Personal Information Collection Statement

This Statement explains what personal information MP Network Inc and MP PAYMENT INC (together, "MPChat", "we", "us" or "our") collect from you, why we collect it, who we disclose it to, how long we keep it, and what you are agreeing to when you accept it.

It should be read together with the MPChat User Agreement. This Statement is the principal document governing our collection and handling of personal information. Where another document incorporated into the User Agreement addresses the same matter, this Statement prevails on that matter unless Applicable Law requires otherwise.

Terms used here have the meaning given to them in the MPChat User Agreement.

1. Purpose of Collection

We collect personal information in order to provide our services, to improve them, and to communicate with you. The information you provide helps us understand your needs and operate the services you have asked for.

We also collect and receive information about you in order to conduct our business, to meet our legal and regulatory obligations, and, where you have not opted out, to market our own products and services to you.

We collect only what is necessary for these purposes, and we apply the principles of lawfulness, legitimacy and necessity when we do so.

2. What We Collect

2.1 Information you give us

Account registration information — your mobile telephone number or email address, your password, and any nickname, profile picture or other profile information you choose to provide.

Identity verification information — where you use MPChat Pay or the MPChat Card, and as required by law, your name, identity document type and number, date of birth, nationality, proof of address, and any other information we need in order to meet our anti-money laundering, counter-terrorist financing and sanctions screening obligations. Facial recognition and other biometric verification are performed by the Identity Verification Provider as described in Clause 9; we receive the verification result and structured identity fields, and we do not receive, store or retain raw facial images or biometric templates.

Chat information — where end-to-end encryption applies, we cannot access or store the content of your messages. We do process message metadata, including sender and recipient identifiers, timestamps, delivery and read status, and group membership. Where you post in a non-encrypted area of MPChat, or interact with a Bot or Mini App, we may collect that content.

Digital asset gift information — where you send a gift or red packet in a chat, information about the sender, the recipients, the amount and the status of the transfer.

MPChat Pay information — your deposit addresses, counterparty addresses or MPChat user identifiers, the assets and amounts transacted, timestamps and transaction status.

MPChat Web3 information — your public wallet addresses, your on-chain transaction history as it appears in the App, and the public credentials associated with your authentication methods. We do not hold, and cannot obtain, your private keys.

MPChat Card information — your application information, the card records associated with your account, and card transaction records including merchant details, amount, time and location, some of which is supplied to us by the card issuer or the card network.

Contact list information — where you choose to use contact matching, and with your express permission, information derived from your device's contact list. We process this information using cryptographic hashing in order to protect the privacy of your contacts.

Customer support information — the contact details, description of the issue and supporting material you provide when you contact us, and recordings or transcripts of your communications with our support team.

2.2 Information we collect automatically

Device information — device model, operating system version, unique device identifiers, IP address, application version, language setting and network type.

Log information — records of your use of the services, including features accessed, time of operation, crash reports and diagnostic data.

Location information — approximate location inferred from your IP address, and, only with your express permission and where you enable the relevant feature, precise location. You may withdraw that permission in your device settings at any time.

Usage information — how you interact with the services, which we use to understand user preferences and improve the product.

Cookie and similar technology information — as described in Clause 8.

Human verification signals — when you register, sign in, reset your credentials, or submit a sensitive request, the Human Verification Provider processes your IP address, TLS fingerprint, User-Agent header, and the Sitekey and associated origin, as described in Clause 10.

2.3 Information from third parties

Where permitted by law, we may obtain information about you from third parties, including:

your public profile information from a third-party login provider, where you choose to sign in that way and authorise the disclosure;

verification results from identity verification providers;

screening and analytics results from sanctions screening and blockchain analytics providers;

transaction information from card issuers, card networks and acquirers; and

the pass or fail outcome of a human verification challenge from the Human Verification Provider.

3. How We Use Your Information

We use your personal information to:

provide, maintain, secure and improve the services, including registration, messaging, MPChat Pay transactions, MPChat Web3, card payments and digital asset gifts;

verify your identity, prevent fraud, monitor for suspicious activity, distinguish human users from automated bots, protect against bulk registration, credential stuffing and automated abuse, and protect you, us and other users from abuse and unlawful conduct;

meet our legal and regulatory obligations, including know-your-customer and anti-money laundering obligations, sanctions screening, and responses to lawful requests from government, judicial and regulatory authorities;

communicate with you, including service notifications, updates and security alerts;

carry out data analysis and research to improve product design and develop new features, using anonymised or de-identified data wherever we can;

provide a personalised experience, where you have consented to it; and

market our products and services to you, subject to Clause 4.

4. Direct Marketing

Where you have not opted out, we may use your name, contact details, information about the products and services you hold with us, and demographic information, to market to you the following categories of products and services offered by us, by other members of the Group, or by our business partners:

messaging, communication and social features;

digital asset payment, transfer and wallet services;

payment card products and related benefits;

rewards, referral and loyalty programmes; and

products and services offered by Bots, Mini Apps and partners within MPChat.

We will not use your personal information for direct marketing without your consent where consent is required by the law applicable to you. You may opt out of direct marketing at any time, at no cost, through the App or by contacting us at [email protected]. Opting out will not affect your ability to use the services, and we will continue to send you service, security and transactional communications, which are not marketing.

5. Your Acknowledgements and Consent

By clicking "I Accept", or by using the services, you confirm that you have read this Statement and that you consent to the following.

I acknowledge that MPChat will collect my personal information, and that during that collection MPChat will use it to:

(i) provide the products and services I have requested;

(ii) verify my identity;

(iii) assess, process and manage my application for a product or service, including verifying my details and assessing risk;

(iv) assess, process and manage any application I make for employment;

(v) handle complaints; and

(vi) carry out data analytics.

I understand that MPChat may disclose information about me to:

organisations that provide products or services used or offered by MPChat, including card issuers, card networks, acquirers, payment providers, the Identity Verification Provider, sanctions screening and blockchain analytics providers, the Wallet Infrastructure Provider, and the Human Verification Provider;

companies and contractors engaged by MPChat to provide services to it, including information technology contractors, cloud service providers, customer support providers, printers, mail houses, storage providers, lawyers, accountants and auditors, each of whom needs access to my information in order to provide those services;

other members of the Group;

persons considering the acquisition of an interest in MPChat's business or assets; and

any other person or company I authorise.

I understand that MPChat may be required to disclose my personal information to a court, tribunal, law enforcement agency, tax authority or regulator, in response to a request, subpoena or other lawful process, and that this may include a foreign law enforcement agency or foreign regulator. By providing my information to MPChat, I consent to disclosure to those entities without MPChat obtaining my consent on each occasion.

I understand that where I interact with a Bot or Mini App, information about me is shared with the independent third party that operates it, as described in Clause 6 of the MPChat User Agreement, and that MPChat does not control that information once it has been transmitted.

I understand that MPChat requires each person and organisation with which it shares my personal information to protect it in accordance with MPChat's instructions and applicable data protection requirements, and that MPChat enters into data protection agreements with them where required.

6. Disclosure to Bots and Mini Apps

When you interact with a Bot or open a Mini App, information about you is shared with its Service Provider. Depending on the Bot or Mini App and on how it was opened, this may include your MPChat user identifier, public display name, username, profile picture, language setting and IP address, and, where opened in a group or channel, the identifier, type, title, username and picture of that chat.

You may also choose to give a Service Provider further information, such as your telephone number, text, media or location, in order to obtain its service.

A Service Provider is an independent third party and is responsible for handling and storing the information it receives. We do not control that information after it has been transmitted, and you agree not to hold us liable for a Service Provider's misuse, mishandling or unauthorised disclosure of it. You should read the Service Provider's own privacy notice before you use its Bot or Mini App.

7. Cross-Border Transfer

We operate globally, and your personal information may be stored in, transferred to, or accessed from, a jurisdiction other than the one in which you provided it, including the United States.

Those jurisdictions may have different data protection laws, or none. Where we transfer your personal information across borders, we take measures to ensure it receives a standard of protection equivalent to that required under the law applicable to you, which may include obtaining your consent, de-identifying data before transfer, and entering into legally binding transfer agreements with recipients, such as standard contractual clauses approved by the relevant authority.

8. Cookies and Similar Technologies

We and our service providers may use cookies, local storage, software development kits, pixels and similar technologies on the Site and in the App to:

keep you signed in and remember your preferences;

understand how the services are used and to measure performance;

detect and prevent fraud and abuse; and

support marketing where you have not opted out, subject to Clause 4.

You can manage cookies through your browser settings and, where the App provides controls, through the App. Blocking certain cookies may affect the availability or function of parts of the services. We do not respond to "Do Not Track" signals in a uniform way across all browsers, because there is no common industry standard for them.

Storage and similar technologies used for human verification are strictly necessary to detect and block bots, so that you can register and sign in securely. They are not marketing cookies, and they are not switched off together with marketing cookies. If you block them, you may be unable to complete registration or sign-in.

9. Biometric Information

Where identity verification requires facial recognition or other biometric identifiers:

(a) the facial images and any biometric templates derived from them are collected and processed by the Identity Verification Provider on our behalf for the purposes in paragraph (c);

(b) we will obtain your express consent before that collection, separately from your acceptance of this Statement as a whole, through a clear affirmative act in the App;

(c) that information is used solely to verify your identity for know-your-customer, anti-money laundering, fraud prevention and account security purposes;

(d) we do not sell biometric information, and we do not use it for marketing, advertising or any purpose other than those stated in this Clause;

(e) we do not receive, store or retain the raw facial images or biometric templates. We receive from the Identity Verification Provider the verification result and structured identity fields (such as the outcome of the check, your name, document type and number, date of birth and nationality). Those structured fields are retained in accordance with the know-your-customer retention guideline in Clause 13; and

(f) you may refuse to provide biometric information, in which case we may be unable to complete verification and may be unable to provide MPChat Pay or the MPChat Card to you.

If the law of your jurisdiction (including the Illinois Biometric Information Privacy Act and similar statutes) imposes additional requirements, we will comply with those requirements to the extent they apply to us.

10. Human Verification

We may require you to complete a human verification challenge when you register, sign in, reset your credentials, or submit a sensitive request. The challenge is provided by the Human Verification Provider.

The Human Verification Provider is Cloudflare, Inc. It provides that challenge through Turnstile and, where applicable, Cloudflare's Challenge Platform. Cloudflare's processing of the signals described in this Clause is governed by the Turnstile Privacy Addendum, which supplements Cloudflare's main privacy policy.

When a challenge is presented:

(a) Cloudflare processes client-side signals consisting of your IP address, TLS fingerprint, User-Agent header, and the Sitekey and associated origin of the page or application that presented the challenge. Those signals are processed solely to distinguish human users from bots. They are not used by us to identify, profile or target you, and they are not used for marketing. Cloudflare states that it cannot directly identify any individual from those signals, including from IP addresses;

(b) for the purpose of detecting and blocking bots on our services, we are the controller of those signals and Cloudflare processes them on our behalf as a processor. You may exercise the rights in Clause 14 in respect of that processing by contacting us;

(c) Cloudflare also processes those signals as an independent controller in order to improve Turnstile's bot detection capabilities, relying on its legitimate interests. That processing is not under our control. It is governed by Cloudflare's own policies. If you have questions about that processing, you may contact Cloudflare's data protection officer at [email protected];

(d) we receive only the pass or fail outcome of the challenge and related validation metadata. We do not receive the underlying signals in their original form;

(e) the signals may be processed on Cloudflare's global network, including in jurisdictions other than the one from which you access the services. Cross-border transfers are addressed in Clause 7;

(f) if you are unable to complete the challenge, we may be unable to open an Account for you or to allow you to sign in. You may contact us at [email protected] to request an alternative means of verification where one is available; and

(g) human verification does not collect biometric information. Facial recognition and other biometric identifiers used for identity verification are addressed separately in Clause 9.

11. Children's Personal Information

Our products and services are primarily directed to adults. We treat anyone under the age of fourteen (14) as a child. A child may not create an Account without the verifiable consent of a parent or legal guardian. Where Applicable Law sets a higher age for parental consent, that higher age applies.

Where we collect a child's personal information with verifiable parental consent, we will use or disclose it only as permitted by Applicable Law, with that consent, or as necessary to protect the child.

If we discover that we have collected a child's personal information without prior verifiable parental consent, we will delete the relevant data as soon as practicable.

Parents or guardians who believe that we hold information about a child without proper consent may contact us at [email protected].

MPChat Pay, MPChat Web3 and the MPChat Card are available only to persons who are at least eighteen (18) years of age, as stated in the MPChat User Agreement. Parental consent is not an alternative to that requirement.

12. Data Security

We maintain a level of protection for personal information appropriate to its sensitivity and to the harm that unauthorised access would cause, in order to prevent unauthorised access, processing, disclosure, alteration, damage, loss or other use.

Our measures include restricting physical access to data, providing secure storage, encrypting data in transit and at rest using industry-standard techniques, operating access controls so that only authorised personnel can access personal information, taking steps to ensure the integrity and competence of those personnel, and providing security and privacy training.

The internet is not an absolutely secure environment. We encourage you to use a strong, unique password, to enable every security feature the App offers, and to keep your credentials and devices secure. If you believe your personal information has been compromised, contact us immediately at [email protected].

In the event of a personal information security incident, we will notify you and the relevant authorities as required by applicable law, and we will tell you what has happened, what we are doing about it, and what you can do to protect yourself.

13. Retention

We retain your personal information only for as long as is necessary for the purposes described in this Statement, unless a longer period is required or permitted by law. When a retention period ends, we delete the information or anonymise it.

Unless Applicable Law requires a different period, we apply the following guidelines:

14. Your Rights

Subject to the law applicable to you, you have the right to:

access the personal information we hold about you;

have inaccurate personal information corrected;

have personal information deleted in certain circumstances;

obtain a copy of your personal information in a portable form;

withdraw a consent you have given, without affecting processing that was lawful before the withdrawal;

object to or restrict certain processing; and

close your Account.

You can exercise these rights in the App, or by contacting us at [email protected]. We may need to verify your identity before we act on a request. We will respond within the period required by the law applicable to you and, where no period is specified, within fifteen (15) working days.

We may be unable to comply fully with a request where Applicable Law requires us to retain information, where complying would adversely affect the rights of another person, where the request is manifestly unfounded or excessive, or where we cannot verify your identity. Where we refuse a request, we will tell you why, to the extent we are permitted to do so.

15. Automated Decision-Making

We may use automated systems, including rules-based and risk-scoring systems, to:

screen for sanctions, fraud, money laundering and other prohibited activity;

decide whether to approve, decline, hold or review a transaction or an application for MPChat Pay or the MPChat Card; and

prioritise customer support and security alerts.

Where an automated decision produces legal effects concerning you, or similarly significantly affects you, and where Applicable Law gives you that right, you may request human review of the decision, express your point of view, and contest the decision, by contacting us at [email protected]. We will explain the logic involved to the extent we can do so without undermining security or revealing trade secrets.

16. Rights of California Residents

If you are a resident of California, the California Consumer Privacy Act as amended by the California Privacy Rights Act (together, "CCPA") provides you with additional rights. For the purposes of the CCPA:

Categories of personal information. In the preceding twelve (12) months we have collected the categories described in Clause 2, which may include identifiers, commercial information, internet or electronic network activity (including the human verification signals described in Clause 10), geolocation data, audio and visual information, professional information where you apply for employment, and inferences, as well as sensitive personal information such as government identifiers, account log-in credentials, precise geolocation where you enable it, and biometric information used for identity verification.

Sources and purposes. We collect that information from the sources and for the purposes described in Clauses 2 and 3.

Disclosure. We disclose personal information to the categories of recipients described in Clause 5 for business purposes. We do not sell personal information, and we do not share personal information for cross-context behavioural advertising.

Your CCPA rights. You have the right to know, to delete, to correct, to opt out of sale or sharing (which does not arise because we do not sell or share), to limit the use and disclosure of sensitive personal information to that which is necessary to perform the services you request, and to be free from discrimination for exercising your CCPA rights.

How to exercise. Submit a request through the App or at [email protected]. You may designate an authorised agent. We will verify your identity and respond within the periods required by the CCPA.

Residents of other U.S. states with similar privacy laws may have comparable rights, which you may exercise through the same channels.

17. Confidential Information

We may, at our discretion, give you confidential information for the limited purpose of obtaining your feedback. "Confidential information" means any information disclosed in any form about our products, services, plans, ideas for improvement, user experiences, or any other information that could reasonably be regarded as confidential.

Where you receive confidential information, you agree:

not to disclose it to any third party; and

not to use it for any purpose other than providing feedback to us.

These obligations do not apply to information that:

was already known to you at the time you received it;

enters the public domain otherwise than through your breach;

is lawfully obtained by you from a third party that is under no obligation of confidence; or

you are required to disclose by judicial or governmental process, provided that you notify us before disclosing it and co-operate with us if we choose to contest the disclosure.

Nothing in this Clause grants you any right in our confidential information or creates any relationship between us beyond that set out in the MPChat User Agreement.

18. Feedback and Intellectual Property

If you give us feedback, suggestions or ideas about our products or services, we may use them at our discretion, incorporate them into our products and services, and do so without notifying you, paying you or obtaining your further consent. You assign to us all rights in that feedback and in anything derived from it.

All tangible and intangible material we provide to you, including technical specifications, remains our property. Nothing in this Statement transfers or assigns any intellectual property right from us to you.

This Clause applies to feedback about our products and services. It does not apply to your personal information, to your User Content, or to any content you send through MPChat Chat, all of which remain yours and are governed by the MPChat User Agreement and this Statement.

19. Use of Your Name and Image

We will not use your name, photograph, image, or audio or video recording of you for marketing or promotional purposes unless you have given us your separate written agreement to do so.

20. Indemnity

To the maximum extent permitted by law, you agree to indemnify us and hold us harmless from any loss, damage, expense or claim arising from your breach of this Statement.

This indemnity does not extend to any loss, claim or action caused by our own negligence, wilful misconduct or fraud, and nothing in this Statement requires you to release us from liability for those matters or limits any right you have that cannot be waived under applicable law.

21. Amendments

We may update this Statement from time to time. We will publish the updated Statement in the App and on the Site, and we will update the version number and date at the top of the document. Where a change is material, we will give you prominent notice, which may include an in-app notice, a push notification or an email. You should review the current version in the App or on the Site.

22. General

This Statement may be varied only in writing.

This Statement may be accepted and executed electronically.

If any provision of this Statement is held to be invalid, illegal or unenforceable, the remaining provisions continue in full force and effect.

If there is any conflict, inconsistency or discrepancy between the English version of this Statement and any translated version, the English version prevails to the extent permitted by applicable law.

23. Contact

Email: [email protected]

In-app: the support chat in MPChat

MP Network Inc — 8 The Green, Suite B, Dover, Delaware 19901, United States of America

MP PAYMENT INC — 1500 N Grant St Ste R, Denver, Colorado 80203, United States of America

Personal Information Collection Statement · Version 2.1.0 · Effective August 17, 2026