Privacy Policy

Manci runs on Solana, a public blockchain that we do not control. Anything recorded on it can be read by anyone, is copied by independent computers around the world, and cannot be changed or deleted by us or by anyone else. This includes:

• your wallet address and every transaction it signs or receives through the platform, with the tokens, amounts and times involved;
• your token balances and the history of your holdings;
• your investor passport, if we issue one: the wallet it belongs to, its status, a numeric code of your jurisdiction, your investor category, its expiry and a one-way reference to your verification file with us (it contains no name and no document);
• the fact that a wallet was placed on the blocklist, that its tokens were moved into quarantine, or that an issuer's proceeds were frozen, if we take one of these measures under our Terms;
• the identifier and fingerprint of the offering document you accepted, which your purchase transaction records.

Blockchain explorers and analytics companies index this data. If anyone learns that a wallet is yours, for example because you told them or because it was linked to your identity elsewhere, they can see that wallet's full history. When you exercise your rights, we cannot erase or correct on-chain records; we can only stop linking them to the data we hold off-chain. Please consider this before you connect a wallet or complete verification.

We collect the following data, mostly from you and your wallet, and in part from public sources and our own systems:

• Wallet and sign-in data: the public addresses of the wallets you connect, the messages you sign to prove that you control them, and short-lived one-time values we keep so that a signed message cannot be reused.
• Account data: the display name you choose, your email address and whether you have confirmed it, and, if you sign in with or link a Google account, that account's identifier and email address. We ask Google only for your account identifier and email address.
• Identity verification (KYC) data, when you verify, for example to convert tokens into company shares: your full legal name, date of birth, nationality, country of residence, address, city and postal code, your email address and, optionally, your phone number, and the documents we request, such as a passport or national identity card, proof of address, a photograph of your face, evidence of the source of your funds and bank statements.
• Company verification (KYB) data, when you act for a company: its name, registration number, country, registered address and website, your role, your name, country of residence, address and contact details, a copy of your passport or identity card, and corporate documents such as the certificate of incorporation or a registry extract, board resolutions and a description of the company's ownership and beneficial owners.
• Verification records: the status and history of our verification decisions and their dates, the documents we requested and their review status, notes our staff add to your file, and a log of each time our staff open or export your documents.
• Investor passport requests: the wallet, the jurisdiction you state, any note you add, and the outcome.
• Transaction records: your purchases (wallet, sale, amount and transaction reference), including purchases in a primary sale made outside the platform that we see on the blockchain, each acceptance of our Terms (wallet, version and time) and, if you raise funds, the fundraising limits and sale approvals that apply to you. We also copy the platform's public on-chain transactions into our database to show your portfolio and history.
• Issuer applications: when you apply to raise funds, information about the company (for example its valuation, revenue, existing investors and plans), the founder's name, email address, social media profiles and statement, pitch materials, and the history of our review.
• Requests you make where these services are offered: contact details and notes for converting tokens into shares, a delivery address and contact details for the delivery of goods, requests for over-the-counter trades, and contact details you add to a resale listing, which the resale board shows publicly.
• Messages: your name, email address, company and message when you use the contact form or write to us.
• Sanctions screening results: before each purchase through the platform, when a wallet uses certain other features, and afterwards for each purchase we see on the blockchain, we check the wallet against public sanctions lists, currently the list of Specially Designated Nationals published by the United States Treasury. A match creates an internal compliance record with the wallet, the list and the details of the match.
• Technical data: your IP address and the country derived from it, which we use while handling a request to limit abuse, to run a bot check and to refuse access from countries where the service is not offered. We store the IP address only as a one-way hash in short-lived abuse counters. Our hosting provider keeps request and error logs, which include IP addresses and can include other identifiers contained in error messages, such as email or wallet addresses. The error reports we send to our error-monitoring provider have identifiers such as email and wallet addresses removed as far as we can detect them.

Our staff review verification documents themselves. We do not use facial recognition or any other biometric matching on your photograph. We do not collect data for advertising and we do not sell personal data.

• To create and run your account, let you sign in and provide the features you use: to perform our agreement with you.
• To verify the identity of investors and issuers, keep records of that verification, screen wallets against sanctions lists, monitor purchases in primary sales made outside the platform, and prevent money laundering, terrorist financing and fraud: to comply with our legal obligations and, where no specific law requires a step, for our legitimate interest in keeping the platform lawful and safe.
• To issue, renew and revoke investor passports and to apply the transfer rules of the tokens you hold: to perform our agreement with you and to comply with our legal obligations.
• To review applications from issuers and decide on them: to take the steps you ask for before entering into an agreement.
• To secure the platform, limit abuse, refuse access from countries where the service is not offered, and find and fix errors: our legitimate interest in a secure and lawful service.
• To send you messages about your account, sign-in, verification, requests and transactions: to perform our agreement with you. We do not send marketing email.
• To keep evidence of what was agreed and done, and to establish, exercise or defend legal claims: our legitimate interest and our legal obligations.
• To answer lawful requests from authorities and courts: to comply with our legal obligations.

Where we ask for your consent, you can withdraw it at any time; this does not affect what we did before. Some features require verification by law or under our Terms: if you do not give us the data we ask for, we cannot offer you those features.

Our staff make verification decisions. Some checks run automatically: a request from a wallet that appears on a sanctions list we screen against, or from a country where the service is not offered, is refused automatically, and an expired verification or passport automatically stops the features that require it. If you believe such a refusal is wrong, contact us and a person will review it. When a purchase in a primary sale made outside the platform comes from a wallet that appears on a sanctions list we screen against, an alert is raised automatically; whether to blocklist a wallet that bought in a primary sale outside the platform and move its tokens is decided by our staff.

• Our staff and the people who operate the platform for us, each only as far as their role requires. Only administrators and staff with the verification role can open identity documents, through links that expire after two minutes (ten minutes in a data export, which only administrators can create), and every opening and export is logged.
• Service providers that process data for us under our instructions: Supabase (database and file storage), Vercel (website hosting and server functions), our email delivery and mailbox providers, Cloudflare (bot check on the email sign-in and contact forms), Helius (blockchain infrastructure, including the requests your browser sends to read the blockchain and submit transactions, and notices of platform transactions), and Sentry (error monitoring).
• Google, if you choose to sign in with or link a Google account. Google handles that sign-in under its own privacy terms.
• Issuers see the purchases made in their own sales (wallet, amount and status), which are also public on the blockchain; they do not receive your verification data from us. Where you request a conversion of tokens into shares or a delivery of goods, where these services are offered, we share with the issuer, the custodian or a public register only the details needed to carry it out.
• Authorities, courts and our professional advisers, where the law requires it or where it is necessary to establish, exercise or defend legal claims, including reports that anti-money-laundering or sanctions law requires.
• A successor or trustee, if the business is transferred or wound down, bound by the same obligations as in this policy.

Anyone can read what is recorded on the blockchain (clause 2). We do not sell personal data and do not share it for advertising.

Our database and file storage are hosted in Ireland and our server functions run in Dublin, Ireland. Other service providers, for example for email, blockchain infrastructure, the bot check and Google sign-in, may process data in other countries, including the United States. The controller named at the top of this page is incorporated outside the European Economic Area, and our staff and service providers may access the data from other countries. Where the law that applies requires it, we protect these transfers with appropriate safeguards, such as the standard contractual clauses approved by the European Commission. Data on the blockchain is replicated worldwide.

• Verification data and documents, verification records and transaction records: while our relationship with you lasts and afterwards for the period that the anti-money-laundering and record-keeping laws that apply to us require. We then delete your documents and verification details and remove your name and contact details from your file. We keep a minimal record of our verification decisions and of your transactions, linked to your wallet, because the on-chain records cannot be removed and we must be able to account for them.
• Your account (display name, email address and linked Google account): until you ask us to delete it or we close the account.
• Issuer applications, messages and service requests: as long as we need them to handle the matter, and afterwards as long as the law or the defence of legal claims requires.
• Sanctions screening records and the log of our staff's actions: for the period that the law requires for compliance records.
• Your acceptances of our Terms: as long as the Terms can be relied on by you or by us, including after the rest of your file has been deleted.
• Email sign-in links expire after 20 minutes and are deleted after they expire. Links to confirm a new email address expire after 30 minutes; the new address stays pending in your account until you confirm it, cancel the change or ask for another link. One-time sign-in values are deleted within minutes after they expire. Hashed abuse counters are deleted after about a day without use.
• Copies of blockchain transactions in our database: we keep the decoded records to show your history and, once we have processed the raw notices we received about them, delete those notices 90 days after we received them.
• Request logs and error reports of our hosting and error-monitoring providers: for the periods those providers apply to our account.
• Data on the blockchain: permanently (clause 2).

We use only the cookies and browser storage the platform needs to work. We do not use analytics, advertising or tracking cookies.

• manci_session: keeps you signed in with your wallet for up to 12 hours, so that you do not have to sign every request.
• manci_account: keeps you signed in to your account for up to 7 days after you sign in with an email link or Google.
• manci_google_link: protects a Google sign-in or the linking of a Google account while it is in progress, for up to 10 minutes.
• Browser storage, which stays on your device: the wallet you connected last, when your wallet session ends, how your wallet signs messages, the page to return to after sign-in, and the state of transactions you started but have not finished.

Cloudflare's bot check loads on the email sign-in and contact forms and processes information about your browser and connection to tell people from automated traffic. Your wallet is software from another provider, with its own privacy terms.

Depending on where you live and on the law that applies to our processing, for example the EU General Data Protection Regulation, the UK General Data Protection Regulation or the Data Protection Act, 2021 of the British Virgin Islands, you may have the right to:

• access your personal data and receive a copy of it;
• have inaccurate data corrected and incomplete data completed;
• have your data erased;
• have our processing of your data restricted;
• object to processing that we base on our legitimate interests;
• receive the data you gave us in a structured, machine-readable format and have it passed to someone else;
• withdraw a consent you gave;
• complain to a data protection supervisory authority, for example in the country where you live or work.

Some of these rights are limited: we cannot erase or change on-chain records (clause 2), and we may keep data that the law requires us to keep, or that we need for legal claims, until that period ends.

To exercise a right, write to the privacy contact shown at the top of this page. We will ask you to show that the data is yours, for example by signing a message with your wallet or by replying from your email address. We answer within one month; where the law allows a longer period for a complex request, we will tell you.

We protect personal data with technical and organisational measures appropriate to the risk, including: encrypted connections; identity documents kept in private storage that browsers cannot reach directly; database tables with personal data closed to the public keys the website uses; staff access to documents through links that expire within minutes (two minutes for a single view, ten minutes in a data export), with every opening and export logged; wallet signatures for administrative actions; our company's hardware wallet, which holds the super administrator, KYC authority and Blocklist Authority roles and the treasury; and a multisig, with a separate hardware wallet as its member, that holds the authority to upgrade the on-chain programs. A second administrator uses a software wallet.

No system is completely secure. If a personal data breach affects you, we will inform you and the competent authorities where the law requires it.

The platform is not intended for anyone under 18. We do not knowingly collect data about children; if we learn that we have, we will delete it unless the law requires us to keep it.

We may update this policy when our services or the law change. We will publish the new version on this page with a new date and, where a change is material and we have your email address, tell you by email before it takes effect.

Questions about this policy and requests about your personal data go to the privacy contact shown at the top of this page.