Privacy policy

1. Who this covers

This policy describes how Token Clear (Token Clear Inc.) handles personal information when you use the Token Clear platform, its printable studies and its exports. The platform is a business tool offered to companies and the professionals who work with them; it is not directed to consumers or to anyone under 18.

2. What we collect

Account information: your email address, the role assigned to you (viewer, analyst or admin), a user identifier, and the organization you belong to. Accounts are created by an administrator; you may be invited by email.

Access records: when you sign in or fail to sign in, when a request is refused for lack of a role, and when you open a protected resource such as a full study, the one-pager, an export, a data API or the operational health endpoint. Each record holds the time, the event, your email or user name, your role, the path requested, your IP address and a shortened browser user-agent string.

Decisions and approvals: when you record a decision on a pathway, approve a treasury policy or submit an instruction, the record holds who acted, when, what changed and the stated reason. These records exist so that outcomes can be traced to the people who approved them.

Operational telemetry: load times, refresh failures, missing-data rates and export errors, kept in memory for operations. These contain no personal information.

We do not collect payment details, precise location, device identifiers beyond the user-agent string, or any information from third-party advertising or analytics services.

3. Cookies

The platform sets only strictly necessary cookies: a signed session cookie, or the authentication cookies of our identity provider, so that you stay signed in and your role can be enforced on every request. There are no advertising, tracking or third-party analytics cookies. Clearing the cookie signs you out.

4. How we use information

To give you access to the platform and enforce the role you were assigned; to keep the platform secure and investigate misuse; to maintain an audit trail of who saw and approved what; to support you; and to meet legal and contractual obligations. We process this information to perform our agreement with your organization and for our legitimate interest in security and accountability.

We do not sell personal information and do not use it for advertising.

5. Who can see it

Access records and the audit trail are readable only by administrators of the platform, and only through authenticated, role-checked requests that are themselves logged. Analysts and viewers cannot read them.

Service providers process information on our behalf and under contract: the hosting provider that runs the platform, the database and identity provider that stores accounts and the audit log, and the log retention service used by the host. Where the filing reader is enabled, a model provider receives only the text of public SEC filings, never account data, access records or client-private information.

Businesses affiliated with Token Clear (SQRL, Deal Box, Orobit) do not receive your personal information or your organization's analyses unless your organization separately engages them and authorizes it in writing.

We disclose information when the law requires it, to protect the rights and safety of users and the platform, or as part of a corporate transaction, subject to this policy.

6. Company data in analyses

Analyses are built from public sources: SEC XBRL filings and Form N-PORT at data.sec.gov, and delayed market data. Company names and logos belong to their owners. Information a client provides for its own analysis is treated as confidential to that client and is used only to produce its analysis.

7. Retention

Account information is kept while the account exists and for a period after closure to preserve the audit trail. Access records and the audit trail are retained for as long as the platform operates and for the audit period set by counsel; the schedule will be stated here once set. Operational telemetry is kept in memory only and is lost on restart.

8. Security

Access is gated on the server for every request, roles are checked again inside the endpoints that return sensitive data, sessions are signed and expire, traffic is encrypted in transit, and no password is stored or logged in a recoverable form. No system is perfectly secure; if we learn of a breach affecting your information we will notify your organization and, where required, you and the relevant authorities.

9. Your choices and rights

You may ask to see the personal information we hold about you, to correct it, or to have your account closed, by contacting us at the address below or through your organization's administrator. Requests to delete access records may be limited by our obligation to keep an accurate audit trail; where we cannot delete, we will tell you why. Depending on where you live you may have further rights, which we will honor as the law requires.

10. Changes and contact

We will post changes to this policy here with a new version date and, for material changes, tell your organization's administrator. Contact details for privacy questions are shown at the foot of this page and on the legal notices page.