Modveon Privacy Policy

1. Introduction

This Privacy Policy explains how Modveon Inc. and its operating subsidiaries ("Modveon," "we," "us," or "our") collect, use, share, store, and protect your personal information when you use the Modveon platform and any Modveon-powered application, including Sivar in El Salvador (collectively, the "Services").

As used in this Privacy Policy, “personal information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.

This Privacy Policy is divided into layered sections. Sections 1 through 9 apply to all users of the Services worldwide. Section 10 applies only to users in the United States and includes specific disclosures required under United States federal and state law. Section 11 applies only to users in El Salvador and includes specific disclosures required under Salvadoran law.

Your contracting entity for purposes of data protection is determined by your location:

• El Salvador users: Modveon El Salvador, S.A. de C.V., a company organized under the laws of the Republic of El Salvador.
• United States users: Modveon Payments LLC, a Delaware limited liability company.

This Privacy Policy should be read together with the Modveon Terms of Service and the applicable Country Addendum. By creating an account or using the Services, you confirm that you have read and understood this Privacy Policy.

2. Information We Collect

We collect only personal information that is reasonably necessary and proportionate to provide and improve the Services, comply with legal obligations, and protect the integrity of our platform. We do not collect personal information for sale, sharing for cross-context behavioral advertising, targeted advertising, or data enrichment. We may use limited account and contact information to market Modveon's own Services, subject to applicable law and your communication preferences.

The Services support three types of users: authorized government users, registered users, and read-only users. Authorized government users communicate through official accounts and perform approved administrative or moderation functions. Registered users must be at least 18 years old, complete the applicable identity-verification process, and may post, comment, join communities, and communicate with other users. Read-only users may access content made available without registration, including users under 18, but cannot use registered-user features.

2.1 Personal Information You Provide Directly.

• Account and profile information (such as your handle or username, email address, profile photo, optional bio, account status, and, for authorized government users, approved role and administrative status).
• Posts, comments, community memberships or interests, civic poll votes, complaint submissions, and other content you submit through the Services ("User Content").
• One-to-one messages, private group chats, and related communications metadata.
• Communications with us through support channels (email, mobile number, in-app support, WhatsApp).
• Information you provide in response to compliance requests or surveys.

2.2 Salvadoran Government Identity Verification.

For Salvadoran citizens who register for Sivar, identity verification occurs in two steps within the Government of El Salvador’s (the “Government”) RNPN-owned process. First, the user submits a government-issued identification document directly to the Government which verifies the identification record. Second, the user captures a selfie photograph and/or video within the Government’s RNPN-owned process. Modveon does not collect, receive, otherwise obtain the selfie photograph or video. Rather, Modveon receives from the Government only the match results, verification status, fraud or security indicators, and related audit information. This Government process is available only to Salvadoran citizens and is also used to verify age eligibility and determine address-based locality. The Government may require the following information directly from you within that process:

• Full legal name.
• Government-issued photograph.
• Government-issued identification document and the information it contains, including the national identification number (DUI number), which the user submits to the Government for processing verification through the Government's RNPN-owned identity verification processes.
• Address of residence (used to assign you to your national, municipal, and district communities).
• Date of birth (for age eligibility verification).

2.3 Transaction and Wallet Information.

• Wallet public addresses associated with your account.
• Transaction records (amount, recipient address, timestamp, transaction reference) for transfers initiated through the Services.
• Bill payment, cash off-ramp, and remittance transaction records.
• Compliance and screening results from our transaction monitoring partners.

We do not have access to, custody, or store your private keys, seed phrases, or any cryptographic credential that controls your wallet. The wallet is self-custodial. See Section 7 of the Modveon Terms of Service.

2.4 Personal Information That We Automatically Collect Through Automated Tracking Technologies.

• Device identifiers and device information (such as device model, operating system, and app version).
• IP address and approximate location derived from IP address.
• Session timestamps, login records, and authentication events.
• Application performance, crash, and error data.
• General usage analytics (pages viewed, features used, in-app navigation patterns).
• We collect the automated information described above from both registered and read-only users when they access or use the Services.

2.5 Personal Information Service Providers Process on Our Behalf.

• Content-classification and moderation results.
• Product-analytics information.
• Compliance screening results from sanctions and transaction monitoring providers.
• Wallet status and transaction confirmations from our wallet infrastructure provider (Coinbase CDP).
• Payment status from on-ramp and off-ramp partners.

3. How We Use Your Personal Information

We use your personal information for the following purposes:

(a) Identity verification and account creation - for Salvadoran citizens who register for Sivar, Modveon receives only the match results, verification status, fraud or security indicators, and related audit information to determine whether registration may proceed. Modveon does not collect, receive, or otherwise obtain the underlying selfie or video data, biometrics.

(b) Service delivery - to operate registered-user and read-only experiences; enable community forums, posts, comments, one-to-one messages, private group chats, and civic features; and provide any wallet and payments features described in the Modveon Terms of Service.

(c) Compliance with applicable law — including anti-money laundering and counter-terrorism financing ("AML/CFT") obligations, sanctions screening, regulatory reporting, and responding to lawful legal process.

(d) Platform integrity and security — to detect and prevent fraud, abuse, unauthorized access, and other threats; to investigate suspected violations of our Terms; and to maintain the security of our systems.

(e) Customer support and communication — to respond to your inquiries, complaints, and requests; to send you transactional communications including automated SMS messages related to your account and transactions (such as one-time passcodes, transfer confirmations, and security alerts).

(f) Service improvement — to analyze how the Services are used, identify and fix technical issues, and improve features.

(g) Marketing — to send information about Modveon's own Services through email, in-app messages, SMS, or WhatsApp, subject to applicable consent requirements and your communication preferences.

(h) Content moderation and community insights — to classify and remove unsafe content, route uncertain content for authorized human review, enforce community standards, and generate administrative insights about community issues, ideas, and concerns.

(i) Legal and regulatory obligations — to comply with our legal obligations, enforce our Terms, and protect the rights, property, or safety of Modveon, our users, or others.

We do not use your personal information for:

• Targeted advertising, cross-context behavioral advertising, or profiling in furtherance of decisions that produce legal or similarly significant effects.
• Selling or renting to third parties for their commercial use.
• Building consumer profiles for marketing purposes.

4. How We Disclose Your Personal Information

We disclose personal information to the categories of recipients described in this Section, and only for the limited purposes described. These service-provider and operational disclosures do not constitute a sale of personal information or sharing for cross-context behavioral advertising under applicable U.S. state privacy laws.

4.1 Service Providers and Sub-Processors.

We share personal information with our service providers that assist us in delivering the Services such as fraud prevention vendors, sanctions screening providers, and compliance service providers that assist us in meeting our legal and regulatory obligations. These providers act under our written instructions, are contractually obligated to protect your personal information, and may not use it for their own commercial purposes.

• Cloud infrastructure and storage providers, for secure hosting, encrypted data storage, and backup of personal data processed in connection with the Services.
• Content-moderation providers.
• Transaction monitoring and compliance providers, for AML/CFT screening, sanctions screening, and fraud detection in connection with our legal obligations.
• Wallet infrastructure providers, for management of self-custodial wallet functionality and transaction processing.
• Payment processing and on-ramp/off-ramp providers, for processing of deposits, withdrawals, and currency conversion in connection with remittance transactions.
• Transactional messaging and communications providers, for delivery of one-time passcodes, transfer confirmations, security alerts, and other account notifications via email and messaging channels.
• Product analytics providers, for measurement of application performance, feature usage, and user-experience improvement.
• Bill payment and cash off-ramp services. We share transaction details necessary for the partner to fulfill the transaction.
• Bank withdrawal services. We share transfer details necessary to complete the transaction.
• Virtual card services. We share account and transaction information necessary to service the card, where such services are available.

A current list of our sub-processors is available on request at soporte@sivarapp.sv.

4.2 Government Authorities and Law Enforcement.

We may disclose your personal information to government authorities, law enforcement agencies, and other third parties where required or permitted by applicable law, including in response to valid legal process, to comply with our regulatory obligations (including anti-money laundering, counter-terrorism financing, and sanctions screening requirements), or where we reasonably believe disclosure is necessary to prevent fraud, protect the safety of any person, or defend our legal rights.

