Effective Date: Aug 28, 2025

This Privacy Policy explains how Decaf, Inc. and any subsidiaries and affiliated companies (“Decaf,” “we,” or “us”) collect, use, and disclose information about you (“you” or “your”).

This Privacy Policy applies when you:

• Use the Decaf Wallet application for interacting with the Stellar and Solana Networks (the “Wallet Services”),
• Visit the Decaf website located at https://decaf.so or successor sites,
• Apply for, are issued, or use a Decaf Card (the “Card Services”),
• Contact our customer service team, engage with us on social media, or otherwise interact with us.

For Card Services, this Privacy Policy should be read together with the Decaf Cardholder Agreement, the E-Sign & Electronic Communications Notice, and, where applicable, the GLBA Privacy Notice provided by the Card Issuer (Third National, Inc.).

We may update this Privacy Policy from time to time. If we make changes, we will revise the date at the top of this policy and, in some cases, provide you with additional notice. We encourage you to review this Privacy Policy regularly.

1. Stellar and Solana Networks

The Wallet Services allow you to generate, authorize, submit, and broadcast transactions on the Stellar and Solana Networks, distributed ledger networks powered by open-source protocols. This Privacy Policy does not apply to any information transmitted to those networks.

Transaction information broadcast to the Stellar or Solana Networks includes your public address, public key of the receiver, transaction amount, date/time, and any other data you include. Due to the nature of blockchain technology, this information is public, permanent, and cannot be deleted.

2. Collection of Information

We collect the following types of information:

2.1 Information You Provide

We collect information you provide directly to us when you create a Decaf account, apply for a Decaf Card, fill out a form, request support, or otherwise communicate with us. This may include:

• First and last name, email address, phone number, profile photo, login credentials from third-party services (e.g., Google, Apple).
• For Decaf Card: government identification (passport, driver’s license), date of birth, address, Social Security number (for U.S. cardholders), and other information required for identity verification and regulatory compliance.

2.2 Information We Collect Automatically

• Wallet Services: IP address, device identifiers, public key information, transaction details (deposits, withdrawals, transfers, exchanges).