Privacy Policy

Document Version: All-PP-v1.0.0 / Legal Pack Version: ALL-LP-v1.0.0

Effective Date: 26 October 2026 | Last Updated: 26 October 2026

This Privacy Policy ("Policy") describes how All360 Technology S.A., incorporated under the laws of the Republic of Panama ("ALL", "we", "us", or "our"), collects, uses, discloses, transfers, stores, and protects Personal Data in connection with the ALL.IS.ONE Platform, website, dashboards, App Store, ALL360 Devices, ALL360 OS, Control Tower, payment and payout interfaces, referral program, Proxy Services, and related products and services (collectively, the "Platform").

This Policy is intended to provide privacy and data protection disclosures required or permitted under applicable law. To the extent this Policy is incorporated by reference into the ALL Terms of Use or another agreement, it forms part of that agreement only for the purpose of describing ALL's data practices and privacy-related rights and obligations.

This Policy does not create warranties, service commitments, data-retention guarantees, fiduciary duties, or contractual rights beyond those expressly required by applicable law or expressly agreed in the ALL Terms of Use, Proxy Services Agreement, Service Order, Data Processing Agreement, data-sharing terms, or applicable jurisdiction-specific supplement. If a specific agreement, Data Processing Agreement, Service Order, jurisdiction-specific supplement, or mandatory law imposes different or additional requirements for a particular processing activity, that document or mandatory law governs that processing activity to the extent of the inconsistency.

ALL may provide additional privacy notices, just-in-time notices, dashboard disclosures, consent screens, onboarding notices, feature-specific notices, regional supplements, or enterprise privacy terms for particular features, roles, jurisdictions, payment methods, Apps, Network Services, or processing activities. Those notices supplement this Policy for the relevant processing activity and prevail to the extent they are more specific, subject to mandatory law.

This Policy should be read together with the ALL Terms of Use, the Acceptable Use Policy, the Cookie Policy, the applicable role-specific addenda, and any Data Processing Agreement or data-sharing terms.

At a Glance

This summary is provided for convenience only. The full Policy below governs. Where there is any conflict, the full Policy controls.

1. Definitions

For purposes of this Policy:

"Personal Data" means any information relating to, associated with, or reasonably linkable to an identified or identifiable natural person, including personal information, personally identifiable information, and analogous concepts under applicable law.

"Platform Data" means operational, usage, telemetry, metering, billing, security, account, support, compliance, and analytics data generated through or in connection with the Platform.

"Traffic Content" means the substance of communications, payload data, files, Customer workload content, or other end-to-end content transmitted or processed through Nodes or Apps, excluding technical metadata and operational records.

"Session ID" means the unique identifier assigned to a network session to support log correlation, compliance, audit, dispute resolution, and abuse response between ALL and Proxy Companies.

"End Customer" means any person or entity that obtains access to Network Services through a Proxy Company or other Business Customer, and has no direct contract with ALL unless separately onboarded.

"Group Companies" means ALL and any entity that directly or indirectly controls, is controlled by, or is under common control with ALL.

Capitalised terms not defined in this Policy have the meaning given to them in the ALL Terms of Use or the applicable Proxy Services Agreement.

2. Data Controller, Processor, and Role Allocation

2.1 ALL as Controller

All360 Technology S.A., Republic of Panama, is the controller responsible for Personal Data processed for account management, Platform operation, KYC/KYB, security, fraud prevention, compliance, billing, payout administration, referral administration, marketing, support, legal claims, and other purposes described in this Policy, unless a different role is stated in an applicable agreement or jurisdiction-specific supplement.

For the sale of ALL360 Devices and ALL360 OS licences, Allecosystem Technologies LLC, a company incorporated in the United Arab Emirates, acts as seller and as an independent controller of order, payment, shipping, invoicing, return, refund, and warranty data, which it processes in accordance with this Policy. Requests concerning such data may be sent to [email protected].

2.2 ALL as Processor or Service Provider

Where ALL processes Personal Data on behalf of a Business Customer, Proxy Company, Developer, or another controller, ALL acts as processor, sub-processor, or service provider only to the extent stated in a Data Processing Agreement, data-sharing arrangement, Service Order, or other written terms agreed between the parties. Where ALL processes Personal Data under the documented instructions of another controller, the applicable Data Processing Agreement, data-sharing arrangement, Service Order, or other written terms will govern that processing. ALL may process Personal Data independently where necessary for account creation, onboarding, KYB/KYC, security, fraud prevention, legal compliance, billing, support, enforcement, or legal claims.

2.3 Independent Controllers

Developers are generally independent controllers for Personal Data collected by or through their Apps. Proxy Companies are independently responsible for Personal Data they collect from or about End Customers, including notices, consent, lawful basis, retention, data subject rights, and downstream compliance. Payment processors, KYC/KYB providers, blockchain analytics providers, VASPs, and other regulated providers may act as independent controllers for their own legal and regulatory obligations.

2.4 Group Companies and Authorised Partners

Group Companies, affiliates, contractors, service providers, and Authorised Partners may support Platform operations, device distribution, onboarding, compliance, support, billing, payout, infrastructure, or local partner-management functions. They process Personal Data as processors, independent controllers, or joint controllers depending on the relevant activity and applicable law.

2.5 Privacy Contact

Privacy contact: [email protected]

Data Protection Officer: [email protected]

EU Representative: where appointed, details will be published in this Policy

UK Representative: where appointed, details will be published in this Policy

3. Who This Policy Applies to

This Policy applies to all individuals and entities who interact with ALL or the Platform in any capacity, including:

Visitors: persons who access the ALL.IS.ONE website, marketing pages, or related digital properties without creating an account.

Node Operators: individuals or entities who operate ALL360 Devices as Nodes, contributing Network Resources to the distributed network under the Node Operator Addendum.

Customers: users who deploy or use Apps on the Platform for their own operations under the Customer Addendum.

Business Customers: entity users who access edge network services, including proxy routing, bandwidth, compute, storage, AI, and related services, through ALL's B2B onboarding process.

Proxy Companies: B2B entities that access Network Services through the Platform and make them available to their own End Customers under a separate Proxy Services Agreement with ALL.

Developers: individuals or entities that register a developer account or publish applications through the ALL App Store under the Developer Addendum.

Affiliates: users who opt in to ALL's referral program under the Affiliate Addendum.

Authorised Partners: resellers, white-label partners, distributors, and other entities that supply, distribute, support, or locally manage ALL360 Devices or Platform access under a separate partner agreement.

ALL has no direct contractual relationship with End Customers of Proxy Companies or Business Customers. Proxy Companies and Business Customers are independently responsible for their End Customers' Personal Data. Section 9 of this Policy describes how ALL handles limited technical metadata that may relate to End Customers.

4. Personal Data We Collect

The categories below describe Personal Data that ALL may collect. The exact categories depend on your role, jurisdiction, enabled features, payment methods, and applicable contractual arrangements.

4.1 Information You Provide Directly

Account and identity: full name, email address, phone number, hashed password, country of residence, language and communication preferences, role selection (Node Operator, Developer, Customer, Affiliate), username or display name, and profile settings.

Business entity information: legal entity name, registration number, registered address, jurisdiction of incorporation, business description, authorised signatory details, and VAT or tax identification number (for entity accounts, Business Customers, and Proxy Companies).

KYC / KYB verification: government-issued identification documents (passport, national ID, driver's licence), proof of address, facial verification and liveness detection data, date and place of birth, nationality, tax residency, beneficial ownership information (UBO disclosure), entity registration documents, authorised signatory details, sanctions screening results, PEP screening results, source of funds declarations, use-case declarations, and enhanced due diligence records where required.

Payment, wallet, and financial: blockchain wallet addresses (for stablecoin deposits and withdrawals), Wallet Balance transaction history, payment method details (where applicable), billing and invoicing information, payout preferences and withdrawal instructions, settlement records, and gas fee records. Blockchain transactions are recorded on public, immutable ledgers and cannot be deleted or modified by ALL.

Device purchase and shipping: shipping name and address, billing address, order details and purchase history, and delivery tracking information.

Communications and support: email correspondence, chat transcripts, support ticket content, feedback, survey responses, testimonials, bug reports, feature requests, and any other information you choose to provide to ALL.

4.2 Information Collected Automatically

Platform and Control Tower telemetry: Node enrollment status, online/offline status, and uptime metrics; aggregate resource utilisation (total CPU time, aggregate bandwidth, aggregate RAM/disk); App installation state and lifecycle events; job allocation events, deployment status, and orchestration signals; billing and metering data (usage totals, charges assessed, payouts calculated); compliance and enforcement logs (account suspensions, KYC status changes, policy violations); and aggregate network performance metrics. The Control Tower does not routinely capture, store, or inspect end-to-end Traffic Content, packet-level data, or Customer workload content.

Session IDs and correlation data: unique identifiers assigned to each network session for log correlation between ALL and Proxy Companies. Session IDs and full correlation data are maintained exclusively off-chain. Only cryptographic hashes or integrity proofs may be recorded on-chain.

Website and application usage: IP address, approximate geographic location derived from IP, browser type and version, operating system, device type, referring URL, pages viewed, features accessed, click-stream data and navigation paths, session identifiers, authentication tokens, and error logs.

Device diagnostic data: where downloaded from ALL360 Devices, diagnostic data relates to device health, operating system and application lifecycle events, uptime metrics, and operational performance indicators. Diagnostic data does not include packet-level inspection, payload capture, or end-to-end traffic content.

Geolocation: approximate geographic location derived from IP address, used for Node location assignment, Customer deployment preferences, fraud detection, sanctions screening, and compliance with geographic restrictions. IP-based geolocation is approximate and may not reflect the actual physical location or legal jurisdiction of a device or user.

Cookies and tracking technologies: see the Cookie Policy and Section 12 of this Policy.

4.3 Role-Specific Information

Node Operators: ALL360 Device serial number and hardware identifiers; Node enrollment status, configuration, and service category opt-in status; ISP information; cross-border movement notifications; ISP complaint or legal notice reports; and incident reports as required under the Node Operator Addendum.

Proxy Companies and Business Customers: KYB application records (UBO disclosure, sanctions screening, use-case declaration); Service Order parameters; BAR metadata (pseudonymous Account identifier or Wallet address, timestamp, document hash, transaction hash); Session ID correlation data maintained off-chain; usage records; billing records; compliance correspondence; and designated collection recipient instructions.

Developers: App name, description, category, and metadata; App privacy policy URL and terms of use; App binaries, code signatures, and security scan results; pricing and revenue share settings; developer contact and support information; and promotional materials, logos, and imagery.

Customers: App deployment preferences (Node location, resource specifications); usage and deployment logs; Wallet Balance top-up and spending history; and billing disputes and support ticket history.

Affiliates: unique referral link and code; referral attribution data (clicks, sign-ups, qualifying revenue); commission earnings and payout history; and marketing channel and promotional method disclosures. Attribution windows and tracking parameters are described in the Referral Commission Plan and Platform interface.

4.4 Information from Third Parties

• KYC/KYB and identity verification providers: verification results, identity validation, facial verification, sanctions and PEP screening, fraud indicators, and enhanced due diligence reports.
• Payment processors, banks, card networks, PSPs, VASPs, stablecoin providers, and payment compliance providers: transaction confirmation, fraud signals, chargeback and dispute information.
• Blockchain analytics providers and public blockchain explorers: wallet address screening, risk indicators, sanctions associations, and on-chain transaction data for AML/CTF compliance.
• Business registries, company registries, tax registries, sanctions lists, and other public or commercially available sources used for entity verification and compliance.
• Developers, Business Customers, Proxy Companies, Authorised Partners, referral partners, resellers, and service providers: where they provide data to operate, protect, support, or enforce the Platform.
• Law enforcement, regulators, courts, complainants, ISPs, network operators, rights holders, and other third parties who submit abuse reports, legal notices, or security information.

4.5 Information About Others

If you provide Personal Data about another person or entity representative — including beneficial owners, directors, officers, authorised signatories, employees, contractors, technical contacts, billing contacts, End Customer contacts, referral contacts, UBOs, or other third parties — you represent that you have the authority or other lawful basis required to provide that Personal Data to ALL and that you have provided any notice, obtained any consent, and satisfied any other legal requirement applicable to that disclosure under applicable law.

You are responsible for the accuracy and lawfulness of any Personal Data about others that you submit to ALL. ALL may process that Personal Data for the purposes described in this Policy, including onboarding, KYB/KYC, compliance, fraud prevention, support, billing, enforcement, dispute resolution, and legal claims.

4.6 Derived Data, Inferences, and Risk Signals

ALL may generate derived data, inferences, classifications, scores, and risk signals from Personal Data and Platform Data, including account risk scores, device reputation signals, Node eligibility signals, wallet risk indicators, sanctions and AML risk indicators, fraud and abuse indicators, use-case risk classifications, jurisdictional availability signals, referral attribution and abuse indicators, payout risk flags, App review signals, and support or enforcement history.

ALL uses these signals to operate, secure, improve, monitor, and enforce the Platform, including to determine feature availability, job allocation eligibility, use-case approval, Service Order configuration, payment or payout review, account restrictions, Node suspension, App review outcomes, referral attribution, fraud prevention, compliance actions, and legal or regulatory risk management.

ALL may use Personal Data and Platform Data to develop, test, monitor, improve, and validate automated systems, analytics models, fraud-prevention tools, allocation systems, risk models, security tools, and AI-assisted systems, subject to applicable law and the restrictions described in this Policy. ALL does not use government ID documents, biometric verification templates, KYC/KYB files, source-of-funds declarations, sanctions results, or sensitive compliance records for unrelated targeted advertising.

4.7 Sensitive Personal Data and Verification Data

ALL may process sensitive Personal Data, special category data, biometric-related verification data, government identification data, sanctions and PEP screening data, source-of-funds information, wallet risk information, and other compliance-sensitive information only where necessary or permitted for identity verification, KYB/KYC, AML/CTF compliance, sanctions screening, fraud prevention, payment and payout security, account integrity, legal compliance, dispute resolution, enforcement, or legal claims.

ALL does not use government identification documents, facial verification templates, biometric-related verification data, KYC/KYB files, source-of-funds declarations, sanctions screening results, PEP screening results, or sensitive compliance records for unrelated targeted advertising or general marketing.

Where such processing is required for legal, regulatory, fraud-prevention, payout, security, or Platform-integrity purposes, ALL may retain and process the relevant data even after account closure or withdrawal of consent, to the extent permitted or required by applicable law.

4.8 Data We Do Not Intentionally Collect

The Platform is not designed to routinely capture, store, or inspect end-to-end Traffic Content, packet payloads, Customer workload content, or the substantive content of communications transmitted through Nodes. Node Operators are contractually prohibited from inspecting or capturing traffic. ALL may process limited content only if: (a) you submit it to support, legal, compliance, security, or dispute channels; (b) transient processing is technically necessary to route traffic or operate the Platform; or (c) processing is required by applicable law, court order, regulatory request, or valid legal process.

5. Node Operator Network Participation and Public IP Visibility

Where you participate as a Node Operator, or otherwise enable network-based Service Categories such as proxy, VPN, bandwidth, routing, or similar services, your ALL360 Device, internet connection, local network, bandwidth, and public IP address may be used to route authorised third-party traffic through the ALL Platform.

In this context, your public IP address may be visible to third-party websites, online services, network operators, security providers, abuse-reporting systems, internet service providers, or authorities, and may appear in access logs, connection logs, abuse reports, ISP notices, legal notices, law-enforcement requests, or similar records.

The Platform is not designed to access your personal files, private browsing history, local device content, or private communications. ALL does not routinely inspect, store, or analyse Traffic Content except to the limited extent described in this Policy, the Terms of Use, the Acceptable Use Policy, and applicable law.

