1. Who we are and whom this covers
This Privacy Policy explains how MooChedda Inc. ("MooChedda", "we", "us" or "our"), with its registered office at 9227 24th Ct SE, Ste 9, Lacey, WA 98513, USA, handles personal information in connection with MooChedda Trust and Fiduciary at tf.moochedda.com, its applications and API (the "Service").
It covers: individuals who register an institution; Operators, meaning staff of member institutions who use the Service; platform administrators; and visitors to our website. For this information, MooChedda is the controller.
Information about members' clients. Member institutions use the Service to record their own clients, the clients' beneficial owners, beneficiaries and counterparties. For that information the member institution is the controller and MooChedda processes it on the institution's behalf and instructions, under our Terms of Use and any data processing agreement between us. If you are a client of a member institution, please direct privacy questions to that institution first. Its own privacy notice applies.
This Policy should be read with our Terms of Use.
2. Summary
| Topic | What happens |
|---|---|
| What we collect | Applicant and Operator identity and contact details, institution details, roles and authority, security and sign-in data, approvals and audit records, and, on members' behalf, client KYC, screening and transaction records. |
| Why | To review institutions, provide and secure the Service, enforce policies and approvals, screen and monitor transactions, keep records, comply with law and communicate with members. |
| Who we share with | Your own institution; service providers acting for us; screening, geolocation and network services; integrations your institution turns on; professional advisers; authorities where required; and a successor in a corporate transaction. Never sold. |
| Cookies | None. A sign-in token is held in your browser tab's session storage, and your display preferences in local storage. |
| Retention | For the life of the account, then as legal, regulatory, audit and dispute needs require. Approvals, transactions, client and compliance records and the audit log are protected from deletion for at least five years and cannot be edited. |
| Your rights | Access, correction, erasure, restriction, objection and complaint, depending on where you live, subject to the record-keeping limits in Section 9. |
3. Information we collect
3.1 Information provided to us
- Institution registration: the institution's legal name, jurisdiction and optional Legal Entity Identifier (LEI), and the registrant's name, work email and password. Passwords are stored only as salted bcrypt hashes.
- Invited Operators: the name, email, roles, executive designations (for example CEO, CRO or Board Chair) and job title entered by the inviting administrator, and the password you choose.
- Authenticator enrollment: the secret for your authenticator app, encrypted at rest with AES-256-GCM.
- Cold-storage ceremonies: when you attend an offline signing ceremony as a custodian, the badge ID you scan and, if your institution uses one, a biometric reference identifier. We do not receive biometric data itself.
- Preferences: your theme and text-size choice, saved to your account so it follows you across devices.
- Communications: messages and support requests you send us.
3.2 Information member institutions enter about their clients (processed on their behalf)
- Client accounts: client name, entity type, jurisdiction, risk tier, KYC status and review dates, PEP (politically exposed person) flags and the KYC information the institution records. KYC information is encrypted at rest, decrypted only for compliance officers, and every view is recorded in the audit log.
- Beneficial owners: name, ownership percentage, nationality, PEP flag and notes.
- Wallets and beneficiaries: wallet addresses, beneficiary names, counterparty virtual-asset service provider (VASP) details and screening results.
- Transactions and compliance: transfer records, AML alerts, case notes and dispositions, and data exported for regulatory reports such as CTR, SAR and travel-rule reports.
3.3 Information created when the Service is used
- Sign-in events: the email used, outcome, IP address, browser user-agent and, where lookups are enabled, the approximate country and city derived from the IP address.
- Sessions: a hash of your session token (never the token itself), IP address, user-agent, and when the session was created, last used and expires.
- Approvals: each approval or rejection you give, the transaction digest it covers, and a signature made with a signing key created for you. The private part of that key is stored encrypted with AES-256-GCM or, if your institution uses the AWS CloudHSM add-on and its AWS-hosted environment, kept inside the HSM.
- Audit log: who did what and when, with IP address and the details of the action, including membership and role changes, policy and governance decisions, KYC views and acceptance of these documents.
- Acceptance records: the version of the Terms of Use and this Policy you accepted, when, and from which IP address.
- Notifications sent to you in the Service and by email.
3.4 Information collected automatically
IP address, browser information and request times, used for security, rate limiting, abuse prevention and troubleshooting, plus the browser storage described in Section 7.
3.5 Information from third parties
- Sanctions lists and screening providers: results of screening wallet addresses against OFAC, EU and UN lists and, where enabled, Chainalysis.
