🛡️ Privacy Policy
✅ SEC CATEGORY 1 COMPLIANT | Issuer-Sponsored Tokenized Securities pursuant to SEC Division of Corporation Finance, Division of Investment Management, and Division of Trading and Markets Joint Statement dated January 28, 2026
🛡️ Our Commitment to Your Privacy
At OTCM Protocol, Inc., we are serious about protecting your privacy while maintaining compliance with federal securities laws and Category 1 regulatory requirements. You don't have to take our word for it though—you can read below to understand how we treat your Personal Data.
✅ Your Agreement
When you use our Services, we require that you:
Requirement | Description |
|---|---|
📋 Acknowledge | Acknowledge and agree to our Privacy Policy |
🤝 Understand | Understand and consent to our Privacy Policy |
✅ Accept | Accept that we will collect, use, and share information as outlined below |
⚖️ Regulatory Consent | Consent to data collection required for Category 1 compliance, KYC/AML, and accredited investor verification |
📜 Related Documents
Remember that your use of our Website and Services are subject to:
- 📋 Our Terms of Use
- 📋 Our Terms of Service (which incorporates this Privacy Policy)
- 📋 Our Risk Disclosure
- 📋 Our Cookie Notice
Note: Capitalized terms in this Policy have the definitions given to them in the Terms of Use and Terms of Service, unless first defined in this Policy.
🎯 Why We Have A Privacy Policy (And What It Covers)
💡 Purpose
Our Privacy Policy helps you understand:
Topic | Description |
|---|---|
🔍 Collection & Use | Our collection and use of information |
⚖️ Your Rights | Your rights regarding your data |
🏛️ Regulatory Requirements | How Category 1 compliance affects data handling |
🛡️ Coverage
Our Privacy Policy covers how we treat Personal Data that we gather when you access or use our Services.
⚖️ Special Notice: Category 1 Compliance Data
OTCM Protocol operates SEC Category 1 compliant infrastructure for tokenized securities. This requires collection and retention of certain data for regulatory compliance purposes, including:
Data Category | Regulatory Purpose |
|---|---|
🪪 KYC Data | Know Your Customer verification required by Bank Secrecy Act |
💰 Accreditation Data | Accredited investor verification required by SEC Rule 506(c) |
🚫 OFAC Screening Data | Sanctions compliance required by U.S. Treasury |
📊 Transaction Records | Securities transaction records required by federal securities laws |
🏦 Custody Records | Records coordination with SEC-registered transfer agent |
⚠️ Important: Certain data collection is mandatory for Category 1 compliance. You cannot use ST22 Tokenized Securities services without providing required KYC and accreditation verification data.
🏢 Third Party Data
If your Personal Data is lawfully given to any company that we don't own or control, or to people we don't directly oversee, then their privacy policy applies, not this Privacy Policy.
🏦 Key Third-Party Data Sharing (Category 1 Requirements)
Third Party | Data Shared | Purpose |
|---|---|---|
🏦 Empire Stock Transfer | Identity, ownership records | SEC-registered transfer agent for custody and shareholder registry |
🔐 KYC/AML Providers | Identity verification data | Regulatory compliance verification |
📊 Accreditation Verification | Financial qualification data | SEC Rule 506(c) compliance |
🚫 OFAC Screening Services | Identity data | Sanctions compliance |
🏛️ Regulatory Bodies | As required by law | SEC, FinCEN, and other regulatory reporting |
📋 Key Areas We'll Cover
Section | Topic |
|---|---|
📥 | How we obtain your Personal Data |
📊 | The types of Personal Data we collect |
🔧 | How we use your Personal Data |
🤝 | Sharing your Personal Data |
⚖️ | Your rights with respect to your Personal Data |
🏛️ | Category 1 regulatory data requirements |
🚨 Questions or Concerns?
If any part of this Privacy Policy is unclear or if you believe your Personal Data is being misused, please contact us immediately so we can investigate and remedy the situation.
Contact: privacy@otcm.io
⛓️ Blockchain Transparency Notice
Please understand that our Services utilize Solana blockchain smart contract technology for Category 1 compliant tokenized securities trading.
📊 What Is Public on Blockchain
Data Type | Visibility | Notes |
|---|---|---|
🔗 Wallet Addresses | Public | Visible on Solana blockchain |
💰 Transaction History | Public | All ST22 and OTCM token transfers visible |
📊 Token Balances | Public | Holdings visible at wallet level |
🪪 Identity Data | Private | NOT stored on blockchain |
📋 KYC/Accreditation | Private | Stored off-chain with compliance providers |
⚠️ Privacy Limitation: Blockchain transactions are permanent and public. While we do not publish your identity on-chain, sophisticated analysis may potentially link wallet addresses to identities. We take reasonable steps to protect your privacy, but blockchain transparency is inherent to the technology.
📥 Here Is How We Gather Personal Data
🎯 Primary Collection Methods
For our Services, we obtain your Personal Data through multiple channels:
1. 👤 Directly From You
As a user, you will:
Action | Data Collected |
|---|---|
✅ Account Creation | Name, email, contact information |
🪪 KYC Verification | Government ID, address verification, date of birth |
💰 Accreditation Verification | Financial documentation (for ST22 securities) |
💳 Payment Information | Payment details for minting fees |
📊 Service Usage | Additional data as you use our Services |
2. 🏦 From Third Parties (Category 1 Requirements)
Third Party | Data Received | Purpose |
|---|---|---|
🏦 Empire Stock Transfer | Custody confirmations, shareholder records | Category 1 custody verification |
🔐 KYC Providers | Verification results | Identity confirmation |
📊 Accreditation Services | Verification status | SEC Rule 506(c) compliance |
🚫 OFAC Screening | Sanctions check results | Compliance verification |
📈 Analytics Providers | Usage patterns | Service improvement |
3. ⛓️ From Blockchain
Data Type | Collection Method |
|---|---|
🔗 Wallet Addresses | When you connect wallet to platform |
💰 Transaction History | Public blockchain data |
📊 Token Holdings | Public blockchain data |
🍪 We Automatically Collect Certain Information
📋 Cookie Disclosure
When you use our Services, you will be shown a cookie disclosure with details on:
Information | Description |
|---|---|
🍪 Cookie Types | What cookies/pixels/tags we use |
🎯 Purposes | Purposes for each type |
⚙️ Management | How to control cookie preferences |
🔧 Tracking Technologies
Our Site may use Cookies or similar methods:
Technology | Purpose |
|---|---|
🍪 Session Cookies | Maintain login state |
📊 Analytics Cookies | Understand usage patterns |
🔐 Security Cookies | Fraud prevention |
🎯 Preference Cookies | Remember your settings |
🎯 Purpose of Cookies
- 🔍 Recognize you (your web browser, phone, etc.)
- 📊 Understand how and when you visit the Site
- 📈 Analyze trends to learn and improve our Services
- 🔐 Maintain security and prevent fraud
- ⚖️ Support Category 1 compliance monitoring
🚫 "Do Not Track" Limitations
Browser Setting | Our Response |
|---|---|
🚫 DNT Signal | We honor DNT signals where technically feasible |
⚠️ Limitations | Some tracking required for Category 1 compliance cannot be disabled |
⚙️ Cookie Management
Option | Description |
|---|---|
🔧 Browser Settings | Accept/reject Cookies through browser settings |
🗑️ Delete Cookies | Delete existing Cookies on your device |
⚠️ Functionality Impact | Some functions may not work if you disable Cookies |
🔄 Preference Reset | Preferences may need readjustment when you visit |
📚 Learn More: Visit AllAboutCookies.org for comprehensive cookie information.
📊 This Is The Kind of Personal Data We Collect
👤 Information That Identifies You Personally
Standard Personal Data
Data Type | Purpose |
|---|---|
📛 Full Name | Account identification, regulatory compliance |
📬 Addresses | Mail, billing, and email addresses |
🌐 Online Identifiers | Usernames, wallet addresses |
🌍 IP Address | Security, geolocation compliance |
📱 Phone Number | Account security, communications |
Category 1 Compliance Data (Required for ST22 Securities)
Data Type | Purpose | Regulatory Basis |
|---|---|---|
🪪 Government ID | KYC verification | Bank Secrecy Act |
📅 Date of Birth | Identity verification, age compliance | BSA, securities laws |
🏠 Residential Address | Identity verification, jurisdiction compliance | SEC regulations |
💰 Financial Information | Accredited investor verification | SEC Rule 506(c) |
📊 Tax Identification | Tax reporting, regulatory compliance | IRS requirements |
🏢 Employment Information | Accreditation verification | SEC Rule 501 |
💎 Net Worth Documentation | Accreditation verification | SEC Rule 501 |
⚠️ Mandatory Collection: Category 1 compliance requires collection of KYC and accreditation data. This data collection is not optional for ST22 Tokenized Securities services.
📋 Customer and User Records
Information that may include customer and user records identified by applicable law:
Record Type | Contents |
|---|---|
📝 Account Records | Registration data, preferences |
💰 Transaction Records | ST22 and OTCM token transactions |
🏦 Custody Records | Empire Stock Transfer coordination |
⚖️ Compliance Records | KYC/AML verification, accreditation status |
📧 Communication Records | Support requests, correspondence |
🌐 Internet Activity Information
Data Type | Purpose |
|---|---|
🔍 Browsing History | Site usage analysis (on our platform only) |
💻 Interaction Data | How you use our Services |
📊 Trading Activity | Transaction patterns for compliance monitoring |
🔐 Security Events | Login attempts, security alerts |
🎯 Collection Philosophy
We collect information that we believe is necessary to:
Purpose | Description |
|---|---|
🖥️ Functionality | Make the Site render and work well for you |
⚡ User Experience | Make your use of Services faster, easier, and more intuitive |
🚀 Improvement | Improve and expand our Services |
⚖️ Compliance | Meet Category 1 regulatory requirements |
🛡️ Security | Protect against fraud and unauthorized access |
⚠️ Without this information: Services will not be possible, and Category 1 compliance cannot be maintained.
🔧 How We Use Your Personal Data
Nearly all Personal Data we collect is used to manage, improve, understand, personalize our Services, and maintain Category 1 compliance.
🎯 We Use Personal Data To:
Service Delivery
Use | Description |
|---|---|
✅ Purpose Fulfillment | Accomplish a purpose when you provide Personal Data |
🛠️ Service Provision | Provide our Services and respond to your requests |
💰 Transaction Processing | Process ST22 and OTCM token transactions |
🏦 Custody Coordination | Coordinate with Empire Stock Transfer |
Category 1 Compliance (Required)
Use | Regulatory Basis |
|---|---|
🪪 KYC Verification | Bank Secrecy Act, AML requirements |
💰 Accreditation Verification | SEC Rule 506(c) |
🚫 OFAC Screening | U.S. Treasury sanctions requirements |
📊 Transaction Monitoring | Securities law compliance |
🏛️ Regulatory Reporting | SEC, FinCEN reporting obligations |
📋 Record Keeping | Securities transaction record requirements |
Communication
Use | Description |
|---|---|
📧 Service Communications | Communicate about Services based on your preferences |
✅ Confirmations | Send transaction confirmations |
📨 Updates | Email you about your use of the Services |
🚨 Security Alerts | Notify you of security-related events |
Support & Personalization
Use | Description |
|---|---|
🤝 Support | Offer and provide support for the Services |
🎨 Personalization | Personalize the content on our Site |
📋 Requests | Fulfill requests and respond to questions |
Improvement & Development
Use | Description |
|---|---|
🔬 Research | Test, research, analyze and develop the Service |
🚀 New Features | Offer new Services and make the Site better |
Security & Compliance
Use | Description |
|---|---|
🛡️ Fraud Prevention | Deter and stop illegal, fraudulent, and other damaging actions |
🔐 Security | Maintain safety, security and integrity of the Site and Services |
⚖️ Policy Enforcement | Ensure compliance with obligations and enforce company policies |
🏛️ Legal Compliance | Interact with governmental and law enforcement as required by law |
🔄 New Uses
We may need to use your previously-collected Personal Data for new purposes consistent with our Services and their evolution. When this happens, we will inform you before we start (except where required by law or Category 1 compliance).
📧 Communication Preferences
Don't want to receive marketing communications from us?
Method | Instructions |
|---|---|
📱 Email Opt-Out | Use the opt-out link provided in emails |
📧 Contact Us | Email your preference to: privacy@otcm.io |
⚠️ Note: You cannot opt out of transactional or compliance-related communications required for Category 1 operations.
🤝 How We Share Your Personal Data
💰 Not for Monetary Gain
We are NOT in the business of sharing your Personal Data for monetary gain.
We do need to perform and improve our Services and maintain Category 1 compliance, which requires sharing your Personal Data with:
🏛️ Regulatory and Compliance Sharing (Required)
Recipient | Data Shared | Purpose |
|---|---|---|
🏦 Empire Stock Transfer | Identity, ownership records | SEC-registered transfer agent custody |
🏛️ SEC | As required by law | Securities law compliance |
💵 FinCEN | SAR/CTR filings as required | Bank Secrecy Act compliance |
🚫 OFAC | Screening data | Sanctions compliance |
👮 Law Enforcement | As required by law | Legal obligations |
⚠️ Mandatory Sharing: Category 1 compliance requires sharing certain data with regulatory bodies and Empire Stock Transfer. This sharing is not optional.
🏢 Service Providers
Provider Type | Purpose |
|---|---|
💳 Payment Processors | Process payments for minting fees |
🛡️ Security Providers | Maintain platform security |
💻 Technology/Hosting | Infrastructure services |
📊 Analytics Providers | Usage analysis |
🔐 KYC/AML Providers | Identity verification |
💰 Accreditation Verification | SEC Rule 506(c) compliance |
🔍 Compliance & Security
Recipient | Purpose |
|---|---|
📋 Auditors | Maintain compliance and security |
🚨 Security Services | Detect security issues and fraud |
🛡️ Fraud Prevention | Protect against illegal or improper activity |
🔬 Research & Development
Recipient | Purpose |
|---|---|
🧪 Internal Research | Technological development |
🐛 Debug Services | Repair errors on the Site or Services |
📞 Customer Service
Recipient | Purpose |
|---|---|
🤝 Customer Care | Customer support services |
📦 Order Processing | Transaction fulfillment |
🌐 Public & Transaction Information
Others may access your Personal Data if you:
Action | Consequence |
|---|---|
📢 Post Publicly | Information becomes public |
💰 Complete Transactions | Transaction data recorded on blockchain (public) |
🤝 Access Third Parties | Their privacy policies control |
⚠️ Blockchain Transparency: ST22 and OTCM token transactions are recorded on the Solana blockchain and are publicly visible. While your identity is not directly published, wallet addresses and transaction history are public.
🏢 Corporate Changes
Your Personal Data may be transferred through:
Event | Handling |
|---|---|
🤝 Merger/Acquisition | Data transfers to acquiring entity |
💔 Bankruptcy | Data may be transferred as asset |
💰 Asset Sale | Data may be included in sale |
We will notify you of any such transfer and your options.
🛡️ Data Security and Retention
🔐 Security Measures
We employ safeguards designed to protect Personal Data:
Safeguard Type | Examples |
|---|---|
🔧 Technical | Encryption, access controls, monitoring |
🏢 Organizational | Employee training, access policies |
🏗️ Physical | Secure facilities, device security |
⚠️ Security Disclaimer
🚨 NO SYSTEM IS 100% SECURE
Despite our security measures, we cannot guarantee absolute security.
You are responsible for:
• Maintaining security of your wallet and private keys
• Using strong, unique passwords
• Protecting your devices from unauthorized access
• Reporting any suspected security breaches immediately📅 Data Retention
Category 1 Compliance Retention Requirements
Data Type | Retention Period | Regulatory Basis |
|---|---|---|
🪪 KYC Records | 5 years after account closure | Bank Secrecy Act |
💰 Transaction Records | 7 years | Securities laws, IRS requirements |
📊 Accreditation Records | 5 years | SEC Rule 506(c) |
🚫 OFAC Screening | 5 years | Treasury requirements |
📧 Communications | 3 years | Business records |
⚠️ Regulatory Retention: We are required by law to retain certain records for specified periods. Deletion requests cannot override regulatory retention requirements.
🌍 Personal Data Use/Storage
🗺️ Global Processing
Your Personal Data may be used, hosted, or otherwise processed outside of your home jurisdiction in jurisdiction(s) that may not provide equivalent levels of protection, including the United States.
Processing Location | Safeguards |
|---|---|
🇺🇸 United States | Primary processing location |
🌍 Other Jurisdictions | Standard contractual clauses where applicable |
👶 Personal Data of Children
🚫 Age Restrictions
Requirement | Description |
|---|---|
❌ No Minors | We do not offer our Services to children |
🚫 No Collection | We do not knowingly collect Personal Data from anyone under 18 |
⚖️ Accredited Investors | ST22 securities require accredited investor status (adults only) |
🗑️ Data Deletion Policy
If we discover Personal Data from a child under 18:
Action | Timeline |
|---|---|
🚨 Deletion | We will delete it as quickly as possible |
📧 Contact | If you believe a child under 18 has given us Personal Data, contact us at privacy@otcm.io |
⚖️ Privacy Rights In Certain Jurisdictions
🏛️ Consumer Data Protection Laws
Certain jurisdictions have enacted laws to protect and empower consumers with respect to their data and Personal Data.
🇺🇸 California Residents (CCPA/CPRA)
California residents have specific rights:
Right | Description |
|---|---|
🔍 Right to Know | Request disclosure of Personal Data collected |
🗑️ Right to Delete | Request deletion of Personal Data (subject to exceptions) |
🚫 Right to Opt-Out | Opt-out of sale/sharing of Personal Data |
✏️ Right to Correct | Request correction of inaccurate Personal Data |
⚖️ Non-Discrimination | Not be discriminated against for exercising rights |
⚠️ Limitations: Category 1 regulatory retention requirements may limit deletion rights.
🌍 Other Jurisdictions
You may have additional rights based on your residency. Contact privacy@otcm.io for jurisdiction-specific information.
🔄 Changes to this Privacy Policy
📝 Updates May Occur
From time to time, we may need to change how we use your Personal Data due to:
Reason | Description |
|---|---|
⚖️ Legal Changes | Applicable laws and regulations |
🏛️ Regulatory Updates | Category 1 compliance requirements |
🚀 Service Evolution | Better performance of our Services |
📢 Notification Process
If changes happen, we will:
Action | Method |
|---|---|
🔄 Update Policy | Update this Privacy Policy |
🚨 Alert You | Place notice on the Site and/or send email |
📅 Effective Date | Clearly indicate when changes take effect |
✅ Continued Use = Agreement
We use Personal Data according to the Privacy Policy effective at the time that information is collected. Continued use after policy updates constitutes acceptance.
📞 Contact Information
🤝 Questions or Comments?
If you have any questions or comments about:
Topic | Contact |
|---|---|
🔒 Your Personal Data | privacy@otcm.io |
🛡️ Your Privacy | privacy@otcm.io |
📋 Our Privacy Policy | privacy@otcm.io |
⚖️ Your Rights | privacy@otcm.io |
🏛️ Category 1 Compliance | compliance@otcm.io |
Mailing Address:
OTCM Protocol, Inc.
Attn: Privacy Officer
[Address]
Wyoming, United States📋 Document Information
Field | Value |
|---|---|
📄 Document Version | 3.0 |
📅 Effective Date | January 2026 |
📍 Jurisdiction | Wyoming, United States |
⚖️ Governing Law | Wyoming State Law and Federal Law |
🏛️ Regulatory Framework | SEC Category 1 (Issuer-Sponsored Tokenized Securities) |
🛡️ Your Privacy Matters — We're committed to protecting your personal information while maintaining Category 1 compliance and providing you with the best possible service experience.
© 2026 OTCM Protocol, Inc. | All Rights Reserved
ST22 Tokenized Securities are securities under federal securities laws. Category 1 compliance requires collection and retention of certain personal data as described in this Privacy Policy.