6. How We Use Personal Data

6.1 Platform Operation and Contract Performance

• Create, maintain, and manage user accounts and roles.
• Enroll and manage ALL360 Devices as Nodes; orchestrate job allocation and workload distribution.
• Facilitate App publishing, submission review, deployment, and distribution through the App Store.
• Process Wallet Balance deposits, usage charges, withdrawals, payouts, commissions, and settlement records.
• Manage Proxy Company and Business Customer onboarding: KYB verification, use-case approval, Service Order generation, and BAR recording.
• Assign and maintain Session IDs for Proxy Company log correlation, compliance, audit, and dispute resolution.
• Manage designated collection recipient instructions and affiliated payment routing.
• Provide customer support, respond to inquiries, and manage disputes.
• Deliver platform updates, maintenance notifications, and service communications.

6.2 Legal and Regulatory Compliance

• Conduct KYC/KYB verification and ongoing identity monitoring.
• Perform AML, CTF, and sanctions screening at onboarding and on an ongoing basis.
• Comply with export controls, trade restrictions, and applicable financial regulations.
• Respond to legal process, court orders, subpoenas, regulatory inquiries, and law enforcement requests.
• Detect, prevent, investigate, and report fraud, money laundering, terrorist financing, and other illegal activity.
• Maintain compliance logs, enforcement records, and audit trails.

6.3 Security and Platform Integrity

• Monitor for security incidents, unauthorised access, tampering, and malicious activity.
• Detect and prevent fraudulent accounts, duplicate registrations, gaming behavior, and Terms violations.
• Perform malware scanning and security review of submitted Apps.
• Enforce the Terms of Use, Acceptable Use Policy, Proxy Services Agreement, and other policies.
• Suspend, disable, or terminate accounts, Nodes, or App listings for policy violations.

6.4 Analytics and Product Improvement

• Analyse usage patterns, performance metrics, and user behavior to improve the Platform.
• Test new features, functionality, and network optimisation algorithms.
• Conduct research and data science projects using aggregated or de-identified data.

6.5 Marketing and Communication

• Send promotional emails, newsletters, and product announcements where permitted by law or with your consent.
• Display Developer names, logos, and App listings in the marketplace and marketing materials.
• Process referral program participation and track Affiliate attributions.
• Conduct surveys, solicit feedback, and request testimonials.

6.6 Dispute Resolution and Legal Claims

• Investigate and respond to user complaints, billing disputes, chargeback claims, and payout withholding decisions.
• Enforce intellectual property rights and respond to infringement notices.
• Defend against legal claims and protect ALL's rights, property, and interests.

7. Automated Processing and Algorithmic Systems

ALL uses automated systems, rules-based logic, analytics, and risk models to operate the Platform. These systems may assist with:

• Matching Customers, Apps, jobs, and Network Resources based on availability, service category, location, performance, risk signals, Wallet Balance, and technical requirements.
• Calculating usage, billing, fees, payouts, commissions, and settlement records based on Control Tower records, Service Orders, Wallet Balance, Smart Contract outputs, and Platform telemetry.
• Detecting fraud, abuse, duplicate accounts, bot activity, referral manipulation, chargeback risk, sanctions exposure, wallet risk, App vulnerabilities, and prohibited use.
• Generating account risk scores, device reputation signals, Node eligibility scores, wallet risk indicators, payout risk flags, use-case risk classifications, referral abuse indicators, App trust signals, and jurisdiction risk indicators, as described in Section 4.6.
• Determining Node eligibility, service-category availability, App listing status, country availability, use-case approval, and payout holds, based in part on derived data and risk signals.
• Conducting KYC/KYB, facial verification, sanctions screening, AML/CTF screening, wallet screening, and risk scoring through third-party providers.
• Personalising dashboard experience, language, country availability, content, onboarding flow, and support.
• Restricting or suspending account features, payout eligibility, Node job allocation, App listing status, or referral attribution where automated monitoring detects risk, policy violations, or anomalous behavior.

Automated processes may affect whether a feature is available, whether a Node receives jobs, whether a transaction is held for review, whether an App is approved or suspended, whether a referral is attributed, or whether a payout is delayed or withheld. Where applicable law gives you the right to human review, explanation, contestation, or intervention for a decision based solely on automated processing that produces legal or similarly significant effects, you may request review through the support process or by contacting [email protected].

8. How We Disclose Personal Data

We do not sell Personal Data for money. Where certain US state laws treat targeted advertising or cross-context behavioural advertising as a "sale", "sharing", or equivalent disclosure, we provide opt-out controls where required by law. We disclose Personal Data as described below.

8.1 Service Providers and Processors

We engage third-party service providers under data processing agreements or equivalent terms to process Personal Data on our behalf. These service providers operate in the following categories, among others:

• KYC and identity verification providers: identity document verification, facial recognition, liveness detection, and sanctions and PEP screening.
• Blockchain analytics and compliance providers: wallet address screening, on-chain activity analysis, and AML/CTF compliance.
• Payment processors, PSPs, VASPs, stablecoin settlement providers, and banking partners: deposit and withdrawal processing, stablecoin settlement, payout execution, and fraud signals.
• Cloud hosting and infrastructure providers: data storage, Control Tower hosting, and Platform infrastructure.
• Email, SMS, and communication providers: transactional and marketing communications.
• Customer support platforms: support ticket management, live chat, and incident tracking.
• Analytics providers: usage and performance data under the Cookie Policy.
• Security, fraud detection, and threat intelligence providers: monitoring for malicious activity, vulnerability scanning, and intrusion detection.

