Privacy Policy

Effective October 1, 2026

This Privacy Policy describes how Gradient Systems, Inc. ("Gradient," "we," "us," or "our") collects, uses, and protects information when you use our platform, API, and related services (the "Services"). We are committed to protecting your privacy and handling your data responsibly.

1. Information We Collect

1.1 Account Information

When you create an account, we collect:

Organization details: Legal name, type, and handle (username).
Contact information: Work email address.
Authentication data: Session tokens (hashed; we use passwordless email verification).

1.2 Verification Information (Transit Only)

During business verification (KYB) for mainnet access, we collect information required by our licensed service providers, which may include:

Employer Identification Number (EIN).
Beneficial owner information (name, date of birth, Social Security Number).
Business address and formation documents.

This information is transit-only. It is transmitted directly to our licensed third-party verification partners and is never stored in Gradient's databases, never logged, and never persisted in any form. Our systems actively redact these fields from all logs.

1.3 Transaction Data

We record transaction metadata necessary to provide the Services: amounts, currencies, timestamps, transfer statuses, and counterparty identifiers. Card PANs (primary account numbers) are never stored — only tokenized aliases.

1.4 Fraud and Risk Data

To protect your account and the platform, we collect and analyze data for fraud detection, risk assessment, and regulatory compliance:

Behavioral signals: Login patterns, session timing, device fingerprints, and browser identifiers.
Transaction monitoring: Transfer amounts, frequency, counterparties, and velocity patterns.
Risk scoring: We generate internal risk scores based on activity patterns to identify potentially fraudulent or unauthorized activity.
Third-party risk services: We may share relevant data with our licensed service providers for sanctions screening, anti-money laundering (AML) checks, and identity verification.

This data is used solely for account protection, compliance with applicable law (including the Bank Secrecy Act and AML regulations), and the prevention of unauthorized transactions. It is not used for marketing or advertising purposes.

1.5 Technical Data

We automatically collect technical information when you use the Services:

IP address and approximate location (for security and fraud prevention).
Browser type and device information.
API request metadata (method, path, response status, timing).

2. How We Use Information

Purpose	Data used
Provide and operate the Services	Account, transaction, and technical data
Business verification	KYB information (transit only — forwarded, not stored)
Fraud detection and risk analysis	Behavioral signals, transaction patterns, risk scores, device data
Security and account protection	Technical data, session data, audit logs
AML / sanctions compliance	Identity data, transaction data (shared with licensed providers)
Communicate with you	Email address
Comply with legal obligations	As required by applicable law
Improve the Services	Aggregated, de-identified usage data

3. How We Protect Information

We implement the following security measures:

Encryption: All data is encrypted in transit (TLS) and at rest.
Hashing: Session tokens and API keys are stored as SHA-256 hashes — the plaintext is shown once and never retained.
PAN protection: Card numbers are never stored; only tokenized aliases are used.
Log redaction: Sensitive fields (SSN, EIN, DOB, tax IDs, account numbers, routing numbers, phone numbers, and beneficial owner information) are automatically redacted from all logs.
Access controls: Role-based access (owner, admin, member) limits who can perform sensitive operations.
Audit trail: All significant actions are recorded in an immutable audit log.

4. Information Sharing

We share information only in the following circumstances:

Brale Inc.: Gradient's Services are powered by Brale Inc., which provides digital asset custody, settlement, and payment infrastructure. We share account information, verification data, and transaction data with Brale as necessary to operate the Services. Your data shared with Brale is governed by the Brale Privacy Policy.
Other service providers: We may share information with additional licensed partners who provide card issuing, payment routing, sanctions screening, and identity verification services. These providers are contractually bound to protect your information and use it only to provide their services.
Legal requirements: We may disclose information when required by law, subpoena, court order, or regulatory request.
Business transfers: In connection with a merger, acquisition, or sale of assets, your information may be transferred as part of the transaction.
With your consent: We may share information with your explicit consent.

We do not sell your personal information. We do not share your data with third parties for their marketing purposes.

5. Data Retention

We retain account and transaction data for as long as your account is active and as required by applicable law and regulation (including anti-money laundering record-keeping requirements). Verification information is never retained by Gradient — it is forwarded to our verification partners at the time of submission and immediately discarded.

When you close your account, we will delete or anonymize your data within 90 days, except where retention is required by law.

6. Your Rights

Depending on your jurisdiction, you may have the right to:

Access the personal information we hold about you.
Correct inaccurate information.
Request deletion of your information (subject to legal retention requirements).
Restrict or object to certain processing.
Data portability — receive your data in a structured, machine-readable format.

To exercise these rights, contact us at privacy@gradientsystems.com. We will respond within 30 days.

7. Cookies and Tracking

The Gradient platform uses only essential, first-party session cookies required for authentication. We do not use advertising cookies, tracking pixels, or third-party analytics cookies. We may use privacy-respecting analytics to measure aggregate usage patterns.

8. API Data

When you use the Gradient API, request metadata (method, path, status code, and timing) is logged for operational and security purposes. Request and response bodies containing sensitive financial data are not logged. API keys must be stored securely and are your responsibility to protect.

9. International Data

The Services are operated from the United States. If you access the Services from outside the United States, your information may be transferred to and processed in the United States. By using the Services, you consent to this transfer.

10. Children's Privacy

The Services are not directed to individuals under 18 years of age. We do not knowingly collect personal information from children.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes at least 30 days before they take effect by email or through the Services. The "Effective" date at the top indicates when the policy was last revised.

12. Contact Us

If you have questions about this Privacy Policy or our data practices, contact us at:

Gradient Systems, Inc.
privacy@gradientsystems.com