Privacy Policy

Effective Date: 01 September 2026

This Privacy Policy explains how ARCLIGHT PAY LTD. ("Arclight Pay", "Arclight", "we", "us", or "our") collects, uses, discloses, stores and protects personal information when you visit our website, create or use an account, communicate with us, or use any product or service that we make available (collectively, the "Services").

Legal entity and contact address

ARCLIGHT PAY LTD.
112 - 970 Burrard Street
Office 1311
Vancouver, BC V6Z 2R4
Canada

Privacy contact: privacy@arclightpay.io

This Privacy Policy should be read together with our Terms & Conditions, Risk Disclosures, Cookie Policy, and any service-specific notices presented to you.

1. Scope

This Privacy Policy applies to our current website, waiting-list, communications and corporate activities and, if and when launched, to the following planned Services:

• our websites, applications, client portals and APIs;
• onboarding, account creation, authentication and account administration;
• fiat and virtual-currency on-ramp and off-ramp services;
• virtual-currency exchanges, swaps, OTC transactions and related settlement;
• foreign-exchange services;
• payment, transfer, payout and beneficiary services;
• virtual or named account / IBAN functionality made available through partners;
• card products and related services made available through partners;
• hosted, embedded, custodial or other wallet functionality, where offered;
• customer support, complaints, security, fraud prevention and compliance activities; and
• business, corporate, supplier and partner relationships.

What is active today

Arclight Pay is currently in pre-launch. The only personal information collected through this website today is what you choose to send us: a waiting-list registration, a complaint submitted through the complaints form, and messages sent through our support chat, together with the ordinary technical information involved in serving a website.

Visiting this website does not subject you to identity verification, know-your-customer checks or transaction monitoring. Those activities relate to planned Services and would begin only if and when you chose to onboard to a Service that has become available.

Some future Services may be provided in whole or in part by regulated banks, electronic money institutions, payment institutions, card issuers, BIN sponsors, exchanges, liquidity providers, custodians, wallet infrastructure providers, identity-verification providers or other third parties. Where a third party acts as an independent controller of your personal information, its own privacy notice will also apply.

2. Privacy laws

Depending on the circumstances, our processing may be subject to the Personal Information Protection Act (British Columbia) ("BC PIPA"), the federal Personal Information Protection and Electronic Documents Act ("PIPEDA"), and other applicable privacy, data-protection, financial-services, anti-money laundering, sanctions, consumer-protection and electronic-communications laws.

Where the GDPR, UK GDPR or another data-protection regime applies to a particular user or processing activity, we will provide the rights and protections required by that law.

3. Personal information we collect

Arclight Pay is currently in pre-launch. Some categories of personal information described below relate to planned future Services and are not currently collected through an active financial-services product. We will collect such information only if and when the relevant Service becomes available and where permitted or required by applicable law.

The information we collect depends on the Services you use and may include:

3.1 Identity and profile information

• full legal name and former names;
• date and place of birth;
• nationality and citizenship;
• residential, business and mailing addresses;
• email address and telephone number;
• occupation, employer, business activity and source of income;
• government-issued identification details and copies;
• photographs, video or biometric/liveness information used for identity verification, where permitted;
• tax residence and tax identification information;
• corporate role, ownership and control information.

3.2 KYC, KYB, AML and sanctions information

For individuals, entities, beneficial owners, directors, officers, authorized persons, beneficiaries and counterparties, we may collect or generate:

• identity-verification results;
• beneficial ownership and control information;
• source-of-funds and source-of-wealth information;
• expected account activity and transaction profile;
• politically exposed person (PEP), head of international organization (HIO), sanctions and adverse-media screening results;
• transaction-monitoring and blockchain-analytics information;
• wallet ownership or control evidence;
• risk ratings, compliance flags, case notes and review outcomes;
• information contained in documents supporting the purpose or economic rationale of a transaction.

3.3 Financial and transaction information

• bank and payment account details;
• IBANs and virtual-account identifiers;
• card-related identifiers and transaction information, to the extent made available to us;
• fiat and virtual-currency balances;
• deposit, withdrawal, exchange, transfer and payout information;
• beneficiary and payer details;
• wallet addresses, transaction hashes and blockchain data;
• exchange rates, quotes, fees, spreads and execution data;
• invoices, contracts, payroll files, payment registers and transaction-supporting documents;
• chargeback, return, recall, rejection and dispute information.

3.4 Device, technical and usage information

• IP address;
• device identifiers;
• browser and operating-system information;
• login and authentication data;
• session information;
• application and website activity;
• cookies and similar technologies;
• security logs, audit logs and fraud signals;
• approximate location inferred from IP or device data.

3.5 Communications

We may record and retain:

• emails, chats and support requests;
• telephone or video-call records where lawfully recorded;
• complaints and feedback;
• communications concerning transactions, onboarding, compliance reviews or disputes.

4. How we collect information

We may obtain personal information:

• directly from you;
• from your employer, company, authorized representative or account administrator;
• from payment senders, recipients, beneficiaries and counterparties;
• from banks, EMIs, payment institutions, card providers, exchanges, liquidity providers and other service providers;
• from identity-verification, fraud-prevention, sanctions, PEP, adverse-media, KYT and blockchain-analytics providers;
• from public registries, corporate databases, government sources, sanctions lists and publicly available sources;
• from blockchains and distributed ledgers;
• automatically through our websites, applications and security systems.

If you provide us with personal information about another person, you are responsible for ensuring that you are permitted to provide that information to us and, where required, that the person has received appropriate notice.

5. Why we use personal information

We may collect, use and disclose personal information for the following purposes:

• to provide, operate and administer the Services;
• to create and maintain accounts;
• to verify identity, business status, ownership and authority;
• to process payments, transfers, exchanges, settlements, withdrawals and payouts;
• to provide quotes, calculate fees and execute instructions;
• to manage wallets, virtual accounts, IBAN functionality and cards where offered;
• to comply with AML/ATF, sanctions, Travel Rule, record-keeping, reporting and other legal obligations;
• to detect, investigate and prevent fraud, financial crime, cybercrime, abuse and unauthorized access;
• to conduct transaction monitoring, blockchain analytics, sanctions and risk screening;
• to assess whether a transaction, customer, beneficiary, jurisdiction, wallet or activity falls within our risk appetite;
• to protect Arclight, our users, partners and the financial system;
• to respond to legal process, regulatory requests, court orders and lawful government requests;
• to maintain accounting, tax, audit and corporate records;
• to investigate complaints and resolve disputes;
• to maintain and improve our products, systems and security;
• to communicate service, security and compliance notices;
• to send marketing communications where permitted by law and your preferences;
• to establish, exercise or defend legal claims.

We will not use personal information for a purpose that a reasonable person would consider inappropriate in the circumstances.

6. Consent and other legal bases

Where consent is required, we will seek consent appropriate to the sensitivity of the information and the circumstances. You may withdraw consent where legally permitted, subject to reasonable notice and any legal or contractual restrictions.

Certain information is necessary for us to provide regulated financial services and meet legal obligations. If you do not provide requested KYC, KYB, source-of-funds, transaction or other required information, we may be unable to open or maintain an account, process a transaction or provide a Service.

Where the GDPR or similar law applies, our legal bases may include performance of a contract, compliance with legal obligations, legitimate interests, consent, and the establishment, exercise or defence of legal claims.

7. AML, sanctions, fraud and automated tools

If and when regulated financial Services become available, applicable financial-services laws may require Arclight to conduct identity checks, customer due diligence, transaction monitoring, sanctions screening and, where applicable, blockchain analytics.

We may use automated tools, rules, models and third-party databases to support these activities. These tools may generate alerts, risk scores or recommendations and may result in a transaction being delayed, rejected or escalated for manual review.

We may not be legally permitted to tell you whether certain reviews, reports or investigations are taking place.

8. How we share personal information

We may disclose personal information to:

• banks, EMIs, payment institutions and account providers;
• card issuers, processors, schemes and BIN sponsors;
• virtual-currency exchanges, OTC counterparties and liquidity providers;
• wallet, custody, key-management and blockchain infrastructure providers;
• KYC/KYB, sanctions, PEP, adverse-media, fraud-prevention and KYT providers;
• Travel Rule providers;
• cloud, hosting, cybersecurity, communications and analytics providers;
• auditors, accountants, lawyers, compliance consultants and insurers;
• regulators, law-enforcement agencies, courts, tax authorities and government bodies where required or permitted by law;
• acquirers, investors or counterparties in a proposed or completed financing, reorganization, merger, acquisition or sale, subject to appropriate safeguards.