ALL may maintain and publish a Subprocessor List identifying material service-provider categories and, where appropriate, specific providers. The Subprocessor List may be updated from time to time as providers are added, replaced, removed, or reclassified. Unless a Data Processing Agreement, mandatory law, or applicable enterprise agreement requires prior notice or objection rights, ALL may update providers without individual notice, provided that appropriate data protection, confidentiality, and security safeguards are maintained. KYC/KYB providers may act as independent controllers for their own regulatory compliance screening in addition to acting as our processors.

8.2 Group Companies and Authorised Partners

We may share Personal Data with Group Companies and Authorised Partners for Platform operation, device distribution, onboarding, compliance support, billing, payout, local support, and partner management, subject to applicable data protection requirements. Group Companies and Authorised Partners process data as processors under ALL's instructions, independent controllers, or joint controllers depending on the activity and applicable law.

8.3 Proxy Company Session Data and End Customer-Related Metadata

ALL may disclose Session ID correlation data, usage records, billing records, abuse indicators, anomaly flags, technical metadata, API records, and other operational records to Proxy Companies and Business Customers where necessary to provide the Network Services, support compliance, investigate abuse, verify usage, resolve disputes, process billing, respond to legal requests, or enforce the Proxy Services Agreement or applicable Service Order.

ALL does not intentionally provide Proxy Companies or Business Customers with independent End Customer identity data unless that data was submitted by the Proxy Company or Business Customer, generated through their own Account or Service Order, required for support, abuse response, legal compliance, dispute resolution, or otherwise permitted by applicable law and applicable data processing terms.

Depending on context, Session IDs, usage records, IP-derived metadata, timestamps, Node or region identifiers, bandwidth consumption, and abuse or anomaly records may constitute Personal Data if they can be linked to an identified or identifiable person by ALL, the Proxy Company, the Business Customer, or another party.

8.4 Business Transfers

If ALL is involved in a merger, acquisition, financing, corporate reorganisation, sale of assets, transfer of business, insolvency, bankruptcy, or similar transaction, Personal Data may be disclosed to or transferred to the relevant buyer, successor, affiliate, adviser, investor, or transaction participant, subject to appropriate confidentiality and data protection safeguards where required by law. Where required by applicable law, ALL will notify affected users of a material change in controller or data practices.

8.5 Legal Obligations and Law Enforcement

We may disclose Personal Data to competent authorities, law enforcement agencies, regulators, courts, or other third parties when: (a) required by applicable law, legal process, subpoena, court order, or government request; (b) necessary to comply with AML, CTF, sanctions, export control, or other regulatory obligations; (c) necessary to detect, prevent, or investigate fraud, security incidents, or illegal activity; or (d) necessary to protect the rights, property, safety, or security of ALL, our users, or the public. ALL's ability to disclose information to law enforcement is limited to data stored in or accessible through the ALL Control Tower. ALL does not routinely capture or retain end-to-end Traffic Content or data processed by Apps running on Nodes. To the extent Traffic Content or Customer workload content is not collected, retained, or accessible by ALL in the ordinary operation of the Platform, ALL will not be able to provide such content in response to a request. Where ALL lawfully holds limited content because it was submitted to support, compliance, dispute, abuse-response, or legal channels, ALL may process or disclose it as required or permitted by applicable law.

Where legally permitted and operationally appropriate, ALL may notify affected users of legal or regulatory requests. ALL will not provide notice where prohibited by law, court order, regulatory instruction, law-enforcement request, confidentiality obligation, or where ALL reasonably believes that notice could compromise fraud prevention, security, sanctions compliance, AML/KYC compliance, law enforcement, regulatory compliance, user safety, payment recovery, or an ongoing investigation.

8.6 Marketing, Analytics, and Advertising Partners

We may share limited data with analytics providers, advertising networks, and referral attribution partners as described in the Cookie Policy and, where maintained, in the Subprocessor List. Where applicable law treats such sharing as a "sale" or "sharing" of Personal Data for targeted advertising, we provide opt-out controls as described in Section 12, Section 17 and the Cookie Policy. We do not use KYC/KYB records, government IDs, biometric data, or sensitive compliance data for advertising.

8.7 With Your Consent or at Your Direction

We may share Personal Data with third parties when you explicitly consent or direct us to do so.

8.8 Use and Commercialisation of Aggregated and De-Identified Data

ALL may create, use, retain, disclose, share, commercialise, and otherwise process aggregated, anonymised, or de-identified data and insights derived from Personal Data and Platform Data for analytics, research, product development, security, fraud prevention, network optimisation, pricing, capacity planning, benchmarking, commercial reporting, investor reporting, and other lawful business purposes.

Where data has been anonymised or de-identified so that it no longer identifies or is reasonably linkable to an individual under applicable law, it is not treated as Personal Data and may be used without restriction under this Policy.

ALL will not attempt to re-identify anonymised or de-identified data except where permitted by law for security, fraud prevention, legal compliance, or validation of de-identification controls.

9. Proxy Companies, Business Customers, and End Customers

Proxy Companies and Business Customers may make ALL Network Services available to their own End Customers under separate agreements. ALL generally does not have a direct contractual relationship with those End Customers unless they are separately onboarded by ALL.

