Privacy Policy

Last updated 2 October 2026

This Privacy Notice explains how Bron Foundation ("Bron", "we", "us" or "our"), a company established in the Cayman Islands, collects, uses, shares and protects personal information when you use our Website and Software. Bron Foundation is the controller of the personal information described in this Notice.

In this Notice:

• "Website" means bron.org and any site of ours that links to this Notice.
• "Software" means the Bron self-custodial wealth platform, including the Bron mobile and desktop applications and any related applications or code we make available.
• "Services" means the Website and the Software together.
• "Partner Services" means services provided by independent third parties that you can choose to access through the Software, such as fiat on- and off-ramps.

The Software is a self-custody tool that lets you interact independently with public blockchains and digital assets. You control your own keys and assets. We cannot access or recover your private keys or digital assets without your explicit authorisation and participation.

Questions? Contact [email protected]. If you do not agree with this Notice, do not use the Services.

Summary of Key Points

• What we collect. Account and contact details, technical data, and the limited data needed for features you switch on. See [01].
• Sensitive information. Only if you choose FaceScan or identity verification for a Partner Service. Both use biometric data and require your explicit consent. See [02] and [03].
• Information from third parties. Yes: verification results from Sumsub, match results from iProov, and confirmations from payment providers and Partner Services. See [01].
• Identity checks. You do not need to verify your identity to use the Software. Some Partner Services, such as Noah, require it. You upload any documents directly to Sumsub, and they are shared with a Partner Service only when you ask. See [02].
• AI agents. We do not send your data to AI providers. An AI agent you connect sees only what you authorise. See [04].
• Selling data. We do not sell or rent your personal information.
• Public blockchains. On-chain activity is public and permanent. We are not the controller of data written to a blockchain. See [01].
• International transfers. We use recognised safeguards. See [08].
• Your rights. Depending on where you live, you can access, correct, delete or port your data, object to processing, and withdraw consent. EU and UK residents can also use our representative. See [01a] and [12].

[01] What Information Do We Collect?

In Short: We collect what you give us, limited technical data, and results from providers you choose to use. We never hold your full private keys.

Information you provide to us

• Account and contact details: email address, username or display name, and your marketing preferences.
• Workspace details: workspace name, members you invite (their email address and role), approval rules and transaction limits.
• Recovery and inheritance details: names and contact details of the Guardians and beneficiaries you nominate. Only give us someone else's details if you are entitled to, and tell them you have done so.
• Address book entries: names and wallet addresses you save.
• FaceScan: if you choose it, biometric data processed by iProov. See [03].
• Identity verification: if you choose a Partner Service that requires it, identity documents and related data. See [02].
• Support and enquiries: messages you send us, including demo requests and Bron for Business enquiries.

Information collected automatically

• Device and technical data: IP address, device type, operating system, app version, browser, device identifiers and crash logs.
• Usage data: features used, pages viewed and interactions with the Services.
• Approximate location: country or city derived from your IP address. We do not collect precise location.
• Security data: sign-in times, devices registered, passkey status, authorisation records, and API keys and CLI sessions you create, with logs of their use.
• Off-chain transaction data: transactions you prepare or approve in the Software, approvals, limits, and the wallet addresses linked to your workspace.
• Cookies and similar technologies: see [07].

Information we receive from third parties

• Sumsub: verification status and results, including screening results, and access to the information you uploaded to Sumsub, if you start identity verification. See [02].
• iProov: an enrolment reference and the result of each liveness and match check. See [03].
• Partner Services such as Noah: your account status with them and references for transactions you make through them.
• Payment providers and app stores (Stripe, Apple, Google): payment and subscription confirmations. We do not receive full card details.
• Security and sanctions screening providers: risk information about wallet addresses that interact with your workspace.
• Public blockchains: on-chain data linked to your wallet addresses.

Public blockchain data

Transactions and smart-contract interactions you initiate are recorded on public blockchain networks. Anyone can read, copy, analyse and link that data, including wallet addresses, balances and transactions. It cannot be changed or deleted. Do not include personal information in transaction data fields.

We are the controller only for off-chain information we collect through the Services. We do not control public blockchain networks and are not the controller of personal information written to a blockchain.

What we do not collect

• Keys and payment cards: we do not store full private keys, seed phrases or payment card details.
• Device biometrics: when you use Face ID, Touch ID or a similar feature to sign in or approve an action, your device performs the check. We receive only a pass or fail result, never your biometric data.

[01a] Our Representative

In Short: EU and UK residents can contact our appointed representative, Prighter, to exercise their privacy rights.

We value your privacy and your rights as a data subject and have therefore appointed Prighter Group with its local partners as our privacy representative under Article 27 of the EU GDPR and the UK GDPR, and as your point of contact for the following regions:

• European Union (EU)
• United Kingdom (UK)

Prighter gives you an easy way to exercise your privacy-related rights (for example, requests to access, correct or erase personal data). If you want to contact us via our representative Prighter or make use of your data subject rights, please visit: https://app.prighter.com/portal/14875999304

[02] Identity Verification for Partner Services

In Short: You do not need to verify your identity to use the Software. If you choose a Partner Service that requires it, such as Noah's on- and off-ramp, you upload your information directly to Sumsub, which checks it for us. It is shared with that partner only at your request.

When this applies

Some Partner Services must verify their users' identity under the laws that apply to them. Currently this is the fiat on- and off-ramp provided by Noah. The Software tells you before you start which Partner Service requires verification and what it needs.

Verification is optional. It starts only when you choose a Partner Service that requires it and confirm that you want to proceed.

What is collected

You upload your documents and images directly to Sumsub. They do not pass through our servers. Depending on the Partner Service and your country, Sumsub may collect:

• Identity details: full name, date of birth, nationality, residential address, email address, phone number and, if a Partner Service requires it, tax residence or tax number.
• Identity documents: images and details of your government-issued ID (type, number, issuing country, expiry) and, where asked, proof of address.
• Selfie and liveness capture: images or a short video of your face, used to confirm you are a real person and to compare your face with the photo on your ID.
• Additional information a partner asks for: for example, source of funds or occupation.
• Technical data: device, IP address and approximate location captured during verification.
• Results: verification status, document and face-match results, and screening against sanctions, politically exposed persons and adverse media lists. Screening results can include information about alleged offences.

The face comparison involves biometric data, which is special category data. It is processed only with your explicit consent, which you give in the Software before verification starts.

Who does what

• Sumsub (Sum and Substance Ltd, England, and its group companies) runs the checks on our behalf as our processor, under a contract that restricts its use of your data. Where Sumsub uses data for its own purposes, it acts as an independent controller. See Sumsub's privacy notice.
• The Partner Service you choose receives your verification data and results only when you ask. We then instruct Sumsub to share them through its secure sharing feature, so they go directly from Sumsub to the Partner Service and not through our servers. It decides whether to accept you and acts as an independent controller under its own terms and privacy notice. For Noah, see noah.com/privacy.
• We can access your verification data and results in Sumsub's system. Our Sumsub account keeps it so that you can reuse it with other Partner Services (see below). Only authorised staff have access, and only to act on your requests or to support you. We do not keep copies outside Sumsub. We use identity data only to enable the Partner Services you choose, to prevent fraud and to comply with law. We never use it for marketing.

Reusing your verification

We keep your verification in our Sumsub account so that, if you later choose another Partner Service that requires identity verification, you can ask us to share it instead of verifying again. We share it only with the Partner Service you name, and only each time you ask. You can ask us to delete your stored verification at any time by contacting [email protected]. Retention limits are in [09].

Automated checks

Sumsub's checks are largely automated. A failed check can stop you using that Partner Service. You can ask for a human review of the check, explain your view and contest the outcome by contacting [email protected]. The Partner Service makes the final decision on its own onboarding.

Your choices

Providing this information is not required to use the Software. It is required by the Partner Service: if you do not provide it, you cannot use that Partner Service.

You can withdraw your consent at any time. This stops any further verification and sharing, and we delete your stored verification from our Sumsub account within 30 days. It does not undo sharing already made, and the Partner Service may keep what it received to meet its own legal obligations. Retention periods are in [09].

