Kettle Pay Privacy Policy

Skillet Group Inc., a Delaware corporation doing business as Kettle and Kettle Pay (“Kettle,” “we,” “us,” or “our”), provides non-custodial software and technology services that enable businesses to send, receive, and settle payments using digital assets, and that connect those businesses to regulated third-party financial institutions for fiat on-ramp, off-ramp, conversion, and settlement services (collectively, with our websites, applications, dashboards, APIs, developer tools, and support channels, the “Services”).

This Privacy Policy describes how Kettle collects, uses, discloses, and otherwise processes Personal Information in connection with the Services and our related business activities, including sales, marketing, and business development. “Personal Information” means information that identifies, relates to, or could reasonably be linked with an identified or identifiable individual, and includes information about individuals acting on behalf of a business, such as owners, officers, employees, and authorized representatives.

Kettle is not a bank, money transmitter, or custodian. Kettle does not hold your private keys or take possession of your digital assets or fiat currency. Regulated financial services are provided by our third-party financial institution partners (“Regulated Partners”), which may include payment processors, liquidity and conversion providers, and banks. When you use a Regulated Partner’s services through Kettle, that Regulated Partner may collect and process your Personal Information as an independent controller under its own privacy notice, and its compliance determinations are its own.

Whom this Policy covers. This Policy applies to (a) our customers and prospective customers, and the individuals associated with them; (b) visitors to our websites and users of our applications; (c) counterparties, payers, and payees whose information is provided to us or processed in connection with a transaction using the Services (“Counterparties”); and (d) individuals whose business contact or professional information we obtain from public, commercial, or other sources for business development purposes.

Where we act on a customer’s behalf. Where a business customer uses our APIs or Services to process Personal Information of its own end users under a written agreement with Kettle, we may process that information as the customer’s service provider or processor, and the customer’s privacy notice governs. This Policy does not apply to that processing except where we act on our own behalf, including for security, fraud prevention, legal compliance, and the improvement and development of the Services.

This Policy does not apply to information about Kettle’s employees and job applicants in that capacity, which is covered by separate notices. Additional or supplemental notices may apply to specific products, features, or jurisdictions and will be presented at the time of collection. By using the Services, you acknowledge that you have read and understood this Policy.

The Personal Information we collect depends on how you interact with Kettle. We collect it directly from you, automatically when you use the Services, from Regulated Partners and other third parties, and from public sources.

2.1 Information you provide or that we generate

• Identifiers and contact information, such as name, business name, title, email address, telephone number (including mobile and messaging-app numbers), mailing and business address, and online identifiers.
• Account and profile information, such as login credentials, account identifiers, profile images, preferences, and the identities and roles of users you authorize on your account.
• Compliance and verification information, such as government-issued identification and the information on it, date of birth, taxpayer identification numbers, proof of address, photographs or video of you and your identification document for liveness or authentication checks, business formation and registration documents, beneficial ownership and control information, licenses, financial statements, bank statements, and source-of-funds and source-of-wealth information.
• Transaction and commercial documentation, such as invoices, purchase agreements, receipts, shipping and delivery records, correspondence, and other records you submit to support a transaction, respond to a request for information, or satisfy a compliance review. These records frequently identify your Counterparties and describe the goods, amounts, dates, and terms of your dealings with them.
• Financial and payment information, such as bank account and routing details, virtual account identifiers, payment method identifiers, and billing records.
• Communications, including the content of emails, support tickets, chats, text and messaging-app conversations (for example, WhatsApp), and telephone calls with us, which we may record or transcribe where permitted by law and with any required notice.
• Information about your Counterparties and business relationships that you provide or that is contained in the materials you submit, such as the names, businesses, contact details, and wallet addresses of the parties you pay or are paid by.
• Feedback, survey responses, and any other information you choose to provide.

2.2 Information collected automatically

• Device and technical data, such as IP address, device identifiers, browser and operating system, and approximate location derived from IP address.
• Usage and activity data, such as pages and features used, API calls, logs, timestamps, referring URLs, and interactions with our emails and messages.
• Cookies and similar technologies, as described in Section 2.4.

2.3 Information from third parties and public sources

• Regulated Partners and compliance vendors, including verification results, risk ratings, account and settlement status, and requests for information relating to your account or transactions.
• Blockchain data, such as public wallet addresses, transaction hashes, amounts, timestamps, and the transaction history and counterparties associated with addresses, together with risk and attribution information from blockchain analytics providers.
• Identity verification, fraud prevention, and sanctions-screening providers, and government and public records.
• Publicly available sources, including business websites, commercial directories, online marketplaces, social media platforms, and online communities and forums in which you or your business participate, from which we may collect business and professional information such as names, business names, business contact details, public posts, and publicly visible indications of business relationships, references, and reputation.
• Customers and other users of the Services, who may provide information about you as their Counterparty, referral, or reference.
• Business partners, referral sources, data providers, and marketing partners, and parties to corporate transactions.

We may combine information from these sources with information we collect directly, and we may infer additional information from it, such as business characteristics, transaction patterns, relationships among businesses, and likely interest in the Services.

2.4 Cookies and tracking technologies

We and our service providers use cookies, pixels, local storage, SDKs, and similar technologies to operate the Services, remember preferences, secure accounts, measure usage, and support analytics and marketing. You can manage cookies through your browser settings, and disabling them may affect functionality. Where required by law, we will honor recognized opt-out preference signals, such as Global Privacy Control, for the browser or device that sends them. We do not otherwise respond to “Do Not Track” signals.

We use Personal Information for the following purposes:

1. To provide and operate the Services, including creating and administering accounts, enabling non-custodial wallet functionality and transaction signing, routing transactions, providing API access, generating statements and records, and providing customer support.
2. To onboard you with, and maintain your access to, Regulated Partners. We collect, organize, review, store, and transmit compliance and verification information and transaction documentation to Regulated Partners so that they can perform KYC, KYB, AML, sanctions screening, transaction monitoring, and regulatory reporting, and so that you can access on-ramp, off-ramp, conversion, and settlement services. We may submit your information to one or more Regulated Partners, including additional or replacement partners, to establish, maintain, or migrate your access, and we may retain copies to respond to their requests for information, support re-verification, and evidence our own compliance.
3. For our own compliance, risk, and security programs, including screening, fraud and scam prevention, transaction review, investigating suspicious activity, enforcing our terms, and protecting the integrity of the Services.
4. To understand transaction activity and business relationships across the Services. We analyze transaction, Counterparty, and relationship information, including information contained in transaction and commercial documentation you submit and information from public sources, to understand how payments flow among our customers and their Counterparties and within the markets and industries we serve. We use these insights to assess risk, develop, improve, and expand the Services, and support our business development. We never disclose the contents of documents you submit, or the details of your transactions, to your Counterparties, to other customers, or to any other third party for marketing purposes, and we never sell this information. Except for disclosures to our service providers acting on our behalf and to Regulated Partners, and as otherwise required or permitted by applicable law, regulation, legal process, or governmental or regulatory request, in each case as further described in Section 4, this information remains confidential to Kettle.
5. For sales, marketing, and business development, including identifying and evaluating prospective customers, contacting prospective customers by email, telephone, and messaging services, sending marketing communications, administering referral programs, and measuring the effectiveness of our outreach.
6. To communicate with you, including service, security, transaction, and compliance notices.
7. For analytics, research, and product development, including developing new products, features, and models, and creating aggregated, de-identified, or anonymized information.
8. To comply with law and protect rights, including responding to legal process and requests from authorities, establishing, exercising, or defending legal claims, and protecting the rights, property, and safety of Kettle, our users, and others.
9. In connection with corporate transactions, such as a financing, merger, acquisition, reorganization, or sale of assets.
10. For other purposes described to you at the time of collection or with your consent.

Limits on our use of government identifiers and biometric information. Notwithstanding the foregoing, we use government-issued identification numbers, images of identification documents, and any biometric or liveness information only for identity verification, compliance, fraud prevention, security, legal obligations, and transmission to Regulated Partners for those purposes, and not for the purposes described in items 4 and 5 above.

De-identified information. Where we de-identify information, we maintain it in de-identified form, do not attempt to re-identify it except as permitted by law, and contractually require recipients to do the same.

We do not sell Personal Information for money. Whether any of our disclosures for analytics or advertising constitute a “sale” or “sharing” under certain U.S. state laws, and how to opt out, is addressed in Section 6.

We may disclose Personal Information to the following categories of recipients:

• Regulated Partners, including payment processors, liquidity and conversion providers, settlement providers, and banks, to establish and maintain your access to their services, to satisfy their legal, regulatory, and contractual requirements, and to respond to their requests for information. Regulated Partners process Personal Information under their own privacy notices and make their own compliance determinations, which Kettle does not control.
• Service providers that process information on our behalf, such as hosting and cloud providers, identity verification and sanctions-screening vendors, blockchain analytics providers, customer support and communications platforms, CRM and sales tools, analytics providers, and data enrichment providers.
• Your Counterparties and other parties to a transaction, to the extent necessary to process, document, or resolve the transaction, such as the business name associated with a payment or information needed to investigate a disputed or held payment.
• Parties you direct or authorize, including users you add to your account and third-party wallets, platforms, or integrations you connect.
• Advertising and marketing partners, where permitted by law and subject to your opt-out rights described in Section 6.
• Professional advisors, such as lawyers, accountants, auditors, and insurers.
• Government authorities, regulators, law enforcement, and other parties where we believe disclosure is required by law, legal process, or regulatory request, or is necessary to protect the rights, property, or safety of Kettle, our users, or others, or to prevent fraud or illegal activity.
• Affiliates, for purposes consistent with this Policy.
• Referral and channel partners, who may receive information relating to the accounts they introduce to us, including account status and activity, in connection with administering our referral and partner programs.
• Parties to corporate transactions, including prospective acquirers, investors, and lenders, and their advisors, in connection with due diligence or the completion of a financing, merger, acquisition, reorganization, bankruptcy, or sale of all or part of our business or assets.

We may disclose aggregated, de-identified, or anonymized information for any lawful purpose.

Public blockchains. Transactions recorded on public blockchains, and the wallet addresses involved, are publicly visible and may be linked to you by others. Kettle does not control, and is not responsible for, the collection or use of public blockchain data by third parties.

5.1 Retention

We retain Personal Information for as long as reasonably necessary for the purposes described in this Policy, taking into account the nature and sensitivity of the information, the duration of our relationship with you, our legal, regulatory, tax, and accounting obligations, the requirements of our Regulated Partners, and the need to resolve disputes, enforce agreements, and establish or defend legal claims. Compliance and verification records and related transaction documentation are generally retained for at least five years after an account is closed or a transaction is completed, or longer where required by law, a Regulated Partner, or a legal hold. When retention is no longer necessary, we delete, de-identify, or aggregate the information.

5.2 Security

We maintain administrative, technical, and physical safeguards designed to protect Personal Information, including access controls and encryption appropriate to the sensitivity of the information. No method of transmission or storage is completely secure, and we cannot guarantee the security of Personal Information. You are responsible for safeguarding your private keys, recovery phrases, credentials, and devices; Kettle cannot access or recover them.

5.3 International transfers

Kettle is based in the United States. We, our Regulated Partners, and our service providers may process Personal Information in the United States and other countries whose data protection laws may differ from those of your country. Where required, we rely on appropriate transfer mechanisms.

5.4 Blockchain data

Because public blockchains are decentralized and immutable, information recorded on them cannot be altered or deleted by Kettle and may persist indefinitely, notwithstanding any request or retention period described in this Policy.

6.1 Marketing communications

You may opt out of marketing emails by using the unsubscribe link in any such email, and out of marketing calls or text messages by replying STOP to a text or by contacting us at the address in Section 7. If you are not a Kettle customer and would prefer that we not contact you about the Services, contact us and we will add you to our suppression list. We will continue to send service, security, transaction, and compliance communications.

6.2 Privacy rights

Depending on where you live and subject to applicable exceptions, you may have the right to:

• know or access the Personal Information we hold about you and the categories of sources, purposes, and recipients;
• correct inaccurate Personal Information;
• delete Personal Information;
• receive a portable copy of Personal Information;
• opt out of the sale of Personal Information, the sharing of Personal Information for cross-context behavioral advertising, targeted advertising, and certain profiling; and
• not receive discriminatory treatment for exercising these rights.

To exercise a right, email compliance@kettlepay.net with the subject line “Privacy Request.” We will verify your request using information associated with your account or, if you have none, information sufficient to match you to our records. You may use an authorized agent where permitted by law, and we may require proof of the agent’s authority and verify your identity directly. If we deny your request, you may appeal by replying to our decision, and if your appeal is denied you may contact your state attorney general.

Limits. We may deny or limit a request where permitted by law, including where we must retain information to comply with AML, sanctions, recordkeeping, or other legal obligations, or the requirements of a Regulated Partner; to detect or prevent fraud or security incidents; or to establish, exercise, or defend legal claims. We cannot delete or alter information recorded on a public blockchain, and requests concerning information held by a Regulated Partner should be directed to that Regulated Partner.

Sensitive Personal Information. We use sensitive Personal Information, such as government identifiers and any biometric information, only for the purposes permitted by applicable law without a right to limit, as described in Section 3.

Account closure. You may request that we close your account, subject to our legal and regulatory obligations and outstanding transactions. Closing a Kettle account does not affect your control of your self-custodied wallet or your relationship with any Regulated Partner.

6.3 State-specific disclosures

Residents of California and other states with comprehensive privacy laws may obtain additional disclosures, including the categories of Personal Information we collected and disclosed in the preceding 12 months, in our U.S. State Privacy Notice at [link]. Nevada residents may submit a request to opt out of sales to the address in Section 7.

Children. The Services are intended for businesses and are not directed to individuals under 18. We do not knowingly collect Personal Information from children under 18. If you believe we have, contact us and we will delete it.

Third-party services. The Services may link to or integrate with third-party websites, wallets, blockchains, and platforms, including Regulated Partners. Their privacy practices are governed by their own policies, and Kettle is not responsible for them.

Changes to this Policy. We may update this Policy from time to time. We will post the updated Policy with a new “Last Updated” date. If we make material changes, we will provide notice by email or through the Services before the changes take effect, and where required by law we will obtain your consent before applying a material change to Personal Information we collected under a prior version of this Policy.

Contact us. Questions, requests, and complaints regarding this Policy may be directed to: