Privacy Policy

Fire Innovations and its affiliated operating entities (collectively, "Fire Innovations," "we," "us," or "our") design, build, and maintain software for clients, including blockchain applications, stablecoin and payment infrastructure, and tokenized asset platforms. This Privacy Policy explains our approach to privacy in two contexts: (1) our own website and business, where we do not directly collect personal information, and (2) the software we build, which may collect and process personal information when deployed and operated by our clients.

Our software development and privacy practices are designed to align with the AICPA Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy, which form the basis of SOC 2 examinations. Where a separate agreement with a client governs the development, hosting, or support of software, the terms of that agreement will control.

Fire Innovations does not directly collect, sell, rent, or share personal information from visitors to our website or from end users of the products we build. Our website does not include account registration, forms that store personal data, advertising trackers, or third-party marketing cookies.

If you choose to contact us by email or another channel, we will receive only the information you voluntarily provide, such as your name and email address, and we use it solely to respond to you. Our hosting provider may automatically process standard technical data, such as IP addresses and request logs, for the limited purposes of delivering the website, maintaining security, and preventing abuse.

The software we build may collect, store, or process personal information when it is deployed by our clients. Depending on the client's requirements, this software may handle categories of information such as:

• Identity and contact information, such as names, email addresses, and phone numbers.
• Verification and compliance information used for Know Your Customer (KYC), Anti-Money Laundering (AML), and sanctions screening.
• Financial and transaction information, such as wallet addresses, payment instructions, and transaction records.
• Technical and usage information, such as device identifiers, IP addresses, and application logs.

In these cases, our client is the business that determines what information is collected and how it is used, and is responsible for providing its own privacy notice to its users. If you are a user of an application built by Fire Innovations, please refer to the privacy policy of the company that operates that application, and direct any privacy requests to that company.

Our clients act as the data controller (or "business" under U.S. state privacy laws) for the software they operate. Where Fire Innovations accesses or processes personal information while developing, testing, hosting, or supporting client software, we act only as a processor or service provider and:

• Process personal information only on the client's documented instructions and for the purposes defined in our agreement.
• Enter into data processing agreements or equivalent contractual terms that define data handling, security, confidentiality, and breach notification obligations.
• Do not sell, retain for our own purposes, or combine client personal information with other data.
• Assist clients in responding to data subject requests and in meeting their regulatory obligations where reasonably required.
• Return or securely delete client personal information at the end of an engagement, unless retention is required by law.

We build privacy and security into the software we deliver from the start. Our engineering practices include:

• Data minimization: designing systems to collect only the personal information necessary for the client's stated purposes.
• Purpose limitation and configurable retention, so clients can define how long data is kept and when it is disposed of.
• Built-in support for notice, consent, access, correction, deletion, and data portability workflows where applicable.
• Encryption of data in transit using TLS 1.2 or higher and encryption of sensitive data at rest using AES-256 or equivalent.
• Role-based access control, least-privilege permissions, and support for multi-factor authentication.
• Audit logging to support monitoring, investigation, and compliance reporting.
• Careful consideration of public blockchains, since information written on-chain is immutable and cannot be deleted. We design systems to avoid placing personal information on-chain.

We maintain a documented information security program with administrative, technical, and physical safeguards that govern how we build software and handle any client data we are given access to. These controls include:

• Secure software development lifecycle practices, including threat modeling, peer code review, and documented change management approvals.
• Automated dependency, static code, and vulnerability scanning, with remediation of findings based on risk.
• Periodic third-party penetration testing and smart contract security audits where applicable.
• Segregation of development, testing, and production environments; production personal information is not used for development or testing without client authorization and appropriate safeguards.
• Multi-factor authentication for access to source code repositories, cloud environments, and client systems, with access reviewed quarterly and revoked promptly upon role change or termination.
• Secure secrets and key management, including hardware security modules and multi-party authorization for digital asset systems where applicable.
• Background checks for personnel with access to sensitive systems, plus security and privacy training at onboarding and at least annually.

No method of transmission or storage is completely secure. While we work to protect the systems we build and any information entrusted to us, we cannot guarantee absolute security.

For software we host or support, we design for resilience through redundancy, monitoring, encrypted backups, and tested recovery procedures. We build input validation, reconciliation, and error handling into our software so that data is processed completely, accurately, and in a timely manner.

Client source code, business information, and any data we are given access to are treated as confidential and handled according to our data classification policy. Employees and contractors are bound by confidentiality agreements, and access is limited to personnel with a documented business need for a specific engagement.

We may use carefully selected service providers, such as cloud hosting and development tooling vendors, to build and operate software for our clients. Each provider is subject to a vendor risk assessment before onboarding and periodically thereafter, and is contractually bound to maintain appropriate security and confidentiality controls. Where required by our client agreements, we disclose subprocessors and notify clients of changes.

We maintain and periodically test a documented incident response plan. If we become aware of a security incident affecting software we build or support, or any client data in our possession, we will investigate, contain, and remediate the incident and notify affected clients without undue delay and within the timeframes required by applicable law or contract, so they can meet their own notification obligations.

Because our clients control the personal information processed by the software they operate, requests to access, correct, delete, or otherwise exercise rights over that information should be directed to the company that operates the application. If we receive such a request, we will forward it to the relevant client and assist them in responding as required by our agreement and applicable law, including the GDPR, the UK GDPR, the California Consumer Privacy Act (as amended by the CPRA), and other U.S. state privacy laws.

If you have contacted Fire Innovations directly and would like us to access or delete the information you provided, contact us at privacy@fireinnovations.com.

Our website does not use advertising, tracking, or third-party marketing cookies. Any cookies used are strictly necessary for the website to function securely. Cookies used by software we build for clients are determined by those clients and described in their own privacy notices.

Our website and services are intended for businesses and are not directed to individuals under 18. We do not knowingly collect personal information from children.

Our privacy and security programs are overseen by designated management personnel who review this policy and related controls at least annually. Compliance is monitored through internal reviews and independent third-party assessments. Personnel who violate this policy are subject to disciplinary action.

We may update this Privacy Policy to reflect changes in our practices, services, or legal requirements. We will post the revised policy with a new effective date and, for material changes affecting clients, provide notice as required by our agreements.

For questions about this Privacy Policy or our software development practices, contact privacy@fireinnovations.com. To report a suspected security vulnerability in software we build, contact security@fireinnovations.com.