Privacy Policy

Nerona Inc. (together with its subsidiaries and affiliates, "Nerona", "we", "us" or "our") is a company incorporated under the laws of the British Virgin Islands, with its registered office at Sixth (6th) Floor, Water's Edge Building 1, Wickham's Cay II, Road Town, Tortola, British Virgin Islands. Nerona operates a digital wealth platform providing stablecoin-based products, earn products, payment card programs, and related services to eligible clients.

This Privacy Policy describes how Nerona collects, uses, shares, and protects personal information when you visit our website (nerona.xyz), use the Nerona mobile or web application (the "App"), or otherwise interact with our products and services (collectively, the "Services").

By accessing or using the Services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with it, please do not use the Services.

Important note on custody and blockchain data. Nerona operates on a non-custodial wallet infrastructure. Your digital assets are held in wallets controlled by you. Transactions you conduct are recorded on public blockchains, which are permanent, public, and outside Nerona's control. Please read the "Blockchain Data" section below carefully.

1. Personal Information We Collect

Information you provide to us

Category	Examples
Contact data	Full name, email address, phone number, country of residence, mailing address
Account and profile data	Username, authentication credentials, preferences, referral codes
Communications data	Messages you send us through in-App support, email, messaging apps, or social media, and records of those exchanges
Transactional data	Deposits, withdrawals, conversions, card transactions, transaction amounts, timestamps, and history
Financial data	Wallet balances, source of funds and source of wealth information, and related documentation where required
Identity verification (KYC) data	Full legal name, date of birth, nationality, residential address, government-issued identification documents and numbers, photographs, and liveness or selfie images collected during onboarding
Marketing data	Your preferences for receiving communications from us and your engagement with them

Information collected by our partners

Certain regulated or specialized functions within the Services are performed by third-party partners, each of which collects and processes personal information under its own privacy policy in addition to this one:

Identity verification providers, which perform KYC, anti-money laundering (AML), and sanctions screening. These providers may collect biometric information (such as facial geometry data from your identification document and live image) to verify your identity. Nerona receives the results of verification and, where required by law, copies of the underlying verification records. Nerona does not independently process biometric data for any other purpose.
Card issuing and program partners, which conduct their own cardholder verification and process card application, cardholder, and card transaction data in order to issue and operate your payment card.
Fiat on-ramp and off-ramp providers (including licensed exchanges, virtual account providers, and OTC desks), which process the personal and financial information required to convert between fiat currency and digital assets, including bank account details.
Wallet infrastructure providers, which process the technical data required to create and secure your non-custodial wallet.

Information collected automatically

Device data: device type, operating system, browser type, IP address, language settings, unique device identifiers, and mobile carrier and network information.
Usage data: pages and screens viewed, features used, session duration, navigation paths, and interactions with our communications.
Approximate location data derived from your IP address, used for security, fraud prevention, and compliance purposes.

Blockchain activity data

Wallet addresses associated with your account, transaction hashes, counterparty addresses, amounts, and other on-chain activity. Although wallet addresses are pseudonymous, they may be combined with other information to identify you.

2. How We Use Personal Information

We use personal information to:

Provide and operate the Services: create and maintain your account, execute your instructions, display balances and transaction history, provide customer support, and send service-related notices;
Verify identity and comply with law: conduct or facilitate KYC, AML, counter-terrorist financing, and sanctions screening; respond to lawful requests from regulators, law enforcement, and other authorities; and satisfy record-keeping, tax, and reporting obligations;
Protect the Services and our users: detect, prevent, and investigate fraud, security incidents, and other unauthorized or illegal activity, and enforce our terms of service;
Improve the Services: analyze usage, diagnose technical issues, and develop new features and products;
Communicate with you: respond to inquiries and, where you have consented or where otherwise permitted by law, send marketing communications about products and services that may interest you. You may opt out of marketing communications at any time;
Support corporate activity: in connection with an actual or contemplated financing, restructuring, merger, acquisition, or sale of all or part of our business; and
Create aggregated or de-identified data that no longer identifies you, which we may use and share for any lawful business purpose.

We do not sell your personal information. We share personal information only with:

Service providers and partners performing functions on our behalf or in connection with the Services, including identity verification providers, card issuing and program partners, fiat on/off-ramp providers, wallet infrastructure providers, cloud hosting, analytics, communications, and customer support providers. Providers acting on our behalf are contractually restricted to processing personal information only as instructed by us;
Corporate affiliates within the Nerona group;
Professional advisers, such as lawyers, auditors, and insurers, in the course of the services they provide to us;
Regulators, law enforcement, and other authorities, where we believe in good faith that disclosure is required by law or is necessary to protect our rights or the rights, safety, or property of others;
Parties to a corporate transaction, such as a prospective or actual acquirer, investor, or successor, and their advisers, subject to confidentiality obligations; and
Third parties you designate, where you instruct us or consent to a disclosure.