4.3 Government Officials Within the Civic Platform.

Where the Services include community or civic-engagement features, authorized government users may access and post within communities in which the government participates and may access information made available to them for approved administrative or moderation functions. Depending on their approved role, these functions may include posting announcements or megathreads, adding or removing government roles, maintaining the platform blocklist, viewing account-deletion requests, and reviewing flagged content and communities. Government users cannot access private one-to-one messages or private group chats absent valid legal process and cannot access transaction history, wallet balances, financial data, or individual poll votes through the administrative portal. Individual poll votes are aggregated and anonymized.

A registered user's national, municipal, or district community is determined from the address associated with the user's verified Salvadoran identity record, rather than device location services.

4.4 Business Transfers.

If Modveon undergoes a merger, acquisition, financing, reorganization, or sale of assets, your personal information may be transferred to the relevant successor entity, subject to the same protections set out in this Privacy Policy. We will notify you of any such transfer.

4.5 With Your Consent.

We may disclose personal information at your direction or with your explicit consent for a specifically disclosed purpose, but we will not use this provision to sell personal information, share it for cross-context behavioral advertising, process it for targeted advertising, or disclose it to strategic partners for their own marketing, advertising, or data-enrichment purposes.

4.6 What We Do Not Do.

We do not sell personal information; share personal information for cross-context behavioral advertising; process personal information for targeted advertising; or disclose personal information to strategic partners for their own marketing, advertising, or data-enrichment purposes. We also do not knowingly sell or share the personal information of users under 16. Disclosures to service providers and contractors are limited to specified services performed on Modveon's behalf and are subject to contractual restrictions on use and disclosure.

5. International Data Transfers

The Modveon platform's primary infrastructure is located in the United States, on Google Cloud Platform servers. If you are located outside the United States, your personal information will be transferred to, stored, and processed in the United States.

By creating an account and using the Services, you consent to the transfer of your personal information to the United States. We maintain contractual, technical, and organizational safeguards designed to protect your data during international transfer and at rest, including:

• Encryption in transit (TLS 1.2 or higher) and at rest (AES-256 or equivalent).
• Access controls, role-based permissions, and audit logging for all administrative access.
• Contractual data protection terms with all sub-processors that meet or exceed our internal standards.

For users in El Salvador, additional disclosures relating to cross-border data transfer under the LPDP are set out in Section 11.

6. Data Retention

We retain your personal information only as long as necessary to provide the Services, comply with applicable law, including applicable anti-money laundering, counter-terrorism financing, and financial recordkeeping requirements, which may mandate retention for periods of up to five years or longer following the conclusion of a customer relationship, and resolve disputes. In determining the appropriate retention period for any category of personal information, we consider the nature and sensitivity of the data, the purposes for which it was collected, the potential risk of harm from unauthorized use or disclosure, our legal and regulatory obligations, and whether those purposes can be achieved through anonymization or aggregation rather than retention of identifiable data.

7. Data Security

We apply technical and organizational security measures designed to protect your personal information, including:

• Encryption of data in transit and at rest.
• Access controls, role-based permissions, and audit logging for all administrative actions.
• Multi-factor authentication for internal access to sensitive systems.
• Regular security monitoring, vulnerability assessment, and patching.
• Vendor security reviews for all sub-processors that handle personal information.
• Incident response procedures for security events.

Despite these measures, no online service can guarantee absolute security. You are responsible for:

• Maintaining the security of the device on which you use the Services.
• Protecting your login credentials.
• Securing the private key associated with your self-custodial wallet (we cannot recover it).
• Notifying us immediately of any suspected unauthorized access to your account at soporte@sivarapp.sv.

8. Your Rights and Choices

Depending on your jurisdiction, you have certain rights regarding your personal information. The specific rights available to you, and the procedures for exercising them, are set out in Sections 10 (United States users) and 11 (El Salvador users) below.

