Your privacy matters to us. Tilt Pay, Inc. is built around a core principle of minimal data collection: we only collect what is strictly necessary to provide the Service. This Privacy Policy explains what personal data we collect, why we collect it, how we use it, and your rights under applicable law. Please read it carefully.

1. Identity of the Data Controller

The data controller responsible for your personal data is:

Tilt Pay, Inc.

A corporation incorporated under the laws of the State of Delaware, USA

Delaware File Number: 10574511

Registered Office: 251 Little Falls Drive, Wilmington, New Castle County, Delaware 19808, USA

Registered Agent: Corporation Service Company

Email: contact@tilt-pay.com

Website: https://tilt-pay.com

For all privacy-related requests, inquiries, or complaints, you may contact us directly at contact@tilt-pay.com. We will respond within thirty (30) calendar days.

2. Scope of This Policy

This Privacy Policy applies to:

•       The Tilt Pay mobile application for iOS and Android (the "App");

•       The Tilt Pay website located at tilt-pay.com (the "Website");

•       All related services, features, and functionality (collectively, the "Service").

This Policy does not apply to third-party services accessed through Tilt Pay, such as Circle (wallet infrastructure), Noah (KYC and on/off-ramp), or Twilio (SMS/WhatsApp verification). Each of these third parties operates under its own privacy policy, referenced in Section 7 of this document.

3. Personal Data We Collect

3.1 Privacy-by-Design Approach

Tilt Pay, Inc. is designed to minimize personal data collection. A standard Tilt Pay account requires only a mobile phone number — nothing else. No name, no email address, no date of birth, no government-issued ID. Additional data is only collected when you choose to use optional features (on/off-ramp) or when required by law (Merchant KYC threshold).

3.2 Data Collection Summary

Data Category

Data Collected

Purpose

Legal Basis

Retention

Account (Standard)

Mobile phone number

Account creation & authentication

Contract performance — Art. 6(1)(b) GDPR / US contract law

3 years after account closure

Phone Verification

Phone number, OTP code

Confirm ownership of phone number via SMS or WhatsApp

Contract performance — Art. 6(1)(b) GDPR

Deleted immediately after verification

Transaction Data

Wallet address, amount, timestamp, transaction hash

Processing and recording payments on Solana blockchain

Contract performance + Legal obligation — Art. 6(1)(b)(c) GDPR

3 years after account closure

Merchant KYC

Identity documents, name, address (if threshold exceeded)

Compliance with AML/KYC regulations

Legal obligation — Art. 6(1)(c) GDPR / US AML law

5 years (legal requirement)

On/Off-Ramp KYC

Handled exclusively by Noah

Fiat conversion compliance

Legal obligation — processed by Noah

Per Noah's policy

Website Analytics

Anonymized browsing data (pages, sessions, device type)

Understanding website usage — no personal data collected

Legitimate interest — Art. 6(1)(f) GDPR

26 months (Google Analytics default)

Technical Logs

App error logs, timestamps

Service stability and debugging

Legitimate interest — Art. 6(1)(f) GDPR

90 days

3.3 Data We Do NOT Collect

To be explicit, Tilt Pay, Inc. does NOT collect or store:

•       Your name or surname (standard accounts);

•       Your email address;

•       Your date of birth (standard accounts);

•       Your physical location or GPS data;

•       BLE/Bluetooth proximity data — all Tap-to-Pay BLE communication occurs entirely on-device and is never transmitted to Tilt Pay servers;

•       Your private keys or wallet seed phrase — these remain exclusively on your device;

•       Payment content, transaction descriptions, or any message attached to a payment;

•       Any marketing or behavioral profile.

4. How We Use Your Personal Data

4.1 To Provide and Operate the Service

We use your mobile phone number to create and authenticate your account, and to enable you to send and receive payments, view your wallet balance, and use all Service features. We use transaction data to record your payment history within the app.

4.2 To Verify Your Identity

When you create an account, we send a one-time verification code (OTP) to your mobile phone number via SMS or WhatsApp, using our partner Twilio. This is the only instance in which your phone number is shared with a third party for verification purposes. The OTP is not stored after verification.

4.3 To Comply with Legal Obligations

When you exceed the Merchant User threshold (USD ,000 received via Tap-to-Pay in any rolling 30-day period), we are required by applicable anti-money laundering (AML) and know-your-customer (KYC) regulations to collect and verify your identity. We retain this data for a minimum of five (5) years as required by applicable law, including EU Directive 2015/849 (AMLD5) and relevant US federal AML regulations.

4.4 To Improve the Website

We use Google Analytics on tilt-pay.com to understand how visitors interact with our website (pages visited, session duration, device type). Google Analytics is configured to anonymize IP addresses. We do not collect any personally identifiable information through the website, and we do not use this data to build individual profiles.

4.5 To Maintain Service Reliability

We retain technical logs (error reports, app crash data) for up to ninety (90) days solely for the purpose of diagnosing and resolving technical issues.

4.6 What We Never Do with Your Data

Tilt Pay, Inc. does NOT:

•       Sell your personal data to any third party;

•       Use your data for advertising or marketing purposes;

•       Send you marketing emails, SMS messages, or push notifications of a promotional nature;

•       Share your data with advertisers or data brokers;

•       Use your data to train machine learning models;

•       Profile you for automated decision-making that produces legal or similarly significant effects.

5. Legal Basis for Processing

Tilt Pay, Inc. processes personal data under the following legal frameworks depending on your location:

For EU/EEA Users (GDPR):

Contract Performance (Article 6(1)(b)): Processing your phone number and transaction data is necessary to provide the Service.

Legal Obligation (Article 6(1)(c)): Processing identity data for Merchant KYC is required to comply with EU anti-money laundering directives.

Legitimate Interests (Article 6(1)(f)): We process anonymized website analytics and technical logs to maintain and improve the Service.

Consent (Article 6(1)(a)): Where we rely on consent (e.g., for non-essential cookies), we will request your explicit consent before processing and you may withdraw it at any time.

For US Users:

We process personal data in accordance with applicable US federal and state privacy laws, including where applicable the California Consumer Privacy Act (CCPA) and other state privacy statutes. We do not sell personal information as defined under US privacy law. We process data based on contractual necessity, legal obligation, and our legitimate business interests.

6. Data Storage, Security, and Retention

6.1 Where Your Data Is Stored

Your personal data is stored on servers operated by Hetzner Online GmbH, headquartered in Germany (European Union). All primary data storage takes place within the European Economic Area (EEA). Tilt Pay, Inc. is a Delaware corporation with operations in France; data transfers between jurisdictions are conducted in compliance with applicable law as described in Section 12.

6.2 Security Measures

We implement appropriate technical and organizational measures to protect your personal data, including:

•       Encryption in transit (TLS 1.2 or higher) for all data communications between the App and our servers;

•       Encryption at rest for stored personal data;

•       Access controls limiting data access to authorized personnel only;

•       Regular security reviews and vulnerability assessments;

•       Non-custodial wallet architecture: your private keys and funds never leave your device.

However, no system is entirely immune to security risks. You are responsible for maintaining the security of your device and account credentials.

6.3 Retention Periods

•       Account data (phone number, transaction history): 3 years from the date of account closure or last activity, whichever is later.

•       Merchant KYC data: 5 years from the date of collection, as required by AML regulations.

•       Phone verification OTPs: deleted immediately upon successful verification or expiration.

•       Website analytics data: 26 months (Google Analytics standard retention).

•       Technical logs: 90 days.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymized.

7. Third-Party Sub-Processors and Data Sharing

We share personal data with the following third parties only to the extent necessary to provide the Service. We do not sell, rent, or trade your personal data.

7.1 Twilio (Phone Verification)

Purpose: Delivery of one-time verification codes (OTP) via SMS or WhatsApp at account creation.

Data shared: Your mobile phone number.

Location: United States (Twilio Inc.). Data transfers covered by Standard Contractual Clauses (SCCs) under GDPR.

Privacy Policy: https://www.twilio.com/en-us/legal/privacy

7.2 Circle (Wallet Infrastructure)

Purpose: Non-custodial wallet infrastructure on the Solana blockchain.

Data shared: Wallet addresses and transaction data (publicly visible on the Solana blockchain). No personal identifiers are shared with Circle by default.

Privacy Policy: https://www.circle.com/legal/privacy-policy

7.3 Noah (On/Off-Ramp & KYC)

Purpose: Fiat-to-digital currency conversion via IBAN, and KYC identity verification for this feature.

Data shared: Identity documents, name, and other KYC data — only if you choose to use the on/off-ramp feature. Processed exclusively by Noah under their own privacy policy.

Privacy Policy: https://noah.com

7.4 Google Analytics (Website Only)

Purpose: Website usage analytics on tilt-pay.com.

Data shared: Anonymized behavioral data. IP addresses are anonymized. No personal data from the App is shared.

Location: United States (Google LLC). Transfers covered by Google's Data Processing Addendum and Standard Contractual Clauses.

Privacy Policy: https://policies.google.com/privacy

7.5 Hetzner (Hosting Infrastructure)

Purpose: Cloud server hosting for Tilt Pay's backend infrastructure.

Data shared: All data stored on Tilt Pay servers is hosted at Hetzner data centers in Germany (EU). Hetzner acts as a data processor under a Data Processing Agreement.

Privacy Policy: https://www.hetzner.com/legal/privacy-policy

7.6 Legal Disclosures

We may disclose your personal data to public authorities, law enforcement agencies, or regulatory bodies — including US federal agencies, the Delaware Division of Corporations, and EU supervisory authorities — when required to do so by applicable law, court order, or binding regulatory request.

8. Cookies and Tracking Technologies

8.1 Website (tilt-pay.com)

We use cookies and similar tracking technologies on tilt-pay.com solely for analytics purposes through Google Analytics. We do not use advertising cookies, retargeting pixels, or any cookies that track you across other websites.

When you first visit tilt-pay.com, we will request your consent to place non-essential cookies (analytics cookies). You may accept, reject, or withdraw consent at any time by clearing cookies in your browser settings.

Strictly Necessary Cookies: Set by Tilt Pay for session management and security. These cannot be disabled. Duration: session.

Analytics Cookies (Google Analytics): Anonymized usage statistics. Require your consent. Duration: up to 26 months.

8.2 Mobile Application

The Tilt Pay mobile application does not use cookies. The App does not track your behavior across third-party apps or websites.

9. Your Privacy Rights

9.1 Rights for EU/EEA Users (GDPR)

As a data subject under the GDPR, you have the following rights. To exercise any of these rights, contact us at contact@tilt-pay.com. We will respond within thirty (30) calendar days.

Right of Access (Art. 15): Obtain a copy of your personal data we hold.

Right to Rectification (Art. 16): Request correction of inaccurate or incomplete data.

Right to Erasure (Art. 17): Request deletion of your personal data, subject to legal retention obligations (e.g., KYC data retained 5 years under AML law).

Right to Restriction (Art. 18): Request restriction of processing in certain circumstances.

Right to Data Portability (Art. 20): Receive your data in a structured, machine-readable format.

Right to Object (Art. 21): Object to processing based on legitimate interests.

Right to Withdraw Consent (Art. 7(3)): Withdraw consent at any time without affecting prior processing.

Right to Lodge a Complaint: Lodge a complaint with the CNIL (France) at www.cnil.fr, or with the supervisory authority of your EU member state.

9.2 Rights for US Users

Depending on your state of residence, you may have additional rights under applicable US privacy law, including:

•       California residents: rights under the California Consumer Privacy Act (CCPA), including the right to know, delete, and opt out of the sale of personal information. Tilt Pay does not sell personal information.

•       Other US state residents: rights under applicable state privacy laws where in effect.

To exercise your US privacy rights, contact us at contact@tilt-pay.com. We will respond within forty-five (45) days as required by applicable US law.

10. Minors

The Service is not directed to persons under the age of legal majority in their country of residence (18 years in most jurisdictions). We do not knowingly collect personal data from minors. If we become aware that we have inadvertently collected data from a minor, we will promptly delete it. If you believe we have collected data from a minor, please contact us at contact@tilt-pay.com.

11. Blockchain Data and Public Transactions

Transactions processed through the Tilt Pay Service are recorded on the Solana public blockchain. By using the Service, you acknowledge and accept that:

•       Transaction data (wallet addresses, amounts, timestamps, and transaction hashes) is permanently and publicly recorded on the Solana blockchain;

•       Tilt Pay has no ability to delete, modify, or restrict access to data recorded on a public blockchain;

•       Your right to erasure cannot apply to data recorded on the Solana blockchain, as it is technically impossible for any party to alter or delete blockchain records;

•       All BLE (Bluetooth Low Energy) communication for Tap-to-Pay occurs entirely on-device. No proximity, location, or BLE metadata is transmitted to Tilt Pay servers at any time.

12. International Data Transfers

Tilt Pay, Inc. is a Delaware corporation with operations in France (EU). This cross-border structure means your data may be processed in both the United States and the European Union. We ensure appropriate safeguards are in place for all international transfers:

•       EU-to-US transfers (Twilio, Google Analytics): covered by Standard Contractual Clauses (SCCs) approved by the European Commission;

•       Primary storage within the EU: Hetzner servers in Germany;

•       Data Processing Agreements in place with all sub-processors.

You may request a copy of the applicable transfer safeguards by contacting us at contact@tilt-pay.com.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will:

•       Update the "Effective Date" at the top of this document;

•       Post a notice within the App;

•       Where feasible, notify you via the contact method associated with your account.

Your continued use of the Service after the effective date of the updated Policy constitutes your acceptance of the changes.

14. Contact and Complaints

For all privacy-related questions, requests, or concerns, please contact:

Tilt Pay, Inc. — Privacy

251 Little Falls Drive, Wilmington, New Castle County, Delaware 19808, USA Email: contact@tilt-pay.com

Website: https://tilt-pay.com

US residents may contact their applicable state Attorney General or privacy enforcement authority.

Tilt Pay, Inc. is committed to protecting your privacy and processing your data responsibly, transparently, and in full compliance with applicable law.