4. Blockchain Data

Transactions conducted through the Services are recorded on public blockchains. Blockchain records are, by design, public, permanent, and immutable. Neither you nor Nerona can amend or delete data once it is recorded on-chain. Information about your transactions, including wallet addresses, amounts, and counterparties, can be viewed, copied, and analyzed by anyone. Your rights of deletion and rectification described in this Privacy Policy therefore do not extend to on-chain data.

5. Cookies and Tracking Technologies

We and our service providers use cookies, software development kits, and similar technologies on our website and in the App to keep you signed in, remember your preferences, measure usage, and detect fraud. You can manage cookies through your browser settings and app tracking permissions through your device settings. Disabling certain cookies may affect the functionality of the Services.

6. Retention

We retain personal information for as long as necessary to fulfill the purposes described in this Privacy Policy, including to satisfy legal, regulatory, accounting, and reporting requirements, resolve disputes, and enforce our agreements. In particular:

Identity verification, KYC, and AML records are retained for the duration of our relationship with you and for at least five (5) years after that relationship ends, or such longer period as required by applicable law;
Transactional, blockchain activity, and financial data are retained for at least five (5) years following the relevant transaction or the end of our relationship with you;
Marketing data is retained until you opt out of marketing communications; and
Communications data is retained for up to three (3) years from the relevant communication, unless a longer period is needed to establish or defend legal claims.

When personal information is no longer required, we delete it, anonymize it, or securely isolate it from further processing.

7. Security

We employ technical, organizational, and physical safeguards designed to protect personal information, including encryption in transit, access controls, and restriction of access to personal information on a need-to-know basis. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

8. International Data Transfers

Nerona is incorporated in the British Virgin Islands and works with service providers and partners located in other jurisdictions, including Singapore, the United States, Canada, and Hong Kong. Your personal information may be transferred to, stored, and processed in jurisdictions whose data protection laws differ from those of your country of residence. Where required by applicable law, we implement appropriate safeguards for such transfers, such as contractual data protection commitments with the recipients.

9. Your Rights

Depending on the data protection laws applicable in your jurisdiction, you may have the right to:

Access the personal information we hold about you and receive information about how it is processed;
Correct inaccurate or incomplete personal information;
Delete personal information, subject to the exceptions described in this Privacy Policy;
Port your personal information to yourself or a third party in a machine-readable format;
Object to or restrict certain processing; and
Withdraw consent where processing is based on your consent, without affecting the lawfulness of processing before withdrawal.

To exercise any of these rights, contact us at support@nerona.xyz. We may need to verify your identity before acting on a request. We aim to respond within thirty (30) days. We may decline requests where permitted or required by law (for example, where the information must be retained for AML compliance) and will explain our grounds where we do so.

If you withdraw consent or decline to provide information that we need to meet our legal obligations, we may be unable to provide some or all of the Services.

10. Account and Data Deletion

You may request deletion of your Nerona account and associated personal data at any time:

In the App: go to Profile → Settings → Account → Delete Account and follow the prompts; or
By email: send a request to support@nerona.xyz from the email address associated with your account, with the subject line "Account Deletion Request".

What happens when you delete your account:

We will confirm receipt of your request and may ask you to verify your identity.
You should withdraw or transfer any remaining assets before deletion. Because Nerona's wallet infrastructure is non-custodial, we cannot access or return assets on your behalf after your account is closed.
Your account will be closed and your profile, preferences, and marketing data will be deleted within thirty (30) days of verification.
Certain records, including identity verification, KYC/AML, and transaction records, will be retained for the periods described in the "Retention" section above, as required by applicable anti-money laundering and financial record-keeping laws. These records are isolated from active processing and used solely for compliance purposes.
Data recorded on public blockchains cannot be deleted by Nerona or anyone else, as described in the "Blockchain Data" section above.

Deletion is permanent. Once your account is deleted, it cannot be restored, and you will need to complete onboarding again to use the Services in the future.

11. Children

The Services are not intended for, and may not be used by, anyone under the age of eighteen (18) or the age of majority in their jurisdiction, whichever is higher. We do not knowingly collect personal information from minors. If you believe a minor has provided us with personal information, please contact us and we will take appropriate steps to delete it.

12. Third-Party Sites and Services

The Services may contain links to, or integrations with, websites, applications, protocols, and services operated by third parties, including decentralized protocols that no one controls. This Privacy Policy does not apply to those third parties, and we are not responsible for their privacy practices. When assets are transferred to a third-party protocol or wallet, Nerona has no control over, and no responsibility for, the processing of data associated with those transactions.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by updating the effective date at the top of this page, posting the updated policy on the Services, or by other appropriate means (which may include email or in-App notice). Your continued use of the Services after the effective date of an updated Privacy Policy constitutes your acknowledgment of the updated policy.

14. How to Contact Us

If you have questions about this Privacy Policy, our data practices, or wish to exercise your rights, contact us at:

Email: support@nerona.xyz

Entity: Nerona Inc., Sixth (6th) Floor, Water's Edge Building 1, Wickham's Cay II, Road Town, Tortola, British Virgin Islands