Privacy Policy

BTC Now, Inc. (“BTC Now,” “we,” “us,” or “our”) purchases and owns Bitcoin and sells Bitcoin Purchase Agreements (“BPAs” or “Agreements”) to retail buyers. A BPA gives a buyer the contractual right to acquire a specified amount of Bitcoin from BTC Now at a fixed Purchase Price by making payments over time. BTC Now is the seller, not a marketplace or exchange.

This Privacy Policy (the “Policy“) explains how we collect, use, disclose, retain, and protect personal information when you use the BTC Now website (www.btcnow.com), mobile application, and related services (collectively, the “Platform”); apply for an offer; enter into or transfer a BPA; or otherwise interact with us (the “Services“).

If you do not agree with this Policy and our terms, you should not access or use the Platform. By accessing or using the Platform, you acknowledge that you have read and agree to this Policy.

Other notices may also apply. These may include our Notice at Collection, financial privacy notice, biometric notice, SMS Privacy Policy, and other notices presented when we collect information or provide a particular service. These notices supplement, and do not replace, this Privacy Policy. This Policy does not apply to: (1) information collected by BTC Now that does not link to this Policy; (2) information collected by any third party, including through any application or content that may link to or be accessible from the Platform; or (3) any information governed by other privacy policies or notices that link to a separate privacy notice instead of this Policy.

1. Information We May Collect

We may collect and process the following types of personal information from you for the purposes listed below. We collect information about you from various sources and in various ways when you use our Platform and Services, including information you provide directly, information collected automatically, information from third-party data sources, and data we infer or generate from other data.

BTC Now may also collect other information that you voluntarily share with us to facilitate your use of the Services and Platform which is not specifically listed here. We will use such data in accordance with this Policy, as otherwise disclosed at the time of collection, in accordance with our agreement, or to the extent necessary for performing the Services.

BTC Now does not collect: card numbers (we don’t take cards), your bank login credentials (Plaid never shows them to us), precise GPS location, or information about minors.

When you are asked to provide your information, you may choose not to do so. However, if you choose not to provide information that is necessary to fulfill your requests or provide our Services, you may not be able to access portions of the Platform, or some Services or features may not be available or fully functional. Certain information may be required by law or necessary for us to provide Services you request.

2. Sensitive and Biometric Information

Sensitive information. Sensitive personal information may include government identifiers, identification documents, financial-account information, and information used to verify identity. We implement appropriate safeguards to protect sensitive personal information, including limiting access to authorized personnel with a legitimate business need. We do not use or disclose sensitive personal information for purposes that require an opportunity to limit under California law (such as for targeted advertising).

Biometric information. If identity verification uses a selfie, facial comparison, or similar technology, our identity-verification provider may collect or generate information treated as biometric information under applicable law. We use that information only for identity verification, fraud prevention, security, and compliance—not for advertising or unrelated profiling. BTC Now receives only the verification result and a provider reference identifier, which is not a biometric identifier and is retained in accordance with our retention schedule and applicable law; BTC Now does not receive or store the underlying photograph or facial comparison.

Where required, BTC Now or its provider will present a separate biometric notice and obtain consent before collection. Biometric information is retained and destroyed under that notice, our retention schedule, and applicable law.

3. How We May Use Information

We may use the information described above in connection with the following business or commercial purposes or otherwise to the extent permitted by law:

• Operate the Platform: Keep the website and app working, maintain your profile, and diagnose and resolve problems.
• Operating our business: Obtain or maintain insurance coverage, manage risks, obtain professional advice, enforce our Terms and Conditions and other agreements, comply with contractual obligations, and manage our relationships with you.
• Review eligibility: Verify your identity, complete KYC/CIP, sanctions and fraud screening, and review other threshold Program requirements. We perform these checks to comply with applicable law and protect the Program and its users. Protected classifications are not used in determining eligibility.
• Create and service your BPA: Generate your Purchase Summary and BPA, process payments and manage AutoPay, provide required notices, administer hardship and transfer requests, process a BPA Termination, and facilitate delivery of your Bitcoin.
• Administer the Bitcoin: Maintain records relating to the Dedicated Wallet and Buyer’s Wallet, coordinate with the BTC Now Bitcoin Trust and custodian, and retain information required to complete and document delivery or another BPA settlement.
• Protect you and BTC Now: Detect, prevent, and investigate fraud, unauthorized access, security incidents, and misuse.
• Communicate with you: Send service and profile messages by email or through the Platform, send text messages if you opt in, determine user interests, for usage analytics purposes, keep records of our communications with you, and respond when you request support.
• Market our services: Send information about BTC Now’s own services, subject to your right to opt out; tailor our products and Services so they are more relevant to you; conduct research and analysis for marketing, business, and other operational purposes; provide targeted offers and advertisements. We do not use your information for third-party advertising.
• Operate the Referral Program: Track referrals and administer referral rewards if you participate.
• Improve the Platform: Analyze how the website and app are used through providers acting on our behalf.
• Legal compliance: Enforce our agreements, comply with federal, state, or local laws, comply with civil, criminal, or regulatory inquiries or investigations, cooperate with law enforcement, and establish, exercise, or defend legal rights or claim.

We may create, disclose, and otherwise use information as de-identified or aggregated data. Once properly de-identified or aggregated in accordance with applicable standards, such data is no longer treated as personal information subject to this Policy.

We will not use personal information for a materially different purpose without first updating this Policy and providing any notice or obtaining any consent required by law.

4. Eligibility

BTC Now uses personal information for one review for eligibility.

Eligibility determines whether you meet the threshold requirements to participate in the Program. It may include identity verification through Plaid/Persona, KYC/CIP, sanctions and fraud screening, residency, age, legal capacity, supported-account requirements, and other Program requirements.

How eligibility decisions are made. Eligibility results are produced by automated rules that BTC Now has written and tested, applied to the categories of information listed above: identity-verification and screening results; your state of residence and age; and the information you enter in the application. Eligibility is not based on race, color, religion, national origin, sex, marital status, age (other than legal capacity), receipt of public assistance, or military status. If BTC Now takes an action and applicable law requires notice, we will provide it. If you think an eligibility result is based on inaccurate information (for example, a mistaken identity result), you may ask us to have a person with authority to change the result review the inputs with you by contacting privacy@btcnow.com. Where state law gives you the right to opt-out of profiling or automated decisions that produce legal or similarly significant effects, or to question a result and be told the reasons for it, you may exercise that right by the same method. Please note that we cannot make an offer without completing the identity, sanctions, and fraud screening the law requires, so declining that screening means we cannot proceed with your application. BTC Now does not furnish your BPA payment history to consumer reporting agencies.

5. Cookies and Analytics

A “cookie” is a small file created by a web server that can be stored on your device (if you allow) for use either during a particular browsing session (a “session” cookie) or a future browsing session (a “persistent” or “permanent” cookie). “Session” cookies are temporarily stored on your device and only last until they expire at the end of your browsing session. “Persistent” or “permanent” cookies remain stored on your device until they expire or are deleted by you. Local stored objects (or “flash” cookies) are used to collect and store information about your preferences and navigation to, from, and on a website. First-party cookies are set by the website you are visiting, and they can only be read by that site. Third-party cookies are set by a party other than that website.

Other Similar Technologies. In addition to cookies, we may use automatic data collection technologies, such as Internet tags, web beacons (clear gifs, pixel tags, and single-pixel gifs), and navigational data collection (log files, server logs, etc.) to collect data as users navigate through and interact with the Services, including relating to your viewing of any video content. For example, web beacons are tiny graphics with unique identifiers that are used to understand browsing activity. In addition, UTM codes are strings that can appear in a URL when you move from one web page or website to another. The string can represent information about browsing, such as which advertisement, page, or publisher sent the user to the receiving website. By viewing any video content on the Platform, you consent to the collection of data related to your accessing of such content, including any automatically collected data.

Cookies and Similar Technologies We May Use And Why We Use Them

To optimize the user experience and with your consent where required by law, our Platform uses cookies and similar tracking technologies to operate core features, understand usage, improve performance and design, and enhance security. The technologies we use may include cookies, web beacons (also called pixel tags or clear GIFs), local storage, SDKs, and tags/scripts. These technologies may collect information such as device identifiers, browser type and settings, operating system, IP address (which may be considered personal information under applicable law), general location, referring/exit pages, pages viewed, links clicked, time spent, and other interactions with the Platform.

Cookies may be set by BTC Now (first-party) and by third parties that provide services to us (third-party), including our hosting, analytics, security, and recruiting vendors.

The cookies and similar technologies used on the Platform include the following:

Essential: Essential cookies are strictly necessary for basic features and functionality of the Platform and do not require your consent. Without these essential cookies, the Platform will not perform properly and we may not be able to provide you with certain Services you have asked for, provide access to secure areas, and choices you have made for better functionality cannot be provided.

