cashBTC Privacy Policy

Effective Date: November 9, 2026 · Last Updated: November 9, 2026

1. Introduction

This Privacy Policy describes how Cashen International (BVI) Limited, the issuer of cashBTC ("we," "us," or "our"), collects, uses, discloses, and protects information in connection with cashBTC.cc (the "Site") and the onboarding of Authorized Minters for cashBTC.

cashBTC is a 1:1 bitcoin-backed token on the Canton Network. It is issued by us. The bitcoin backing cashBTC is held by Cashen Trust, a Cayman Islands trust with Leeward Trust Limited as trustee (the "Trustee"), at a qualified custodian.

By accessing the Site or submitting information to us, you acknowledge this Privacy Policy. If you do not agree, do not use the Site.

2. Who This Policy Applies To

This policy applies to:

• Site visitors: anyone who browses the Site.
• Interested parties: individuals and organizations who register interest, subscribe to updates, or contact us through the Site.
• Authorized Minter applicants: institutions applying to mint and redeem cashBTC, and their directors, beneficial owners, and authorized representatives.

Only onboarded institutions that have completed KYB and AML verification may mint or redeem cashBTC. Minting and redemption are not available to US persons or to individuals. The Site is not intended for persons under the age of 18.

3. Information We Collect

3.1 Interest and Contact Information

When you register interest or contact us, we collect your name, email address, organization, role, country, and the nature of your interest (for example minting, integrating, or market making).

3.2 Authorized Minter Onboarding Information

As part of KYB and AML onboarding, we collect:

• legal entity name, jurisdiction of incorporation, and registered address;
• certificate of incorporation, constitutional documents, and corporate structure documentation, including shareholder registers and organizational charts;
• identity documents and proof of address for directors and for beneficial owners holding more than 25% ownership;
• contact details for authorized representatives;
• the institution's Canton Network party identifier, registered bitcoin send-from and payout addresses, and evidence that it controls those addresses; and
• confirmations that the institution acts as principal or for non-US clients.

3.3 Mint and Redemption Information

For Authorized Minters, we collect records of mint and redemption requests, including amounts, addresses, bitcoin transaction identifiers, request status, and fees.

3.4 Site Usage Information

When you visit the Site, we collect IP addresses, device and browser identifiers, pages viewed, and session timestamps.

3.5 Communications

We retain communications you send to us, including emails and onboarding correspondence.

3.6 Information from Third Parties

We may receive information about you or your organization from sanctions, PEP, and adverse media screening providers; blockchain analytics providers that screen bitcoin addresses and transactions; the custodian, in connection with deposits and payouts; and publicly available sources such as corporate registries.

4. How We Use Your Information

• Responding to interest: replying to enquiries and sending updates you have asked for. You can unsubscribe at any time.
• KYB and AML compliance: verifying identity, screening for sanctions and politically exposed persons, screening bitcoin addresses and transactions, and meeting anti-money laundering and travel rule obligations.
• Minting and redemption: matching deposits to mint requests, processing redemptions and refunds, and keeping records of each.
• Transparency: publishing proof of reserves and a status page. These show reserve addresses, balances, and transaction identifiers, but never the identity of an Authorized Minter.
• Security: protecting the Site, the reserve, and Authorized Minter accounts, and detecting fraud.
• Compliance and legal: complying with laws and legal processes, responding to lawful requests from authorities, and enforcing our terms.
• Improvement: analyzing Site usage to improve the Site.

5. Legal Basis for Processing

Where applicable law requires a legal basis, we rely on: contractual necessity, to onboard Authorized Minters and process their requests; legal obligation, to meet KYB, AML, sanctions, and travel rule requirements; consent, for marketing updates and non-essential cookies; and legitimate interests, for Site security, fraud prevention, and improvement, balanced against your rights.

6. How We Share Your Information

We do not sell personal information. We share it only as follows:

• The Trustee: Authorized Minter onboarding information is shared with Leeward Trust Limited, which relies on the same KYB process for minting and redemption.
• The custodian: limited information needed to process deposits and payouts and to meet travel rule obligations is shared with the qualified custodian holding the reserve.
• Service providers: screening and blockchain analytics providers, cloud hosting, communication and CRM tools, and analytics providers, each bound to use the information only to provide their services.
• Legal and regulatory: where required by law, regulation, legal process, or governmental request, or to protect our rights or the safety of others.
• Corporate transactions: in a merger, acquisition, reorganization, or sale of assets. We will notify you of any such change.

We do not disclose KYB documents, screening results, or compliance decisions to other Authorized Minters or to holders of cashBTC.

7. Blockchain Data

Bitcoin network. Bitcoin transactions, including deposits into and payouts from the reserve, are permanently and publicly recorded on the Bitcoin blockchain. Each Authorized Minter deposits to fixed addresses on the reserve wallet, and reserve addresses are published for proof of reserves. We never publish which addresses belong to which Authorized Minter, but third parties may be able to infer this from public blockchain data.

Canton Network. cashBTC transactions are recorded on the Canton Network, which shares transaction data only with the parties to each transaction rather than broadcasting it publicly.

Data recorded on a blockchain cannot be deleted or altered in the way data in a conventional database can. This may limit some of the rights described in Section 10.

8. Data Retention

• KYB and AML records: at least five years after the business relationship ends.
• Mint, redemption, and refund records: at least five years after the transaction.
• Interest registrations and marketing preferences: until you unsubscribe or ask us to delete them, or two years without contact.
• Site usage data: up to two years.

When a retention period ends, we securely delete or anonymize the information.

9. Data Security and International Transfers

We use administrative, technical, and physical safeguards to protect your information, including encryption in transit and at rest, access controls, and regular security assessments. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Your information may be transferred to and processed in jurisdictions other than your own, including the United States, the Cayman Islands, and the British Virgin Islands. Where required, we use appropriate safeguards under applicable data protection law.

10. Your Rights

Depending on where you live, you may have the right to access, correct, or delete your personal information; to object to or restrict certain processing; to withdraw consent; and to data portability. To exercise any of these rights, contact us at compliance@cashen.cc. Some requests may be limited by legal retention obligations or by the permanent nature of blockchain records (Section 7).

11. Cookies

The Site uses strictly necessary cookies to operate and, with your consent where required, analytics cookies to understand how it is used. We do not use cookies for advertising or cross-site tracking. You can manage cookies through your browser settings.

12. Third-Party Links

The Site may link to third-party websites, including the custodian, Canton Network venues, and wallets. This policy does not apply to them, and we are not responsible for their privacy practices.

13. Children's Privacy

The Site is not directed at individuals under the age of 18, and we do not knowingly collect their personal information. If we learn we have, we will delete it promptly.

14. Changes to This Policy

We may update this policy from time to time. We will post material changes on the Site with a revised "Last Updated" date.

15. Contact Us

Cashen International (BVI) Limited
Email: compliance@cashen.cc
Website: cashBTC.cc