ReLeaf Financial
Contact

Legal

Privacy Policy

1. Information We Collect

We keep the personal information we collect to a minimum. Here is what we collect, and when:

Using the ReLeaf app and SDK. Our software identifies you by a pseudonymous, on-device credential — not by your name, email, or a password — so ordinary use of the software does not create a record of who you are. If you carry out a transaction, the details you or your organization include to complete it may contain personal information about the people involved; we process those details only to carry out that transaction and do not store them afterward. Where the software uses your device's location (for example to complete a location-based request, or to check which country a witness is in), it is tied only to a pseudonymous device identifier, used only for that request, and not linked to your identity. To keep the Service secure and our proofs verifiable, we also keep a limited, pseudonymous security log and, for some actions, write a one-way hash to a public blockchain; because we cannot delete these on request, we describe them in Section 7.

Contacting us or requesting the SDK. If you fill out a form to contact us or request our SDK, we collect the details you provide — typically your name, email address, company, and phone number — so we can respond and provide what you asked for.

Subscribing to updates. If you subscribe to our newsletter, we collect your email address to send it. You can unsubscribe at any time.

Creating a developer account. If you create an account on our developer portal, we collect your email address, a password (kept only in hashed form), and the profile details you provide.

Automatically. Like most online services, our systems receive basic technical information such as device or browser type and IP address to deliver and secure the service. We do not use advertising or cross-site tracking, and we do not build profiles of you.

2. How We Use Information

We use the information we collect to provide, maintain, and secure our software, website, and developer portal; to respond to your requests and provide the SDK and materials you ask for; to send our newsletter if you have subscribed; and to meet our legal obligations. We use information from a transaction only to carry out that transaction.

3. What We Don't Do

We do not sell or rent personal information. We do not use advertising, analytics, or cross-site tracking, and we do not build profiles of you. Our software does not store the personal information in a transaction beyond what is needed to carry it out, and it does not link location to your identity.

4. How We Share Information

We share personal information only: with service providers who work on our behalf — such as hosting, security, and support providers — under confidentiality and security obligations; when required by law, or to protect the rights, safety, or property of ReLeaf, our users, or the public; and, if we are ever involved in a merger, acquisition, or sale of assets, as part of that transaction (ReLeaf will use reasonable efforts to have the acquiring entity honor this Policy). We do not share personal information with advertisers or data brokers.

5. Cookies

Our marketing website does not use tracking or advertising cookies. Our developer portal uses a single strictly-necessary cookie to keep you signed in.

6. Data Retention

We keep personal information only as long as we need it. Transaction details are not retained after the transaction is carried out, aside from the limited records described in Section 7 (a pseudonymous security log kept for up to three years, and blockchain hashes) and any brief retention required for backups or the law. Information you provide through a contact or SDK request form is kept for one year. Newsletter subscriptions are kept until you unsubscribe. Developer-account information is kept while your account is active.

7. Security Log and Blockchain Records

Two kinds of record are handled differently from everything described above, because we cannot delete them on request. We explain them here so you can make an informed choice about using ReLeaf.

Security log. We keep an append-only security log that records pseudonymous identifiers and cryptographic hashes of actions taken through the Service. We use it to keep the Service secure, detect and investigate fraud and abuse, and resolve disputes. This information is personal data, and because the log is tamper-evident by design, it cannot be changed or erased on request. We keep it for no longer than three years. We rely on our legitimate interests as the basis for keeping it — an interest we have weighed against your privacy rights (a legitimate-interests assessment) and found is not overridden, given how little the log contains and how it is used.

Blockchain records. For some actions, we write a one-way cryptographic hash to a public blockchain so a proof can be independently verified. The hash reveals nothing on its own, but because we hold the underlying data it is treated as pseudonymous personal information about you. Anything written to a public blockchain is permanent and cannot be altered or deleted by anyone, including us — so this is one record we cannot erase, even at your request.

8. Data Security

We use industry-recognized, appropriate administrative, technical, and organizational measures to protect personal information in transit and at rest, and we review them as our services evolve. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

9. International Data Transfers

ReLeaf is offered internationally and may process information in countries other than your own, including the United States. Where required, we use appropriate safeguards for cross-border transfers — such as the European Commission's Standard Contractual Clauses, or the mechanism a law like China's PIPL requires (including your separate consent). This Policy is intended to comply with the data-protection laws that apply where our users are located.

10. Your Privacy Rights

Wherever you are located, you can ask us to access, correct, or delete the personal information we hold about you, object to or restrict certain uses, withdraw consent where we rely on it, and receive a copy in a portable form; and you can complain to your local data-protection regulator. Because our software is designed not to retain transaction information, we may hold little or no such information to act on once a transaction has concluded. Two records are an exception and cannot be deleted on request — our security log and any hash written to a public blockchain (see Section 7). To make a request, contact us (Section 13).

Your local law may give you additional or stronger rights, and we honor them — including:

  • European Economic Area & UK (GDPR/UK GDPR): access, rectification, erasure, restriction, objection, portability, and withdrawal of consent; you may complain to your local supervisory authority.
  • California (CCPA/CPRA): the rights to know, delete, and correct, and to opt out of the “sale” or “sharing” of personal information — which we do not do. We will not discriminate against you for exercising your rights.
  • Brazil (LGPD): confirmation, access, correction, anonymization or deletion, and withdrawal of consent; you may petition the ANPD.
  • Canada (PIPEDA): access and correction, and withdrawal of consent; you may complain to the Office of the Privacy Commissioner of Canada.
  • China (PIPL): access, correction, deletion, and portability, and withdrawal of consent; cross-border transfers are made on the basis the PIPL requires, including your separate consent.
  • India (DPDP Act): access, correction, and erasure, withdrawal of consent, and grievance redressal; you may complain to the Data Protection Board of India.
  • Australia (Privacy Act): access and correction; you may complain to the Office of the Australian Information Commissioner (OAIC).
  • Japan (APPI): disclosure, correction, and cessation of use; you may raise concerns with the Personal Information Protection Commission (PPC).
  • Singapore (PDPA): access and correction, and withdrawal of consent; you may contact the Personal Data Protection Commission (PDPC).
  • South Africa (POPIA): access, correction or deletion, and objection; you may complain to the Information Regulator.

11. Children's Privacy

ReLeaf is not directed to children under 16, and we do not knowingly collect personal information from children. If you believe a child has provided us personal information, contact us and we will delete it.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the date above and, where appropriate, provide additional notice. Your continued use of ReLeaf after changes take effect constitutes acceptance of the revised Policy.

13. Contact Us

If you have questions or requests about this Policy or your personal information, contact:

Releaf Financial, Incorporated

2810 N Church St, PMB 826690, Wilmington, DE 19802-4447

Email: hello@releaf-financial.com