Privacy Policy

1. Introduction

OFFRZ.io ("OFFRZ," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our tokenized real estate investment platform. By using OFFRZ.io, you consent to the practices described in this policy.

2. Information We Collect

Personal Information You Provide: Name, email address, phone number, mailing address, date of birth, government-issued identification documents (for KYC verification), financial information for accredited investor verification (income, net worth documentation), bank account information (for fund verification), and investment suitability data (risk tolerance, experience, objectives).

Automatically Collected Information: IP address, browser type, operating system, device information, pages visited, timestamps, referring URLs, and session data. We use Cloudflare for security, which may collect additional technical data.

Blockchain Data: Transaction records published on the XRP Ledger, including token purchases, sales, transfers, and wallet addresses associated with your account.

3. How We Use Your Information

We use your information for: account creation and authentication; KYC/AML compliance verification; accredited investor certification; processing token transactions and revenue distributions; maintaining the shareholder registry (as required for transfer agent functions); customer support and communication; platform improvement and analytics; fraud prevention and security; compliance with legal and regulatory obligations; and sending transactional emails (verification, trade confirmations, distribution notices).

4. KYC/AML Compliance

As a platform offering securities under SEC Regulation D 506(c), we are required to verify your identity, screen against sanctions lists (OFAC SDN, OFAC Consolidated, PEP databases, adverse media), and verify accredited investor status. Identity verification is conducted through Sumsub (automated) or manual document review. Identity documents and verification results are stored securely with AES-256 encryption at rest on AWS infrastructure.

5. Sharing Your Information

We may share your information with:

• Identity Verification Providers: Sumsub for KYC/AML screening
• Cloud Infrastructure: AWS (hosting, S3 storage, SES email) in the US-East-2 region
• Payment Processors: Stripe for ACH transfers and payment processing
• Blockchain Networks: Transaction data published on the XRP Ledger (public)
• Security Services: Cloudflare for DDoS protection and bot prevention
• Legal and Regulatory: When required by law, subpoena, or regulatory request (SEC, FINRA, FinCEN)

We do not sell your personal information to third parties.

6. Blockchain Data

Transaction records are published on the XRP Ledger blockchain. Blockchain data is public and immutable — once recorded, it cannot be deleted or modified. We do not publish personal information (name, email, address) on the blockchain; only transaction hashes, token amounts, and wallet identifiers are recorded on-chain.

7. Data Storage & Security

Data is stored on AWS infrastructure in the US-East-2 (Ohio) region. Identity documents are stored in encrypted S3 buckets with AES-256 server-side encryption. Database credentials and API keys use encryption at rest. All data in transit is encrypted via TLS 1.2+. We implement industry-standard security measures including multi-factor authentication support, rate limiting, and access logging.

8. Cookies & Tracking

We use the following technologies:

• Essential Cookies: Session management, authentication state, CSRF protection
• Cloudflare Cookies: Security, bot detection, and performance optimization
• Analytics: We may use privacy-respecting analytics to understand platform usage

We do not use third-party advertising cookies or tracking pixels. You can disable non-essential cookies through your browser settings.

9. Data Retention

We retain account data for the life of your account plus 7 years for regulatory compliance (SEC record-keeping requirements, anti-money laundering regulations). KYC documents are retained as required by AML regulations. Transaction records on the blockchain are permanent and immutable. You may request account deletion, subject to regulatory retention requirements.

10. Children's Privacy

OFFRZ.io is not intended for use by individuals under 18 years of age. We do not knowingly collect personal information from children. All users must verify they are at least 18 years old during KYC verification. If we learn that we have collected personal information from a child under 18, we will delete that information promptly.

11. International Users

OFFRZ.io is operated from the United States and is currently available only to U.S. accredited investors. If you access the platform from outside the United States, you understand that your information will be transferred to, stored, and processed in the United States. By using OFFRZ.io, you consent to this transfer. We do not currently offer services in the European Union and are not subject to GDPR; however, we apply reasonable data protection practices to all users.

12. Your Rights

You have the right to:

• Access your personal data held by OFFRZ
• Request correction of inaccurate data
• Request deletion of your account (subject to regulatory retention requirements)
• Opt out of marketing communications
• Download a copy of your data
• Withdraw consent for non-essential data processing

California residents may have additional rights under the CCPA. Contact us at [email protected] to exercise any of these rights.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by posting a notice on the platform. Your continued use of OFFRZ.io after changes are posted constitutes acceptance of the updated policy.

14. Contact

For privacy-related inquiries, contact us at [email protected] or write to: OFFRZ LLC, 401 E Las Olas Blvd, Fort Lauderdale, FL 33301.