Functionality: Functionality cookies help us customize content on the Platform based on your preferences. We use functionality cookies to remember choices you’ve made or information you’ve provided, such as your username or the region you are in. This allows us to tailor your experience on the Platform to your preferences.

Analytics and Performance: We use analytics and performance cookies to collect information about how you use the Platform, including which website pages you go to most often and if users receive error messages from certain pages in order to help us fix technical issues or errors and highlight areas where we can improve the Platform. We also use these cookies to detect the most searched for words in search engines that lead to the Platform. You may also encounter third-party analytics and performance cookies on our Platform which may gather browsing activity (such as information you have entered or choices you have made) across numerous websites that you visit and across numerous browsing sessions. These cookies also help improve how our Platform functions and performs, customizes your interaction with our Platform, and helps provide more relevant messaging and marketing communications to you.

Advertising: Advertising cookies and other similar technologies are used by us to enable us to understand your interests and tailor marketing to you and your interests and provide you with a more personalized service. These cookies remember that you visited our Platform and we may share this information with third-parties, such as advertising platforms, so that we can show you relevant offers and direct personalized advertising to you. These cookie-based disclosures may constitute “sharing” or a “sale” under applicable state privacy laws, including for targeted advertising, even if BTC Now does not receive monetary consideration. We may also use these cookies to target and re-target visitors to our website with digital advertising that is most relevant to the user. These cookies are also used to limit the number of times you see an advertisement or particular content, as well as help measure the effectiveness of an advertising or marketing campaign.

Visitor identifier: We set one first-party cookie, btcnow_vid, holding a random identifier for your browser. It lets us match questions you ask in our chat to an early-access signup you make later on the same browser, so we can send you the answers we promised. It identifies the browser, not you, until you sign up. It is not shared with advertising partners, and it lasts up to 400 days, renewed on each visit.

Chat questions: Questions you type into our chat are sent to Anthropic, our language-model provider, only to find the matching approved answer. We remove email addresses and long numbers before we store a question, and we keep the stored questions so we can answer them.

We also use third-party digital tracking technologies on our website and receive data from such technologies including, but not limited to, the following:

Google Analytics. Where you have explicitly consented or have not disabled third party advertising cookies (depending on your location), we use Google Analytics to collect and process statistical data about the number of people using the Platform and to better understand how they find and use the Platform. The data collected includes data related to your device/browser, your IP address, and on-site activities to measure and report statistics about user interactions. The information stored is reduced to a random identifier. Google may show advertisements for us across the Internet. Google also uses cookies and other similar technologies to serve ads based on someone’s past visits to our Platform. Any data collected by Google Analytics is used in accordance with this Policy and Google’s Privacy Policy. You can learn more about Google’s restrictions on data use by visiting the Google Privacy Policy. You can learn more about Google’s advertising services by visiting its Technologies page along with information on Google Analytics.

You can opt-out of Google’s use of cookies or device identifiers by visiting Google’s Ads Settings. You can also opt-out of Google Analytics, by installing the Google Analytics Opt-out Browser Add-on feature. For more details, visit the Google Analytics Opt-out Browser Add-on page.

Google Tag Manager. We may use Google Tag Manager, which allows marketed website tags to be managed using an interface. The tool itself (which implements the tags) does not use cookies and does not register identifiable data. The tool causes other tags to be activated which may, for their part, register personal information under certain circumstances and be used for retargeting. Google Tag Manager does not access this information. Google Tag Manager is subject to the Google Privacy Policy located at: https://www.google.com/policies/privacy.

How Do Our Advertising and Marketing Partners Use Cookies for Interest-Based Advertising?

We may use third parties such as advertising networks and other content providers to serve targeted ads on our Platform and on other websites like social media websites. This practice is referred to as interest-based advertising. These advertising networks and/or content providers may use cookies and similar tracking technologies to uniquely distinguish you, your web browser, or your device and report certain information about your visits to our Platform and other websites (e.g., web pages you visit and your response to ads) in order to measure the effectiveness of our marketing campaigns and to deliver ads that are more relevant to you, both on and off the Platform and across your devices, including on social media websites. This information may also be used to evaluate our online advertising campaigns.

Some third parties may use data collection technologies to collect information from our Platform and combine it with other information they have collected relating to your web browser’s activities across their network of websites, where permitted. We do not control these third parties’ technologies or how they may be used. If you have questions about targeted content, you should contact the responsible party directly or consult their privacy policies. Please see examples of the opt-outs offered below.

How Can You Opt-Out from Interest-Based Advertising?

Some advertising networks we may use for these purposes may be members of the Digital Advertising Alliance (“DAA”) or the Network Advertising Initiative (“NAI”). Please visit the website below to learn more about interest-based advertising and to opt out of receiving personalized advertising or content from participating third-party advertising companies:

• Digital Advertising Alliance: https://optout.aboutads.info/?lang=EN&c=2#!%2F
• National Advertising Initiative: https://optout.networkadvertising.org/?c=1#!%2F

Please note that if you opt-out, you may still receive online advertising from us, but it will not be tailored to your interests based on online behavioral information about you. To successfully opt-out, you must have cookies enabled in your web browser (see your browser’s instructions for information on cookies and how to enable them). Your opt-out only applies to the web browser you use, so you must opt-out of each web browser on each computer you use. Once you opt-out, if you delete your browser’s saved cookies, you will need to opt-out again.

Choices About Cookies

Most web browsers are set by default to accept cookies. If you do not wish to receive cookies, you may set your browser to refuse all or some types of cookies or to alert you when cookies are being stored. These settings may affect your enjoyment of the functionality of the Platform. Adjusting the cookie settings may not fully delete all of the cookies that have already been created. To delete them, you should review your web browser settings after you have changed your cookie settings.

If you decline the use of cookies, you may not have access to the full benefits of the Platform. Further, your opt-out applies to the web browser you use, so you must opt-out of each web browser on each computer you use. Once you opt-out, if you delete your browser’s saved cookies, you will need to opt out again. In addition, adjusting the cookie settings on the Platform may not fully delete all of the cookies that have already been created. To delete them, visit your web browser settings after you have changed your cookie settings on the Platform.

The links below provide additional information about how to disable cookies or manage the cookie settings. PLEASE NOTE: These third-party links are provided for your convenience, and we may not actively monitor the content of these links.

• Google Chrome: https://support.google.com/chrome/answer/95647?hl=en
• Firefox: https://support.mozilla.org/en-US/kb/enable-and-disable-cookies-website-preferences
• Internet Explorer: http://windows.microsoft.com/en-GB/windows-vista/Block-or-allow-cookies
• Safari; iOS: https://support.apple.com/guide/safari/manage-cookies-and-website-data-sfri11471/mac and https://support.apple.com/en-us/HT201265
• Microsoft Edge: https://support.microsoft.com/en-us/microsoft-edge/delete-cookies-in-microsoft-edge-63947406-40ac-c3b8-57b9-2a946a29ae09

For more information on how to modify your browser settings to block or filter cookies, visit http://www.aboutcookies.org/. You may learn more about internet advertising practices and related consumer resources at https://youradchoices.com/control, https://thenai.org/about-online-advertising/faq, and http://www.networkadvertising.org/choices.

Online Tracking Signals. We do not currently recognize browser settings or signals of tracking preferences, which may include “Do Not Track” instructions. “Do Not Track” is a web browser setting that seeks to disable the tracking of individual users’ browsing activities. We adhere to the standards set out in this Policy and do not currently respond to “Do Not Track” signals on the Services or on third-party websites or online services where we may collect information.

How to Opt-Out. We recognize the Global Privacy Control (GPC) signal. Certain disclosures through cookies and similar technologies described in Section 5 may constitute “sharing” or a “sale” for targeted advertising under applicable state privacy laws. We will treat a recognized GPC signal as a request to opt out of those disclosures where required by law. GPC does not alter our processing of information that is not subject to the signal or is exempt from applicable state privacy laws.

6. How We Disclose Information

We may disclose personal information to:

• Service providers: Providers supporting Plaid/Persona identity verification and bank connectivity, fraud and sanctions screening, payments, custody, wallets, BPA administration, electronic signatures and vaulting, hosting, security, communications, support, and analytics. We require these service providers to maintain the confidentiality and security of personal information they process on our behalf and to use it only for the purposes for which we disclose it to them.
• The BTC Now Bitcoin Trust: To hold legal title to Bitcoin associated with active BPAs and support custody, delivery, and Agreement Terminations. The Trust receives only the information needed for those purposes and does not use it for marketing.
• Custodians and wallet providers: To maintain Dedicated Wallets and Buyer’s Wallets, verify identity where required, and complete delivery or another BPA settlement.
• Transfer and assignment parties: To review or complete a requested BPA transfer, release an original buyer, maintain or transfer the authoritative BPA record, or complete an assignment permitted by the BPA.
• Professional advisers: Lawyers, auditors, accountants, insurers, and consultants subject to professional or contractual duties.
• Government and legal recipients: Courts, law enforcement, regulators, taxing authorities, and others when disclosure is required or permitted by law or reasonably necessary to protect rights, safety, or security.
• Acquisition and similar transactions: If we sell, transfer, or otherwise share some or all of our assets in connection with a merger, reorganization, liquidation, dissolution, bankruptcy, or sale of assets, we may disclose your personal information as a part of the assets transferred as a result of the transaction. For example, if another company acquires us, we will share your personal information with that company.
• With your consent or at your direction: A person or service you direct us to contact or provide information to.
• Deidentified or aggregated data: We may share aggregated information, and information that does not identify any specific individual, such as groupings of demographic data and customer preferences, (i) for compliance with reporting obligations; (ii) for business or marketing purposes; and (iii) to assist us and others in understanding our users’ interests, habits, and usage patterns for certain programs, content, services, marketing, and/or functionality.

BTC Now does not sell personal information for monetary consideration and does not furnish BPA payment history to consumer reporting agencies. However, certain cookie-based disclosures described in Section 5 may constitute a “sale” or “sharing” under applicable state privacy laws, including for targeted advertising.

We do not share your personal information with data brokers, (for your payment history) credit bureaus, or non-affiliated third parties for their independent marketing purposes.

7. Financial Privacy

BTC Now may provide a separate financial privacy notice describing how we collect, disclose, and protect nonpublic personal information under applicable financial-privacy law. If provided, that notice supplements this Policy and controls to the extent required by law for the information and practices it covers.

8. Bitcoin, Wallets and the Blockchain

The Bitcoin blockchain is public and generally permanent. On-chain transactions may remain visible after BTC Now deletes related information from its systems.

A Dedicated Wallet address will be visible in your Purchase Summary or profile so you can review the Bitcoin associated with your BPA. The blockchain ordinarily does not display your name, but a person who knows an address is associated with you may observe its activity.

When you become entitled to delivery, a regulated custodian may establish a Buyer’s Wallet for your benefit and verify your identity. BTC Now and its providers may retain records linking you, the BPA, the Dedicated Wallet, the Buyer’s Wallet, and the related blockchain transaction as needed to administer the BPA, prevent fraud, comply with law, and maintain transaction records.

After delivery, activity in your wallet is publicly visible on-chain, forever. Blockchain records can’t be edited or deleted, by you, by us, or by any privacy request. State privacy laws give you deletion rights over personal information in our possession or control. On-chain records are neither: they are held by a public network, not by BTC Now. What we can and will do, when you ask and the law permits, is delete or break the link in our own systems between your identity and the wallet addresses associated with your BPA, subject to the recordkeeping periods described in Section 12.

9. Your Rights and Choices

Depending on where you live in the United States, you may have certain rights relating to your Personal Information, which may include those described below. We will respond to requests from individuals in accordance with applicable law; however, we reserve the right to deny any requests where appropriate and permitted by applicable law. Please use the “Contact Us” details provided at the end of this Policy to exercise your rights and choices under this Policy.

Email Opt-Out. If you no longer wish to receive communications from us via email, you may opt-out by clicking the “unsubscribe” link at the bottom of our emails, and you may opt-out of other communications by contacting us via the “Contact Us” details at the end of this Policy or by contacting us at support@btcnow.com and providing your name and email address so that we may identify you in the opt-out process. Once we receive your instruction, we will promptly take corrective action. Please note that registered users on the Platform cannot opt-out of receiving transaction emails related to their account.

Text Messages (SMS) Opt-Out. We may ask for your consent to receive text messages (including messages related to the Services or transaction requested by you or our other products or Services that may be of interest to you). Certain text messages may be sent by automated systems or technology. You may unsubscribe from marketing text messages at any time by replying STOP or clicking the unsubscribe link (where available) in the text messages or text HELP for help. For additional information, please review our SMS Terms of Service.

Cookies. You may be able to set your browser to refuse all or some browser cookies or to alert you when cookies are being sent. You may also adjust your cookie preferences by using the cookies consent banner, if available.

Accuracy and Updating Your Information. Our goal is to keep your personal information accurate, current, and complete. If you have an account with us, you may update certain information by logging in, or by letting us know via the “Contact Us” details at the end of this Policy. We are not responsible for any losses arising from any inaccurate, inauthentic, deficient, or incomplete personal information that you provide to us.

Complaints. If you believe your rights relating to your personal information have been violated, please contact us via the “Contact Us” details provided at the end of this Policy.

California Residents. Under California Civil Code Section 1798.83, California residents who provide personal information in obtaining products or services for personal, family, or household use may be entitled to request and obtain from us once each calendar year information about the information we shared, if any, with other businesses for direct marketing uses. We do not currently share your personal information with third parties for those third parties’ direct marketing purposes. Please be aware that not all information sharing is covered by California’s “Shine the Light” requirements, and only information regarding covered sharing (if any) will be included in our response. As a part of the California Online Privacy Protection Act, all users of our Platform may make any changes to their information at any time by contacting us at support@btcnow.com.

The rights described in this section generally do not apply to nonpublic personal information collected, processed, or disclosed pursuant to the Gramm-Leach-Bliley Act, which is subject to BTC Now’s financial privacy notice.

10. Individual Privacy Rights

To the extent you are a resident of certain U.S. states with comprehensive state privacy laws, you may be eligible for one or more of the following consumer rights where authorized by applicable U.S. state privacy laws. This section provides an overview of these rights which we honor where required by applicable law:

• Right to Access. Subject to certain conditions set forth in the applicable U.S. state privacy laws, you have the right to know and see what personal information we have collected about you and receive a copy of such information in a portable format, purposes for which we collect your personal information, recipients of your personal information to whom we disclose or share, which in some states may include categories of personal information collected, categories of sources of collection, business or commercial purposes for data processing, and categories of third parties with whom we disclose that information.
• Right to Correct. Subject to certain conditions and exceptions set forth in the applicable U.S. state privacy laws, you have the right to request that we correct any inaccurate personal information that we have collected about you.
• Right to Delete. Subject to certain conditions and exceptions set forth in the applicable U.S. state privacy laws, you have the right to request that we delete the personal information we have collected about you.
• Right to Opt-Out. Residents of certain states may have the right to direct us to stop selling, and for residents of California, sharing, your personal information to third parties and to refrain from doing so in the future. Residents of certain states also have the right to opt out of targeted advertising and profiling based on your personal information.
• Right to Non-Discrimination. You have the right not to be discriminated against for exercising any of your rights under any applicable U.S. state privacy laws.
• Right to Appeal. To the extent the applicable U.S. state privacy laws provide such rights, you may appeal our denial to act on your consumer rights under the applicable state privacy laws within a reasonable time. We will respond within designated period for responding to U.S. data subject requests and may exercise the right to extend this response period (to the extent authorized by applicable state privacy laws).

How to Exercise Your Rights. You may submit a request to exercise one of the above rights by emailing support@btcnow.com.

In your request, please specify the right you wish to exercise and provide enough information to help us verify your identity and locate your records. We may request additional information solely to verify your identity and protect privacy and security. If we deny your request (for example, where we must retain certain records for legal, security, or equal employment opportunity obligations), we will provide a reason where required by law.

Authorized Agents. Where permitted by law, you may designate an authorized agent to submit a request on your behalf; we may require proof of authorization and your identity. If we deny your request, you may appeal by emailing support@btcnow.com and indicating “Privacy Request Appeal” in the subject line.

Non-Discrimination. We will not discriminate against you for exercising your privacy rights.

Excessive Requests. If requests from a consumer are manifestly unfounded or excessive, in particular because of their repetitive character, we may either (1) charge a reasonable fee, or (2) refuse to act on the request and notify the consumer of the reason for refusing the request. If we charge a fee, the amount will be based upon the administrative costs of providing the information or communication or taking the action requested.

GLBA Carve-Out. The rights described in this section generally do not apply to nonpublic personal information collected, processed, or disclosed pursuant to the Gramm-Leach-Bliley Act, which is subject to our financial policy.

Opt-Out Preference Signals/Universal Opt-Out Mechanism. To the extent certain cookie-based disclosures described in Section 5 may constitute a “sale” or “sharing” under California law, we will provide a “Do Not Sell or Share My Personal Information” link and honor opt‑out preference signals (such as Global Privacy Control) consistent with applicable law.

11. California Residents

All terms used in this section shall have the meanings given in the California Consumer Privacy Act (“CCPA“), where applicable.

CCPA Notice at Collection

We collect and process personal information as described in the above Information We May Collect & How We May Use Information section of this Policy. The relevant CCPA categories for this information are indicated below. We may provide a separate notice at collection if we collect additional information or intend to use information for additional purposes.

Exclusions from Personal Information

Personal information does not include:

• Publicly available information or lawfully obtained, truthful information that is a matter of public concern.
• Consumer information that is deidentified or aggregated.
• Information excluded from the scope of the CPRA including, but not limited to:
  • To the extent applicable, personal information collected, processed, sold, or disclosed subject to the Gramm-Leach-Bliley Act (GLBA) or the California Financial Privacy Act.
  • An activity involving the collection, maintenance, disclosure, sale, communication, or use of any personal information bearing on a consumer’s credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living by a consumer reporting agency, a furnisher of information who provides information for use in a consumer report, and by a user of a consumer report provided that the agency, furnisher, or user is subject to regulation under the Fair Credit Reporting Act (FCRA).
  • Medical information governed by the Confidentiality of Medical Information Act or protected health information as governed by the U.S. Department of Health and Human Services pursuant to the Health Insurance Portability and Accountability Act of 1996 (HIPAA).
  • Personal information collected, processed, sold, or disclosed pursuant to the Driver’s Privacy Protection Act of 1994.

Categories of Sources: We collect the personal information in this Privacy Policy directly from you when you provide it to us, automatically as you navigate through our Platform, and from third parties, including business partners and public sources, as applicable.

Business and Commercial Purposes for Collecting: We have collected the categories of personal information listed above for the purposes identified in the “How We May Use Your Information” Section of this Policy.

Categories of Personal Information Disclosed for a Business Purpose: We have disclosed the following categories of personal information to service providers or contractors for a business purpose, or upon your consent to third parties, during the preceding 12 months. We have disclosed each category of personal information to some or all of the following categories of third parties: (1) affiliates; (2) advisors (e.g., accountants, attorneys); (3) service providers (e.g., data analytics, data storage, mailing, payment processing, administration, technical support); (4) marketing providers; (5) investors; and (6) as required by law, to government agencies, law enforcement, and regulatory authorities.

• Identifiers
• Categories Described in the Customer Records Statute
• Commercial Information
• Characteristics of Protected Classifications
• Internet or Other Electronic Network Activity Information
• Geolocation Data
• Audio, Electronic, Visual, Thermal, Olfactory, or Similar Information
• Sensitive Personal Information

Personal Information Sold or Shared: We may sell or share the following categories of personal information:

• Identifiers
• Personal information described in Cal. Civ. Code § 1798.80(e)
• Internet or other similar network activity

No Financial Incentives: We offer a financial incentive through the referral program described in Section 9. The program is voluntary; its material terms, the categories of Personal Information involved, how to opt in or withdraw, and our good-faith estimate of the value of that information are described in Section 9. We do not offer any other financial incentives or any price or service difference in exchange for the retention or sale of your personal information.

Non-Discrimination: You have the right not to receive discriminatory treatment by us due to your exercise of the rights provided by the CCPA.

California Consumer Rights and Choices

The CCPA provides Consumers with specific rights regarding their personal information. This section describes your rights and explains how to exercise those rights. You may submit requests to us as described below and we honor those rights where they apply.

Right to Know: You have the right to request that we disclose personal information that we have collected, sold, or shared about you. This includes a request for any or all of the following:

• The categories of personal information we have collected about you.
• The categories of sources from which the Personal information is collected.
• The categories of personal information that we have sold or shared for a business purpose about you.
• The categories of third parties to whom the personal information was sold or shared for a Business purpose.
• The specific pieces of personal information we collected about you.
• The business or commercial purpose for collecting, selling, or sharing personal information.

Right to Delete: You have the right to request that we delete any personal information that we have collected, sold, or shared about you.

Right to Limit: In certain circumstances, you have the right to limit the use and disclosure of sensitive personal information. Our use of your sensitive personal information is solely for business purposes and not for those purposes for which a Consumer may exercise a right to limit the use or disclosure under the CCPA. Therefore, we include this disclosure of information for informational purposes only.

Right to Opt-Out of Sale/Sharing: You have the right to direct a business that Sells or Shares personal information about you to third parties to stop doing so.

Right to Correct: You have the right to request that we correct inaccurate personal information that we maintain about you. Our goal is to keep your personal information accurate, current, and complete.

Other California Privacy Rights: Under California Civil Code Section 1798.83, California residents who provide personal information in obtaining products or services for personal, family, or household use may be entitled to request and obtain from us, once a calendar year, information about the information we shared, if any, with other businesses for direct marketing uses. Please be aware that not all information sharing is covered by the “Shine the Light” requirements and only information on covered sharing, if any, will be included in our response. As part of the California Online Privacy Protection Act, all users of our Platform may make any changes to their information at any time by contacting us at support@btcnow.com.

How to Submit Consumer Requests

You may submit a request a Request to Know, Request to Delete, or Request to Correct by either:

• Emailing support@btcnow.com with the subject line “State Privacy Rights Request”

You may submit a Request to Opt-Out of Sale/Sharing by:

• Emailing support@btcnow.com with the subject line “Do Not Sell or Share My Personal Information”; or
• Submitting a Data Privacy Rights Request

Limitations: We are committed to responding to requests in accordance with applicable law. However, your rights are subject to certain limitations including, but not limited to, the following:

• We are only required to respond to Requests to Know twice in a 12-month period.
• A response to a Request to Know may be limited to the 12-month period preceding receipt of the request if it would be impossible, involve disproportionate effort, or the request is for data for a specific time period.
• We are prohibited from disclosing certain specific pieces of personal information in response to a Request to Know including, but not limited to, Social Security numbers, driver’s license numbers, and financial account numbers.

12. Retention

We retain personal information as reasonably necessary to operate the Platform; administer applications, offers, and BPAs; complete transfers, deliveries, and BPA Terminations; maintain transaction records; comply with law; resolve disputes; prevent fraud; protect security; and establish or defend legal claims.

Retention varies by category and context. Profile and servicing information is generally kept while a profile or BPA is active and afterward as needed. Application, identity, compliance, BPA, payment, transfer, wallet, and signature records may be retained for legally required periods. Certain records are generally retained for five years, while some BPA, electronic-record, tax, audit, dispute, or corporate records may be retained for up to ten years. Biometric information is retained under the applicable biometric notice and law. Blockchain records cannot be deleted by BTC Now.

When information is no longer needed, we take reasonable steps to delete, destroy, or deidentify it. We delete personal information when: (1) we have a legal obligation to do so; (2) we no longer have a purpose for retaining the information; or (3) you ask us to delete your personal information, unless we determine that doing so would violate our existing legal, regulatory, dispute resolution, contractual, or similar obligations. To the extent permitted by law, we may retain and use anonymous, deidentified, or aggregated information for performance reporting, benchmarking, and analytic purposes and for product and service improvement. We maintain de-identified information in deidentified form and do not attempt to reidentify it except as permitted by law.

13. Security

BTC Now recognizes the importance of safeguarding your personal information and maintains reasonable and appropriate administrative, technical, and physical safeguards designed to protect personal information against accidental loss and unauthorized access, use, alteration, or disclosure. These may include access controls, encryption, authentication, logging, monitoring, incident response, training, and vendor oversight. We are not responsible for circumvention of any privacy settings or security measures contained on the Platform.

No system is completely secure, and we cannot guarantee absolute security. We provide legally required notice of a security incident. If we learn of a security breach or incident affecting your information, we’ll notify you as the law requires.

14. Children’s Privacy

The Platform and our Services are intended for adults age 18 and older and are not directed to children under 13. BTC Now does not knowingly collect personal information from children under 18. If we learn we have collected personal information from a child under 13, we will delete it in accordance with applicable law. If you are a parent or guardian and believe we have collected information from a child under 13, please contact support@btcnow.com.

15. Third-Party Services

The Platform may link to or integrate with third-party services, websites, or content that BTC Now does not control. This Privacy Policy does not apply to those third parties. Information provided directly to a third party is governed by that party’s privacy policy and terms. The inclusion of a link on the Platform does not imply endorsement of the linked site or service by us. We are not responsible for the privacy practices or content of third-party Platform. We encourage you to review each third-party site’s terms and privacy policies before providing any personal information.

16. Changes and Contact Information

We may update this Policy to reflect changes in our practices, technologies, services or legal requirements. We will post the revised Policy with a new effective date and provide additional notice or obtain consent where required.

If a change meaningfully affects how we handle personal information already collected, we’ll notify you (email or in-app) before it takes effect, and where the change concerns your Agreement-covered information, the Privacy & Data Notices are reissued. Your continued use of the Platform after the effective date of any changes constitutes your acceptance of the revised Policy.

Prior versions are available from support@btcnow.com.

BTC Now Inc. · Attn: Privacy · 919 N Market St, Suite 406, Wilmington, DE 19801

Privacy questions and requests: support@btcnow.com

If you need this Policy in an alternative format, contact us using the information above.

Your Bitcoin Purchase Agreement and its Privacy & Data Notice control for your account; this Policy is the public description. It is not investment, legal, or tax advice.

See also our Terms of Service.