1. Scope

This Privacy Policy explains how TokenNest Inc. collects, uses, shares and protects personal information when you visit tokennest.com, open an account or use our services. It applies under the Personal Information Protection and Electronic Documents Act (PIPEDA) and, for Québec residents, the Act respecting the protection of personal information in the private sector (Law 25). Business clients' representatives, directors and beneficial owners are covered as individuals.

2. What we collect

Identity: name, date of birth, address, government ID and a verification selfie; for businesses, incorporation documents and beneficial-owner details. Financial: bank account details, transaction history, wallet addresses you provide, source-of-funds information for larger transactions. Technical: IP address, device and browser data, login events. Communications: emails, support conversations and form submissions. We collect only what the law and the service require; identity verification is performed through a screened third-party provider acting on our instructions.

3. How we use it

To open and operate your account; to verify identity and screen for sanctions and fraud as FINTRAC and Revenu Québec require; to execute, settle and record transactions; to meet record-keeping and reporting obligations; to respond to you; to secure the platform; and, with your consent, to send product news. We do not sell personal information and do not use it for advertising profiles. Automated screening flags transactions for human review; no account decision is made by automation alone.

4. Sharing and processors

We share information only with: identity-verification, sanctions-screening and email providers acting as processors under contract; Canadian banks and payout partners as needed to move your funds; FINTRAC, Revenu Québec, law enforcement and courts where the law requires; and professional advisers under confidentiality. Some processors store data outside Canada (primarily the United States and the EU) under contractual safeguards; a list is available on request from the Privacy Officer.

5. Retention

Identity, transaction and reporting records are kept for at least five years after the account closes or the transaction occurs, as required by the Proceeds of Crime (Money Laundering) and Terrorist Financing Act. Website analytics are kept 14 months; support conversations 3 years. Information no longer required is deleted or irreversibly anonymised.

6. Your rights

You may access the personal information we hold, ask us to correct it, withdraw consent for optional uses, and — subject to the retention rules above — request deletion. Québec residents may also request a copy in a structured, commonly used format and ask about the logic of any automated processing. We respond within 30 days. If you are not satisfied, you may complain to the Office of the Privacy Commissioner of Canada or, in Québec, the Commission d'accès à l'information.

7. Contact the Privacy Officer

[email protected] · TokenNest Inc., Privacy Officer, 401 West Georgia Street, Vancouver, BC V6B 5A1. We confirm receipt of requests within 2 business days. Changes to this policy are posted here with a new effective date and, where material, emailed to account holders 30 days in advance.