Depending on where you live, you may:

• Access your information. Request a copy of the personal data we hold about you in a portable and, to the extent technically feasible, readily usable format.
• Correct your information. Request correction of inaccurate or incomplete data.
• Close your account. End your relationship with us at any time, subject to legal retention obligations.
• Withdraw consent. Withdraw consent for any data processing that is based on your consent (subject to limitations described in this Policy).
• Contact us. Submit any privacy-related question or request to soporte@sivarapp.sv.
• Appeal a decision. Where applicable law provides an appeal right, appeal our refusal to act on a privacy request.

We will respond to all requests within the timeframes required by applicable law.

9. Children's Privacy

Registered-user features are intended only for individuals who are at least 18 years old. Individuals under 18 may access read-only content made available without registration but may not create an account, post, comment, send messages, join private groups, or use wallet or payment features.

We may automatically collect limited device, network, and usage information when any user accesses read-only content, as described in Section 2.4. We do not knowingly collect personal information online from a child under 13 in a manner subject to the Children's Online Privacy Protection Act without first providing required notice and obtaining verifiable parental consent. If we learn that we collected personal information from a child under 13 without required consent, we will delete it. A parent or guardian who believes a child provided personal information may contact us at soporte@sivarapp.sv.

10. United States Users — Additional Disclosures

This Section applies only if you are a user located in or accessing the Services from the United States. It is provided in addition to, and forms part of, this Privacy Policy.

10.1 Annual Privacy Notice (Gramm-Leach-Bliley Act).

The notice required under the Gramm-Leach-Bliley Act ("GLBA") and 12 CFR Part 1016 is set out below in the standard regulatory format.

FACTS — WHAT MODVEON PAYMENTS LLC DOES WITH YOUR PERSONAL INFORMATION

Why? Financial companies choose how they share your personal information. Federal law gives consumers the right to limit some but not all sharing. Federal law also requires us to tell you how we collect, share, and protect your personal information. Please read this notice carefully.

What? The types of personal information we collect and share depend on the product or service you have with us. This information can include:

• Name, address, and contact details.
• Government identification information.
• Transaction history and account balances.
• Device and usage data.

How? All financial companies need to share customers' personal information to run their everyday business. The chart below shows the reasons we can share your personal information; the reasons Modveon Payments LLC chooses to share; and whether you can limit this sharing.

To limit our sharing. Federal law gives you the right to limit only:

• Sharing for affiliates' everyday business purposes — information about your creditworthiness.
• Affiliates from using your information to market to you.
• Sharing for non-affiliates to market to you.

State laws and individual companies may give you additional rights to limit sharing. Modveon does not engage in any of the sharing categories above for which you would have a right to opt out, so there is nothing to opt out of.

Questions? Contact us at soporte@sivarapp.sv or visit modveon.com.

Who we are. Modveon Payments LLC, a Delaware limited liability company.

What we do to protect your information. To protect your personal information from unauthorized access and use, we use security measures that comply with federal law. These measures include computer safeguards and secured files and buildings. For full details, see Section 7 of this Privacy Policy.

How we collect your personal information. We collect your personal information, for example, when you open an account, use our Services, provide account information, or interact with us. We also collect your personal information from others, such as compliance partners, and for the Salvadoran identity verification, the Government of El Salvador through its RNPN-owned process. In that process, Modveon only receives the match result and not the underlying selfie/video data or biometric information..

Definitions.

• Affiliates — companies related by common ownership or control. Our affiliates include Modveon Inc. and Modveon El Salvador, S.A. de C.V.
• Non-affiliates — companies not related by common ownership or control.
• Joint marketing — a formal agreement between non-affiliated financial companies that together market financial products or services to you. We do not engage in joint marketing.

This notice is provided to you at account opening and annually thereafter for as long as you maintain an account with us. We will deliver the annual notice by posting the updated notice at modveon.com/privacy.

10.2 Rights Under U.S. State Privacy Laws

Depending on where you live, you may have the following rights under applicable U.S. state privacy laws with respect to personal information that is not covered by an entity-level or data-level exemption, including any applicable GLBA exemption described in Section 10.1 above.

