Privacy Policy

1. Introduction

Xwire AI, Inc. ("Xwire," "we," "us," or "our") operates the defi.xwire.ai platform (the "Platform"). This Privacy Policy describes how we collect, use, share, and protect your personal information when you use our DeFi lending and borrowing services. By using the Platform, you consent to the practices described in this policy.

2. Information We Collect

2.1 Personal Identification Information (PII)

• Full legal name, date of birth, and nationality.
• Email address, phone number, and mailing address.
• Government-issued identification documents (passport, driver's license, national ID).
• Social Security Number or Tax Identification Number (for US persons).
• Proof of accredited investor status (for RE token investors).

2.2 Financial & Transaction Data

• Wallet addresses (blockchain public keys).
• Deposit, withdrawal, borrowing, and repayment transaction history.
• Collateral positions and liquidation events.
• USDC on-ramp/off-ramp transaction records.
• Investment positions in tokenized real estate.
• Payment information processed through Stripe.

2.3 KYC/AML Verification Data

• Identity verification results and scores.
• Document images submitted for verification.
• Sanctions screening results.
• Source of funds documentation.

2.4 Technical & Usage Data

• IP address, browser type, operating system, and device information.
• Pages visited, features used, and interaction patterns.
• AI assistant conversation logs (for service improvement).
• Error logs and performance metrics.

3. How We Use Your Information

• Platform Operations: Processing deposits, withdrawals, loans, and investments; calculating interest and managing positions.
• Identity Verification: Completing KYC/AML checks as required by law; verifying accredited investor status.
• Security & Fraud Prevention: Detecting and preventing fraudulent activity, unauthorized access, and suspicious transactions.
• Regulatory Compliance: Meeting Bank Secrecy Act (BSA), anti-money laundering (AML), and sanctions compliance obligations.
• AI-Powered Services: Providing personalized yield recommendations, portfolio analysis, and chat assistant responses.
• Communications: Sending account notifications, rate alerts, liquidation warnings, and required disclosures.
• Service Improvement: Analyzing usage patterns to improve platform features and user experience.

4. Third-Party Service Providers

We share information with the following categories of third-party processors, each bound by data processing agreements:

5. Data Retention

We retain your data according to the following schedule:

• Financial & Transaction Records: 5 years from the date of the transaction, as required by BSA/AML regulations.
• KYC/Identity Verification Data: 2 years after account closure, or as required by applicable law.
• Account Profile Data: Duration of the account relationship plus 2 years.
• AI Conversation Logs: 90 days, unless retained for compliance or dispute resolution purposes.
• Technical/Usage Logs: 12 months.

6. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Right of Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete personal data.
• Right to Data Portability: Receive your data in a structured, machine-readable format.
• Right to Deletion: Request deletion of your personal data, subject to legal retention requirements (financial records must be retained per BSA/AML requirements).
• Right to Restrict Processing: Request limitation of how we process your data.
• Right to Object: Object to processing of your data for marketing or profiling purposes.

To exercise any of these rights, contact us at privacy@xwire.ai. We will respond within 30 days.

7. Cookies & Tracking Technologies

We use the following types of cookies:

• Essential Cookies: Required for authentication, session management, and security. These cannot be disabled.
• Analytics Cookies: Used to understand how users interact with the Platform (Vercel Analytics). Can be disabled in your browser settings.
• SSO Cookies: Used for single sign-on across xwire.ai subdomains (defi.xwire.ai, supply.xwire.ai, pm.xwire.ai).

You can manage cookie preferences through your browser settings. Disabling essential cookies may prevent you from using the Platform.

8. Data Security

We implement industry-standard security measures to protect your personal data, including encryption in transit (TLS 1.3) and at rest, access controls, regular security reviews, and monitoring for unauthorized access. However, no system is completely secure, and we cannot guarantee the absolute security of your information. You are responsible for maintaining the security of your account credentials and wallet private keys.

9. International Data Transfers

Your data may be transferred to and processed in countries other than your country of residence, including the United States. We ensure appropriate safeguards are in place for such transfers, including standard contractual clauses and data processing agreements with our service providers.

10. Children's Privacy

The Platform is not intended for use by individuals under 18 years of age. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child under 18, we will take steps to delete such information promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on the Platform and updating the "Last updated" date. Your continued use of the Platform after such changes constitutes acceptance of the revised policy.

12. Contact Information

For privacy-related inquiries, requests, or complaints:

• Email: privacy@xwire.ai
• Data Protection Officer: dpo@xwire.ai