Privacy Policy

1. Introduction

This Privacy Policy explains how [LEGAL ENTITY NAME] (“SlabStake,” “we,” “us,” or “our”), operator of the SlabStake platform and the website at slabstake.com (the “Service”), collects, uses, discloses, retains, and protects your personal information. SlabStake lets members deposit cryptocurrency, hold a US dollar cash balance, and buy fractional shares of PSA-graded trading cards that we acquire and hold in custody.

We are based in [Quebec, Canada]. We handle your personal information in accordance with Quebec’s Act respecting the protection of personal information in the private sector (as amended by Law 25) and Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA). Where we knowingly serve members in other jurisdictions, additional laws may apply to them, and we will comply with those that are applicable to us.

By creating an account or using the Service, you acknowledge that you have read and understood this Policy. If you do not agree with it, please do not use the Service.

2. Who is responsible for your information

The person accountable for our handling of personal information is our Privacy Officer. You can reach them at:

• Privacy Officer: [NAME]
• Email: [[email protected]]
• Mailing address: [STREET, CITY, PROVINCE, POSTAL CODE, COUNTRY]

3. Personal information we collect

We collect only what we need to run the Service, verify who you are as required by law, hold and move funds on your behalf, and keep the marketplace honest. Specifically:

a. Account & profile information

• Email address (your login identity and how we contact you).
• A password, which we never store in readable form — only a one-way cryptographic hash.
• A display name and a public pseudonymous account code (e.g. 0x1a2b…3c4d) shown to other members instead of your real name.
• An optional profile picture you choose to upload.
• Your display-currency preference.

b. Identity verification information (KYC)

Because we hold funds and shares on your behalf, we are required to confirm that each member is a real, unique adult. To trade or withdraw, you must provide:

• Your full legal name;
• Your date of birth (used to confirm you are at least 18);
• Your residential address.

We derive a one-way fingerprint from your name and date of birth so that the same person cannot verify two accounts. Depending on our legal obligations, identity verification may in future be performed by a third-party identity-verification provider, in which case that provider’s handling of any documents or images would be governed by their own privacy terms, which we would disclose to you at that time.

c. Financial & transaction information

• Your cash balance, which we maintain as an append-only ledger.
• Cryptocurrency deposits: the coin, the amount received, the corresponding US-dollar value at the time of deposit, and a payment reference from our payment processor.
• The permanent deposit address(es) generated for you for each supported coin.
• Withdrawals: the amount, the coin, and the destination wallet address you provide.
• Your holdings, share purchases and sales, listings, sale support, and payouts.

We do not collect or store your bank account numbers, full payment-card numbers, or the private keys to any cryptocurrency wallet. Cryptocurrency payments are processed by our third-party processor (see Section 6).

d. Technical & usage information

• Your IP address, which we use to apply security rate limits and detect abuse.
• A secure, http-only session cookie that keeps you signed in. We describe cookies in Section 9.
• Basic device and request information (such as browser type) sent automatically by your browser, and diagnostic error reports.

e. Marketing information

• If you join our waitlist or opt in to updates, the email address you provide for that purpose.

4. Why we use your information (purposes)

We use personal information for the following purposes:

• To provide the Service — create and secure your account, maintain your balance and holdings, execute deposits, share purchases and sales, and withdrawals.
• To verify identity and prevent fraud — confirm you are a real, unique adult; enforce our one-account rule; detect and prevent market manipulation, money laundering, and abuse.
• To meet legal and regulatory obligations — including record-keeping, and anti-money-laundering / know-your-customer requirements that may apply to us as a business that holds and moves funds.
• To communicate with you — send account, transaction, security, and support messages, and (only if you opt in) product updates.
• To keep the platform safe and reliable — security monitoring, debugging, and preventing service abuse.

We rely on your consent, on the necessity of processing to perform our contract with you, on our legitimate business interests (balanced against your rights), and on compliance with legal obligations, as the applicable bases for these uses.

5. When we disclose your information

We do not sell your personal information. We disclose it only in these circumstances:

• Service providers (processors) who perform functions on our behalf, under contract and only for the purposes we specify (see Section 6).
• Other members, in limited public form only — cap tables, holder lists, listings, and the public custody log show your pseudonymous account code, never your real name, email, or identity details.
• Legal and regulatory disclosure — where required by law, regulation, subpoena, court order, or lawful request, or to establish, exercise, or defend legal claims.
• Fraud prevention and safety — to protect the rights, property, or safety of SlabStake, our members, or others.
• Business transfers — in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy.