Right to Know. You may request disclosure of: (a) the categories of personal information we have collected about you; (b) the categories of sources from which we collected it; (c) the business or commercial purpose for collecting it; (d) the categories of third parties with whom we share it; and (e) the specific pieces of personal information we hold.

Right to Delete. You may request deletion of personal information we hold about you, subject to exceptions for information we are required to retain by law (including AML/CFT and financial record retention obligations).

Right to Correct. You may request correction of inaccurate personal information.

Right to Opt Out of Sale or Sharing. Modveon does not sell your personal information and does not share your personal information for cross-contextual behavioral advertising. Accordingly, we do not offer the right to opt-out at this time.

Right to Limit Use of Sensitive Personal Information. You may direct us to limit our use of sensitive personal information to certain enumerated purposes under applicable privacy laws. We use sensitive personal information only for the purposes permitted under those laws. Thus, we do not offer the right to limit the use of sensitive information at this time.

Right to Non-Discrimination or Non-Retaliation. We will not deny you services, retaliate against you, charge different prices, or provide a different level of service because you exercised your privacy rights.

How to Submit a Request. Submit a verifiable consumer request to soporte@sivarapp.sv or through modveon.com/privacy. Requests must provide sufficient information for us to verify your identity and describe your request in sufficient detail for us to evaluate and respond to it. You may designate an authorized agent to make a request on your behalf; we will require verification of the agent’s authority before responding. We will respond within 45 days. We may extend this period by an additional 45 days where reasonably necessary, with prior written notice.

Appeals. Depending on if we decline to take action on your request, we will inform you of our reasons and, where applicable law provides you with an appeal right, you may submit an appeal by sending a written appeal to soporte@sivarapp.sv with the subject line “Privacy Request Appeal.” Please include your original request and our response. We will respond to appeals within the timeframe required by applicable law.

Categories of Personal Information Collected (Last 12 Months). In the past 12 months we may have collected the following categories of personal information about you: identifiers; personal information categories listed in the California Customer Records statute; commercial information; internet or other similar network activity; geolocation data (approximate); and inferences drawn from the above. The sensitive personal information we may collect about you include government identification numbers.

Categories of Sources. We collect personal information directly from users; automatically from devices and use of the Services; from the Government of El Salvador, through its RNPN-owned process, which only provides the match result and no underlying biometric data; from other service providers, including analytics, moderation, wallet, payment, compliance, and communications providers; and from authorized government users acting within the platform.

Business or Commercial Purposes. We collect, use, and disclose personal information to provide and maintain the Services; verify eligibility; operate community, messaging, wallet, and payment features; moderate content and generate community insights; provide support and communications; conduct first-party marketing; detect and prevent fraud and security incidents; comply with law; and improve the Services.

Disclosures for a Business Purpose. In the preceding 12 months, we may have disclosed the categories described above, as applicable, to service providers and contractors for cloud hosting, content moderation, product analytics, security, compliance, wallet and payment infrastructure, transaction fulfillment, communications, and support. We may also disclose information to government authorities as required or permitted by law and in connection with a business transfer. We disclose only the information reasonably necessary for the applicable purpose.

No Sale or Sharing. We have not sold personal information or shared personal information for cross-context behavioral advertising in the preceding 12 months. We do not have actual knowledge that we sell or share personal information of consumers under 16.

California’s “Shine the Light” law (Civil Code § 1798.83) permits users of the Services who are California residents to request certain information regarding our disclosure of personal information to third parties for their direct marketing purposes. We do not make such disclosures so we do not offer this right at this time.

Text Messaging

By providing Modevon your mobile phone number, you consent to receive automated SMS messages from us at the mobile phone number provided.

Transactional Messages Account Notices: We may place such calls or texts to send you one-time passcodes, transfer confirmations, and security alerts.

Marketing Messages: You may also opt-in to receive automated SMS messages from us for marketing purposes.

You may withdraw your consent at any time by replying “STOP” to a message you have received after which we may send you an SMS message to confirm that you have been unsubscribed. After this, you will no longer receive SMS messages from us. For assistance with the messaging program, you can reply to the short code with the keyword “HELP.” Carriers are not liable for delayed or undelivered messages. Message and data rates may apply for any messages sent to you from us and to us from you.

11. El Salvador Users — Additional Disclosures

This Section applies only if you are a user located in or accessing the Services from El Salvador. It is provided in addition to, and forms part of, this Privacy Policy. The Spanish-language version of this Privacy Policy will be the governing version for El Salvador users.

11.1 Your Rights Under the Ley de Protección de Datos Personales (LPDP).

Under the LPDP, you have the following rights with respect to personal data processed by Modveon El Salvador:

(a) Right of Access (Derecho de Acceso). You may request information about what personal data we hold about you, the purposes for which it is processed, and the categories of recipients with whom it is shared.

(b) Right of Rectification (Derecho de Rectificación). You may request correction of inaccurate or incomplete personal data.

(c) Right of Erasure (Derecho de Cancelación / Supresión). You may request deletion of your personal data, subject to our legal obligations to retain certain records (including AML/CFT and CNAD record retention requirements).

(d) Right to Portability (Derecho de Portabilidad). You may request your personal data in a structured, commonly used, and machine-readable format.

(e) Right to Object (Derecho de Oposición). You may object to processing of your personal data where that processing is not required by law or by the performance of our agreement with you.

To exercise any of these rights, submit a request to soporte@sivarapp.sv. We will respond within the timeframe required by the LPDP (7 days).

11.2 Lawful Basis for Processing. Consistent with the LPDP's opt-in model, we process your personal data only on the basis of:

(a) Your explicit, informed, free, and unambiguous consent, obtained at account creation and at relevant points in the Services.

(b) The performance of our contractual obligations to you under the Modveon Terms of Service and El Salvador Country Addendum.

(c) Our legal obligations under applicable Salvadoran law, including AML/CFT, CNAD, UIF reporting, and consumer protection requirements.

You may withdraw consent at any time by contacting us at soporte@sivarapp.sv. Withdrawal of consent may limit or prevent your ability to use the Services.

11.3 Cross-Border Transfer of Your Data. Your personal data is processed and stored on Google Cloud Platform servers located in the United States. By creating a Sivar account and using the Services, you provide your explicit consent to the transfer of your personal data to the United States for processing in accordance with this Privacy Policy.

We have implemented contractual and technical safeguards designed to ensure that your data receives a level of protection in the United States that is consistent with the LPDP.

11.4 Data Protection Officer (DPO). Modveon will designate a Data Protection Officer in accordance with the LPDP. Until then, privacy inquiries may be directed to soporte@sivarapp.sv.

11.5 Data Retention in El Salvador. AML/CFT and CNAD records are retained for a minimum of five (5) years from the date of the relevant transaction or account closure, whichever is later. This retention period reflects mandatory legal requirements and cannot be shortened on user request.

11.6 Sub-Processors and Cross-Border Transfers. A current list of sub-processors that may process your personal data, including any that are located outside El Salvador, is available on request at soporte@sivarapp.sv.

11.7 Right to Lodge a Complaint. You have the right to lodge a complaint with:

• The Defensoría del Consumidor at defensoriadeconsumidor.gob.sv or hotline 910, for consumer protection and complaint handling matters.
• The Comisión Nacional de Activos Digitales (CNAD) for matters relating to digital asset services.
• Any competent court of the Republic of El Salvador.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or the Services.

For material changes, we will provide at least 30 days' advance notice through in-app notification and to your registered contact before the change takes effect. Material changes include changes to:

• The categories of personal data we collect.
• How we use or share personal data.
• Your rights or how to exercise them.
• The purposes for which we process personal data.

For non-material changes, we will update the "Last Updated" date at the top of this Privacy Policy, and the change will take effect upon posting.

Previous versions of this Privacy Policy are available on request at soporte@sivarapp.sv.

13. Contact Us

For any privacy-related question, request, or concern:

Modveon

Email: soporte@sivarapp.sv

Website: modveon.com

El Salvador: sivarapp.sv

For United States users with questions about the GLBA Annual Privacy Notice or state privacy rights, please specify the nature of your request when you contact us.

For El Salvador users wishing to contact our Data Protection Officer, see Section 11.4.