- IP geolocation: approximate location derived from sign-in IP addresses (Section 6).
- Integrations: where your institution links an account to MooChedda's MTFX trading platform, MTFX sends account references, deposit and release requests and destination addresses.
4. How we use information and our legal bases
Where the EU or UK General Data Protection Regulation ("GDPR") or similar laws apply, we rely on the legal bases below for information we control.
| Purpose | Examples | Legal basis |
|---|---|---|
| Institution review | Reviewing registrations before an institution can operate | Legitimate interests; legal obligation where applicable |
| Provide the Service | Accounts, roles, policies, approvals, transaction processing, notifications | Performance of our contract with your institution; legitimate interests in respect of its staff |
| Security and fraud prevention | Two-factor sign-in, step-up codes for approvals, session control, sign-in monitoring, rate limiting | Legitimate interests; legal obligation where applicable |
| Accountability | Signed approvals and the hash-chained audit log | Legitimate interests (provable accountability for our members); legal obligation where applicable |
| Compliance support for members | Screening, AML monitoring, report exports | Performed on members' instructions as their processor |
| Communications | Invitations, password resets, service notices | Performance of contract; legitimate interests |
| Improve the Service | Diagnosing errors, measuring performance | Legitimate interests |
| Legal claims and requests | Establishing or defending claims; responding to lawful requests | Legitimate interests; legal obligation |
You may ask us for details of the balancing tests we carried out for legitimate interests.
5. Automated decisions
The Service decides some things automatically: whether an action matches an active policy (if none does, the action is refused); whether a destination has completed onboarding; whether a transfer below a member-configured threshold is auto-approved; and whether AML rules or a sanctions match place a transaction on hold. A critical alert automatically requests an Emergency Freeze. These decisions concern institutions' transactions. People review the outcomes that matter: only a compliance officer can release a hold, and a freeze takes effect only after the required people approve it. Where the GDPR applies and a decision based solely on automated processing has legal or similarly significant effects on you, you may ask for human review.
6. How we share information
We do not sell or rent personal information or share it for cross-context behavioural advertising. We share it only as follows:
- Your institution: its administrators and auditors can see Operators' activity, approvals and the audit trail, as the Service is designed to do.
- Service providers that process data for us under confidentiality and security obligations, including hosting, database and backup (and Amazon Web Services for institutions on the AWS CloudHSM add-on), and email delivery.
- IP geolocation: where enabled, sign-in IP addresses are sent to ip-api.com to derive an approximate location.
- Screening: wallet addresses (not names) are sent to Chainalysis for sanctions screening where that is enabled.
- Blockchain networks: broadcasting a transfer publishes its addresses and amounts on a public ledger, where they are visible to anyone and cannot be deleted. Network data providers we use to read chains may see the addresses we query. For MooChedda-network wallets, the wallet's address and signed proofs of control are sent to the MooChedda network service to read balances.
- Integrations your institution enables: for example, compliance events and case records to a governance, risk and compliance (GRC) system your institution connects, and deposit and release events to MTFX. Your institution chooses these and is responsible for them.
- Professional advisers such as lawyers, auditors and insurers, under confidentiality duties.
- Regulators, law enforcement and other authorities where we believe disclosure is required by law or legal process, or is necessary to prevent fraud, financial crime or security incidents, or to protect rights and safety.
- Corporate transactions: a buyer or successor in a merger, acquisition, financing, reorganisation or sale of assets, subject to equivalent protections.
Our pages load no third-party scripts, fonts or trackers. Price data comes from a public market feed and involves no personal information.
7. Cookies and browser storage
The Service sets no cookies. It uses browser storage only where strictly necessary or to remember a display choice you make:
| Name | Type | Purpose | Duration |
|---|---|---|---|
tf_session | Session storage | Keeps an Operator signed in | Until the tab is closed or you sign out; the server ends the session after 8 hours by default |
tf_admin_session | Session storage | Keeps a platform administrator signed in | As above |
tf_display | Local storage | Your theme and text-size choice | Until cleared |
Blocking session storage prevents signing in.
8. International transfers
We and our service providers may process personal information outside the country where it was collected, including in the United States. Where we transfer personal information from the European Economic Area, the United Kingdom or Switzerland to a country without an adequacy decision, we use appropriate safeguards such as the Standard Contractual Clauses and the UK International Data Transfer Addendum. You can request a copy of them.
9. How long we keep information
Accountability is the purpose of the Service, so several records are deliberately permanent for a period. The database itself refuses to edit approvals, ceremony attestations and the audit log, and refuses to delete the protected records below until they are at least five years old.
| Category | Retention |
|---|---|
| Operator accounts | While the account is active, then as long as needed for the records that refer to it. |
| Transactions, approvals, client accounts, AML alerts, screenings, cold-storage ceremonies and attestations, governance requests, and MTFX deposits and releases | At least five (5) years from creation, and longer where law, a legal hold or the member institution's own obligations require. |
| Audit log | At least five (5) years. Entries are append-only and hash-chained, so they cannot be altered or selectively removed. |
| Sign-in events | 180 days by default, then deleted automatically. |
| Sessions | Until they expire or are revoked, then deleted within about a day. |
| Invitations and password-reset links | Invitations expire after 72 hours and reset links after 60 minutes. Only hashes of them are stored. |
| Rate-limit counters | For the length of the rate-limit window. |
Information on a public blockchain is outside our control and cannot be deleted by anyone.
10. How we protect information
- passwords stored only as salted bcrypt hashes, with strength rules;
- mandatory authenticator-app two-factor authentication for every Operator and administrator, with replay protection, and a fresh code required for each approval and other sensitive action;
- server-side sessions identified by hashed tokens, sent by header rather than cookie, ending after 8 hours by default and revoked on suspension or role change;
- KYC information, authenticator secrets, approval signing keys and integration credentials encrypted at rest with AES-256-GCM, and, for institutions on the AWS CloudHSM add-on, an environment hosted in Amazon Web Services where signing keys are generated and used inside a hardware security module that never exports them;
- role-based access with separation of duties, and multi-person approval for transfers and policy changes;
- an append-only, hash-chained audit log with a timestamp attestation on each entry;
- a strict Content Security Policy with no third-party scripts, an allow-list for cross-origin requests, and rate limits; and
- encryption in transit (TLS) in production.
No system is completely secure. If we become aware of a personal-data breach affecting you, we will notify you, your institution and the relevant authorities where the law requires.
11. Your rights and choices
Depending on where you live, you may have the right to access your personal information and receive a copy, have it corrected, have it erased, restrict or object to processing, ask for human review of significant automated decisions, and complain to a data-protection authority.
To make a request, email privacy@[your-domain] from the email address on your account. We may need to verify your identity, and we respond within the time required by law, usually one month under the GDPR or 45 days under US state laws. Where records must be kept (Section 9), we restrict their use rather than erase them, and we will explain this when we respond. Requests about client information held for a member institution are referred to that institution. We will not discriminate against you for exercising your rights.
12. Region-specific information
12.1 European Economic Area, United Kingdom and Switzerland
You have the rights described in Section 11 under the GDPR, the UK GDPR and the Swiss Federal Act on Data Protection, and may complain to your local supervisory authority. Where required, our EU representative is [EU representative, if appointed] and our UK representative is [UK representative, if appointed].
12.2 California and other US states
Where state privacy laws apply to information about you, we collect the categories described in Section 3 (identifiers, professional or employment-related information, commercial information about your institution's transactions, internet activity, and inferred location) for the purposes in Section 4, and disclose them to the recipients in Section 6. We do not sell personal information or share it for cross-context behavioural advertising, and have not done so in the last 12 months. You have the rights to know, delete and correct, and not to be discriminated against for exercising them. If we deny a request, you may appeal by replying to our decision.
12.3 Canada
We handle personal information in accordance with PIPEDA and applicable provincial laws. You may access and correct your information and complain to the Office of the Privacy Commissioner of Canada. Our privacy officer can be reached at privacy@[your-domain].
13. Children
The Service is for institutions and their staff. It is not directed to anyone under 18 (or the age of majority where they live), and they may not hold Operator accounts. We do not knowingly collect children's personal information as a controller. If you believe a child has given us information, contact us and we will delete it.
14. Changes to this Policy
We may update this Policy. We will notify Operators through the Service or by email before material changes take effect. The version and effective date above identify the current Policy.
15. Contact and complaints
MooChedda Inc.Attn: Privacy
9227 24th Ct SE, Ste 9
Lacey, WA 98513
USA
Email: privacy@[your-domain]
Please contact us first so we can try to resolve your concern. You may also complain to the data-protection authority where you live or work, or where you believe an infringement occurred.