Privacy Policy

Prometheum Ember ATS, Inc. | Prometheum Capital LLC | ProFinancial, Inc. 
Last Updated: October 27, 2026

Privacy Policy
Prometheum, Inc., Prometheum Ember ATS, Inc., Prometheum Capital LLC, and ProFinancial, Inc. (collectively, "Prometheum," "we," "our," and/or "us") value the privacy of individuals who use our applications or services that link to this Privacy Policy (collectively, our "Services"). This Privacy Policy explains how we collect, use, share, and protect personal information from users of our Services, and describes your rights with respect to that information. This Privacy Policy is provided in accordance with the Securities and Exchange Commission's Regulation S-P (17 CFR Part 248) and other applicable federal and state privacy laws.

Applicability
‍By using our Services, you voluntarily provide your personally identifiable information to us and consent to its collection and use as described in this Privacy Policy. Your use of our Services is also subject to our Terms of Service.If you do not agree to the terms of this Privacy Policy or our Terms of Service, do not provide us with any information and do not use our Services.You must be at least 18 years of age to use our Services. We do not knowingly collect, maintain, or use personal information from individuals under the age of 18. If you learn that a minor has provided us with personal information, please contact us at customersupport@procustody.com.

Modification
‍We may modify this Privacy Policy at any time. We will notify you of material changes by posting the updated policy on our website and, where required by applicable law, by delivering notice to you directly. Please review this policy periodically. Questions regarding this Privacy Policy may be directed to customersupport@procustody.com.
‍Information We Collect
‍We may collect a variety of personally identifiable information from or about you or your devices from various sources, as described below.

1. Information You Provide to Us
   
   Registration and Profile Information
   ‍When you register for an account, we may ask for personally identifiable information including your name, email address, phone number, residential address, password, date of birth, social security number, employment status, employer name, job description, annual income, net worth, identity documents (e.g., driver's license, passport), information on your trusted contacts, affiliations with companies and/or brokerage firms, and information on whether you or a family member are a senior military, governmental, or political official.
   
   Communications
   If you contact us directly, we may receive additional personal information about you, including your name, email address, and the contents of your message.
   
   Careers
   ‍If you apply for a job with us, we will collect personal information you provide as part of your application, including contact information and resume content.
2. Information We Collect When You Use Our Services .
   
   Use of our Services
   ‍When you use our Services, we collect the personal information you provide. For example, when transactions are executed or custodied through our platforms, we collect information regarding the transaction, including date, amount, security, and related account information.
   
   Location Information
   ‍We may infer your general location from your IP address or other signals when you use our Services.
   
   Device Information
   ‍We receive information about the device and software you use to access our Services, including IP address, device type, and operating system version.
   
   Usage Information
   ‍We automatically receive information about your interactions with our Services, such as time spent on pages, objects clicked, and session dates and lengths.
   
   Analytics Partners
   ‍We use analytics services such as Google Analytics, and may use other third-parties in our sole discretion, to collect and process analytics data. You can learn about Google's practices at https://www.google.com/policies/privacy/partners/ and opt out at https://tools.google.com/dlpage/gaoptout.
   
   Cookies and Similar Technologies
   ‍We and our third-party partners may collect information using cookies, pixel tags, or similar technologies. Strictly necessary cookies support security, authentication, and core site functions and are set automatically. Analytics and advertising cookies, are configured to load only after you accept them through our cookie banner. You may modify your cookie settings through your browser; however, disabling cookies may limit your ability to use certain features of our Services. Withdrawing consent does not affect processing before withdrawal.
3. Information We Receive from Third Parties.
   
   Introducing Broker-Dealers
   If you access our Services through an introducing broker-dealer under a fully-disclosed clearing arrangement, that firm may transmit personal information about you to us, including account application information, identity verification documents, and transaction instructions. We are authorized to receive and store such information consistent with this Privacy Policy and our clearing agreement with the introducing firm.
   
   Partners and Service Providers
   We may receive personal information about you from third-party partners and service providers and combine it with other personal information we have about you.
   ‍
   We use the personal information we collect to:
   - Provide, maintain, improve, and enhance our Services;
   - Verify your identity and process account applications;
   -Execute, clear, settle, and custody transactions in crypto asset securities and cash;
   -Communicate with you about your account, transactions, and our Services;
   -Comply with applicable laws, regulations, and regulatory requests, including anti-money laundering, know-your-customer, and sanctions screening obligations;
   -Detect, investigate, and prevent fraud and other unlawful activity;
   -Generate de-identified and aggregated data for lawful purposes;
   -Send marketing communications where permitted and where you have not opted out;
   -Enforce our Terms of Service and other legal rights; and
   -For other purposes for which we provide specific notice at the time the information is collected.
   
   How We Share the Personal Information We Collect
   
   We do not share or disclose personal information except as described below.
   
   Affiliates
   ‍We may share personal information among our affiliated entities — Prometheum Ember ATS, Inc., Prometheum Capital LLC, ProFinancial, Inc., Prometheum Inc., and ProCoinery — for purposes consistent with this Privacy Policy, including facilitating Services, account maintenance, compliance, and data processing. Each affiliate is a separate legal entity; none is responsible for the obligations of the others.
   
   Introducing Broker-Dealers
   If you have an account introduced to us through a fully-disclosed introducing broker-dealer, we may share your account information, statements, transaction records, and related information with that introducing firm as necessary to service your account, fulfill our obligations under our clearing agreement, and comply with applicable regulations.
   
   Clearing and Settlement Counterparties
   ‍We share information regarding your transactions with counterparties, settlement agents, and service providers — including Broadridge Financial Solutions and other third-party service bureaus — as necessary to execute, clear, and settle your transactions and maintain required books and records.
   
   Vendors and Service Providers
   We share personal information with vendors and service providers retained in connection with our Services, including technology providers, compliance vendors, identity verification services, and statement and tax reporting vendors. We require our service providers by contract to implement appropriate safeguards to protect customer information and to notify us promptly of any security incident affecting your information.
   
   Marketing
   ‍We do not rent, sell, or share personal information about you with nonaffiliated companies for their direct marketing purposes without your permission.
   
   Analytics Partners
   We may use analytics services such as Google Analytics and other third-parties in our sole discretion. See the Analytics Partners section above for opt-out options.
   
   As Required by Law
   ‍We may disclose personal information to comply with applicable laws, regulations, court orders, subpoenas, regulatory examinations, or requests from law enforcement or governmental agencies, or to protect the rights, property, or safety of ourselves, our customers, or others.
   
   Aggregate and De-Identified Information
   ‍We may share aggregate, de-identified, statistical information regarding our customers, traffic patterns, and usage with partners and affiliates. This information does not identify any individual customer and is maintained in a manner designed to prevent re-identification.
   
   Merger, Sale, or Asset Transfer
   ‍We may transfer personal information to third parties in connection with a merger, acquisition, sale of assets, or similar corporate transaction. We will notify you of such a transfer where required by applicable law.
   
   Consent
   ‍We may also disclose your personal information with your permission.
   
   Your Opt-Out Rights
   ‍
   Sharing with Nonaffiliated Third Parties
   You have the right to opt out of our sharing your nonpublic personal information with nonaffiliated third parties for purposes other than those required or permitted by law (such as processing transactions, complying with legal obligations, or preventing fraud). To exercise your opt-out right, contact us at:
   
   ‍Email: customersupport@procustody.com
   ‍
   ‍Phone: (212) 333-3316
   ‍
   ‍Mail: Prometheum Capital LLC, 29 Broadway, Suite 1110, New York, NY 10006
   
   Please note that opting out of certain sharing may limit our ability to open or service your account, as some information sharing is necessary to provide our Services.
   
   ‍Marketing Communications
   You may unsubscribe from promotional emails at any time using the unsubscribe link in those emails. You will continue to receive administrative and transactional communications even if you opt out of marketing communications.
   
   ‍Do Not Track
   There is no accepted industry standard for responding to Do Not Track signals, and we do not currently respond to such signals. We treat Global Privacy Control signals as an opt-out of sale/sharing and a rejection of non-essential cookies.
   