[03] FaceScan Recovery

In Short: FaceScan is an optional way to recover access using your face. iProov runs the check for us. It is used only for recovery, only with your explicit consent, and you can remove it at any time.

What FaceScan is

FaceScan is an optional recovery method, offered as an alternative or addition to recovery with Guardians. It is used only to recover access, never for everyday sign-in.

FaceScan compares a live capture of your face with your own FaceScan enrolment for your workspace. It is a one-to-one check. It does not search any database, check your name or use an identity document.

What is processed

• At enrolment: iProov captures images of your face, checks that you are a real person who is present, and creates an encrypted biometric template linked to a unique reference.
• At each recovery attempt: iProov captures new images, repeats the liveness check and compares the result with your template.
• What we hold: only the enrolment reference and the outcome of each check (pass or fail, date and time). We do not hold your template or images of your face.
• What iProov holds: your encrypted biometric template and an encrypted reference image for as long as FaceScan is set up.
• During the 30-day security period: when you first set up or change FaceScan, a 30-day security period applies. During it, iProov keeps frame data, encrypted facial image data and diagnostic logs, then permanently deletes them within 30 days after the period ends.

Who does what

iProov Limited (England) processes FaceScan data on our behalf as our processor, under a contract that limits its use to providing FaceScan. iProov may not sell your biometric data or use it for any other purpose.

Legal basis and consent

Biometric data is special category data. We process it only with your explicit consent, which you give in the Software before enrolment. Where required by US state law, that consent is your written release.

FaceScan is optional. If you do not consent, you can still recover access in other ways, for example through Guardians.

Removing FaceScan

You can remove FaceScan at any time in the Software. Removing it withdraws your consent. iProov then deletes your template and reference image within 30 days, including from backups within 90 days. The same applies if you close your account.

In any event, we and iProov permanently destroy FaceScan biometric data when the purpose for collecting it has been met, and no later than three years after your last interaction with the Software, whichever is sooner.

Automated checks

Each FaceScan check is automated. If a check fails, you can try again or use another recovery method. You can also contact [email protected] to ask for human review.

[04] AI Agents and Third-Party AI Applications

In Short: You can connect an AI application of your choice to the Bron desktop application. It sees only what you authorise, cannot sign or approve transactions, and we do not send your data to AI providers.

The Software lets you connect a third-party AI application of your choice (an "AI Agent"), such as Claude, ChatGPT or Cursor, through a Model Context Protocol (MCP) server built into the Bron desktop application. The server runs on your own device, is not reachable from the internet, and answers only while the Bron desktop application is open and you are signed in.

What you control. An AI Agent has no access until you authorise it. When you do, you choose the workspace, the access level (Read only or Manage) and the accounts it may see, and you confirm with your device's biometric or other authentication. You can pause all AI Agents or revoke any one of them at any time in Settings → AI agents. An AI Agent can never sign or approve a transaction: anything it prepares waits for your own signature in the Software, your workspace approval rules still apply, and an AI Agent never has access to your keys.

What an AI Agent can access. Only data from the workspace and accounts you authorised: workspace and account details, balances, transactions and their history, transaction limits, workspace members, address book entries (including names and addresses), deposit addresses, asset, price and network data, and staking positions. With the Manage access level it can also prepare and cancel transactions and add or remove address book entries.

Where the data goes. We do not send your data to any AI provider. Data reaches the provider of an AI Agent only when that AI Agent requests it from the server on your device under the authorisation you gave. From that point it forms part of your conversation with that provider and is handled under that provider's own terms and privacy policy, which you accept with them directly. We do not receive your conversations with the AI provider; the server sees only the requests the AI Agent makes to it. We are not responsible for the privacy practices of AI providers. Choose the narrowest access level and accounts that meet your needs, particularly as some of this data is about other people, such as workspace members and address book contacts.

What we record. For each authorisation we record the workspace, the user who granted it and how they confirmed it, the AI Agent's name and client identifier, the device it was granted on, the access level and accounts granted, and the time it was granted. The Bron desktop application also keeps, on your device, the list of connected AI Agents and when each was last active. Transactions and address book entries an AI Agent creates are stored in your workspace like those you create yourself. We use these records to provide the Services and show you which AI Agents have access (performance of our contract with you), and for security and fraud prevention (our legitimate interests). We retain them as described in [09].

[05] How Do We Use Your Information, and on What Legal Basis?

In Short: We use your information to provide the Services, run the features you switch on, keep users safe and comply with law. Biometric data is used only with your explicit consent.

Purpose	Information used	Legal basis (UK and EU GDPR)
Provide your account, workspace and the Software	Account, workspace, device and off-chain transaction data	Performance of our contract with you
Recovery with Guardians and digital inheritance	Your details; your Guardians' and beneficiaries' contact details	Contract (for you); our legitimate interests in running the feature you set up (for Guardians and beneficiaries)
FaceScan recovery	FaceScan data (see [03])	Your explicit consent
Identity verification and sharing with a Partner Service you choose	Verification data and results (see [02])	Your consent; explicit consent for biometric data
AI Agents	Authorisation records (see [04])	Contract; legitimate interests in security
Payments and subscriptions	Plan, payment and subscription confirmations	Contract; legal obligation (tax and accounting)
Support and service messages	Contact details and support communications	Contract; legitimate interests in responding to you
Security, fraud prevention and sanctions compliance	Device, security and IP data; wallet addresses and screening results	Legitimate interests in protecting users and the Services; legal obligation
Analytics and improving the Services	Usage and cookie data	Consent for non-essential cookies; legitimate interests otherwise
Marketing	Email address and preferences	Consent, or for existing users our legitimate interests where the law allows; you can opt out at any time
Legal compliance, disputes and authority requests	As needed for the matter	Legal obligation; legitimate interests in establishing, exercising or defending legal claims
Business transfers	As needed for the transaction	Legitimate interests in reorganising or selling our business

Legitimate interests. Where we rely on legitimate interests, we have balanced them against your rights. You can object at any time (see [12]).

Consent. Where we rely on consent, you can withdraw it at any time. Withdrawal does not affect processing before it.

Special category and criminal offence data. We process biometric data only on the basis of your explicit consent. Screening results that include information about alleged offences are processed only to complete the check you asked for and only as permitted by applicable law.

[06] When and With Whom Do We Share Your Personal Information?

In Short: We do not sell or rent your personal information. We share it with providers who work for us, with third parties you choose, and where the law requires.

Service providers acting for us

These providers process personal information only on our instructions, under contracts that restrict their use of it:

• Sumsub: identity verification for Partner Services (see [02]).
• iProov: FaceScan (see [03]).
• Infrastructure and operations: cloud hosting, security and sanctions screening, analytics, customer support, CRM and email providers. Cookie providers are listed in our Cookie Notice.
• Bron group affiliates that develop and support the Software on our behalf.

Third parties you choose

These parties act as independent controllers under their own terms and privacy notices. We share with them only what is needed for the service you asked for:

• Partner Services, such as Noah, when you ask for your information to be shared (see [02]).
• Recovery providers you appoint directly, such as Qrypt.
• Staking, swap and tokenised-asset providers you choose to interact with. Your on-chain interactions with them are public.
• AI providers of AI Agents you connect (see [04]).
• Payment providers and app stores: Stripe (privacy notice), Apple and Google process your payments.

Other users

• Workspace members see workspace information according to the role you give them.
• Guardians and beneficiaries receive only what they need to perform their role, such as notice of their nomination or of a recovery request.

Others

• Authorities: when required by law or valid legal process (see [14]).
• Professional advisers: auditors and lawyers, under duties of confidentiality.
• Business transfers: a buyer or successor in a merger, acquisition or similar transaction, subject to this Notice.
• Anyone else with your consent or at your direction.

We are not responsible for the privacy practices of third-party sites, dApps or services you choose to use. Please review their policies.

[07] Do We Use Cookies and Other Tracking Technologies?

In Short: We use cookies for essential functions, security and, with your consent where required, analytics.

