Platform Privacy Policy

Effective date: October 30, 2026

Dansoft Labs LLC · 30 N Gould St, Ste N, Sheridan, WY 82801, USA · Filing ID 2026-002060926

This Platform Privacy Policy explains how Dansoft Labs LLC ("Web3Card", "we", "us") collects, uses, shares and protects personal data of people who use the Web3Card platform: the personal app, the business panel, the white-label apps operated on our platform and the Web3Card API (together, the "Platform"). Visits to the public website web3card.dev are covered by our separate Website Privacy Policy.

1. Who is responsible

Dansoft Labs LLC, a Wyoming limited liability company, is responsible for the personal data processed on the Platform. Cards are issued by regulated card issuing partners, which process cardholder data as independent controllers for their own regulatory purposes, under their own privacy notices.

2. Data we collect

Category	Examples	Source
Account data	Name, email address, phone number, password (stored only as a secure hash), two-factor authentication settings	You
Wallet data	Public address of the wallet you connect, which becomes your identity in our smart contract	You, the blockchain
Identity verification (KYC) data	Photo of your ID document, selfie and liveness data, data extracted from the document (full name, date of birth, nationality, document number), address, verification result	You, through our KYC providers
Screening data	Results of sanctions, politically exposed persons (PEP), watchlist and adverse media screening	Our KYC providers
Card and transaction data	Card status, limits, last digits, transactions (amount, merchant, date, result)	The card issuer, by API and webhooks
On-chain data	Deposits, card loads and withdrawals in our smart contracts	The public blockchain
Business (KYB) data	Company registration, ownership structure, beneficial owners and their KYC	The company and its owners
Technical data	IP address, device and browser data, access logs, security events	Your device

Card numbers, CVV and PIN are not stored by us. They stay with the card issuer and are shown to you only through the issuer's secure flow.

3. How we use your data

To create and secure your account (email, two-factor authentication and SMS phone verification).
To verify your identity and screen against sanctions and PEP lists before any card is created, as required by our issuing partners and applicable law.
To request, issue and manage your cards with the card issuer, and to show you your balances and transactions.
To prevent fraud, money laundering and terrorist financing, including transaction monitoring and blocking duplicate identities.
To provide support and send service communications.
To comply with legal obligations and requests from competent authorities.

We do not sell your personal data and do not use it for third-party advertising.

4. Legal bases

We process your data to perform our contract with you (providing the Platform and your cards), to comply with legal obligations (identity verification, sanctions and anti-money laundering rules, record keeping), on our legitimate interest in securing the Platform and preventing fraud, and on your consent where it is required (for example, sharing your verification with the card issuer).

5. Automated decisions

Identity verification and screening are performed automatically by our KYC providers (document authenticity, liveness, face match and list screening). Cases with a PEP or adverse media match are not approved automatically and are reviewed by our compliance officer. You can contact us to request a human review of a decision.

6. Who we share data with

KYC providers: Didit and Sumsub, for identity verification and AML screening.
Card issuing partners: the regulated institutions that issue your cards receive the data needed to open your account and issue and operate the cards (identification data and the verification result).
Infrastructure providers: cloud hosting, blockchain node and event providers, email and SMS delivery providers, acting on our instructions.
Authorities: when required by law, or to the issuing partner when a transaction must be reported.

Transactions on a public blockchain are visible to anyone by their nature; we do not publish your identity on-chain.

We do not share mobile numbers or SMS consent with third parties for marketing.

7. International transfers

We operate internationally, and your data may be processed in the United States, the European Union, Brazil and other countries where our providers operate. Where required, we rely on appropriate safeguards for such transfers, such as standard contractual clauses.

8. Retention

Identity verification, screening and transaction records are retained for at least 5 years after the end of the relationship, or longer where required by law or by our issuing partners.
Account, card and transaction records are not deleted during this period: closed accounts and cards are kept as inactive records.
After the retention period, personal data is deleted or anonymised, unless a legal hold applies.
On-chain records cannot be deleted, as they are part of the public blockchain.

9. Your rights

Subject to applicable law, including the EU General Data Protection Regulation (GDPR) and the Brazilian General Data Protection Law (LGPD), you may request access to your data, correction, deletion, portability, information about sharing, restriction or objection, and withdraw consent. Some data must be kept to meet legal retention obligations, and we will tell you when that applies. You may also complain to your local data protection authority (for Brazil, the ANPD).

10. Security

We protect personal data with encrypted connections (TLS), two-factor authentication, access limited to what each function requires, secrets stored outside application data, and monitoring of security events. Identity documents are kept in our KYC providers' secure environments, not on our servers. No system is completely secure, and we will notify you and the competent authorities of a data breach where the law requires.

11. Age

The Platform is only for people aged 18 or over.

12. Changes

We may update this Policy. The updated version will be posted with a new effective date, and material changes will be notified in the Platform.

13. Contact

Privacy questions and requests: [email protected]
Dansoft Labs LLC, 30 N Gould St, Ste N, Sheridan, WY 82801, USA