6. Third-party service providers

We rely on the following categories of providers. Each processes only the data needed for its function, and we share personal information with them only as necessary:

• Cryptocurrency payment & custody processor — processes your deposits and withdrawals and generates deposit addresses. It receives blockchain transaction data and the amounts involved.
• Cloud hosting & database providers — host the Service and store our data, including on servers that may be located in [Canada / the United States].
• Transactional email provider — delivers account, security, and (if opted-in) marketing emails; receives your email address.
• Error-monitoring provider — receives limited diagnostic information to help us fix problems.
• Content-delivery / network security provider — helps deliver the Service securely.

We use certain external sources — such as a marketplace listing API, a market-price data service, and the grading company’s public certificate registry — to source and value cards. When we query these, we send information about the card (for example a listing identifier or a certificate number), not your personal information.

Some providers may store or process information outside Quebec, including in the United States. Where personal information is transferred outside the province or the country, it may be subject to the laws of the destination jurisdiction, including lawful access by courts and government authorities. We take reasonable contractual and technical measures intended to give your information a comparable level of protection.

7. How long we keep your information

We keep personal information only as long as necessary for the purposes described in this Policy, or as required by law. Because we hold and move funds, some records — in particular identity-verification and transaction records — may need to be retained for a period of years after your account closes to satisfy legal, accounting, and anti-money-laundering obligations. When information is no longer needed and no legal obligation requires us to keep it, we securely delete or anonymize it.

8. How we protect your information

We use technical and organizational safeguards designed to protect your information, including: encryption of traffic in transit; one-way hashing of passwords; strict access controls and session-invalidation on password change or account suspension; append-only ledgers so balances cannot be silently altered; an audit log of privileged actions; rate limiting and abuse detection; and a principle of never exposing your real name or credentials to other members. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security. You are responsible for keeping your password confidential.

If a breach of security involving your personal information creates a risk of serious injury, we will notify you and the relevant authorities as required by applicable law.

9. Cookies and similar technologies

We use a small number of strictly necessary cookies — most importantly a secure, http-only session cookie that keeps you signed in and a cookie that remembers a pre-launch preview bypass. These are essential to the Service and cannot be switched off through the Service while you use it. We do not use third-party advertising or cross-site tracking cookies. You can block or delete cookies in your browser settings, but the Service may not function properly without the essential ones.

10. Your rights and choices

Subject to applicable law and to our legal obligations to retain certain records, you have the right to:

• Access the personal information we hold about you;
• Correct or update information that is inaccurate or incomplete;
• Withdraw consent to uses that rely on consent (this may limit or end your ability to use parts of the Service);
• Request deletion of your information, where we are not required to retain it;
• Data portability — receive certain computerized personal information you provided to us in a structured, commonly used technological format, where the law provides for it;
• Opt out of marketing emails at any time using the unsubscribe link or by contacting us; and
• Complain to a regulator (see Section 13).

To exercise any of these rights, contact our Privacy Officer at the address in Section 2. We may need to verify your identity before acting on a request, and we will respond within the timeframe required by applicable law.

11. Children and minors

The Service is intended only for individuals who are at least 18 years of age. We do not knowingly collect personal information from anyone under 18. Our identity verification is designed to prevent minors from trading or withdrawing. If we learn that we have collected information from a minor, we will delete it.

12. Automated decision-making & profiling

We use automated rules to help keep the marketplace honest — for example, rate limits, a one-account fingerprint check, and safeguards that ignore trades that fall outside expected price ranges. Decisions that materially affect your account, such as suspension or the outcome of identity verification, involve human review by our staff. You may contact us to ask about, or to contest, such a decision.

13. How to make a complaint

If you have a concern about how we handle your personal information, please contact our Privacy Officer first so we can try to resolve it. You also have the right to complain to:

• the Commission d’accès à l’information du Québec (for members in Quebec); and/or
• the Office of the Privacy Commissioner of Canada.

14. Changes to this Policy

We may update this Policy from time to time. When we make material changes, we will update the “Last updated” date and, where appropriate, notify you by email or through the Service. Your continued use of the Service after a change takes effect means you accept the updated Policy.

15. Contact us

Questions about this Policy or your personal information? Contact our Privacy Officer at [[email protected]], or by mail at the address in Section 2.

This Privacy Policy is provided for general information and does not constitute legal advice. Nothing on SlabStake is investment advice. See also our Terms of Service.