Some cookies are necessary to operate the Services. Others help us analyse usage or remember preferences. Where required, we ask for your consent before setting non-essential cookies, and you can change your choices at any time through our cookie settings. For details, see our Cookie Notice.

To the extent any tracking counts as a "sale" or "sharing" under US state laws, you can opt out as described in [13].

[08] International Data Transfers

In Short: Your information may be processed outside your country. We use recognised safeguards when it is.

We are established in the Cayman Islands. Our providers and partners operate in other countries, including the United Kingdom, the European Economic Area and the United States. For example, Sumsub is based in the UK with group companies in other countries, iProov is based in the UK, and Noah operates through entities in several countries, including the United States and Lithuania.

Where the law requires safeguards for a transfer, we use one or more of:

• Adequacy decisions, including for recipients in the UK and EEA, and US recipients certified under the EU–US Data Privacy Framework, its UK Extension or the Swiss–US Data Privacy Framework.
• Standard contractual clauses: the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum or Agreement, and Swiss equivalents.
• Supplementary measures such as encryption, access controls and data minimisation.

Transfers from the Cayman Islands are made in line with the Cayman Islands Data Protection Act. You can ask for details of our safeguards, or a copy of the relevant clauses, at [email protected].

[09] How Long Do We Keep Your Information?

In Short: Only as long as needed. Unless the law requires otherwise, nothing is kept more than six months after you close your account.

Information	How long we keep it
Account, workspace and support data	While your account is open, then up to 6 months
Identity verification data Sumsub holds for us	Until you ask us to delete it, close your account, or 12 months pass since you last verified or shared it, whichever is first. Then deleted within 30 days. The Partner Service keeps its own copy for as long as its law requires.
FaceScan template and reference image held by iProov	Until you remove FaceScan or close your account, then deleted within 30 days; never more than 3 years after your last interaction with the Software
FaceScan security-period data (frames, encrypted facial images, diagnostic logs)	The 30-day security period, then deleted within 30 days
FaceScan check outcomes we hold	While your account is open, then up to 6 months
AI Agent authorisation records (including revoked ones), API keys and their usage logs	While your account is open, then up to 6 months
Payment and accounting records	As long as tax and accounting law requires, usually 5 years
Marketing preferences	Until you unsubscribe; we keep a minimal record so we do not contact you again
Cookie data	As set out in our Cookie Notice
Information needed for a legal claim or authority request	Until the matter is resolved

When a period ends, we delete or de-identify the information. Backups are deleted on a rolling schedule.

[10] How Do We Keep Your Information Safe?

We use technical and organisational measures appropriate to the risk, including encryption in transit and at rest, access controls, data minimisation and contractual security obligations on our providers. Biometric data is encrypted and held only by iProov or Sumsub, not by us. The design of the Software means we cannot access your private keys.

No method of transmission or storage is completely secure. If the law requires us to notify you of a personal data breach, we will. You can help by protecting your devices, passkeys and recovery methods.

[11] Do We Collect Information From Minors?

In Short: The Services are not intended for anyone under 18.

We do not knowingly collect personal information from, solicit or market to anyone under 18, and we do not sell such information. If we learn that we have collected it, we will delete it. If you nominate a beneficiary under 18, we use only the contact details you give us for that purpose. Contact [email protected] if you believe a minor has given us personal information.

[12] What Are Your Privacy Rights?

In Short: Depending on where you live, you can access, correct, delete or port your information, object to or restrict processing, withdraw consent, and complain to a regulator.

Depending on where you live, you may have the right to:

• access your personal information and receive a copy;
• correct inaccurate or incomplete information;
• delete your information;
• restrict or object to processing, including processing based on legitimate interests, and to object at any time to direct marketing;
• receive information you gave us in a portable format;
• withdraw consent at any time, including by removing FaceScan or stopping identity verification;
• ask for human review of a decision based solely on automated processing that significantly affects you (see [02] and [03]).

How to exercise them. Use the settings in the Software where available, or email [email protected]. EU and UK residents can also use our representative (see [01a]). We may ask for information to confirm your identity, and will use the minimum needed. We respond within one month, or longer where the law allows and we tell you why.

Marketing. You can unsubscribe at any time using the link in our emails or by contacting us.

Limits. Some rights depend on the legal basis we rely on. We cannot change or delete data recorded on a public blockchain. A Partner Service may keep information it received to meet its own legal obligations. We may keep limited information where the law requires or to protect our rights.

Complaints. You can complain to the data protection authority where you live or work, or where you believe an infringement occurred. In the UK this is the Information Commissioner's Office. In the EU it is your national authority, listed by the European Data Protection Board. In the Cayman Islands it is the Ombudsman. We would welcome the chance to address your concern first.

[13] Do United States Residents Have Specific Privacy Rights?

In Short: Residents of certain US states have rights to know, access, correct, delete, obtain a copy and opt out of certain processing. Biometric data has extra protections.

Categories of personal information we collect (past 12 months)

Category	Examples	Collected
Identifiers	Name, email address, username, IP address, device identifiers, wallet addresses	Yes
Customer records (Cal. Civ. Code §1798.80)	Name, address, phone number, ID document details (identity verification only)	Yes
Protected classifications	Age or date of birth, nationality, sex as shown on an ID document (identity verification only)	Yes
Commercial information	Subscriptions, payment confirmations, off-chain transaction records	Yes
Biometric information	FaceScan template; face comparison during identity verification	Yes
Internet or network activity	Usage and interaction data	Yes
Geolocation data	Approximate location from IP address	Yes (approximate only)
Audio or visual information	Selfie and ID images during identity verification; FaceScan images during the security period	Yes
Professional or employment information	Occupation, if a Partner Service asks	Yes
Education information	Student records	No
Inferences	Profiles about preferences	No
Sensitive personal information	Government ID numbers, biometric information	Yes

We collect this information from the sources in [01], use it for the purposes in [05], and disclose it to the categories of recipients in [06]. We keep it for the periods in [09].

Sale and sharing. We do not sell personal information. We do not sell or share sensitive personal information. Some analytics cookies may count as "sharing" under certain state laws; you can opt out through our cookie settings or by emailing [email protected].

Sensitive personal information. We use it only to provide the services you request and for security and integrity. We do not use it to infer characteristics about you.

Your rights. Depending on your state, you may have rights to know, access, correct, delete and obtain a copy of your information, and to opt out of sale, sharing, targeted advertising and certain profiling. You can use an authorised agent. We will not discriminate against you for exercising your rights. You can appeal our decision on a request by emailing [email protected]; if we deny your appeal, you can contact your state attorney general.

Biometric data (including Illinois, Texas, Washington and Colorado)

• This Notice, with [03] and [09], is our public written policy for biometric data, including our retention and destruction schedule.
• We obtain your written consent before collecting biometric data.
• We do not sell, lease, trade or otherwise profit from biometric data.
• We disclose it only to iProov and Sumsub as our processors, to a Partner Service with your consent, or where the law requires.
• We store, transmit and protect it using at least the same care as our other confidential information.

[14] Government and Law-Enforcement Requests

We may preserve or disclose personal information when we reasonably believe it is necessary to: (i) comply with applicable law, valid legal process or enforceable governmental requests; (ii) enforce our terms; or (iii) protect the rights, property or safety of users or others.

Process. We assess each request for legal validity, scope and proportionality, require proper legal process, and seek to narrow any disclosure. We may challenge unlawful or overbroad requests.

User notice. Where legally permitted and practical, we will notify affected users before producing information so they can seek remedies. We may delay or withhold notice if prohibited by law or where notice could cause harm.

Transparency. We keep internal records of requests and, where lawful, may publish high-level information about their volume and type.

[15] Controls for Do-Not-Track Features

There is no uniform standard for responding to Do-Not-Track signals, and we do not respond to them.

[16] Do We Make Updates to This Notice?

We update this Notice as needed and revise the "Last updated" date. For material changes, such as a new use of biometric data, we will give you additional notice and, where required, ask for your consent again.

[17] How Can You Contact Us?

Bron Foundation, Cayman Islands

Email: [email protected]

EU and UK residents can also contact our representative, Prighter: https://app.prighter.com/portal/14875999304