# Privacy Policy **Last updated: 08/10/2025** ## 1. Introduction Welcome to Hashgraph Online DAO LLC ("Company", "we", "our", "us"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our conversational agent application and related services ("Service"). Your privacy is important to us. Please read this Privacy Policy carefully to understand our practices regarding your information and how we treat it. ## 2. Information We Collect ### Local Application Data Our desktop application stores configuration data locally on your device, including: - **API Keys**: OpenAI, Anthropic, and other service credentials - **Hedera Configuration**: Account ID, private keys, and network preferences - **Application Settings**: Theme preferences, operational modes, and user preferences - **Chat History**: Conversation data with AI agents (stored locally only) - **Legal Acceptance Records**: Records of your acceptance of terms and privacy policy ### Blockchain Data When you interact with the Hedera network through our application: - **Transaction Data**: All blockchain transactions are publicly recorded on the Hedera ledger - **HCS Messages**: Messages sent through Hedera Consensus Service are publicly visible - **Account Information**: Hedera account IDs and transaction history are publicly accessible - **Points Data**: HCS-10 and HCS-20 protocol data is permanently recorded on the blockchain ### Third-Party Service Data When you use integrated AI services: - **API Usage**: Your queries and responses are processed by third-party AI services (OpenAI, Anthropic) - **Service Logs**: Third-party services may maintain their own usage logs per their privacy policies ## 3. How We Use Information We use the collected information to: - **Provide Core Functionality**: Enable AI agent interactions and blockchain operations - **Maintain Configuration**: Store and restore your application settings - **Enable Features**: Support autonomous mode, manual transaction signing, and other features - **Legal Compliance**: Track acceptance of legal agreements as required ## 4. Data Storage and Security ### Local Storage - **Encryption**: Sensitive data like private keys and API keys are encrypted using industry-standard encryption - **Access Control**: Data is protected by your device's security measures - **No Cloud Backup**: We do not automatically backup your local data to cloud services ### Blockchain Storage - **Immutable Records**: Blockchain data cannot be deleted, modified, or made private once recorded - **Public Visibility**: All Hedera transactions and HCS messages are publicly accessible - **Permanent Storage**: Blockchain data persists indefinitely on the network ## 5. Information Sharing and Disclosure ### Third-Party Services We share data with third-party services only as necessary: - **AI Providers**: Your queries are sent to OpenAI, Anthropic, or other selected AI services - **Blockchain Networks**: Transaction data is broadcast to the Hedera network - **No Other Sharing**: We do not sell, rent, or otherwise share your data with other parties ### Legal Requirements We may disclose information if required by law or to: - Comply with legal obligations - Protect our rights and safety - Prevent fraud or illegal activities - Respond to government requests ## 6. Third-Party Privacy Policies Our application integrates with third-party services that have their own privacy policies: - **OpenAI**: https://openai.com/policies/privacy-policy - **Anthropic**: https://www.anthropic.com/privacy - **Hedera Hashgraph**: https://hedera.com/privacy - **HashPack Wallet**: https://www.hashpack.app/privacy-policy Please review these policies to understand how these services handle your data. ## 7. Data Retention ### Local Data - **User Control**: You can delete local application data at any time - **Application Uninstall**: Uninstalling the application removes local data - **Configuration Backup**: You may export and import configuration data ### Blockchain Data - **Permanent Storage**: Blockchain transactions and messages cannot be deleted - **Public Record**: All blockchain data remains publicly accessible indefinitely - **No Deletion Rights**: We cannot remove or modify blockchain data ## 8. Your Privacy Rights ### Access and Control - **Local Data Access**: You have full control over locally stored data - **Configuration Export**: Export your settings for backup or transfer - **Data Deletion**: Delete local application data at any time ### Limitations - **Blockchain Data**: Cannot be deleted, modified, or made private - **Third-Party Services**: Subject to their respective privacy policies - **Public Records**: Blockchain transactions remain publicly accessible ## 9. Children's Privacy Our Service is not intended for children under 