Privacy Policy

1. Information We Collect

1.1 Information You Provide

When you create an account, complete identity verification, or contact us, we may collect the following categories of personal information:

• Full legal name
• Date of birth
• Residential address (current and historical)
• Email address and phone number
• Social Security Number or Individual Taxpayer Identification Number (ITIN), as required by federal law for identity verification
• Government-issued identification documents (passport, driver's license, state ID)
• Selfie photographs submitted as part of KYC verification
• Financial account information provided for funding or withdrawal purposes
• Source of funds declarations where required under our AML program
• Communications and correspondence with our support team

1.2 Information Collected Automatically

When you visit our website, we may automatically collect certain technical information, including:

• IP address and approximate geographic location
• Browser type, version, and operating system
• Pages visited, time spent on pages, and navigation paths
• Referring URLs and exit pages
• Device identifiers and screen resolution
• Cookie identifiers (see our Cookie Policy for details)

1.3 Information from Third Parties

As part of our legal obligations as a Money Services Business, we may receive information from identity verification services, fraud detection services, and sanctions screening databases. This information supplements what you provide directly and is used to fulfill our compliance obligations under the Bank Secrecy Act and the USA PATRIOT Act.

2. How We Use Your Information

We use the personal information we collect for the following purposes:

• Service Provision: To create and manage your account, process transactions, and provide cryptocurrency exchange and wallet services.
• Identity Verification: To fulfill our Customer Identification Program (CIP) obligations under the USA PATRIOT Act and Bank Secrecy Act. Identity verification is mandatory and cannot be opted out of.
• AML Compliance: To conduct transaction monitoring, sanctions screening, and Suspicious Activity Report (SAR) filing as required by the Bank Secrecy Act and FinCEN regulations.
• Legal Compliance: To respond to lawful requests from law enforcement agencies, regulatory bodies including FinCEN, the IRS, and other governmental authorities.
• Communication: To send account notifications, verification status updates, and responses to your inquiries.
• Security: To detect, investigate, and prevent fraudulent activity, unauthorized access, and other illegal conduct.
• Platform Improvement: To analyze how the website is used and improve our services. This analysis is performed on aggregated or de-identified data where possible.
• Legal Record Keeping: To maintain records as required by federal and state law, including BSA record retention requirements of five years or more.

3. How We Share Your Information

We do not sell, rent, or trade your personal information to third parties for marketing purposes. We may share your information in the following limited circumstances:

• Legal Requirements: We share information with FinCEN, the IRS, law enforcement agencies, and other governmental authorities when required by law, including through Currency Transaction Reports (CTRs), Suspicious Activity Reports (SARs), and responses to lawful subpoenas or court orders.
• Service Providers: We engage third-party vendors who assist with identity verification, payment processing, data hosting, fraud detection, and compliance screening. These vendors are contractually required to protect your information and use it only for the purposes specified.
• Business Transfers: In the event of a merger, acquisition, or sale of assets, personal information may be transferred as part of the transaction. We will notify you of any such transfer and any changes to this Privacy Policy.
• Protection of Rights: We may disclose information to protect the rights, property, or safety of Ethio American LLC, our customers, or the public.

4. Data Retention

We retain personal information for as long as necessary to provide services and fulfill our legal obligations. Specific retention periods include:

• Customer identification records: minimum five years after account closure, as required by the Bank Secrecy Act (31 U.S.C. § 5318)
• Transaction records: minimum five years from the date of the transaction
• SAR records: five years from the date of filing
• Communications records: retained as needed for legal and compliance purposes

When retention periods expire and no legal obligation requires continued storage, we delete or de-identify personal information in a secure manner.

5. Data Security

We implement administrative, technical, and physical security measures designed to protect your personal information from unauthorized access, disclosure, alteration, and destruction. These include:

• Encryption of sensitive data in transit and at rest
• Access controls limiting employee access to personal information on a need-to-know basis
• Regular security assessments and vulnerability monitoring
• Secure document upload and storage protocols for KYC materials

No method of electronic transmission or storage is completely secure. While we work to protect your information, we cannot guarantee absolute security. If you believe your account has been compromised, contact us immediately at support@harbormint.co.com.

6. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), including:

• Right to Know: You may request information about the categories and specific pieces of personal information we have collected about you, the purposes for collection, and the categories of third parties with whom we share it.
• Right to Delete: You may request deletion of personal information we hold about you, subject to exceptions including our legal obligation to retain financial records under the Bank Secrecy Act.
• Right to Correct: You may request correction of inaccurate personal information.
• Right to Opt Out of Sale: We do not sell personal information. This right is not applicable, but we honor it by policy.
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.

To exercise your CCPA rights, submit a written request to support@harbormint.co.com with the subject line "California Privacy Request." We will verify your identity before processing your request. Note that certain BSA record-keeping obligations may limit our ability to delete certain financial records.

7. Children's Privacy

HarborMint services are intended for individuals who are 18 years of age or older. We do not knowingly collect personal information from anyone under 18. If we become aware that we have collected information from a minor, we will delete it promptly. If you believe we have collected information from a minor, please contact us at support@harbormint.co.com.

8. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or applicable law. When we make material changes, we will update the "Last Updated" date at the top of this page. For significant changes, we may provide additional notice through email or a prominent notice on our website. Your continued use of HarborMint services following the posting of changes constitutes your acknowledgment of the updated policy.

9. Contact Us

For questions about this Privacy Policy or to exercise your privacy rights, contact us at: