Privacy Policy

1. Introduction

Welcome to HOLD, a service of HIHODL TECHNOLOGIES OÜ, a company incorporated in Estonia ("HOLD", "we," "our," or "us"). We are committed to protecting your privacy and ensuring you have a positive experience on our website and in using our products and services. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website hihodl.xyz or use our services.

2. Information We Collect

3. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our services
• Process your waitlist registration and manage referrals
• Send you updates, newsletters, and marketing communications (with your consent)
• Respond to your inquiries and provide customer support
• Monitor and analyze usage patterns and trends
• Detect, prevent, and address technical issues and security threats
• Comply with legal obligations and enforce our terms

4. Information Sharing and Disclosure

We do not sell, trade, or rent your personal information to third parties. We may share your information only in the following circumstances:

• Service Providers: With trusted third-party service providers who assist us in operating our website and conducting our business
• Legal Requirements: When required by law or to protect our rights and safety
• Business Transfers: In connection with a merger, acquisition, or sale of assets
• With Your Consent: When you have given us explicit permission to share your information

5. Identity Verification (KYC) Data

When you choose to access features that require identity verification (such as on/off-ramps, fiat payment rails, fiat accounts, and the payment card), the following identity data is collected and processed by our verification partner, Sumsub (Sum and Substance Ltd.), and not by HOLD:

• Legal name, date of birth, and nationality
• Government-issued identification (for example, passport or ID, including document number, issuing country, expiry, and embedded data)
• Selfie images and facial biometric data derived from your selfie and liveness check
• Residence and address information

HOLD does not maintain, store, or retain your identity documents, selfie, or biometric data in our own systems. As your verification partner, Sumsub captures and processes this data on our documented instructions. HOLD receives only a verification status and the minimum data needed for compliance — for example, the verification outcome, your country of residence, and a verification reference.

6. Biometric and Special-Category Data

Facial biometric data is "special category" or sensitive personal data under the GDPR, UK GDPR, and comparable laws (for example, LGPD).

• Explicit consent: Where required, biometric data is processed only on the basis of your explicit consent, which you provide at the point of verification. You may withdraw your consent at any time; withdrawal does not affect processing carried out before withdrawal and may mean you can no longer access features that require verification.
• Processor: Biometric processing is carried out by Sumsub as a processor acting on our documented instructions. Sumsub captures and processes the biometric data for identity verification and liveness confirmation; HOLD does not receive or store the underlying biometric data.

7. Sharing With Regulated Providers

To unlock features you request, we and/or Sumsub may share your verification result and relevant compliance data (such as country of residence and identifying details required by the provider) with regulated third-party providers, including:

Those providers — who they are, what each one does, and what data each one receives — are listed on our Service Providers page. We maintain that page as a live list and update it when an integration changes, so it is always the accurate answer to "who receives my data". It also names our commercial suppliers and technical sub-processors.

Versions of this Policy published before August 13, 2026 named Bitso and MoonPay in this section. That reflected an integration plan we did not proceed with; neither is integrated in the live product and we have no contractual relationship with either. The Service Providers page records this correction.

Each regulated provider acts as an independent controller for its own processing and is governed by its own privacy policy. Residence and address data you provide during verification is collected by Sumsub and passed to providers as needed for their compliance and to determine feature eligibility. HOLD does not store your full residential address beyond what is operationally required, such as your country of residence for eligibility and compliance.

8. Data Security

We implement appropriate technical and organizational security measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. However, no method of transmission over the Internet or electronic storage is 100% secure, and we cannot guarantee absolute security.

8.1 Encrypted backup of your wallet recovery phrase

So that you can restore your wallet on a new device by signing in, we store an encrypted copy of your wallet recovery phrase. It is encrypted and decrypted on your device and is never transmitted to us in readable form. The key that encrypts it is currently derived from values held on our systems rather than from a secret only you know, which means HOLD is technically capable of decrypting that backup. We do not do so, and we are replacing this design with one in which no single party, HOLD included, can decrypt it alone. This is explained in full, including how to have the backup deleted, in Section 5.1 of our Terms of Service.

9. Your Rights and Choices

Depending on your location, you may have certain rights regarding your personal information, including:

• The right to access and receive a copy of your personal data
• The right to rectify inaccurate or incomplete information
• The right to request deletion of your personal data
• The right to object to or restrict processing of your data
• The right to data portability
• The right to withdraw consent at any time, including consent to biometric processing
• The right to opt-out of marketing communications
• The right to lodge a complaint with your data-protection supervisory authority

To exercise these rights, please contact us at the email address provided below. Because your biometric and KYC data are held by Sumsub rather than by HOLD, some requests may be fulfilled by or directed to Sumsub as our processor; we will assist as required.

10. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to track activity on our website and store certain information. You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent. However, if you do not accept cookies, you may not be able to use some portions of our website.

11. Third-Party Links

Our website may contain links to third-party websites or services. We are not responsible for the privacy practices of these external sites. We encourage you to review the privacy policies of any third-party sites you visit.

12. Children's Privacy

Our services are not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately.

13. International Data Transfers

Your information may be transferred to and maintained on computers located outside of your state, province, country, or other governmental jurisdiction where data protection laws may differ, including by Sumsub, our cloud providers, and downstream regulated providers. Where required, such transfers are protected by appropriate safeguards, such as standard contractual clauses or an adequacy decision. By using our services, you consent to the transfer of your information to these facilities.

14. Data Retention

We retain personal information only for as long as necessary for the purposes described in this Policy, including to provide the services, comply with legal and anti-money-laundering obligations, resolve disputes, and enforce our agreements. KYC and biometric data captured by Sumsub are retained and deleted in accordance with Sumsub's retention practices and applicable law; HOLD does not hold this data. Retention periods required by anti-money-laundering law may extend beyond account closure.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date. You are advised to review this Privacy Policy periodically for any changes.

16. Contact Us

If you have any questions about this Privacy Policy, please contact us at: