Privacy Policy

1.1 This Policy

This Privacy Policy (this "Policy") explains how Alto Inc. (the "Company", "we", "us", or "our"), an international business company incorporated under the laws of Saint Lucia (registration number 2026-00476) and operator of the Altus brand, collects, uses, discloses, transfers, stores, and protects personal data in connection with the Altus application, website, and related services available at https://altus.trade (collectively, the "Services").

1.2 Technology Provider

The Altus application is developed, maintained, and operated by Metaloop Inc. (the "Technology Provider") on our behalf.

Metaloop Inc. processes personal data as our service provider and, where applicable, as our processor acting under our instructions.

1.3 Broker and Clearing Firm

Brokerage execution services are provided by Atomic Vaults Securities LLC (the "Broker"), a U.S. broker-dealer.

Your securities account is carried, cleared, settled, and custodied by RQD Clearing, LLC* (the "Clearing Firm").

The Broker and the Clearing Firm may process your personal data as independent controllers for their own brokerage, execution, clearing, custody, settlement, regulatory, tax, compliance, and recordkeeping purposes.

1.4 Incorporated Policy

This Policy forms part of the Altus Terms of Service.

Capitalized terms not defined in this Policy have the meanings assigned to them in the Terms of Service.

2.1 Persons Covered

This Policy applies to users and prospective users of the Services.

2.2 Eligibility

The Services are available only to eligible non-U.S. persons outside our Restricted Jurisdictions and are not available to persons under 18 years of age or below the age of majority in their jurisdiction.

2.3 Related Documents

You should read this Policy together with the Terms of Service, Risk Disclosure, Restricted Persons & Jurisdictions Policy, Fee Schedule, and applicable Broker and Clearing Firm agreements and disclosures.

3.1 Company

Alto Inc. is the data controller for personal data processed in connection with the Altus platform, except where another party acts as an independent controller.

3.2 Technology Provider

Metaloop Inc. acts as a technology and operations provider on our behalf and processes personal data only as necessary to provide, operate, maintain, secure, and support the Services.

3.3 Broker and Clearing Firm

Atomic Vaults Securities LLC and RQD* Clearing, LLC may separately process personal data as independent controllers for brokerage, execution, clearing, custody, settlement, tax, regulatory, compliance, and recordkeeping purposes.

4.1 Information You Provide

We may collect personal data that you provide to us, including:

(a) identity and contact information, including name, date of birth, nationality, country of residence, residential address, email address, phone number, and government-issued identification;

(b) verification information, including photographs, selfies, liveness checks, and other KYC or KYB materials;

(c) tax information, including tax residency, taxpayer identification number, and IRS Form W-8BEN or W-8BEN-E;

(d) financial and suitability-related information, including source of funds, source of wealth, investment experience, investment objectives, risk tolerance, expected activity, and financial situation;

(e) entity information, where applicable, including incorporation documents, ownership structure, directors, authorized signatories, control persons, and ultimate beneficial owners; and

(f) communications with us, including support requests, complaints, feedback, and records of your interactions with us.

4.2 Information Collected Automatically

We may automatically collect certain information when you access or use the Services, including:

(a) device, browser, and log information, including IP address, device identifiers, operating system, browser type, access times, app version, crash logs, and usage data;

(b) approximate location derived from IP address;

(c) security, fraud-prevention, and risk signals; and

(d) cookies, local storage, SDK data, pixels, device identifiers, and similar technologies.

4.3 Information from Third Parties

We may receive personal data and related information from third parties, including:

(a) identity-verification, sanctions-screening, PEP-screening, adverse-media, fraud-prevention, and compliance providers;

(b) the Broker, the Clearing Firm, payment providers, banking partners, conversion providers, and other service providers;

(c) public records, sanctions lists, regulatory sources, and commercially available databases; and

(d) blockchain networks and blockchain analytics providers, including wallet addresses and related transaction information.

5.1 Purposes of Processing

We may use personal data to:

(a) register, verify, operate, and maintain your Account;

(b) perform KYC, KYB, residency, eligibility, sanctions, PEP, adverse-media, source-of-funds, and source-of-wealth checks;

(c) provide, operate, support, secure, maintain, and improve the Services;

(d) transmit orders to the Broker and support execution, clearing, settlement, custody, account reporting, and related services through the Broker and the Clearing Firm;

(e) process crypto deposits, conversions, and withdrawals;

(f) comply with AML/CTF, sanctions, tax, FATCA, securities, brokerage, clearing, custody, and recordkeeping obligations;

(g) detect, prevent, investigate, and respond to fraud, abuse, sanctions evasion, market abuse, unauthorized access, security incidents, prohibited use, and other unlawful or harmful activity;

(h) enforce the Terms of Service and other policies;

(i) communicate with you about your Account, the Services, security, operational updates, and support matters;

(j) exercise, establish, or defend legal claims; and

(k) maintain records required by law, regulation, regulators, the Broker, the Clearing Firm, or our service providers.

6.1 Legal Bases

Where applicable data-protection law requires a legal basis for processing, we rely on one or more of the following legal bases:

(a) performance of our contract with you;

(b) compliance with legal and regulatory obligations;

(c) our legitimate interests in operating, securing, improving, and protecting the Services;

(d) prevention of fraud, financial crime, sanctions exposure, market abuse, and misuse of the Services; and

(e) your consent, where required.

6.2 Withdrawal of Consent

Where processing is based on consent, you may withdraw your consent at any time.

Withdrawal of consent does not affect processing carried out before withdrawal or processing that we are required or permitted to continue under applicable law.

7.1 Recipients

We may disclose personal data to:

(a) Atomic Vaults Securities LLC, to receive, execute, process, and report on orders;

(b) RQD Clearing, LLC*, to carry, clear, settle, custody, report, and maintain your Account;

(c) Metaloop Inc., as our Technology Provider, to develop, operate, host, maintain, secure, and support the Services and crypto funding, conversion, and withdrawal workflows;

(d) identity-verification, sanctions-screening, PEP-screening, adverse-media, fraud-prevention, wallet-screening, analytics, communications, cloud-hosting, infrastructure, and security providers;

(e) payment, banking, conversion, liquidity, blockchain infrastructure, and blockchain analytics providers;

(f) regulators, tax authorities, law-enforcement agencies, courts, exchanges, clearing organizations, and other competent authorities, where required or permitted by law;

(g) professional advisers, including lawyers, auditors, insurers, and compliance consultants; and

(h) counterparties, affiliates, successor entities, or transferees in connection with any merger, acquisition, financing, restructuring, reorganization, transfer, or sale of all or part of our business.

7.2 No Sale of Personal Data

We do not sell your personal data.

8.1 Cross-Border Processing

Your personal data may be transferred to, stored in, and processed in countries other than your country of residence, including Saint Lucia, the United States, and other jurisdictions where we, the Broker, the Clearing Firm, Metaloop Inc., or our service providers operate.

8.2 Safeguards

These jurisdictions may have data-protection laws different from those in your country of residence.

Where required by applicable law, we use appropriate safeguards for cross-border transfers.

9.1 Retention Period

We retain personal data for as long as necessary to provide the Services and thereafter for the periods required or permitted by applicable securities, AML/CTF, sanctions, tax, brokerage, clearing, custody, and recordkeeping obligations.

9.2 Post-Closure Retention

We may be required or permitted to retain certain information after your Account is closed, including identity, verification, transaction, tax, compliance, communication, and account records.

9.3 Legal and Compliance Retention

We may also retain personal data where necessary to resolve disputes, investigate suspicious activity, enforce our agreements, comply with legal or regulatory obligations, or establish, exercise, or defend legal claims.

10.1 Security Measures

We use administrative, technical, and organizational measures designed to protect personal data against unauthorized access, loss, misuse, alteration, and disclosure.

These measures may include:

(a) encryption in transit and at rest;

(b) access controls;

(c) monitoring and logging;

(d) internal policies and procedures; and

(e) vendor due diligence.

10.2 No Absolute Security

No method of transmission, processing, or storage is completely secure.

10.3 User Responsibility

You are responsible for safeguarding your login credentials, devices, accounts, and authentication methods, and for notifying us promptly of any suspected unauthorized access or security incident.

11.1 Available Rights

Depending on your jurisdiction, you may have the right to:

(a) access your personal data;

(b) correct inaccurate or incomplete personal data;

(c) delete certain personal data;

(d) restrict or object to certain processing;

(e) request data portability;

(f) withdraw consent where processing is based on consent; and

(g) lodge a complaint with a supervisory authority.

11.2 Legal Limits

These rights are subject to legal limitations.

We may decline, delay, or limit requests where we are required or permitted to retain or process personal data for brokerage, clearing, tax, AML/CTF, sanctions, fraud-prevention, legal, regulatory, compliance, security, or recordkeeping purposes.

11.3 Exercising Rights

To exercise your rights, contact us at info@altus.trade.

We may need to verify your identity before responding to your request.

12.1 Use of Technologies

We use cookies and similar technologies, including local storage, SDKs, pixels, and device identifiers, to operate, secure, maintain, and improve the Services.

12.2 Categories

We may use:

(a) strictly necessary technologies, which are required for authentication, session management, security, fraud prevention, and core functionality;

(b) functional technologies, which are used to remember preferences and settings; and

(c) analytics and performance technologies, which are used to understand usage and improve the Services.

12.3 No Sale Through Cookies

We do not use cookies to sell your personal data.

12.4 Cookie Controls

You may manage cookies through your browser or device settings. Disabling certain cookies may affect the availability or functionality of the Services.

Where required by applicable law, we request consent for non-essential cookies.

13.1 Age Restriction

The Services are not directed to, and may not be used by, anyone under 18 years of age or below the age of majority in their jurisdiction.

13.2 No Knowing Collection

We do not knowingly collect personal data from children.

14.1 Updates

We may amend, supplement, or replace this Policy from time to time by posting the updated version with a new "Last Updated" date.

14.2 Notice

Where required by applicable law, we may notify you by email, through the Services, or by other electronic means.

14.3 Continued Use

Your continued access to or use of the Services after the updated Policy becomes effective means that you acknowledge the updated Policy.

For questions about this Policy or to exercise your privacy rights, contact:

Alto Inc., The Johnsons Centre, #2 Bella Rosa Road, Suite 202, Gros Islet, Saint Lucia

info@altus.trade