Modveon Privacy Policy

• Account profile information (username, profile photo, optional bio).
• Posts, comments, civic poll votes, complaint submissions, and other content you submit through the Services ("User Content").
• Communications with us through support channels (email, in-app support, WhatsApp).
• Information you provide in response to compliance requests or surveys.

When you create an account, we collect and verify the following information from your government-issued identity record through the applicable national identity database (the Registro Nacional de las Personas Naturales ("RNPN") in El Salvador, or its equivalent in your jurisdiction):

• Full legal name.
• Government-issued photograph.
• National identification number.
• Address of residence (used to assign you to your national, municipal, and district communities).
• Date of birth (for age eligibility verification).

• Transaction records (amount, recipient address, timestamp, transaction reference) for transfers initiated through the Services.
• Compliance and screening results from our transaction monitoring partners.

• Device information (model, operating system, app version).
• IP address and approximate location derived from IP address.
• Session timestamps, login records, and authentication events.
• Application performance, crash, and error data.
• General usage analytics (pages viewed, features used, in-app navigation patterns).

• Identity verification confirmations from the RNPN or equivalent national identity system.
• Compliance screening results from sanctions and transaction monitoring providers.
• Payment status from on-ramp and off-ramp partners.

We do not collect:

• Your contact lists, address books, or messages from other applications.
• Background location data when the App is not in use.
• Browsing history outside of the Services.
• Biometric data beyond the photograph stored in your government identity record.
• Sensitive personal data is not collected.

We share personal data with carefully vetted third-party service providers that assist us in delivering the Services. These providers act under our written instructions, are contractually obligated to protect your data, and may not use it for their own commercial purposes.

A current list of our sub-processors is maintained at modveon.com/sub-processors.

For specific Services, we share necessary information with authorized partners who provide that Service:

• El Salvador — Bill payment and cash off-ramp providers. We share transaction details necessary for the partner to fulfill the transaction.
• El Salvador — Withdrawal services. We share transfer details necessary to complete the transaction.
• Virtual card services, where available. We share account and transaction information necessary to service the card.

These partners use the data we share solely to provide the relevant Service to you.

We may disclose your information to government authorities and law enforcement agencies where:

• Required by valid legal process (court order, subpoena, warrant).
• Required by applicable law, including AML/CFT reporting obligations to the Financial Investigation Unit ("UIF") of the Attorney General's Office in El Salvador and the Financial Crimes Enforcement Network ("FinCEN") in the United States.
• We reasonably believe disclosure is necessary to prevent imminent harm, fraud, or illegal activity.
• Required by sanctions screening obligations (OFAC and equivalent regimes).

Authorized government officials using the Services in their official capacity may access platform information limited to their designated scope of authority. Specifically:

• Officials may see your publicly visible profile information (name, photograph, municipality) when you participate in their community.
• Officials may see complaints you submit to their jurisdiction through the in-app complaint center.
• Officials cannot see your individual poll votes — poll results are aggregated and anonymized.

If Modveon undergoes a merger, acquisition, financing, reorganization, or sale of assets, your personal data may be transferred to the relevant successor entity, subject to the same protections set out in this Privacy Policy. We will notify you of any such transfer.

We may share your information for any other purpose with your explicit consent.

We do not sell your personal data. We do not rent or trade your personal data. We do not share your personal data with advertisers, marketers, or data brokers. We do not engage in cross-context behavioral advertising.

Your profile, identity verification, and account configuration data are retained for the duration of your active account.

Transaction records, identity verification records, and AML/CFT compliance data are retained for a minimum of fifteen (15) years from the date of the relevant transaction or account closure, whichever is later. This retention period reflects mandatory legal requirements and cannot be shortened on user request.

Posts, comments, and other User Content remain visible while the relevant community exists. Audit and moderation logs may be retained longer for security and accountability purposes.

Device, session, and usage data are retained for up to 24 months from collection for security, fraud prevention, and service improvement purposes, after which they are aggregated or deleted.

When your account is closed, your personal data is deleted from active systems within 30 days, except for data we are required to retain for legal, regulatory, audit, or dispute resolution purposes.

The notice required under the Gramm-Leach-Bliley Act ("GLBA") and 12 CFR Part 1016 is set out below in the standard regulatory format.

FACTS — WHAT MODVEON PAYMENTS LLC DOES WITH YOUR PERSONAL INFORMATION

Why? Financial companies choose how they share your personal information. Federal law gives consumers the right to limit some but not all sharing. Federal law also requires us to tell you how we collect, share, and protect your personal information. Please read this notice carefully.

What? The types of personal information we collect and share depend on the product or service you have with us. This information can include name, address, and contact details; government identification information; transaction history and account balances; and device and usage data.

How? All financial companies need to share customers' personal information to run their everyday business. The chart below shows the reasons we can share your personal information; the reasons Modveon Payments LLC chooses to share; and whether you can limit this sharing.

To limit our sharing. Federal law gives you the right to limit only sharing for affiliates' everyday business purposes (creditworthiness information), affiliates using your information to market to you, and sharing for non-affiliates to market to you. Modveon does not engage in any of the sharing categories above for which you would have a right to opt out, so there is nothing to opt out of.

Questions? Contact us at support@modveon.com or visit modveon.com.

Who we are. Modveon Payments LLC, a Delaware limited liability company.

What we do to protect your information. To protect your personal information from unauthorized access and use, we use security measures that comply with federal law. These measures include computer safeguards and secured files and buildings. For full details, see Section 7 of this Privacy Policy.

How we collect your personal information. We collect your personal information, for example, when you open an account, use our Services, provide account information, or interact with us. We also collect your personal information from others, such as identity verification providers, compliance partners, and the RNPN.

Definitions. Affiliates — companies related by common ownership or control. Our affiliates include Modveon Inc. and Modveon El Salvador, S.A.S. de C.V. Non-affiliates — companies not related by common ownership or control. Joint marketing — a formal agreement between non-affiliated financial companies that together market financial products or services to you. We do not engage in joint marketing.

If you are a California resident, you have the following rights under the California Consumer Privacy Act and the California Privacy Rights Act of 2020:

• Right to Know. You may request disclosure of: (a) the categories of personal information we have collected about you; (b) the categories of sources from which we collected it; (c) the business or commercial purpose for collecting it; (d) the categories of third parties with whom we share it; and (e) the specific pieces of personal information we hold.
• Right to Delete. You may request deletion of personal information we hold about you, subject to exceptions for information we are required to retain by law (including AML/CFT and financial record retention obligations).
• Right to Correct. You may request correction of inaccurate personal information.
• Right to Opt Out of Sale or Sharing. Modveon does not sell your personal information and does not share your personal information for cross-contextual behavioral advertising. There is nothing to opt out of. You may exercise this right at any time by contacting us, and we will confirm in writing.
• Right to Limit Use of Sensitive Personal Information. You may direct us to limit our use of sensitive personal information to the purposes described in CCPA Regulations §7027. We use sensitive personal information only for the purposes permitted under that section, but we will honor any such request.
• Right to Non-Discrimination. We will not deny you services, charge different prices, or provide a different level of service because you exercised any CCPA right.

How to Submit a Request. Submit a verifiable consumer request to support@modveon.com or through modveon.com/privacy. We will respond within 45 days. We may extend this period by an additional 45 days where reasonably necessary, with prior written notice.

You may designate an authorized agent to make a request on your behalf. We will require verification of the agent's authority before responding.

Categories of Personal Information Collected (Last 12 Months). For purposes of CCPA disclosure, in the past 12 months we have collected the following categories of personal information about California residents: identifiers; personal information categories listed in the California Customer Records statute; commercial information; internet or other similar network activity; geolocation data (approximate); and inferences drawn from the above. We have not collected biometric information beyond the photograph in government identity records, sensitive personal information beyond government identification numbers (used for verification only), or any of the other CCPA-enumerated categories.

Where applicable, residents of other US states with comprehensive privacy laws (Virginia, Colorado, Connecticut, Utah, and others) may have rights similar to those described above. To exercise any such right, contact us at support@modveon.com.

Under the LPDP, you have the following rights with respect to personal data processed by Modveon El Salvador:

• (a) Right of Access (Derecho de Acceso). You may request information about what personal data we hold about you, the purposes for which it is processed, and the categories of recipients with whom it is shared.
• (b) Right of Rectification (Derecho de Rectificación). You may request correction of inaccurate or incomplete personal data.
• (c) Right of Erasure (Derecho de Cancelación / Supresión). You may request deletion of your personal data, subject to our legal obligations to retain certain records (including AML/CFT and CNAD record retention requirements).
• (d) Right to Portability (Derecho de Portabilidad). You may request your personal data in a structured, commonly used, and machine-readable format.
• (e) Right to Object (Derecho de Oposición). You may object to processing of your personal data where that processing is not required by law or by the performance of our agreement with you.
• (f) Right to Limitation (Derecho de Limitación). You have the right to request the restriction of the processing of your personal data, in accordance with the provisions set forth under the LPDP.

To exercise any of these rights, submit a request to support@modveon.com. We will respond within twenty (20) business days; this period may be extended for justified reasons by up to an additional twenty (20) business days, in accordance with the LPDP.

Consistent with the LPDP's opt-in model, we process your personal data only on the basis of:

• (a) Your explicit, informed, free, and specific consent, obtained at account creation and at relevant points in the Services.
• (b) The performance of our contractual obligations to you under the Modveon Terms of Service and El Salvador Country Addendum.
• (c) Our legal obligations under applicable Salvadoran law, including AML/CFT, CNAD, UIF reporting, and consumer protection requirements.

You may withdraw consent at any time by contacting us at support@modveon.com. Withdrawal of consent may limit or prevent your ability to use the Services.

Your personal data is processed and stored on Google Cloud Platform servers located in the United States. By creating a Sivar account and using the Services, you provide your explicit consent to the transfer of your personal data to the United States for processing in accordance with this Privacy Policy. We have implemented contractual and technical safeguards designed to ensure that your data receives a level of protection in the United States that is consistent with the LPDP.

AML/CFT and CNAD records are retained for a minimum of fifteen (15) years from the date of the relevant transaction or account closure, whichever is later. This retention period reflects mandatory legal requirements and cannot be shortened on user request.

A current list of sub-processors that may process your personal data, including any that are located outside El Salvador, is maintained at modveon.com/sub-processors.

You have the right to lodge a complaint with:

• The Defensoría del Consumidor at defensoriadeconsumidor.gob.sv or hotline 910, for consumer protection and complaint handling matters.
• The Comisión Nacional de Activos Digitales (CNAD) for matters relating to digital asset services.
• The Agencia de Ciberseguridad del Estado (ACE) for matters related to personal data privacy.
• Any competent court of the Republic of El Salvador.