Proxy Companies and Business Customers acknowledge that Network Services may involve the routing of authorised End Customer traffic through distributed Nodes, including ALL360 Devices and internet connections operated by Node Operators. In such cases, the public IP address associated with the relevant Node may be visible to third-party websites, online services, network operators, security providers, abuse-reporting systems, internet service providers (ISPs), authorities, or other external parties as part of normal internet routing and logging.

Proxy Companies and Business Customers are responsible for ensuring that their End Customers receive appropriate notice that Network Services may involve routing through distributed network resources, including public IP addresses associated with participating Nodes, where required by applicable law.

The Proxy Company or Business Customer is responsible for: providing appropriate privacy notices to End Customers; obtaining any required consents; establishing a lawful basis for processing; maintaining downstream records; handling End Customer rights requests; and ensuring its use of Network Services complies with applicable law.

ALL may process limited End Customer-related technical metadata generated through the Platform or supplied by the Proxy Company or Business Customer. This may include Session IDs, timestamps, region or Node identifiers, bandwidth consumed, session status, abuse or anomaly flags, billing metrics, API metadata, and other operational or correlation records. Depending on context and applicable law, this information may constitute Personal Data if it can be linked to an identified or identifiable person by ALL, the Proxy Company, Business Customer, or another party.

ALL does not intentionally inspect or retain End Customer Traffic Content, except for: (a) transient technical processing strictly necessary to route traffic or operate the Network Services; (b) information provided to ALL for support, abuse response, dispute resolution, compliance, or legal purposes; or (c) processing required by applicable law or valid legal process.

Where ALL processes Personal Data under the documented instructions of a Proxy Company, Business Customer, Developer, or other controller, the applicable Data Processing Agreement, data-sharing arrangement, Service Order, or other written terms will govern that processing. ALL may also process Personal Data independently where necessary for account creation, onboarding, KYB/KYC, security, fraud prevention, legal compliance, billing, support, abuse response, enforcement, dispute resolution, or legal claims. Where the parties act as independent controllers or joint controllers, appropriate data-sharing or joint-controller terms must be used where required by applicable law.

10. Blockchain Records and On-chain Data

Limited on-chain data: On-chain records contain only pseudonymous Account identifiers or Wallet addresses, timestamps, transaction hashes, document or version hashes, Smart Contract events, settlement data, and other limited metadata strictly necessary for Platform operation or verification.

Off-chain records: Full document content, identity documents, KYC/KYB records, Session content, Confidential Information, support files, and detailed compliance files are maintained off-chain.

Pseudonymisation: Pseudonymous blockchain data may still be Personal Data where it can be linked to an identified or identifiable person. ALL applies technical and organisational safeguards to reduce linkability where appropriate.

Immutability: Public blockchain records are generally immutable and cannot be deleted, reversed, or modified by ALL once confirmed. Where applicable law provides a right to erasure, ALL will satisfy this right, where available, by deleting or de-linking off-chain records controlled by ALL rather than modifying the blockchain itself.

No sensitive data on-chain: No directly identifying Personal Data, Traffic Content, Session content, Confidential Information, KYC/KYB documents, or biometric data should be recorded on-chain by design. Users and counterparties must not submit such information to Smart Contracts or blockchain fields.

11. Legal Bases for Processing

Where applicable privacy law requires ALL to identify a legal basis for processing — including the GDPR, UK GDPR, Panama Law No. 81 of 2019, Brazil LGPD, UAE PDPL, and similar laws — ALL relies on one or more of the legal bases described below. US state privacy laws, including CCPA/CPRA and similar laws, operate primarily through notice, opt-out, consumer rights, and sensitive-data frameworks rather than a legal-basis requirement; those laws are addressed separately in the jurisdiction-specific disclosures in Section 18.

For identity verification, facial verification, liveness detection, biometric-related verification, sanctions screening, AML/CTF screening, fraud prevention, and payout security, ALL may rely on legal obligation, contractual necessity, legitimate interests, substantial public interest, establishment, exercise, or defence of legal claims, explicit consent where required by applicable law, or another legal basis permitted by applicable law. If verification is required for onboarding, compliance, payouts, fraud prevention, security, or legal obligations, refusal to provide the required information, or withdrawal of consent where consent is used, may prevent ALL from providing the relevant feature, approving access, processing payouts, or continuing the account relationship.

Where biometric verification is used, ALL will provide a specific notice before collection explaining the data processed, purposes, parties involved, applicable legal basis and special-category condition, retention period or criteria, and relevant rights. Where explicit consent is relied upon, it will be obtained separately before processing begins. Biometric data used to uniquely identify a person will not be processed unless the applicable legal requirements are satisfied.

Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect processing that occurred before withdrawal or processing that continues on another lawful basis. Where verification is legally required or necessary for fraud prevention or payout security, ALL may continue to retain and process relevant data on legal obligation or legitimate interests notwithstanding consent withdrawal. Where we rely on legitimate interests, you may object where applicable law gives you that right. For special-category biometric data, any continued processing also requires a valid special-category condition; contractual necessity or legitimate interests alone are insufficient.

12. Cookies and Similar Technologies

ALL uses cookies, pixels, SDKs, local storage, tracking URLs, log data, and similar technologies to provide, secure, analyse, improve, and market the Platform. The Cookie Policy sets out the full details of the cookies and tracking technologies we use, the purposes for each category, the third parties involved, and the opt-out options available to you. The Cookie Policy forms part of this Privacy Policy.

Essential cookies necessary for Platform operation cannot be disabled without affecting core functionality. Analytics, functional, and marketing cookies can be managed through the cookie banner, Platform settings, and browser controls. Where required by law, we honour recognised opt-out preference signals such as Global Privacy Control for applicable sales, sharing, or targeted advertising opt-outs.

13. Marketing, Advertising, and Referral Communications

We may send transactional communications including account notices, security alerts, billing statements, payout notices, legal updates, service messages, and policy changes. These are not marketing communications and may be necessary to provide the Platform. You cannot opt out of transactional communications while your account is active.

We may send promotional communications, product updates, event invitations, surveys, or referral-related communications where permitted by law. You may opt out using unsubscribe links in emails, dashboard settings, or by contacting [email protected]. Opting out of marketing does not affect transactional or legal communications.

We do not use government ID documents, facial verification templates, biometric data, KYC/KYB files, source-of-funds declarations, sanctions results, or sensitive compliance records for targeted advertising purposes.

14. Data Retention

We retain Personal Data for as long as necessary to provide the Platform, perform contracts, comply with law, resolve disputes, enforce agreements, prevent fraud and abuse, protect security, maintain accounting and tax records, and establish, exercise, or defend legal claims. Retention periods vary by jurisdiction, role, feature, and risk profile.

When Personal Data is no longer needed, we delete, de-identify, aggregate, or anonymise it, unless retention is required or permitted by law. Public blockchain data cannot be deleted by ALL. Retention periods may be extended for ongoing investigations, regulatory holds, litigation, or other legitimate purposes. Aggregated and de-identified data may be retained indefinitely as described in Section 8.8.

15. International Data Transfers

ALL operates globally. Personal Data may be processed in Panama, the United Arab Emirates, the European Economic Area, the United Kingdom, the United States, and other countries where ALL, Group Companies, service providers, payment providers, KYC/KYB providers, cloud providers, support providers, or other counterparties operate.

Where we transfer Personal Data internationally, we use safeguards required by applicable law, which may include:

• Adequacy decisions issued by the European Commission, UK Government, or other competent authority.
• Standard Contractual Clauses (SCCs) approved by the European Commission.
• UK International Data Transfer Agreement or Addendum.
• Transfer impact assessments and supplementary technical or contractual safeguards.
• Consent, contract necessity, or legal obligation derogations where applicable.

Transfers outside Panama are handled consistently with Panama Law No. 81 of 2019 where applicable. Copies of applicable transfer safeguards are available on request at [email protected].

16. Data Security

ALL implements technical, administrative, and physical safeguards designed to protect Personal Data against unauthorised access, loss, misuse, alteration, disclosure, or destruction, taking into account the nature of the data, the processing activity, the role of the User, the state of technology, implementation costs, and the relevant risks. These safeguards may include, as appropriate and depending on the relevant system, feature, provider, or processing activity:

Technical: TLS/SSL encryption in transit; encryption at rest where appropriate; role-based access controls (RBAC) and, where implemented, multi-factor authentication (MFA) for administrative access; logging and monitoring, where appropriate; secure development practices; vulnerability management, where applicable; ALL360 Device security features, which may include, where implemented: secure boot, TPM integration, full disk encryption, App sandboxing, and signed updates.

Administrative: regular security and privacy training; access to Personal Data limited to personnel who need it; confidentiality obligations for all personnel and contractors; vendor due diligence and security assessments.

Physical: Control Tower infrastructure hosted in secure data centres with physical access controls, surveillance, and environmental protections.

No security measures are completely effective. You are responsible for protecting your account credentials, API keys, private keys, Wallet, and any data you deploy on the Platform. In the event of a personal data breach that requires notification under applicable law, we will notify affected individuals, relevant controllers, processors, and supervisory authorities within applicable timeframes and with the information required by law.

17. Your Rights and Choices

Depending on your jurisdiction, role, and applicable law, you may have the following rights:

Access: request confirmation of whether we process your Personal Data and obtain a copy.

Correction: request correction of inaccurate or incomplete Personal Data, or update information through the dashboard.

Deletion (erasure): request deletion of Personal Data, subject to legal retention obligations, fraud prevention, security, accounting, blockchain immutability, pending disputes, and other lawful limitations.

Portability: request a structured, commonly used, machine-readable copy of Personal Data you have provided to us, where technically feasible.

Restriction: request that we restrict processing in certain circumstances (e.g., while we verify accuracy or assess legitimate interests).

Objection: object to processing based on legitimate interests, or to direct marketing.

Consent withdrawal: withdraw consent at any time where processing is based on consent. Withdrawal does not affect prior processing or processing that continues on another lawful basis, including legal obligation or legitimate interests.

Marketing opt-out: opt out of promotional communications via unsubscribe links, dashboard settings, or by contacting [email protected]. Transactional communications continue.

Targeted advertising opt-out: opt out of sale, sharing, or targeted advertising where applicable law provides this right, using controls in the Cookie Policy or Platform settings.

Automated decision review: request explanation, human review, or contestation of certain automated decisions where applicable law provides this right.

Complaint: lodge a complaint with a competent data protection authority.