The categories above describe the disclosures that may become necessary once the relevant Services are available. They do not mean that personal information is being shared with each category today. In pre-launch, disclosures are limited to the providers that operate this website and our communications, and to professional advisers, regulators or authorities where required by law. We do not currently use analytics providers.

We require service providers acting on our behalf to use personal information only for authorized purposes and to apply appropriate confidentiality and security measures.

9. International transfers

Arclight is developing a cross-border financial-services model and may use service providers in multiple countries. Your personal information may therefore, where applicable, be processed or stored outside British Columbia or outside your country of residence.

Information processed in another jurisdiction may be accessible to courts, law-enforcement agencies or regulators under the laws of that jurisdiction.

Where required, we use contractual or other safeguards for international transfers.

10. Retention

We retain personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy, including legal, regulatory, AML/ATF, accounting, tax, fraud-prevention, dispute-resolution and security purposes.

Certain MSB records and reports may be required to be retained for at least five years under Canadian AML/ATF requirements. Other retention periods may be longer where required by law, litigation hold, regulatory direction or legitimate business need.

When information is no longer required, we will securely delete, destroy or anonymize it, subject to applicable law and technical constraints.

11. Security

We maintain administrative, technical and physical safeguards appropriate to the sensitivity of the information we process. These may include:

• encryption in transit and at rest;
• access controls and least-privilege permissions;
• multi-factor authentication;
• logging and monitoring;
• segregation of duties;
• vendor security reviews;
• incident-response procedures;
• backup and business-continuity controls.

No system can be guaranteed to be completely secure. You are responsible for protecting your credentials, devices, authentication factors and recovery methods and for promptly notifying us of suspected unauthorized access.

12. Cookies and analytics

Our website and applications may use cookies, SDKs and similar technologies for essential functionality, authentication, security, preferences, analytics and, where permitted, marketing.

Where required by law, non-essential cookies will be used only after obtaining appropriate consent.

Our Cookie Policy sets out what is currently stored on your device, when it is stored and for what purpose, and is published at arclightpay.io/legal/cookies. You can review and change your choices at any time using the Cookie settings link in the footer of our website.

13. Marketing communications

We may send marketing communications only where permitted by applicable law. Canadian commercial electronic messages are subject to applicable consent, identification and unsubscribe requirements.

You can unsubscribe using the mechanism included in a marketing message or by contacting us. Service, security, transactional and regulatory messages are not marketing messages and may still be sent where necessary.

14. Your privacy rights

Subject to applicable law and exceptions, you may have the right to:

• request access to personal information we hold about you;
• request correction of inaccurate or incomplete information;
• withdraw consent where processing is based on consent;
• object to or restrict certain processing;
• request deletion where applicable;
• request portability of certain information;
• complain to a privacy or data-protection regulator.

We may need to verify your identity before responding.

Requests should be sent to privacy@arclightpay.io.

Canadian residents may also have the right to complain to the Office of the Information and Privacy Commissioner for British Columbia or the Office of the Privacy Commissioner of Canada, depending on the circumstances.

15. EEA and UK supplemental rights

Where the GDPR or UK GDPR applies, you may also have rights to erasure, restriction, portability, objection and, in certain circumstances, rights relating to solely automated decisions with legal or similarly significant effects.

Where required, Arclight will identify the relevant controller, representative or data-protection contact and the applicable international-transfer mechanism.

16. Children's privacy

The Services are not intended for persons under 18 years of age. We do not knowingly offer financial Services to minors. If we learn that we have collected personal information from a minor contrary to applicable law, we will take appropriate steps to delete or restrict it.

17. Third-party sites and services

Our Services may contain links to, or integrations with, third-party sites or services. Their privacy practices are governed by their own notices. We are not responsible for the privacy practices of independent third parties.

18. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. We will publish the revised version with a new effective date and, where required, provide additional notice.

19. Contact us

For privacy questions, access or correction requests, or complaints:

ARCLIGHT PAY LTD.
112 - 970 Burrard Street
Office 1311
Vancouver, BC V6Z 2R4
Canada

Email: privacy@arclightpay.io