18. We do not knowingly collect personal information from children under 18. If you become aware that a child has provided us with personal information, please contact us, and we will delete such information. ## 10. International Data Transfers ### Third-Party Services When you use AI services, your data may be processed in various countries: - **OpenAI**: Data may be processed in the United States - **Anthropic**: Data may be processed in the United States - **Compliance**: These services implement appropriate safeguards for international transfers ### Blockchain Networks - **Global Network**: Hedera operates a global network of nodes - **Distributed Storage**: Blockchain data is replicated across multiple jurisdictions - **No Control**: We have no control over the international distribution of blockchain data ## 11. California Privacy Rights (CCPA) California residents have additional rights under the California Consumer Privacy Act: - **Right to Know**: Information about data collection and use practices - **Right to Delete**: Request deletion of personal information (limited by blockchain immutability) - **Right to Opt-Out**: Opt-out of the sale of personal information (we do not sell data) - **Non-Discrimination**: We will not discriminate for exercising privacy rights ## 12. European Privacy Rights (GDPR) European users have rights under the General Data Protection Regulation: - **Legal Basis**: We process data based on consent, legitimate interests, or legal obligations - **Data Rights**: Access, rectification, erasure, portability, and objection rights - **Limitations**: Blockchain data immutability limits some rights - **Data Controller**: Hashgraph Online DAO LLC serves as the data controller ## 13. Data Breach Notification In the event of a data breach involving your personal information: - **Immediate Assessment**: We will assess the scope and impact of the breach - **Timely Notification**: We will notify affected users within 72 hours when feasible - **Regulatory Reporting**: We will comply with applicable breach notification laws - **Remediation**: We will take steps to prevent future breaches ## 14. Cookies and Tracking ### Desktop Application - **No Web Cookies**: The desktop application does not use web cookies - **Local Preferences**: Application settings are stored locally - **No Tracking**: We do not implement tracking or analytics in the desktop application ### Web Components If the application includes web-based components: - **Essential Cookies**: Only necessary for core functionality - **No Third-Party Tracking**: We do not use third-party tracking services - **User Control**: You can clear local storage through application settings ## 15. Updates to This Privacy Policy ### Policy Changes - **Regular Review**: We may update this policy to reflect changes in practices or laws - **User Notification**: We will notify users of material changes through the application - **Effective Date**: Changes become effective when posted with a new "Last updated" date - **Continued Use**: Using the Service after changes constitutes acceptance ### Version History - **Change Log**: Significant changes will be documented - **Archive Access**: Previous versions may be available upon request - **Transparency**: We commit to clear communication about policy updates ## 16. Data Security Measures ### Technical Safeguards - **Encryption**: Sensitive data is encrypted both at rest and in transit - **Access Controls**: Strict access controls limit data access to necessary functions - **Secure Development**: We follow secure coding practices and regular security reviews - **Updates**: Regular application updates address security vulnerabilities ### User Responsibilities - **Device Security**: Secure your device with passwords, biometrics, or other protection - **Private Key Security**: Never share your private keys or seed phrases - **Software Updates**: Keep the application updated to the latest version - **Network Security**: Use secure networks when possible ## 17. Contact Information For privacy-related questions or concerns, please contact us: **Email**: privacy@hashgraphonline.com **Mailing Address**: Hashgraph Online DAO LLC Privacy Department Republic of the Marshall Islands **Response Time**: We aim to respond to privacy inquiries within 30 days. ## 18. Governing Law This Privacy Policy is governed by the laws of the Republic of the Marshall Islands. Any disputes related to privacy matters will be resolved in accordance with the jurisdiction's applicable laws and our Terms of Service. ## 19. Acknowledgment By using our Service, you acknowledge that you have read and understood this Privacy Policy and agree to the collection, use, and disclosure of your information as described herein.