Privacy Policy

This Privacy Policy (the "Policy") describes how Galleon Labs Ltd ("Galleon Labs," the "Company," "we," "us," or "our") collects, uses, and shares data in connection with the USDCtoFiat web app (usdctofiat.xyz), the USDCtoFiat Verify browser extension, the@usdctofiat/offramp developer SDK, and all of our other properties, products, and services (the "Services"). Your use of the Services is subject to this Policy. It describes our policies and procedures on the collection, use, and disclosure of your information when you use the Services and tells you about your privacy rights and how the law protects you.

High-Level Summary

• USDCtoFiat is a non-custodial USDC off-ramp and bridge built on the ZKP2P protocol. It consists of smart contracts deployed on Base and other chains, a web app at usdctofiat.xyz, and the USDCtoFiat Verify browser extension used for payment metadata capture and verification flows.
• We do not sell user data. We do not use user data for personalized advertising, retargeting, data brokerage, or creditworthiness decisions.
• We do not require users to provide personal details just to install the extension or access the basic Services. Your funds move directly between your own wallet and the protocol's smart contracts — we never take custody of your assets.
• Some optional authentication features may require limited account information, such as an email address, linked wallet address, or phone number, to create and secure an authenticated session.
• We enable user-initiated payment metadata capture, verification, and related off-ramp flows through the web app and extension. Only data you explicitly approve is used for those flows, and the extension applies provider-specific metadata templates so that only the data needed to verify the selected payment is used.
• The extension does not persist saved extension state. Active metadata-capture state is held in memory for the current user-initiated flow and is cleared when that flow ends, the provider tab closes, or the browser restarts.
• Any material changes to this Policy will be reflected in an updated version posted here.

Data We Collect

Privacy is central to everything we do. We aspire to be transparent about what data we collect. We do not require users to create accounts or provide personal details such as first name, last name, street address, date of birth, or email address simply to access the basic Services. Certain features support optional authentication where needed, which may involve limited account information such as an email address or phone number.

Outside user-initiated metadata capture, verification, registration, authentication, and support flows, the extension does not ask for or intentionally collect direct personal details such as your home address, date of birth, government ID, contacts, photo library, microphone audio, camera input, or precise location.

If you provide communications and information directly to us via email, customer support, or a social channel (such as X, Discord, or Telegram), or when you participate in surveys or questionnaires, that data may be persisted on our servers.

If you choose to authenticate with the Services, link an account, or use an authentication provider, we and our authentication providers may collect and process the information needed to create, maintain, and secure that authenticated account or session. This may include your email address, phone number where phone authentication is used, linked wallet address, authentication provider identifiers, verification status, and session-related metadata. If you authenticate using a phone number, that number may be used to send a one-time verification code, verify your identity, prevent fraud or abuse, and support account security and recovery.

If you specifically provide us with information such as payment verification payloads, metadata, or debug data, we may use that information for the purposes described when you provide it. We do not use that information for personalized advertising or sale.

If telemetry is enabled in the build you are using, we may collect error logs or debugging information to help identify and fix issues in payment verification or related product flows. For this we may use third-party analytics tooling (e.g., PostHog). We only collect limited technical details needed for troubleshooting, such as app or extension version, runtime context, performance or verification status, non-sensitive error messages, and similar diagnostics. Telemetry is not used for advertising or sale.

If you use the Services as a seller, you may choose to provide publicly identifiable payment details (e.g., your Venmo handle, Cash App tag, Revolut tag, or similar identifiers) so that buyers can send you payments. These identifiers may be stored on our servers to improve user experience. You may request that we remove this information at any time by contacting us at team@usdctofiat.xyz.

Extension and App-Specific Data Practices

The following additional practices apply to the USDCtoFiat Verify browser extension and to app features that support payment metadata capture, verification, registration, authentication, or support and debug flows.

• The extension does not store proof history, approved connected website origins, extension settings, or flow state. It keeps active capture state in memory only for the current user-initiated flow.
• When you choose to use metadata capture, verification, or registration features, the extension or app may process payment or provider data you approve, and authentication or session data where needed for the requested feature.
• Some user-initiated features require limited data to be sent to our verification, authentication, analytics, or support providers so the requested action can be completed. We do not use that data for personalized advertising or sale.
• If you use optional phone-number-based authentication where available, the phone number and related authentication metadata may be processed by us and our authentication provider solely to deliver login codes, verify identity, maintain the authenticated session, protect account security, and prevent fraud or abuse.
• The extension injects content scripts on HTTPS pages so supported provider pages and USDCtoFiat pages can interact with the extension during user-initiated metadata-capture and verification flows. Third-party websites cannot use the extension outside those supported flows.
• We do not sell browsing history or use browsing activity for advertising. Page and request data are accessed only to capture provider metadata and complete the user-initiated verification flow.
• You can end a provider verification flow by closing the provider tab or browser. Active in-memory extension capture state is cleared when the flow completes, the provider tab closes, or the browser restarts. Support or debug data is sent only if you choose to provide it.

How We Use Data

We use the data we collect in accordance with your instructions and as required by law. We may also use data for the following purposes:

• Providing the Services. To provide, maintain, customize, and improve our Services and their features.
• Payment metadata capture, verification, and registration. We use extension-collected payment or provider metadata and verification payloads only to verify the selected payment, validate the requested registration or verification, and complete the related order flow.
• Customer support. To provide support for and answer inquiries about the Services.
• Authentication and account security. To authenticate you, send one-time passcodes, maintain your authenticated session, protect your account, detect and prevent fraud or abuse, and support account recovery.
• Safety and security. To protect against, investigate, and stop fraudulent, unauthorized, or illegal activity, address security risks, fix bugs, enforce our agreements, and protect our users and Company.
• Legal compliance. As needed or requested by regulators, government entities, and law enforcement to comply with applicable laws and regulations.
• Aggregated data and technical diagnostics. To compile aggregated data that helps us learn how the Services are used and where we can improve, and to improve reliability and troubleshooting.

How We Share Data

We may share or disclose the data we collect:

• With service providers. We may share information with our service providers and vendors to help us provide, deliver, and improve the Services. Depending on the feature, this may include verification, authentication, analytics, support, and infrastructure providers, such as Privy (wallet authentication), PostHog (product analytics), Alchemy (blockchain RPC), Google Firebase and Google Cloud (hosting, database, and notifications), and Telegram (optional notifications). For example, if you use optional authentication, we may share your email address, phone number where phone authentication is used, linked wallet address, and related authentication metadata with the provider handling authentication so it can send login codes, verify your identity, maintain your account, and secure authenticated sessions.
• To comply with our legal obligations. In the course of litigation, regulatory proceedings, and compliance measures, and when compelled by subpoena, court order, or other legal procedure. We may also share data when we believe it is necessary to prevent harm to our users, our Company, or others, and to enforce our agreements and policies.
• Safety and security. To protect against, investigate, and stop fraudulent, unauthorized, or illegal activity, address security risks, fix bugs, enforce our agreements, and protect our users, Company, and ecosystem.
• Business changes. We may transfer or share data to another entity in the event of a merger, acquisition, bankruptcy, dissolution, reorganization, asset or stock sale, or other business transaction.
• With your consent. Any other time you provide us with your consent to do so.
• We do not share your information with any third parties for any marketing purposes whatsoever.

Chrome Web Store Limited Use Statement

Our use of user data is limited to providing and improving the user-facing features described in this Privacy Policy. We do not use or transfer user data for personalized advertising, sale, or data brokerage. Our use of user data complies with the Chrome Web Store User Data Policy, including the Limited Use requirements.

Third-Party Cookies

On usdctofiat.xyz and other web or app surfaces where applicable, we may use services that use tracking technology such as cookies, device identifiers, and localStorage to collect information about your use of the Services. You can opt out of having your online activity and device data collected through third-party services, including by:

• Blocking cookies in your browser by following the instructions in your browser settings. For more information about cookies, visit www.allaboutcookies.org.
• Blocking or limiting the use of your advertising ID on your mobile device through device settings.
• Using privacy plug-ins or browsers that block third-party cookies and trackers.
• Using the platform opt-out provided by Google at adssettings.google.com. You can learn more about how Google uses your information at policies.google.com/privacy.

Third-Party Links and Sites

We may integrate technologies operated or controlled by other parties into parts of the Services, and the Services may include links to websites and platforms not operated or controlled by us. When you interact with these other parties, including when you leave the Services, they may independently collect and solicit information about you. You can learn more about how those parties collect and use your data by consulting their privacy policies and terms.

Security

We implement and maintain reasonable administrative, physical, and technical security safeguards to help protect data from loss, theft, misuse, unauthorized access, disclosure, alteration, and destruction. Nevertheless, transmission via the internet is not completely secure and we cannot guarantee the security of information about you. You are responsible for all of your activity on the Services, including the security of your blockchain network addresses, cryptocurrency wallets, and their cryptographic keys.

Age Requirements

The Services are intended for a general audience and are not directed at children. We do not knowingly receive personal information (as defined by the U.S. Children's Online Privacy Protection Act, or "COPPA") from children. If you believe we have received personal information about a child under the age of 18, please contact us at team@usdctofiat.xyz.

Additional Notice to California Residents ("CCPA Notice")

The California Consumer Privacy Act of 2018 ("CCPA") requires certain businesses to explain how they collect, use, and share California residents' personal information, and the rights and choices offered regarding that information.

Privacy Practices. We do not "sell" personal information as defined under the CCPA. Please review the "How We Share Data" section above for details about the categories of parties with whom we share information.

Privacy Rights. The CCPA gives you the right to request information about how we have collected, used, and shared your personal information, to request a copy of information we may maintain about you, and to ask us to delete personal information we may have received about you. The CCPA limits these rights in certain circumstances. We will respond to requests only to the extent we can reasonably associate the information we maintain with the identifying details you provide. You are entitled to exercise these rights free from discrimination. You can submit a request for information, access, or deletion to team@usdctofiat.xyz.

Identity Verification. The CCPA requires us to collect and verify the identity of any individual submitting a request to access or delete personal information before providing a substantive response.

Authorized Agents. California residents can designate an authorized agent to submit requests on their behalf. We will require the authorized agent to provide written authorization confirming their authority.

Disclosures for European Union Data Subjects

We process personal data for the purposes described in "How We Use Data" above. Our bases for processing include: (i) you have given consent for one or more specific purposes; (ii) processing is necessary for the performance of a contract with you; (iii) processing is necessary for compliance with a legal obligation; and/or (iv) processing is necessary for the legitimate interests pursued by us or a third party, where your interests and fundamental rights do not override those interests.

Your rights under the General Data Protection Regulation ("GDPR") include the right to (i) request access to and obtain a copy of your personal data, (ii) request rectification or erasure of your personal data, (iii) object to or restrict the processing of your personal data, and (iv) request portability of your personal data. You may withdraw your consent at any time. Nevertheless, we cannot edit or delete information stored on a public blockchain. Information such as your transaction data, blockchain wallet address, and assets held by your address is beyond our control. To exercise any of your rights under the GDPR, please contact us at team@usdctofiat.xyz. We may require additional information to process your request, and we may retain information as necessary to fulfill the purpose for which it was collected, including to comply with legal obligations, resolve disputes, prevent fraud, and enforce our agreements.

If you are located in the European Economic Area, your data may be processed in the United States or other jurisdictions where our service providers operate. We rely on appropriate safeguards, including standard contractual clauses where applicable, for such transfers. For data protection inquiries, contact us at team@usdctofiat.xyz.

Changes to This Policy

If we make material changes to this Policy, we will notify you via the Services. Your continued use of the Services reflects your periodic review of this Policy and indicates your consent to it.

Contact Us

If you have any questions about this Policy or how we collect, use, or share your information, please contact us at team@usdctofiat.xyz.