Privacy Policy

This Privacy Policy explains what Asset Layer LLC (“Asset Layer,” “we”) collects when you use the AssetLayer platform, why we collect it, and the choices you have. We built the platform to hold as little personal data as a compliance-gated marketplace can: identity documents stay with our verification provider, sensitive files are encrypted before they touch storage, and public APIs never expose personal information.

AssetLayer currently runs as an incentivized testnet: the offerings shown are fictional demonstrations funded with testnet tokens, and nothing on the platform is a real securities offering. We still verify identity, because verification is the control that the platform exists to demonstrate and because a verification completed now carries forward to a future live deployment. If you would rather not be verified, you can browse deals, read data rooms, use the AI analyst, and earn testnet points with a free account and no identity check at all.

1. What we collect

• Wallet addresses and on-chain activity. Your wallet address, signatures on platform messages, and your transactions with our smart contracts. Blockchain data is public by design and permanently visible to anyone.
• Email address, when you subscribe to deal alerts or register an agent reporting address, together with the source of the signup and the wallet it was linked to.
• Verification information. When you request verification: your legal name, entity type, residency, accreditation basis, evidence metadata, and the contact email you give us for updates on your review. Government-ID verification runs through Stripe Identity — your ID images and biometric checks stay with Stripe; we store only the session identifier and the pass/fail outcome. Accreditation letters you upload are encrypted (AES-256-GCM) before storage and are readable only by compliance officers through signed, short-lived access.
• Community-round declarations. If you take part in a community (Regulation CF) round, the annual income and net worth you declare and sign with your wallet — the figures that set your regulatory investment limit. We store them server-side only; no API ever returns them, and the platform exposes only the derived limit, the amount used, and the amount remaining.
• Compliance records. An append-only audit log of verification actions (requests, approvals, revocations, freezes) with the acting officer, subject wallet, notes, and transaction hashes — records we are required to keep.
• Issuer and data-room content you submit for listing, attributed to the submitting wallet.
• Technical data collected by our hosting provider in ordinary server logs (IP address, user agent, timestamps).

2. How we use it

• Operating the platform: sessions, gated data rooms, agent delegations, proposals, and notifications you asked for.
• Telling you what happened to your verification: we email the address on your request when your identity check is received and when your wallet is approved. These are transactional notices about your own account, not marketing.
• Compliance: verifying identity, accreditation, and residency; screening names and wallets against the U.S. Treasury OFAC SDN list; maintaining the audit trail that securities and anti-money-laundering rules require.
• The testnet program: computing points and leaderboards — public program data shows wallet addresses only, never names or emails.
• Improving and securing the platform, including rate-limiting and abuse prevention.

3. AI processing

Data-room documents and accreditation letters may be processed by an AI model provider (Anthropic) to generate summaries, retrieval answers, and verification pre-screens. This processing is initiated by you or by a compliance workflow, and outputs are advisory. We do not use your personal information to train models.

4. What we share

• Service providers who process data for us: hosting and storage (Vercel), identity verification (Stripe), email delivery (Resend), and AI processing (Anthropic). Each receives only what its function needs — our email provider receives your address and the text of the notice, never verification evidence.
• Compliance disclosures: regulators, law enforcement, or auditors where the law requires; issuers never receive your identity documents.
• On-chain data: anything written to a public blockchain (including your verification status as a claim on your wallet address) is public and outside our control.
• We do not sell personal information, and we do not share it for cross-context behavioral advertising.

5. Retention

We keep verification and compliance records for as long as regulation requires (typically at least five years after the relationship ends), subscription emails until you unsubscribe, and operational logs briefly. Blockchain records cannot be deleted by anyone, including us.

6. Security

Sensitive documents are encrypted before storage with keys held only server-side; officer access requires a wallet signature checked against on-chain roles; public storage never holds readable personal information; and every compliance action lands in an append-only log. No system is perfectly secure — protect your wallet keys and session tokens, which we can never recover for you.

7. Your choices and rights

• Unsubscribe from emails at any time via the link in any message or by contacting us.
• Revoke agent delegations from your portal; revocation immediately ends the agent’s access.
• Depending on where you live, you may have rights to access, correct, or delete personal information. Contact us and we will honor them to the extent the law allows — compliance-mandated records and public blockchain data are exempt from deletion.

8. Children

The platform is not directed to anyone under 18, and we do not knowingly collect their data.

9. Changes

We will update this policy as the platform evolves and revise the date above; material changes will be flagged on the site.

10. Contact

Privacy questions or requests: peter@assetlayer.org.