To exercise rights, contact [email protected] with your full name, account email, role, country, and a description of your request. We may require identity verification before responding. If your request relates to data controlled by a Developer, Proxy Company, Business Customer, payment provider, KYC provider, or other independent controller, we may direct you to that controller. We will respond within the time required by applicable law (generally 30 days under GDPR; 45 days under CCPA; extensions where lawfully permitted with notice). We do not discriminate against you for exercising privacy rights, subject to lawful service limitations.

Closing your account or terminating Platform access does not automatically delete Personal Data. ALL may retain Personal Data after account closure where required or permitted for legal compliance, KYB/KYC, AML/CTF, sanctions screening, tax and accounting, fraud prevention, security, abuse response, payment disputes, chargebacks, payout records, blockchain records, dispute resolution, enforcement, or legal claims.

18. Jurisdiction-specific Disclosures

18.1 European Economic Area, United Kingdom, and Switzerland

If you are located in the EEA, UK, or Switzerland, the GDPR, UK GDPR, or Swiss data protection law applies. You may contact our EU or UK Representative (if appointed), lodge a complaint with your national supervisory authority, and exercise the rights described in Section 17. Cross-border transfers are handled under SCCs, UK transfer mechanisms, adequacy decisions, or other lawful mechanisms.

18.2 Panama

ALL is incorporated in Panama and processes Personal Data in accordance with Panama Law No. 81 of 2019 on Personal Data Protection. Data subjects may exercise the rights described in Section 17 and may lodge complaints with Panama's National Authority for Transparency and Access to Information (ANTAI).

18.3 United Arab Emirates

Where UAE data protection law applies, including UAE Federal Decree-Law No. 45 of 2021 on Personal Data Protection or applicable free-zone data protection laws (including the DIFC Data Protection Law), UAE data subjects may exercise applicable rights and lodge complaints with the UAE Data Office or DIFC Commissioner of Data Protection.

18.4 California and Other US State Privacy Laws

US state privacy laws, including the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA) and similar laws in other states, operate primarily through notice, opt-out rights, sensitive-data protections, and consumer rights frameworks rather than a legal-basis requirement. If you are a California resident or a resident of another US state with applicable privacy laws, you may have rights to: know and access the categories and specific pieces of Personal Data collected about you; correct inaccurate Personal Data; delete Personal Data subject to applicable exceptions; obtain portability; opt out of sale or sharing of Personal Data for cross-context behavioural advertising; limit the use and disclosure of sensitive personal information; and not be discriminated against for exercising these rights. ALL does not sell Personal Data for money. Where analytics, advertising, or referral-attribution disclosures constitute a "sale" or "sharing" under applicable US state law, opt-out controls are available through the Cookie Policy, Platform settings, and opt-out mechanisms described in this Policy. Sensitive Personal Data such as government ID, biometric verification data, and KYC/KYB files is processed only for verification, security, fraud prevention, compliance, and service delivery. To exercise California or other US state privacy rights, contact [email protected] or use available Platform controls.

18.5 Brazil

Where Brazil's Lei Geral de Proteção de Dados Pessoais (LGPD) applies, data subjects may exercise rights of confirmation, access, correction, anonymisation, blocking, deletion, portability, information about sharing, and consent withdrawal, subject to applicable exceptions.

18.6 Australia

Where the Australian Privacy Act 1988 and Australian Privacy Principles apply, Australian users may request access to and correction of Personal Data and may submit privacy complaints to ALL and, where applicable, the Office of the Australian Information Commissioner.

18.7 Additional Local Supplements

ALL may publish jurisdiction-specific supplements or notices. If a supplement conflicts with this Policy, the supplement prevails for users to whom it applies, to the extent of the conflict.

19. Third-party Apps, Integrations, and Websites

The ALL App Store includes Apps developed, published, and maintained by independent Developers. Developers act as independent data controllers where they determine the purposes and means of the relevant processing. Before deploying or using a third-party App, you should review the Developer's App privacy policy and Terms of Use. ALL is not responsible for Developer data practices.

The Platform may link to third-party websites, wallets, payment providers, blockchain explorers, integrations, documentation, or services not controlled by ALL. This Policy does not apply to those third-party services. Their privacy practices are governed by their own policies.

20. Children and Age Restrictions

The Platform is not intended for persons under 18 years of age or the age of majority in their jurisdiction, whichever is higher. We do not knowingly collect Personal Data from children. If we become aware that we have collected Personal Data from a child without a valid legal basis or verifiable parental consent, we will delete it as required by law. Contact [email protected] if you believe a child has provided Personal Data to ALL.

21. Changes to This Policy

We may update this Policy to reflect changes in law, technology, security, Platform features, data practices, corporate structure, service providers, or operational requirements. The "Last Updated" date indicates the latest revision.

Where required by law or where changes are material, we may provide notice through email, Platform dashboard, website notice, or another appropriate method. Where required by law, we may request renewed consent or acknowledgement. Continued use of the Platform after an update is effective constitutes acknowledgement of the updated Policy to the extent permitted by applicable law.

22. Contact US

Platform Entity: All360 Technology S.A., Republic of Panama, Registered address: [●]

Device and Licence Seller: Allecosystem Technologies LLC, United Arab Emirates

Privacy email: [email protected]

Data Protection Officer: [email protected]

EU Representative: where appointed, details will be published in this Policy

UK Representative: where appointed, details will be published in this Policy

This Policy is drafted in English. If translated into another language, the English version controls to the extent permitted by applicable law, unless mandatory local law requires otherwise.