Satoshi Loan and Pawn — Privacy Policy

This Privacy Policy ("Policy") describes how Satoshi Loan & Pawn LLC ("Company," "we," "us," or "our") collects, uses, stores, and shares personal information when you visit our website at satoshiloanandpawn.com or use our loan services (collectively, the "Platform").

This Policy applies to all users of the Platform, including visitors, registered account holders, and loan applicants. By using the Platform, you consent to the practices described in this Policy.

We are subject to the Gramm-Leach-Bliley Act (GLBA), the Bank Secrecy Act (BSA), FinCEN regulations, and applicable Michigan state privacy laws. This Policy is designed to satisfy our disclosure obligations under those frameworks.

Information you provide directly:

• Full legal name, date of birth, and government-issued ID details
• Social Security Number or Individual Taxpayer Identification Number (ITIN)
• Email address, phone number, and mailing address
• Financial information including income, assets, and collateral details
• Bitcoin wallet addresses and transaction hashes
• Account credentials (email and hashed password)
• Communications you send us via contact forms or email

Information collected automatically:

• IP address, browser type, and operating system
• Pages visited, time on site, and referring URLs
• Device identifiers and session tokens
• Cookie and local storage data (see Section 08)

Information from third parties:

• Identity verification results from KYC/AML screening providers
• OFAC sanctions screening results
• Spot price data from market data providers (CoinGecko, Swissquote)

We use the information we collect for the following purposes:

We do not use your personal information for targeted advertising or sell it to data brokers or marketing companies.

We process your personal information on the following legal bases:

• Contract performance: Processing necessary to enter into and perform your loan agreement.
• Legal obligation: Processing required by the Bank Secrecy Act, FinCEN regulations, OFAC sanctions programs, and Michigan state law.
• Legitimate interests: Fraud prevention, platform security, and improving our services — where these interests are not overridden by your rights.
• Consent: For optional communications such as marketing emails, where you have opted in. You may withdraw consent at any time.

We do not sell, rent, or trade your personal information. We share it only in the following limited circumstances:

• Regulatory authorities: FinCEN (CTRs, SARs), Michigan DIFS, and other regulators as required by law.
• Law enforcement: In response to lawful subpoenas, court orders, or government requests.
• Identity verification providers: KYC/AML screening vendors who process data solely on our behalf under data processing agreements.
• Email delivery providers: To send transactional emails (loan agreements, account notifications). These providers do not use your data for their own purposes.
• Business transfers: In connection with a merger, acquisition, or sale of assets, subject to the acquirer honoring this Policy.

All third-party service providers are contractually required to protect your data and use it only for the purposes we specify.

We implement industry-standard technical and organizational measures to protect your personal information:

• Encryption at rest: AES-256 encryption for all stored personal and financial data.
• Encryption in transit: TLS 1.3 for all data transmitted between your browser and our servers.
• Access controls: Role-based access; only authorized personnel with a need-to-know basis can access customer records.
• Multi-factor authentication: Required for all customer accounts and enforced for all internal staff systems.
• Security audits: Annual independent security assessments and penetration testing.
• Breach notification: We will notify affected users and regulators within the timeframes required by applicable law in the event of a data breach.

No method of transmission or storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

We retain personal information for as long as necessary to fulfill the purposes described in this Policy and to comply with our legal obligations:

After the applicable retention period, data is securely deleted or anonymized. Deletion requests received during a mandatory retention period will be honored after the period expires.

We use cookies and similar technologies to operate the Platform, remember your preferences, and analyze usage. We do not use third-party advertising cookies.

You can control non-essential cookies through your browser settings. Disabling required cookies may prevent you from logging in or using certain features of the Platform.

Depending on your jurisdiction, you may have the following rights regarding your personal information:

• Right of access: Request a copy of the personal data we hold about you.
• Right to correction: Request correction of inaccurate or incomplete data.
• Right to deletion: Request deletion of your data, subject to legal retention obligations.
• Right to restrict processing: Request that we limit how we use your data in certain circumstances.
• Right to data portability: Receive your data in a structured, machine-readable format.
• Right to object: Object to processing based on legitimate interests.
• Right to withdraw consent: Withdraw consent for optional processing at any time without affecting prior processing.

To exercise any of these rights, contact us at sales@satoshiloanandpawn.com with the subject line "Privacy Request." We will respond within 30 days. We may need to verify your identity before processing your request.

Note: We cannot delete data we are legally required to retain under BSA/FinCEN rules during the applicable retention period.

Our Platform is not directed to individuals under the age of 18. We do not knowingly collect personal information from minors. If you believe we have inadvertently collected information from a minor, please contact us immediately at sales@satoshiloanandpawn.com and we will delete it promptly.

The Platform may contain links to third-party websites (such as regulatory agency sites, market data providers, or identity verification portals). These sites have their own privacy policies, and we are not responsible for their practices. We encourage you to review the privacy policy of any third-party site you visit.

If you are a California resident, the California Consumer Privacy Act (CCPA) grants you additional rights:

• Right to know: Request disclosure of the categories and specific pieces of personal information we have collected about you in the past 12 months.
• Right to delete: Request deletion of personal information we have collected, subject to certain exceptions.
• Right to opt out of sale: We do not sell personal information. No opt-out is required.
• Right to non-discrimination: We will not discriminate against you for exercising your CCPA rights.

To submit a CCPA request, contact us at sales@satoshiloanandpawn.com with the subject line "CCPA Request." We will respond within 45 days.

Note: Financial institutions subject to the GLBA are exempt from certain CCPA provisions. To the extent our data practices are governed by GLBA, GLBA requirements apply.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will update the "Last updated" date at the top of this page and notify you by email at least 14 days before the changes take effect.

Your continued use of the Platform after the effective date of any changes constitutes your acceptance of the revised Policy. If you do not agree to the revised Policy, you must stop using the Platform and contact us to close your account.

For privacy-related questions, requests, or complaints, please contact our Privacy Officer:

You also have the right to lodge a complaint with your applicable data protection authority or, for Michigan residents, with the Michigan Department of Insurance and Financial Services (DIFS) at michigan.gov/difs.