1. Controller and Scope
SharedState ("we", "us", "our") is the controller of personal data collected through this website and platform. This Privacy Policy describes what information we collect, why we collect it, how we use it, with whom we share it, and the rights you have over your data.
2. Information We Collect
a. Account and Profile Data
- Registration: full name, email address, password hash (never stored in plaintext), and optional phone number.
- Profile preferences: preferred display language, appearance (light/dark/system), two-factor and passkey enrollment.
b. Transaction Data
- Reservations, purchases, payments (method, reference, amount, notes), share transfers, sell and buy requests, dividend distributions, and all approval or review decisions made by administrators.
- Every share transfer is permanently recorded in an append-only ownership ledger, including the identity of the buyer and seller, as required by the platform's ownership model.
c. Identity Verification (KYC) Data
When you voluntarily submit identity verification documents, we store the submitted file, submission timestamp, status, administrator review notes, and reviewer identity. Documents are stored on a private disk with signed-access URLs and are never publicly downloadable.
d. Contact Inquiries
Messages submitted via the contact form, including the provided name, email, phone, subject, and message text, are stored for customer-service and compliance purposes.
e. Security and Telemetry
All write-actions taken by logged-in users are recorded in an audit log (IP address, user agent, timestamp, action, and the affected entity). We also use cookies and standard web-server request logs for security, fraud detection, and session management.
3. How We Use Your Information
- To provide, operate, maintain and improve the Service.
- To process share purchases, payments, transfers, and dividend distributions.
- To verify your identity and comply with anti-money laundering, know-your-customer, and sanctions-screening obligations.
- To communicate account notifications, service announcements, transactional confirmations, and, where you have opted in, marketing messages.
- To investigate fraud, abuse, security incidents, and to enforce our Terms of Service.
4. Legal Bases (EU / EEA users)
Where applicable, we process personal data on the following legal bases: (a) performance of a contract with you; (b) compliance with a legal obligation; (c) our legitimate interests pursued in a reasonable and proportionate way; (d) your explicit consent for specific purposes, which you may withdraw at any time.
5. Sharing and Disclosures
We do not sell personal information. We share your data only with:
- Regulated service providers who assist us with payment processing, identity verification, cloud hosting, or email delivery, each bound by written confidentiality and data-protection obligations.
- Regulators, law enforcement, or courts when required by law, court order, or legal process, or to prevent fraud, imminent harm, or a violation of our terms.
- Successors in title in connection with a merger, acquisition, reorganization, or sale of assets, in accordance with applicable law.
6. Data Retention
- Shareholder and transaction records are retained permanently in the append-only ownership ledger as long as necessary for the purpose of establishing and verifying ownership of shares.
- Contact inquiries are retained for up to 3 years after closure of the case, unless a longer retention is required by law.
- KYC documents are retained for 5 years after the account relationship ends, in line with AML/CTF requirements.
- Audit logs are retained for a minimum of 12 months.
7. Your Rights
Depending on your jurisdiction, you may have rights to: access, rectify, delete (where lawful), restrict, or export your personal data; object to processing; withdraw consent; and lodge a complaint with your local data-protection authority. To exercise your rights, email hello@sharedstate.example.
8. Children's Privacy
The Service is not directed to, and we do not knowingly collect data from, children under 16. If you become aware of such data being collected, please contact us to arrange removal.
9. Security
We protect data in transit using TLS 1.3 or later, encrypt sensitive fields at rest, enforce multi-factor authentication for administrators, and regularly audit access logs. No system is 100% secure, however, and we cannot guarantee absolute security.
10. International Transfers
Where we transfer personal data to countries outside your jurisdiction of residence, we do so using appropriate safeguards as required by applicable law, including Standard Contractual Clauses where relevant.
11. Changes to This Policy
We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page reflects the effective date of the latest revision. Material changes will be announced via in-app notification.