information collected to meet legal obligations, information collected automatically, and blockchain data.

Information You Provide:

Identity and Financial Information (KYC/AML):

Collected when you verify your identity in order to hold a balance, receive donations, or move funds. This is processed by our identity verification provider and our custody partner as described in Section 4.

BIOMETRIC DATA. The selfie and liveness check involve processing biometric data, which is a special category of personal data under GDPR and is separately regulated in some U.S. states. It is collected solely to confirm that the identity document you present belongs to you, is processed by our identity verification provider on our behalf, is not used to identify you elsewhere on the Platform, is never sold, and is retained only as long as Section 6 permits. You will be asked for explicit consent before the check. If you decline, you cannot complete verification and cannot use custodial or fiat features.

Information Collected Automatically:

Blockchain Data:

When you transact through the Platform, certain information is permanently recorded on public blockchain networks. This includes:

• Wallet addresses (sender and recipient), including the addresses of custodial wallets held for you
• Transaction amounts
• Transaction timestamps
• Transaction hashes/IDs
• Smart contract interactions

IMPORTANT NOTICE REGARDING BLOCKCHAIN DATA PERMANENCE: Transactions occur on public blockchains including Base, Ethereum, Solana, Tempo, and Tron. Once a transaction is confirmed on any network, the data becomes permanent and immutable. It is publicly visible on block explorers and cannot be modified, deleted, or erased by anyone, including Crypto Hearts and our custody partner. We cannot fulfil deletion requests for on-chain data. Because a custodial wallet address is linked to your verified identity in our records, on-chain activity from that address may be linkable to you by anyone who learns the association.

We use collected information for the following purposes:

Service Delivery:

• Creating and managing your account and profile
• Provisioning and operating custodial wallets held for you by our custody partner
• Processing donations, transfers, conversions, fiat deposits, and withdrawals
• Provisioning campaign deposit addresses and routing campaign funds
• Displaying campaign, donation, and transaction information
• Sending donation receipts and platform notifications

Legal and Compliance:

• Verifying your identity (KYC) and, for organizations, your business (KYB)
• Screening you and your counterparties against sanctions, PEP, and adverse-media lists, on an ongoing basis
• Monitoring transactions for suspicious activity and meeting anti-money-laundering obligations
• Making regulatory reports, including suspicious activity reports, which we may be prohibited from disclosing to you
• Recording which version of our legal terms you accepted and when
• Responding to lawful requests from courts, regulators, and law enforcement
• Meeting tax and financial reporting obligations

Platform Operations:

• Maintaining security and preventing fraud and abuse
• Enforcing our Terms of Service and Acceptable Use Policy, including moderating campaigns
• Responding to support requests
• Communicating service updates and changes

Analytics and Improvement:

• Understanding how users interact with our Platform (with consent)
• Improving user experience and platform features
• Product analytics and session recordings with sensitive data automatically masked via PostHog

AUTOMATED DECISION-MAKING. Identity verification, sanctions screening, and fraud and transaction monitoring involve automated processing. An automated result can cause your verification to fail, a transaction to be declined or delayed, or your account to be limited or suspended. Where a decision produces a legal or similarly significant effect on you and is made solely by automated means, you have the right to request human review — email info@heart.fi with "Verification Review" in the subject line. We may be unable to explain the detail of a screening outcome where disclosure would breach a legal prohibition, and we cannot override a decision our custody partner is legally required to make.

Custodial wallets (the default).

When you complete identity verification, we instruct our custody partner to open stablecoin wallets for you. Those wallets are created, held, and operated by the custody partner.

• We and our custody partner hold the keys, not you. No private key or seed phrase is issued to you and none can be exported.
• Your identity is linked to your wallet addresses in our records and in the custody partner's records, and to every transaction made from them.
• Your balance, transaction history, and instructions are processed by us and by the custody partner to operate your account.
• Your funds and account can be frozen by us or the custody partner in response to legal process, sanctions obligations, or suspected fraud. Where the law permits, we will tell you; sometimes it does not.
• The custody partner keeps its own records of you and your activity, as its own controller, under its own privacy policy and its own regulatory retention obligations. Deleting your Heart.Fi account does not delete those records.

Fiat rails. If you use fiat deposits or withdrawals, your bank account details and the details of each payment are processed by our custody partner and its banking partners, who are subject to their own banking and anti-money-laundering obligations.

Connected external wallets.

If you connect an external self-custody wallet (such as MetaMask, Phantom, or a hardware wallet) to send a donation, we receive only its public address and network information. We never receive its private keys, seed phrase, or recovery phrase, and signatures are produced locally in your wallet software. Note that connecting an external wallet to a verified Heart.Fi account associates that address with your verified identity in our records.

Self-custody wallet creation is not currently offered on the Platform. Earlier versions of this Policy described a non-custodial embedded wallet whose credentials you could export; that feature is not available.

We share personal information with the following categories of recipients. Providers acting on our behalf operate under data processing agreements; some recipients, noted below, act as independent controllers with their own privacy policies.

Bridge — Custody, Stablecoin, and Fiat Partner (independent controller):

• Data Shared: Full legal name, date of birth, nationality, residential address, government identity document and verification result, tax identifier, email, phone, bank account and virtual account details, transaction data, sanctions and screening results
• Purpose: Opening and operating custodial wallets, executing transfers and conversions, processing fiat deposits and withdrawals, meeting its own regulatory obligations as a licensed financial services provider
• Role: Bridge and its licensed affiliates and banking partners act as independent controllers for the regulated activity they perform. They keep their own records under their own privacy policy and their own retention obligations, which we do not control and cannot shorten.
• Your Control: You cannot use custodial wallets or fiat rails without this sharing. You may close your account, but records the partner must retain by law will persist.

Didit — Identity Verification (processor):

• Data Shared: Government identity document images, selfie and liveness/biometric check, name, date of birth, address, and the verification result
• Purpose: Confirming your identity and detecting document fraud
• Role: Processes on our behalf under a data processing agreement
• Retention: Source images and biometric templates are retained only as long as needed to complete and evidence verification, then deleted in line with Section 6; the verification outcome is retained for the AML period

Sanctions and screening data providers:

• Data Shared: Name, date of birth, nationality, address, wallet addresses
• Purpose: Screening against sanctions, PEP, and adverse-media lists, and against blockchain risk intelligence
• Note: Screening is performed both by us and by our custody partner

PostHog (Product Analytics & Session Recordings):

• Data Shared: Usage events, page views, clicks, session recordings (with sensitive inputs masked), IP addresses (for geolocation)
• Purpose: Product analytics, user experience improvement, bug detection
• Data Location: EU (Frankfurt, Germany)
• Storage Method: localStorage (no cookies used for analytics)
• Compliance: SOC 2 Type II certified; GDPR compliant; Data Processing Agreement with Standard Contractual Clauses
• Your Control: Analytics and session recordings can be disabled at any time in Settings > Privacy & Data. Identity verification and banking data are never sent to PostHog.

Cloudflare Email Sending (Transactional Email):

• Data Shared: Email addresses, recipient names, and the content of transactional messages
• Purpose: Delivering sign-in codes and links, donation receipts, and account and campaign notifications, sent from auth.heart.fi and notifications.heart.fi
• Compliance: EU-US Data Privacy Framework certified; ISO 27001, SOC 2, PCI DSS certified
• Retention: Delivery metadata is retained under Cloudflare's terms; message content is not retained by us beyond the notification records described in Section 6

Cloudflare (Hosting, Storage, and Security):

• Data Shared: IP addresses, request metadata, traffic data, uploaded images and files
• Purpose: Content delivery, object storage, DDoS protection, security services
• Compliance: EU-US Data Privacy Framework certified; ISO 27001, SOC 2, PCI DSS certified
• Retention: Traffic logs retained 24-72 hours

Blockchain Explorer and Node APIs (Etherscan, Alchemy, and similar):

• Data Shared: Wallet addresses, transaction queries
• Purpose: Transaction verification, balance checking, transaction history display
• Note: Blockchain data is publicly available; API queries do not share additional personal data

Email support inbox:

• Purpose: Customer support correspondence sent to info@heart.fi is received and stored by our email provider

Other disclosures. We may also share information when required by law; in response to a subpoena, court order, regulator request, or law enforcement demand; to establish or defend legal claims; to prevent fraud or harm; or in connection with a merger, acquisition, or sale of assets. We do not sell your personal information.

Public information. Your display name, profile picture, bio, campaigns, and — depending on your donation visibility settings — your donations may be visible publicly. Your identity verification data, banking details, and address are never shown publicly.

Crypto Hearts is based in Wyoming, USA. Your information may be transferred to and processed in the United States and other countries where we and our service providers and partners operate.

Transfer Mechanisms:

For international transfers, we rely on the compliance mechanisms maintained by our providers and partners:

• Cloudflare, which provides our hosting, storage, and transactional email, is certified under the EU-US Data Privacy Framework
• PostHog incorporates Standard Contractual Clauses in its data processing terms
• Our custody partner and identity verification provider transfer data under Standard Contractual Clauses or an equivalent mechanism set out in their own terms, and process it in the jurisdictions where they and their banking partners are licensed

We do not maintain separate EU-specific transfer agreements beyond those provided by our service providers. By using the Platform, you acknowledge that your data may be transferred to and processed in the United States.

Our analytics provider (PostHog) processes data in the EU (Frankfurt, Germany), minimizing cross-border transfers for analytics data.

Blockchain-Specific Transfer Notice: Public blockchain networks operate through globally distributed nodes. When you transact, data is replicated across nodes worldwide, including in jurisdictions without equivalent data protection laws. This is inherent to blockchain technology and cannot be prevented while using blockchain-based services.

We retain your personal information according to the following schedule:

On an account deletion request we delete off-chain personal data that we are free to delete within 90 days. We cannot delete identity verification, sanctions screening, transaction monitoring, or payment records within the statutory retention periods above — instead we restrict them so they are used only for the legal purpose that requires their retention, and delete them at the end of the period. On-chain data cannot be deleted at all. Our custody partner retains its own records under its own obligations.

Depending on your location, you may have the following rights regarding your personal information:

For All Users:

• Access: Request a copy of your personal data
• Correction: Request correction of inaccurate data
• Deletion: Request deletion of your personal data (subject to the legal retention requirements in Section 6)
• Export: Receive your data in a portable, machine-readable format
• Objection: Object to processing based on legitimate interests
• Withdrawal of Consent: Withdraw consent for processing based on consent (such as analytics, or the biometric check — though withdrawing the latter means you can no longer use custodial or fiat features)
• Human review: Request human review of a solely automated decision that significantly affects you (see Section 2)

For EEA, UK, and Swiss Residents (GDPR/UK GDPR): You have all rights listed above, plus the right to lodge a complaint with your local data protection authority. For the EEA, find your authority at: https://edpb.europa.eu/about-edpb/about-edpb/members_en

For California Residents (CCPA/CPRA): If the CCPA applies to our processing of your data, you have the right to:

• Know what personal information we collect, use, and share
• Delete your personal information (subject to exceptions)
• Correct inaccurate personal information
• Limit the use and disclosure of sensitive personal information — noting that identity documents, biometric data, and financial account information are "sensitive personal information" that we use only for the permitted purposes of providing the service, verifying identity, and meeting legal obligations
• Opt-out of the "sale" or "sharing" of personal information
• Non-discrimination for exercising your rights

We do not "sell" personal information as defined under CCPA. We do not share personal information for cross-context behavioral advertising.

Limitations on your rights.

• We cannot delete transaction data recorded on public blockchains. It is technically impossible to erase.
• We cannot delete identity verification, screening, transaction monitoring, or payment records inside the statutory retention periods in Section 6.
• We cannot disclose the existence or content of a suspicious activity report, or the detail of certain screening decisions, where the law prohibits it.
• Our custody partner is an independent controller for the regulated activity it performs; requests about its own records should be directed to it, and we will tell you how.

When you make a deletion request, we will delete what we can and explain what we must keep and why.

To Exercise Your Rights: Email us at info@heart.fi with the subject line "Privacy Rights Request." We will respond within 30 days (45 days for complex requests, with notice). We may need to verify your identity before acting on a request.

We do not use cookies for analytics. Our analytics provider (PostHog) uses localStorage instead of cookies to store anonymized usage data.

Essential cookies may be used for:

• Authentication: Maintaining your login session
• Security: CSRF protection, rate limiting

These essential cookies are necessary for the Platform to function and do not require consent under GDPR.

Analytics Opt-Out: You can disable analytics tracking and session recordings at any time by visiting Settings > Privacy & Data and toggling off analytics. When disabled, we do not collect any usage data, session recordings, or analytics events.

See our Cookie Policy for full detail.

We implement industry-standard security measures to protect your personal information:

• Encryption: TLS 1.2+ for data in transit; AES-256 for data at rest
• Access Controls: Role-based access, principle of least privilege; identity documents and banking details are restricted to staff with a compliance or support need
• Custody: Private keys for custodial wallets are held and secured by our regulated custody partner, not by Heart.Fi
• Infrastructure Security: DDoS protection via Cloudflare, SOC 2 Type II compliant service providers
• Monitoring: Security logging, anomaly detection, and transaction monitoring
• Vendor Security: Third-party processors maintain SOC 2 or equivalent certifications

Despite these measures, no system is completely secure. You are responsible for maintaining the confidentiality of your account credentials and any second factor. If you believe your account has been compromised, contact us immediately at info@heart.fi.

Breach notification. If a personal data breach is likely to result in a risk to your rights, we will notify the relevant supervisory authority and, where required, you, within the timeframes the law sets.

Our Platform is not directed to individuals under 18 years of age. We do not knowingly collect personal information from children under 18, and identity verification is designed to prevent under-18 accounts from being opened. If you believe we have collected information from a child under 18, contact us immediately at info@heart.fi and we will delete it.

This policy does not restrict campaigns from benefiting children or minors as aid recipients. If you publish information about a child in a campaign, you are responsible for having the right to do so.

We may update this Privacy Policy periodically. We will notify you of material changes by posting the updated policy on our Platform with a new "Last Updated" date, and for significant changes by email or an in-product prompt. Where a change materially affects how we handle your data, we may ask you to review and accept the updated terms before continuing to use affected features. Your continued use of the Platform after changes become effective constitutes acceptance of the revised policy.

For privacy-related inquiries, requests, or complaints:

Crypto Hearts LLC (d/b/a Heart.Fi) Email: info@heart.fi

For EEA residents, you may also contact your local data protection authority.