USD.AI Privacy Policy

Effective Date: March 24 2026

USD.AI Foundation, an exempted limited guarantee foundation company incorporated under the laws of the Cayman Islands (“USD.AI Foundation,” “we,” “us,” or “our”), is committed to the responsible and transparent handling of personal information. This Privacy Policy (this “Policy”) describes how USD.AI Foundation collects, uses, stores, discloses, and protects personal information in connection with: (i) the USD.AI Protocol and associated application frontend available at app.usd.ai (the “Site”); (ii) the GPU Loans information site at gpuloans.com (the “GPU Loans Site”); (iii) CHIP governance interfaces and any other sites or applications operated by USD.AI Foundation; and (iv) all related services (collectively, the “Service”), as described in the USD.AI Terms of Service (the “Terms”).

This Policy applies to all Users of the Service, including general visitors, institutional counterparties onboarding as Mint Users under the USDai Institutional Mint and Redemption Agreement (the “Mint User Agreement”), prospective borrowers accessing the GPU Loans Site, and CHIP governance participants. By using the Service, you consent to the collection and use of your information as described in this Policy. If you do not agree with this Policy, you may not use the Service.

This Policy is incorporated by reference into the Terms and the Mint User Agreement. Capitalized terms not defined herein have the meanings given to them in the Terms or Mint User Agreement, as applicable.

1. Information We Collect

1.1 Information You Provide Directly

In the course of registering for the Service, onboarding as a Mint User, or otherwise interacting with USD.AI Foundation, you may provide the following categories of personal information:

Identity and entity information: full legal name, business or entity name, jurisdiction of incorporation or organization, date of birth, government-issued identification (passport, national ID, or equivalent), and beneficial ownership information.
Contact information: email address, telephone number, postal address, and other communication details.
Financial and institutional information: information about your institution, role, source of funds, trading activity, and related financial background required for KYC/KYB/AML onboarding.
Transaction information: records of mint and redemption transactions, wallet addresses, transaction amounts, timestamps, and blockchain transaction identifiers.
Wallet and credential information: whitelisted wallet addresses and, where applicable, administrative credentials submitted during onboarding.
Communications: correspondence, support requests, and any other communications you send to USD.AI Foundation.
Governance participation: wallet addresses and voting records associated with CHIP governance activity.

1.2 Information Collected Automatically

When you access the Site, the GPU Loans Site, or any other interface operated by USD.AI Foundation, we and our service providers may automatically collect:

Log and usage data: IP address, browser type and version, operating system, referring URLs, pages accessed, time and date of access, and clickstream data.
Device information: device type, unique device identifiers, and hardware configuration.
On-chain data: public blockchain data associated with wallet addresses you connect to or use in connection with the Service, including transaction history visible on public ledgers.
Cookie and tracking data: see Section 6 (Cookies and Tracking Technologies) below.

1.3 Information from Third Parties

USD.AI Foundation may receive personal information from the following categories of third parties:

KYC/KYB and AML screening providers: identity verification, sanctions screening, politically exposed person (PEP) checks, and adverse media screening results provided by third-party compliance vendors engaged by USD.AI Foundation.
Credit reference and fraud prevention agencies: information provided in response to inquiries made for identity verification or financial crime prevention purposes.
Blockchain analytics providers: on-chain risk scoring and wallet analysis data.
Service providers and partners: information necessary to facilitate the provision of the Services.

2. How We Use Your Information

USD.AI Foundation processes personal information for the following purposes:

2.1 Provision and Operation of the Service

To establish and maintain your account or Mint User status.
To process USDai mint and redemption transactions.
To whitelist and monitor wallet addresses.
To provide access to the GPU Loans Site and facilitate borrower intake and due diligence coordination.
To support CHIP governance participation.
To provide customer and technical support.

2.2 Compliance and Legal Obligations

To conduct KYC, KYB, and AML onboarding and ongoing monitoring, including identity verification, sanctions screening, and transaction monitoring, as required by applicable law and USD.AI Foundation’s compliance program.
To comply with requests from governmental and regulatory authorities.
To detect, investigate, and prevent fraud, money laundering, terrorist financing, sanctions evasion, and other financial crimes.
To fulfill record-retention obligations under applicable law.

2.3 Security and Integrity

To monitor the Service for unauthorized access, abuse, or technical vulnerabilities.
To enforce the Terms, the Mint User Agreement, and USD.AI Foundation’s policies.
To protect the rights, property, and safety of USD.AI Foundation, its users, and third parties.

2.4 Communication

To send transactional communications, including confirmations, notices, and alerts relating to your account or transactions.
To send compliance-related communications, including requests for updated documentation or information.
To provide information about material changes to the Terms, this Policy, or the Mint User Agreement.

2.5 Analytics and Improvement

To analyze usage patterns and improve the design, functionality, and performance of the Service.
To conduct internal research and analysis in connection with the development of the USD.AI Protocol.

3. Legal Basis for Processing

To the extent that applicable data protection law requires USD.AI Foundation to identify a legal basis for processing personal information, USD.AI Foundation processes personal information on the following bases:

Contractual necessity: processing required to perform our obligations under the Terms and the Mint User Agreement, including onboarding, transaction processing, and account management.
Legal obligation: processing required to comply with applicable law, including AML, KYC/KYB, sanctions, and financial crime regulations.
Legitimate interests: processing necessary for the purposes of fraud prevention, network security, enforcement of our policies, and the improvement of the Service, where such interests are not overridden by the interests or rights of the data subject.
Consent: where required by applicable law and not covered by another basis, processing based on your consent, which may be withdrawn at any time without affecting the lawfulness of processing carried out prior to withdrawal.

4. Disclosure of Personal Information

USD.AI Foundation does not sell personal information. USD.AI Foundation may disclose personal information in the following circumstances:

4.1 Service Providers and Third-Party Processors

USD.AI Foundation engages third-party service providers to assist in the operation of the Service, including KYC/KYB and AML compliance vendors, blockchain analytics providers, cloud infrastructure providers, and software development and maintenance partners, as referenced in Section 3 of the Terms. Such providers process personal information on USD.AI Foundation’s behalf and are subject to confidentiality and data protection obligations consistent with this Policy.

4.2 Affiliated Entities

USD.AI Foundation may share personal information with GPU Finance Ltd. (BVI), its wholly owned lender-of-record subsidiary, and Permian Labs Inc., its operational service provider, to the extent necessary to facilitate the Services, conduct due diligence, or fulfill legal or contractual obligations.

4.3 Legal and Regulatory Disclosure

USD.AI Foundation may disclose personal information to governmental authorities, regulators, law enforcement agencies, courts, or other third parties: (i) when required to do so by applicable law or legal process; (ii) in response to a valid subpoena, court order, or regulatory request; (iii) to comply with economic sanctions programs administered by OFAC or other applicable authorities; or (iv) where USD.AI Foundation believes disclosure is necessary to prevent or investigate fraud, financial crime, or harm to persons or property.

4.4 Credit Reference and Fraud Prevention Agencies

In connection with the KYC/KYB/AML onboarding process described in the Mint User Agreement, USD.AI Foundation may disclose personal information to credit reference agencies and financial crime prevention bodies, and such agencies may respond to USD.AI Foundation’s inquiries in full. Such information may be retained and used by those agencies for the purposes of fraud prevention and identity verification.

4.5 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of assets involving USD.AI Foundation, personal information may be transferred to the acquiring or successor entity as part of that transaction, consistent with Section 23 (Change of Control) of the Mint User Agreement and the corresponding provision of the Terms.

4.6 Public Blockchain Data

Certain information associated with your use of the Service is recorded on public blockchains and is inherently accessible to any person. USD.AI Foundation is not responsible for the availability or use of on-chain data by third parties, and such data is not subject to deletion or modification by USD.AI Foundation.

5. Data Retention

USD.AI Foundation retains personal information for as long as necessary to fulfill the purposes for which it was collected, including compliance with legal, regulatory, and contractual obligations. In particular:

KYC/KYB/AML onboarding records and identity verification documentation are retained for a minimum of five (5) years following the termination of a Mint User’s account, or such longer period as may be required by applicable law.
Transaction records are retained for a minimum of five (5) years following the date of the transaction, or such longer period as required by applicable law or as necessary to resolve disputes.
General account and usage information is retained for the duration of the account relationship and for a reasonable period thereafter.
Information retained pursuant to legal hold or regulatory inquiry will be retained for the duration of the relevant proceeding or obligation.

Following the expiration of the applicable retention period, USD.AI Foundation will delete or anonymize personal information, subject to applicable law and USD.AI Foundation’s records management policies. As noted in Section 26 of the Mint User Agreement, USD.AI Foundation is entitled to retain registration and onboarding records following termination of Mint User status for regulatory compliance and legal proceedings purposes.

6. Cookies and Tracking Technologies

USD.AI Foundation and its service providers use cookies and similar tracking technologies (including web beacons, pixel tags, and local storage) on the Site and GPU Loans Site to:

• Maintain session state and authentication.

• Analyze usage patterns and measure the performance of the Service.

• Detect and prevent fraud and unauthorized access.

• Store user preferences.

You may configure your browser to refuse all cookies or to notify you when a cookie is set. Disabling cookies may affect the functionality of the Service. A separate Cookie Policy, available at usd.ai/cookies, provides additional detail on the specific cookies used and your choices regarding them.

7. Security

USD.AI Foundation implements technical and organizational measures designed to protect personal information against unauthorized access, disclosure, alteration, or destruction. These measures include, among others, encryption of data in transit, access controls, and periodic security assessments.

Notwithstanding the foregoing, as noted in Section 4 of the Terms, no security system is impenetrable. USD.AI Foundation cannot guarantee the absolute security of personal information and is not liable for unauthorized third-party access to the extent such access results from circumstances beyond USD.AI Foundation’s reasonable control. Users are responsible for maintaining the security of their own access credentials, private keys, and wallet security, as described in Section 7 of the Mint User Agreement.

8. Your Rights and Choices

Subject to applicable law and USD.AI Foundation’s legal obligations (including its AML and regulatory compliance obligations, which may limit or override certain rights), you may have the following rights with respect to your personal information:

Access: the right to request confirmation of whether USD.AI Foundation holds personal information about you and, if so, to receive a copy.
Correction: the right to request correction of inaccurate or incomplete personal information.
Deletion: the right to request deletion of personal information, subject to USD.AI Foundation’s legal obligation to retain certain records (including KYC/KYB/AML records, transaction records, and records subject to legal hold).
Restriction: the right to request that processing of your personal information be restricted in certain circumstances.
Portability: the right, where applicable, to receive personal information you have provided to USD.AI Foundation in a structured, commonly used, machine-readable format.
Objection: the right to object to processing of your personal information carried out on the basis of legitimate interests, subject to USD.AI Foundation’s overriding legitimate interests or legal obligations.

Requests to exercise any of the foregoing rights should be directed to USD.AI Foundation at the contact details set out in Section 12 below. USD.AI Foundation will respond within the timeframe required by applicable law. Note that verification of identity may be required before USD.AI Foundation can action any request, and that certain rights may be limited where personal information is processed for regulatory compliance purposes.

9. International Data Transfers

USD.AI Foundation is incorporated in the Cayman Islands and its operations and service providers are located in various jurisdictions globally. Personal information collected in connection with the Service may be transferred to and processed in jurisdictions outside your country of residence, including jurisdictions that may not provide the same level of data protection as your home jurisdiction.

Where required by applicable law, USD.AI Foundation implements appropriate safeguards for cross-border transfers of personal information, including standard contractual clauses or other transfer mechanisms as required. By using the Service, you acknowledge and consent to the transfer of your personal information to jurisdictions as described in this Section.

10. Third-Party Sites and Services

The Service may contain links to third-party websites or services. This Policy applies only to information collected by USD.AI Foundation through the Service. USD.AI Foundation is not responsible for the privacy practices of any third-party site or service, and users who access third-party content through the Service do so at their own risk, consistent with Section 6 of the Terms (Third-Party Links and Information).

11. No Collection from Minors

The Service is not directed to persons under the age of 18, and USD.AI Foundation does not knowingly collect personal information from minors. If USD.AI Foundation becomes aware that personal information has been collected from a person under 18, it will take steps to delete such information promptly. If you have reason to believe that a minor has provided personal information to USD.AI Foundation, please contact us using the details in Section 12.

12. Contact Information

Questions, requests, or complaints regarding this Policy or USD.AI Foundation’s processing of personal information should be directed to:

USD.AI Foundation

PO Box 10061

George Town Financial Center, 90 Fort Street, Suite 306

Grand Cayman, KY1-1001, Cayman Islands

Email: hello@usd.ai

13. Amendments to this Policy

USD.AI Foundation reserves the right to modify this Policy at any time by posting a revised version at usd.ai/privacy with an updated effective date. Material changes will be notified in accordance with the notice provisions of the Terms and the Mint User Agreement. Continued use of the Service following the effective date of any amendment constitutes acceptance of the revised Policy. If you do not agree with the amended Policy, you should discontinue use of the Service.

Appendix A: Data Practices Summary

The following table provides a summary overview of USD.AI Foundation’s primary data processing activities. It is supplemental to, and does not modify, the substantive provisions of this Policy.