Privacy Policy

1. Who we are (Data Controller)

Azuros Limited
Liberty House
Sandy Lane
Kingston Upon Thames
KT1 4BB, United Kingdom
Email: privacy@azuros.ai

2. What we collect

• Contact form data: name, email, subject, and your message.
• Account data: name, email address, and authentication identifiers when you register or sign in. Authentication is provided by Auth0 (Okta); we receive your verified email and profile basics, never your password.
• Profile and onboarding data: the role, investment preferences, organisation details, and project information you provide while using the platform.
• Investor classification: where you take part as an investor, the category we admit you under (for example retail, professional or institutional), the type of entity you invest through, whether its beneficial ownership has been traced, the evidence of any accreditation, and, for a holder of record, its jurisdiction and legal entity identifier (LEI).
• Wallet addresses: the blockchain wallet addresses linked to your account, and the proof that you control each one (a message you sign with the wallet). We never ask for, receive or hold your wallet's private key.
• Public blockchain records: when you are registered as an eligible holder of a token issued through the platform, or you subscribe for, hold, transfer or redeem one, the record is written to a public blockchain (today Polygon's public test network, Amoy). It includes your wallet address, your holdings and transactions, an on-chain identity record linked to your wallet, a numeric code for your country, and the eligibility claims we issue — as digital signatures and fingerprints of the evidence, never the documents themselves. Anyone can read these records, and neither we nor anyone else can alter or delete them.
• Identity-verification data: where a feature requires it, identity verification is carried out by our verification provider, Sumsub. Government-issued identity documents, a liveness selfie, and screening results are captured by Sumsub directly in your browser and held by them — those files never pass through our servers. What we store is the verification outcome: your applicant reference, the verdict and level reached, and the status notifications Sumsub sends us, which we keep in full so a verification decision can be audited and re-checked.
• Uploaded documents: files you submit in support of projects, milestones, or verification (for example evidence documents), stored so they can be reviewed and attested.
• Project images: if you give a web address for a project's cover image, our servers fetch the image from that address, store a re-encoded copy, and show it publicly with the project.
• Assistant conversations: the signed-in dashboard includes an AI assistant. When you use it, your messages and the context needed to answer them — your name, email and role, and, depending on what you ask, your investment preferences, saved projects, and the projects and expressions of interest linked to your account, including any free-text notes on them — are sent to Anthropic, which operates the underlying model on our behalf. Your conversation is held for the duration of your session. The project editor's indicator-suggestion helper sends the project details you have entered to the same provider when you use it. Do not put anything into these tools that you would not want processed by a third-party provider.
• Session cookie: we set one strictly-necessary cookie (azuros-session) to keep you signed in and to carry the token that protects forms against cross-site request forgery. It is essential, expires within 24 hours, and carries no tracking.
• Verification-partner details: if you act as an independent attestor or verifier on the platform, we hold your legal name, contact email, jurisdiction, the public half of your signing key, and the notes we keep on your insurance and any conflicts of interest.
• Account activity: sign-ins and changes made through your account, with the date, time and IP address, kept in the platform's audit history.
• Technical data: IP address, date/time, user-agent, pages visited (standard server logs for security/diagnostics).
• Optional analytics: Currently not enabled. Beyond the essential session cookie above, we do not set non-essential cookies or tracking pixels. If this changes, we'll update this Policy and request consent where required.

Please do not include sensitive information in free-text fields.

3. Legal bases

Under UK and EU data-protection law (GDPR) we rely on the bases below. Where Bermuda's Personal Information Protection Act 2016 applies, we rely on the corresponding conditions in that Act.

• Contract (Art. 6(1)(b)) to create and operate your account and provide the platform features you request.
• Legal obligation (Art. 6(1)(c)) for identity verification and screening where anti-money-laundering and know-your-customer rules apply, for keeping the register of token holders, and for producing records to supervisory authorities.
• Legitimate interests (Art. 6(1)(f)) to respond to enquiries, operate/secure the Site, prevent abuse, and improve performance.
• Consent (Art. 6(1)(a)) for any future non-essential analytics/cookies.

4. How we use your data

• Respond to your enquiry and maintain related correspondence.
• Create and operate your account, and provide the platform features you use — onboarding, matching projects to your stated preferences, project authoring, and the reporting and evidence workflows.
• Verify identity where a feature or a legal obligation requires it, and screen for financial-crime risk.
• Decide whether a wallet may hold the platform's tokens, record that eligibility on the blockchain, keep the register of holders, and reconcile it with the blockchain.
• Send you email about your account, matching projects and expressions of interest.
• Answer your questions through the dashboard assistant and suggest impact indicators in the project editor.
• Operate, secure, and improve the Site (monitoring, debugging, abuse prevention).
• Comply with legal obligations and enforce our Terms.

We do not sell your personal data.

5. Sharing and service providers

We share personal data with the service providers that run parts of the platform on our behalf:

• Auth0 (Okta) — account sign-in and authentication.
• Sumsub — identity and business verification, including the capture and storage of identity documents.
• Amazon Web Services (London region) — cloud hosting, database, and storage of uploaded files.
• Amazon SES — delivery of email you receive from us, and of contact-form enquiries to our own inbox.
• Anthropic — the AI model behind the dashboard assistant and the indicator-suggestion helper, which receives the data described in section 2.
• Blockchain node providers — the services through which the platform reads the public blockchain and submits transactions to it. They see the wallet addresses and transactions involved.

Records written to the public blockchain (section 2) are visible to anyone. Independent verifiers and attestors on the platform see the project evidence they are asked to check, and supervisory authorities, including the Bermuda Monetary Authority, may inspect the platform's records, including the register of holders.

We also share data with professional advisers and with authorities where required by law. Providers are bound by appropriate confidentiality and security obligations and process data only on our instructions, and are not permitted to use it to train their own AI models.

6. International transfers

Where data is transferred outside the UK/EEA, we implement safeguards such as UK/EU Standard Contractual Clauses and relevant addenda.

7. Data retention

• Contact correspondence: up to 24 months after last interaction (or longer if needed to establish/defend legal claims).
• Account and profile data: for the life of your account and up to 24 months after closure, unless a longer period is required by law.
• Identity-verification records: verification verdicts, references and status notifications are retained as required by applicable anti-money-laundering regulation (typically five years after the end of the relationship). The underlying documents are held by Sumsub under their retention policy.
• Uploaded documents: retained for as long as the project, milestone or report they evidence remains on the platform, and thereafter as needed to preserve the audit trail behind a verification or attestation. Uploads you start but do not finish are discarded within 24 hours.
• Assistant conversations: held for the duration of your signed-in session and cleared when the session ends or when you clear the conversation.
• Server logs: up to 12 months for security/diagnostics.
• Audit history: the platform keeps a permanent history of changes to its records, because supervision of a regulated instrument requires it. When data is corrected or removed, the earlier values remain in that history with access restricted.
• Public blockchain records: permanent. They cannot be deleted by us or by anyone else.

If you request earlier deletion, we will comply unless we have a lawful need to retain the data. Where data cannot technically be erased — the audit history and public blockchain records — we will stop using it for any purpose other than the records we are required to keep, and explain what remains.

8. Your rights

Subject to the conditions of the law that applies to you (UK/EU GDPR, or Bermuda's Personal Information Protection Act 2016), you may request access, rectification, erasure, restriction, portability (where applicable), and object to processing based on legitimate interests. You may withdraw consent at any time for consent-based processing. Section 7 explains the limits that the audit history and the public blockchain place on erasure.

To exercise rights, email privacy@azuros.ai. We may need to verify your identity.

9. Children

This Site is not intended for children under 16, and we do not knowingly collect their data.

10. Security

We use appropriate technical/organizational measures (e.g., HTTPS, access controls, logging). No method of transmission or storage is 100% secure.

11. Complaints

In the UK you can complain to the Information Commissioner's Office (ICO): ico.org.uk. If you're in the EEA, you may contact your local supervisory authority. In Bermuda you can complain to the Office of the Privacy Commissioner for Bermuda: privacy.bm. Please contact us first so we can try to resolve your concerns.

12. EU/UK representatives

We keep our need for Article 27 representation under review as the platform opens up. If a representative is required, we'll update this Policy with their details.

13. Changes to this Policy

We may update this Policy from time to time. Material changes will be posted here with an updated effective date and "Last updated" date.