Soltar Corporation Privacy Policy

1. Scope of This Policy

1.1 Who This Policy Covers. This Policy applies to personal data we collect from (a) merchant Clients and their authorized representatives, officers, and ultimate beneficial owners ("Client Personnel"); (b) a Client's end-customers who use the Platform to purchase or transfer Stablecoins ("End-Customers"); and (c) visitors to our websites and platform interfaces. It does not apply to data processed solely by our Ramp Partners, Acquirers, Payment Service Providers, or Digital Asset Liquidity Providers under their own privacy policies, which govern their independent processing activities.

1.2 Relationship to Other Agreements. This Policy supplements, and should be read together with, the Embedded Payment Facilitation, Non-Custodial Crypto Settlement & Sub-Merchant Terms and the Terms of Service & Click-Through Agreement. In the event of a direct conflict between this Policy and those agreements regarding the processing of personal data, this Policy shall govern.

2. Information We Collect

2.1 Client & Business Information. When a Client onboards to the Platform, we collect corporate registration documents, business licenses, beneficial ownership information, authorized signatory identification, banking and settlement account details, and related compliance documentation.

2.2 End-Customer Identity Information. In connection with our KYC, AML, CFT, and sanctions screening obligations, we and our Ramp Partners collect End-Customer identity information, which may include full legal name, date of birth, government-issued identification numbers, residential address, nationality, and, where required for enhanced due diligence, source-of-funds documentation.

2.3 Transaction & Financial Data. We collect records of payment transactions, card and electronic payment metadata (processed primarily by our PSP and Acquirer partners), transaction amounts, timestamps, currency conversion details, fee calculations, and chargeback or dispute records.

2.4 Digital Wallet & Blockchain Data. We collect wallet addresses, wallet verification results, and on-chain transaction identifiers. Once a Stablecoin transaction is broadcast to the applicable blockchain network, associated wallet addresses and transaction data become part of a public, distributed ledger outside our control (see Section 7).

2.5 Technical & Device Data. We automatically collect IP addresses, device identifiers, browser type, operating system, log data, and similar technical information when you access our Platform, APIs, or websites.

2.6 Compliance & Risk Data. We generate and retain sanctions screening results, fraud and risk scores, rolling reserve calculations, and audit logs of consent and acceptance events, including clickwrap acceptance records.

3. How We Use Your Information

We use personal data to: (a) verify identity and conduct KYC, AML, CFT, sanctions, and UBO screening; (b) facilitate payment processing, Stablecoin conversion, and settlement; (c) calculate, deduct, and reconcile applicable fees; (d) detect, investigate, and prevent fraud and unauthorized activity; (e) administer chargebacks, disputes, offsets, and rolling reserves; (f) comply with legal, regulatory, and law enforcement obligations, including reporting to Costa Rican and international authorities; (g) provide customer support and respond to inquiries; (h) maintain, secure, and improve the Platform; and (i) enforce our agreements.

4. Legal Basis for Processing

Under Law No. 8968 (Ley de Protección de la Persona Frente al Tratamiento de sus Datos Personales), we process personal data on the basis of: your documented consent; the necessity of processing to perform our contract with you; compliance with a legal obligation (including KYC/AML/sanctions laws); or our legitimate interest in operating a secure payment platform, provided such interest does not override your fundamental rights. Where the data protection law of another jurisdiction applies to you, for example, because you or your End-Customers are located outside Costa Rica, we process personal data on the legal bases recognized under such laws.

5. How We Share Your Information

5.1 Payment & Liquidity Partners. We share personal data with our licensed Acquirers, Payment Service Providers, Digital Asset Liquidity Providers, and other Ramp Partners as necessary to execute fiat-to-Stablecoin conversions, process payments, and route settlements.

5.2 Banking & Compliance Intermediaries. We share verified identity records, KYC/AML validation status, transaction histories, and wallet metadata with banking intermediaries and compliance partners as necessary to facilitate fiat settlement, prevent fraud, and satisfy compliance obligations, consistent with the cross-border data sharing authorization described in our Terms of Service.

5.3 Regulators & Authorities. We disclose personal data to PRODHAB, SUGEF, tax authorities, courts, law enforcement, and other competent authorities in Costa Rica and other jurisdictions where required by law, court order, or regulatory directive, including sanctions screening obligations under OFAC and equivalent UN, EU, and UK regimes.

5.4 Service Providers. We share data with vendors who provide hosting, cloud infrastructure, identity verification, analytics, and customer support services on our behalf, under contractual confidentiality and security obligations.

5.5 Business Transfers. We may disclose personal data in connection with a merger, acquisition, financing, or sale of assets, subject to appropriate confidentiality protections.

5.6 No Sale of Personal Data. We do not sell personal data to third parties for their own independent marketing purposes.

6. International Data Transfers

Because our Ramp Partners, Liquidity Providers, and service providers may be located outside Costa Rica, personal data may be transferred internationally. Where we transfer personal data to a jurisdiction that has not been determined to provide an adequate level of protection, we rely on your express consent, the necessity of the transfer to perform our contract with you, or other legally recognized transfer mechanisms.

7. Blockchain & Public Ledger Data — Important Limitation

Stablecoin transactions are recorded on public, decentralized blockchain networks that Soltar does not own, control, or operate. Once broadcast, wallet addresses and associated transaction data are permanently and publicly viewable and cannot be deleted, modified, or withdrawn, including in response to a request for erasure. By using the Platform, you acknowledge this technical limitation and that Soltar's ability to honor deletion or rectification requests does not extend to data recorded on public blockchain networks.

8. Data Retention

We retain personal data for as long as necessary to fulfill the purposes described in this Policy, including the duration of your relationship with us and any additional period required to comply with KYC/AML recordkeeping obligations, tax laws, statute-of-limitations periods, or dispute resolution needs. Compliance-related records (including KYC files and sanctions screening results) are retained for a minimum of five years following the end of the relevant relationship, or such longer period as applicable law requires.

9. Data Security

We maintain administrative, technical, and physical safeguards designed to protect personal data against unauthorized access, disclosure, alteration, or destruction, including encryption of sensitive data in transit and at rest, access controls, and audit logging. No system is completely secure, and we cannot guarantee absolute security.

10. Your Privacy Rights

10.1 Costa Rica ARCO Rights. If Law No. 8968 applies to your personal data, you have the right to Access the personal data we hold about you, request Rectification of inaccurate or incomplete data, request Cancellation (deletion) of data that is no longer necessary or unlawfully processed, and Oppose certain processing activities, subject to the limitations described in Section 7 and Section 11. We will respond to verified requests within five business days, as required by Costa Rican law.

10.2 Other Jurisdictions. If you are located in the European Economic Area, the United Kingdom, California, or another jurisdiction that grants additional data protection rights, you may have further rights available to you under applicable law, such as data portability or the right to restrict processing. Contact us using the information in Section 18 to exercise these rights, and we will respond in accordance with applicable law.

10.3 Verification. To protect your data, we may need to verify your identity before fulfilling a rights request.

11. Regulatory Disclosure Overrides

Where a request to delete, restrict, or object to processing would conflict with our legal obligations including ongoing KYC/AML recordkeeping, sanctions screening, tax reporting, or an active regulatory inquiry, we will retain and process the minimum data necessary to satisfy that obligation and will inform you of the basis for doing so to the extent permitted by law.

12. Cookies & Tracking Technologies

Our websites and Platform interfaces may use cookies and similar technologies to authenticate sessions, remember preferences, and analyze usage. You can control cookies through your browser settings; disabling certain cookies may limit Platform functionality.

13. Children's Privacy

The Platform is not directed to, and we do not knowingly collect personal data from, individuals under 18 years of age. If we learn that we have collected personal data from a minor, we will take steps to delete it.

14. Third-Party Links & Services

The Platform may reference or link to services operated by Ramp Partners or other third parties. Their collection and use of personal data is governed by their own privacy policies, and Soltar is not responsible for their practices.

15. Regulatory Registration Status

Soltar Corporation is incorporated under the laws of the Republic of Costa Rica and processes personal data in accordance with Law No. 8968 and its implementing regulations. Certain databases maintained by SUGEF-regulated financial entities may qualify for exemption from registration with PRODHAB (the Agencia de Protección de Datos de los Habitantes); Soltar's current registration and exemption status is available upon written request.

16. Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices or applicable law. We will post the revised Policy with an updated effective date and, where required by law, provide additional notice.

17. Governing Law

This Policy is governed by the laws of the Republic of Costa Rica, without regard to conflict-of-law principles, and without prejudice to any mandatory data protection rights you may hold under the law of your place of residence.

18. Contact Us

If you have questions about this Policy or wish to exercise your privacy rights, please contact us at:

Soltar Corporation
Email: Support@SoltarX.com
Attn: Data Protection Contact