Privacy Policy

Last updated: 1 October 2026

1. Introduction

Ivy Connection PLC ("Ivy", "we", "us", "our"), a company registered in England and Wales with its registered office at 20 Fenchurch Street, London, EC3M 3BY, United Kingdom, provides the Ivy Messenger application, the IVY token sale platform, and associated websites (together, the "Services"). This Privacy Policy explains what information we collect, why we collect it, and the choices you have.

Because Ivy Messenger is built around end-to-end encryption and local key generation, we deliberately collect far less personal data than a typical messaging or financial platform. Where we do collect data — such as during token sale identity verification — this Policy tells you exactly what, why, and for how long.

2. Information We Collect

We collect the following categories of information, depending on how you interact with our Services:

• Account information: email address, display name, and a hashed password, if you create an account or join the waitlist.
• Identity verification data (KYC): full legal name, date of birth, nationality, government-issued ID document, and a selfie or liveness check, collected only if you participate in a token sale round, consistent with our AML Policy.
• Wallet and transaction metadata: public wallet addresses and on-chain transaction references. We do not store private keys or seed phrases — these remain on your device.
• Technical data: IP address, device type, app version, and crash logs, collected to secure and improve the Services.
• Communications data: information you submit through our contact form, careers applications, or support requests.
• Cookies and similar technologies: as described in our Cookies Policy.

We explicitly do not collect message content, contact lists, or call metadata from the Ivy Messenger app — these are encrypted end-to-end and never pass through our infrastructure in readable form.

3. How We Use Information

We use the information described above to:

• Create and administer your account and waitlist entry;
• Verify your identity and eligibility before accepting a token sale contribution;
• Detect, investigate, and prevent fraud, money laundering, and abuse of the Services;
• Respond to support requests, careers applications, and general enquiries;
• Send service updates, sale-round notifications, and (with consent) marketing communications;
• Analyse aggregated, de-identified usage trends to improve the Services.

4. Legal Basis for Processing

Where the UK GDPR or EU GDPR applies, we rely on the following legal bases:

• Contractual necessity — to provide the account, waitlist, and token sale services you request;
• Legal obligation — to comply with anti-money-laundering and counter-terrorist-financing laws;
• Legitimate interests — to secure our Services and prevent fraud, balanced against your rights;
• Consent — for optional marketing communications and non-essential cookies, which you may withdraw at any time.

5. Data Sharing & Third Parties

We share personal data only where necessary, with:

• Identity verification providers who perform KYC checks on our behalf, under contractual confidentiality obligations;
• Cloud infrastructure and email delivery providers who process data strictly on our instructions;
• Regulators, law enforcement, or courts where required by applicable law or a valid legal order;
• Professional advisers (legal, auditing) bound by confidentiality duties.

We do not sell personal data to third parties, and we do not share message content with anyone — because we never possess it in readable form.

6. International Transfers

Our relay network and some service providers operate internationally. Where personal data is transferred outside the UK or European Economic Area, we rely on adequacy decisions or Standard Contractual Clauses, and we require recipients to apply safeguards equivalent to UK/EU data protection standards.

7. Data Retention

We retain account and waitlist data for as long as your account is active, plus 24 months after closure for legal and dispute-resolution purposes. Identity verification records collected for AML compliance are retained for 5 years from the end of the business relationship, in line with the UK Money Laundering Regulations 2017. Technical logs are retained for a maximum of 12 months.

8. Your Rights

Subject to applicable law, you have the right to:

• Access a copy of the personal data we hold about you;
• Request correction of inaccurate data;
• Request erasure, where we are not legally required to retain it (note: AML records cannot be erased before the statutory retention period expires);
• Object to or restrict certain processing, including direct marketing;
• Request a portable copy of data you provided to us;
• Lodge a complaint with the UK Information Commissioner's Office (ICO) or your local data protection authority.

To exercise any of these rights, contact us using the details in Section 12.

9. Security Measures

We apply encryption in transit and at rest, strict access controls, regular penetration testing, and independent security audits (see our Technology section) to protect the limited personal data we do hold. No system is perfectly secure, and we encourage you to use a strong, unique password and enable device-level biometric locks within the app.

10. Children's Privacy

Our Services are not directed at individuals under 18. We do not knowingly collect personal data from minors, and token sale participation is restricted to legally eligible adults under our Terms & Conditions.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. Material changes will be notified via email or an in-app notice at least 14 days before taking effect. The "Last updated" date above reflects the most recent revision.

12. Contact Us

For privacy-related questions or to exercise your data protection rights, contact our Data Protection Officer:

Ivy Connection PLC
Ste 18, 100 Borough High Street, London, SE1 1LB
Email: privacy@ivymessenger.com