Andoh Capital Management LLC ("Company," "we," "us," or "our") operates the Atlas Intelligence OS platform (the "Platform"). This Privacy Policy describes how we collect, use, store, and protect your personal information when you use the Platform.

We take your privacy seriously. This policy is designed to be transparent about our practices so you can make informed decisions about your data.

1. Information We Collect

Information you provide directly:

• Account information: name, email address, phone number, company name, and role when you create an Atlas ID
• Company profile: legal entity name, jurisdiction, year of incorporation, industry, and team size
• Financial data: transactions, invoices, ledger entries, and portfolio data entered through Hub modules
• Documents: files uploaded to the data room, HR module, or document management systems
• Communications: messages sent through the Platform's messaging features
• Identity verification: information required for KYC/AML compliance on the Institution tier

Information collected automatically:

• Usage data: features accessed, actions taken, timestamps, and session duration
• Device information: browser type, operating system, IP address, and device identifiers
• Atlas Token activity: actions that earn or redeem tokens

2. How We Use Your Information

3. Data Sharing

We do not sell your personal information. We share data only in the following circumstances:

• With your organization: Data entered on the Platform is accessible to members of your organization based on roles and permissions you configure.
• Terminal listings: If you opt in to Terminal, anonymized financial metrics are visible to verified investors. Your company name is never shared unless you explicitly grant access.
• Portal: Data you configure for Portal display is shared with your invited LPs and investors.
• Service providers: We use third-party providers for hosting (Google Cloud / Firebase), payment processing, email delivery, and identity verification. These providers are bound by data processing agreements.
• Legal requirements: We may disclose information when required by law, regulation, legal process, or governmental request.
• Business transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction with equivalent privacy protections.

4. Tokenized Asset Data

If you use the Tokenized Asset Layer on the Institution tier, certain data is recorded on blockchain networks as part of the tokenization process. This includes ownership records, transfer history, and distribution events. Blockchain records are immutable by design and cannot be deleted.

We minimize the personal information recorded on-chain. Wallet addresses and transaction records are pseudonymous. Your personal identity is not published on-chain unless required by regulatory compliance logic embedded in the relevant smart contracts.

5. Data Security

We implement industry-standard security measures to protect your data:

• AES-256 encryption at rest for all stored data
• TLS 1.3 encryption in transit for all communications
• SOC 2 Type II audit in progress
• Role-based access controls within the Platform
• Regular security assessments and penetration testing
• Incident response procedures with notification within 72 hours of a confirmed breach

While we implement reasonable security measures, no system is completely secure. You are responsible for maintaining the security of your Atlas ID credentials.

6. Data Retention

We retain your data for as long as your account is active or as needed to provide the Platform. After account termination, we retain data for 30 days to allow for export, after which it is deleted in accordance with our retention schedule. Certain data may be retained longer as required by law or for legitimate business purposes such as fraud prevention and regulatory compliance.

Blockchain records associated with tokenized assets are retained indefinitely due to the immutable nature of distributed ledger technology.

7. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate or incomplete data
• Deletion: Request deletion of your personal data (subject to legal retention requirements)
• Portability: Request export of your data in a structured, machine-readable format
• Restriction: Request restriction of processing in certain circumstances
• Objection: Object to processing based on legitimate interest
• Withdrawal of consent: Withdraw consent for processing based on consent at any time

To exercise any of these rights, contact us at privacy@andohcapitalmanagement.com. We will respond within 30 days.

8. International Data Transfers

The Platform is operated from the United Arab Emirates and the United States. If you access the Platform from other jurisdictions, your data may be transferred to and processed in these countries. We implement appropriate safeguards for international data transfers, including standard contractual clauses where applicable.

9. Cookies & Tracking

The Platform uses essential cookies required for authentication and session management. We use analytics tools to understand how the Platform is used in aggregate. We do not use advertising cookies or sell data to advertisers. You can control cookie settings through your browser preferences.

10. Children's Privacy

The Platform is not intended for individuals under the age of 18. We do not knowingly collect personal information from minors. If we learn that we have collected data from a minor, we will promptly delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or through the Platform at least 30 days before they take effect. Your continued use of the Platform after the effective date constitutes acceptance of the updated policy.