   Annual Privacy Notice
   We will deliver this Privacy Notice to you at the time your account is opened and annually thereafter for the duration of our relationship, in accordance with Regulation S-P. Annual notices will be delivered electronically to your email address of record or posted to your account portal, consistent with your electronic delivery preferences.
   ‍
   Data Security and Safeguards
   We implement reasonable physical, technical, and administrative safeguards designed to protect your personal information from unauthorized access, use, disclosure, alteration, and destruction. These measures include:
   
   - Defense-in-depth security architecture with multiple layers of access controls;
   - Restriction of network access to authorized users based on job function;
   - Infrastructure and network monitoring, logging, and alerting systems;
   - Encryption of data in transit and at rest;
   - Multi-factor authentication for system access;
   - Vendor security requirements, including contractual obligations to maintain appropriate safeguards and notify us of security incidents; and
   - Regular cybersecurity risk assessments and penetration testing.
   
   We require our service providers and vendors who handle customer information to implement comparable security measures and to notify us promptly of any unauthorized access to or acquisition of your information.
   
   Despite these measures, no security system is impenetrable. The security of your information also depends on steps you take to protect your account credentials, devices, and email access. You should keep your username, password, and multi-factor authentication credentials confidential at all times.
   
   Data Retention
   We retain personal information for as long as necessary to provide our Services, comply with our legal and regulatory obligations, resolve disputes, and enforce our agreements. In particular:
   
   - Account, transaction, and related books-and-records information is retained for a minimum of six years, consistent with SEC Rule 17a-4 and other applicable regulatory recordkeeping requirements.
   - Identity verification and KYC/AML records are retained for the period required under applicable Bank Secrecy Act, USA PATRIOT Act, and related regulations.
   - Information collected for marketing or analytics purposes is retained until you opt out or for 12 months of inactivity, whichever occurs first.
   - Career/application information is retained for 36 months following the conclusion of the hiring process, unless otherwise required by law.
   
   When personal information is no longer needed for these purposes, we take reasonable steps to securely delete or de-identify it, subject to legal and regulatory retention obligations.
   ‍
   Incident Response and Data Breach Notification
   ‍We maintain a written incident response program designed to detect, respond to, and recover from unauthorized access to or acquisition of customer nonpublic personal information. In the event of a data breach or security incident involving your information, we will:
   ‍
   - Investigate promptly upon discovering the incident;
   - Notify affected customers within 30 days of discovering that their information was or is reasonably likely to have been accessed or used without authorization, unless a law enforcement agency requests a delay;
   - Provide notice describing the nature of the incident, the categories of information involved, the steps we have taken or are taking in response, and any steps you can take to protect yourself; and
   - Notify applicable regulatory authorities as required by law.
   
   If you believe your account has been compromised or you have experienced unauthorized access, contact us immediately at customersupport@procustody.com or (212) 333-3316.
   
   International Visitors
   ‍Our Services are hosted in the United States. By using our Services and providing personal information, you consent to the transfer, storage, and processing of your information in the United States. We may collect and process personal information about individuals located in the European Economic Area ("EEA"), the United Kingdom, and Switzerland (collectively, "European Visitors"). This section applies to European Visitors and describes how we comply with the EU General Data Protection Regulation ("GDPR") and, where applicable, the UK GDPR and the UK Data Protection Act 2018. If you reside outside the United States, you may have additional privacy rights under the laws of your jurisdiction.
   
   Data Controller.
   Prometheum Inc. is the data controller responsible for personal information collected from European Visitors through the Services.
   
   Legal Basis for Processing.
   We process your personal information on the following legal bases, as applicable:
   
   - Performance of a contract — to open and administer your account and provide the Services you request;
   - Compliance with a legal obligation — to satisfy our anti-money laundering, know-your-customer, sanctions-screening, and other regulatory obligations;
   - Legitimate interests — to detect and prevent fraud, maintain the security of our Services, and improve our Services, where those interests are not overridden by your rights and interests; and
   - Consent — for marketing communications and non-essential cookies, where required by applicable law. You may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.
   
   International Data Transfers.
   Your personal information is transferred to, and processed in, the United States. Where required, we rely on the Standard Contractual Clauses approved by the European Commission, the UK International Data Transfer Addendum, or another approved transfer mechanism to safeguard these transfers. You may request a copy of the relevant safeguard by contacting us as described below.
   
   Where applicable, you may have the following rights:
   
   - Right to access — request copies of your personal data;
   - Right to rectification — request correction of inaccurate or incomplete information;
   - Right to erasure — request deletion of your personal data, subject to applicable legal and regulatory retention requirements;
   - Right to restrict processing — request that we limit how we use your information;
   - Right to object — object to our processing of your personal data; and
   - Right to data portability — request transfer of your data to another organization or directly to you.
   - Right to withdraw consent — where processing is based on consent, withdraw it at any time; and
   - Lodge a complaint — file a complaint with your local data protection supervisory authority. A list of EEA supervisory authorities is available at https://edpb.europa.eu/about-edpb/about-edpb/members_en; UK residents may contact the UK Information Commissioner's Office at https://ico.org.uk.
   
   To exercise these rights, contact us at customersupport@procustody.com. We will respond without undue delay and in any event within one month of receiving a verifiable request, which we may extend by a further two months where necessary, taking into account the complexity and number of requests; we will inform you of any such extension within one month of your request.
   
   California Residence
   If you are a California resident, you have the following additional rights under the California Consumer Privacy Act ("CCPA") and California Privacy Rights Act ("CPRA"):
   
   - Right to know — request disclosure of the categories and specific pieces of personal information we have collected about you, the sources of that information, the purposes for which it is used, and the categories of third parties with whom it is shared. You may make this request up to twice per year, free of charge. If we have retained your personal information for longer than the 12-month period preceding your request, you may request that we provide personal information dating back to January 1, 2022, and we will provide it unless doing so proves impossible or would involve disproportionate effort.
   - Right to delete — request deletion of personal information we have collected from you, subject to exceptions for information we are required to retain by law or regulation.
   - Right to correct — request correction of inaccurate personal information.
   - Right to opt out of sale or sharing — request that we stop selling or sharing your personal information. We do not sell personal information. To the extent advertising cookies constitute ‘sharing’ for cross-context behavioral advertising, you may opt out through Cookie Settings or by using a Global Privacy Control signal.
   - Right to limit use of sensitive personal information — request that we limit our use of sensitive personal information (such as social security numbers, financial account information, and precise geolocation data) to the purposes necessary to provide our Services, except that this right does not apply to information collected or processed for purposes permitted under Cal. Civ. Code § 1798.140(e), including verifying your identity, complying with our AML/KYC obligations, and preventing fraud or illegal activity.
   - Right to non-discrimination — we will not discriminate against you for exercising your privacy rights.
   - Personal information we collect, use, or disclose in connection with your application for, or maintenance of, an account with Prometheum Ember ATS, Inc., Prometheum Capital LLC, or ProFinancial, Inc., whether or not that application is approved, is governed by our Regulation S-P privacy notice. The rights described in this Section do not apply to that information to the extent it is collected, processed, sold, or disclosed pursuant to the Gramm-Leach-Bliley Act, as permitted under Cal. Civ. Code § 1798.145(e).
   
   To exercise your California privacy rights, contact us at customersupport@procustody.com or (212) 333-3316. We will respond within 45 days, with a possible extension of an additional 45 days where reasonably necessary.
   
   Third-Party Links and Services
   Our Services may contain links to websites or services operated by third parties. This Privacy Policy does not apply to those third-party services. We are not responsible for the privacy practices of third parties and encourage you to review their privacy policies before providing any personal information.
   
   Contact Us
   For questions about this Privacy Policy, to exercise your privacy rights, or to report a privacy concern, contact us at:
   
   ‍Prometheum Capital LLC 29 Broadway, Suite 1100, NY 10006 customersupport@procustody.com or (212) 333-3316
   
   This Privacy Policy applies to Prometheum, Inc., Prometheum Ember ATS, Inc., Prometheum Capital LLC, and ProFinancial, Inc. Each entity is a separate legal entity. This policy does not create any rights or obligations beyond those required by applicable law.
   ‍