Privacy Policy

Effective Date: August 23, 2026

This Privacy Policy describes how Alpha Collective, Inc., a Delaware corporation doing business as Colossus ("Colossus," "we," "us," or "our"), collects, uses, and shares personal information in connection with colossus.build, app.colossus.build, our APIs, and related services (collectively, the "Services"). By using the Services, you agree to the practices described in this Policy.

The Services are built for business use. When we process personal information about you as a customer, a representative or beneficial owner of a customer, or a visitor to our websites, this Policy applies. Our banking services provider, Bridge, and its partner financial institutions, including Lead Bank, independently collect and process certain information under their own privacy notices, which are presented to you during onboarding.

1. Information We Collect

Information you provide

• Account and contact information: name, email address, phone number, authentication information, and role within your business.
• Business information: legal business name, entity type, formation details, tax identification number, address, ownership structure, and information about beneficial owners and control persons.
• Identity verification information: for individuals connected to an account, information such as name, date of birth, government identification numbers (such as SSN or other tax identifiers), identification documents, and address, collected by us and through our identity verification and compliance providers as required by law.
• Financial information: bank account details, funding sources, balances, payee information, invoices, and transaction details.
• Communications: messages you send us, support requests, and feedback.

Information collected automatically

• Usage and device information: IP address, device and browser type, operating system, pages viewed, actions taken, timestamps, and referring pages.
• Cookies and similar technologies: we use essential cookies to operate the Services and analytics cookies to understand usage. See Section 5.
• Approximate location: inferred from IP address for security, fraud prevention, and compliance purposes.

Agent and API activity

• When software agents access the Services using your credentials, we collect the associated activity, including API requests, credentials used, payment and other instructions submitted, policy evaluations and their outcomes, approvals, and related metadata. Instructions submitted by your agents are treated as information provided by you.

Blockchain information

• Wallet addresses and transactions on public blockchain networks are public by design. We collect and process wallet addresses and related on-chain transaction information associated with your use of the Services.

Information from third parties

• We receive information from identity verification, fraud prevention, and sanctions screening providers, from our banking and payment partners, and from publicly available sources and business registries, to verify identity, meet legal obligations, and protect the Services.

2. How We Use Information
‍

• Provide, operate, maintain, and improve the Services;
• Open and manage accounts, verify identity, and screen against sanctions and other watchlists, as required by law;
• Execute, record, and reconcile payments and other transactions, and operate policy, limit, and approval controls;
• Detect, investigate, and prevent fraud, abuse, security incidents, and violations of our terms;
• Communicate with you about the Services, including service notices, security alerts, approvals, and support;
• Send limited marketing communications about our own products, which you can opt out of at any time;
• Comply with legal and regulatory obligations, including anti-money-laundering, counter-terrorist-financing, sanctions, tax, and recordkeeping requirements;
• Establish, exercise, and defend legal claims and enforce our agreements;
• Create aggregated or de-identified data that does not identify you, which we may use for any lawful purpose.

3. How We Share Information
‍

We share personal information with:

• Banking and payment partners: our banking services provider, Bridge, and its partner financial institutions, including Lead Bank, to provide accounts, move money, and meet legal obligations;
• Compliance providers: identity verification, sanctions screening, and fraud prevention providers;
• Service providers: cloud infrastructure, wallet infrastructure, blockchain infrastructure, analytics, communications, and email delivery providers that process information on our behalf under contractual obligations;
• Professional advisors: lawyers, accountants, auditors, and insurers as reasonably necessary;
• Legal and safety recipients: regulators, law enforcement, and other parties where required by law, legal process, or to protect the rights, safety, and property of Colossus, our customers, or others;
• Corporate transactions: parties to a merger, acquisition, financing, reorganization, or sale of assets, subject to customary protections;
• At your direction: payees, integrations, and other recipients you or your authorized agents instruct us to share with.

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising.

4. Payment Instructions Initiated by Agents
‍

The Services are designed to be used by software agents acting on your behalf. Activity generated by your agents is processed under this Policy in the same way as activity you generate directly. You are responsible for ensuring that any personal information your agents submit to the Services, such as payee details contained in invoices, was collected and shared lawfully.

5. Cookies and Analytics
‍

We use essential cookies that are necessary for the Services to function, such as authentication and security cookies, and analytics cookies that help us understand how the Services are used so we can improve them. You can control cookies through your browser settings; disabling essential cookies may prevent the Services from working. We do not use third-party advertising cookies. Because there is no common standard for browser "Do Not Track" signals, we do not respond to them, but we do honor applicable opt-out preference signals where required by law.

6. Data Retention
‍

We retain personal information for as long as your account is active and as needed to provide the Services, and afterwards as required to comply with legal obligations, resolve disputes, and enforce agreements. Financial services laws, including anti-money-laundering and recordkeeping rules, generally require us and our partners to retain identity and transaction records for a number of years after an account is closed. Information on public blockchain networks is permanent by design and cannot be deleted by us.

7. Security
‍

We use administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit, access controls, and monitoring. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If you believe your account or credentials have been compromised, contact us immediately at erick@colossus.build.

8. Your Rights and Choices
‍

All users

You can access and update most account information within the Services, opt out of marketing emails using the unsubscribe link, and contact us at erick@colossus.build with privacy requests.

California residents

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (the "CCPA"), gives you rights to request: (a) access to the categories and specific pieces of personal information we have collected about you, and information about our collection and sharing practices; (b) deletion of your personal information; (c) correction of inaccurate personal information; and (d) portability of your personal information. We will not discriminate against you for exercising these rights. Note that much of the information we process is collected in connection with financial products and services subject to the Gramm-Leach-Bliley Act or is business-contact information, and may be exempt from some CCPA requirements. We do not sell personal information and have not done so in the preceding 12 months, and we do not use or disclose sensitive personal information for purposes requiring a right to limit under the CCPA. To exercise your rights, email erick@colossus.build; we will verify your request using information associated with your account. You may use an authorized representative to submit a request, subject to verification.

Other U.S. states

Residents of states with comprehensive privacy laws, such as Virginia, Colorado, Connecticut, and Utah, may have similar rights of access, correction, deletion, and portability, and a right to appeal a refusal, subject to exemptions for financial data. To exercise these rights or appeal a decision, email erick@colossus.build.

Outside the United States

If you access the Services from the European Economic Area, the United Kingdom, or another jurisdiction with data protection laws, the following applies. Alpha Collective, Inc. is the controller of the personal information described in this Policy. We process personal information: to perform our contract with you; to comply with legal obligations, including financial crime laws; for our legitimate interests, such as securing and improving the Services and preventing fraud; and with your consent where required. You may have rights to access, rectify, erase, restrict, or object to our processing, to data portability, to withdraw consent, and to lodge a complaint with your local supervisory authority. The Services are operated from the United States, and your information will be transferred to and processed in the United States; where required, we rely on appropriate safeguards, such as standard contractual clauses, for those transfers.

9. Children
‍

The Services are intended for business use by adults. We do not knowingly collect personal information from anyone under 18, and if we learn that we have, we will delete it.

10. Third-Party Services
‍

The Services link to and interoperate with third-party services, including our banking and payment partners, whose privacy practices are governed by their own notices. We encourage you to review the privacy notices of Bridge and its partner financial institutions presented during onboarding, and of any other third-party service you use with Colossus.

11. Changes to This Policy
‍

We may update this Policy from time to time. If we make material changes, we will provide notice through the Services or by email before the changes take effect, and we will update the Effective Date above. Your continued use of the Services after the effective date of an updated Policy constitutes acceptance.

12. Contact Us
‍

Alpha Collective, Inc. d/b/a Colossus
1 Pine Street, Apt. 2209
San Francisco, CA 94111
erick@colossus.build

‍