Privacy Policy

Prometheum Ember ATS, Inc.; Prometheum Capital LLC; ProFinancial, Inc.
Last Updated: June 10, 2026

Privacy Policy
Prometheum, Inc., Prometheum Ember ATS, Inc., Prometheum Capital LLC, and ProFinancial, Inc. (collectively, "Prometheum," "we," "our," and/or "us") value the privacy of individuals who use our applications or services that link to this Privacy Policy (collectively, our "Services"). This Privacy Policy explains how we collect, use, share, and protect personal information from users of our Services, and describes your rights with respect to that information. This Privacy Policy is provided in accordance with the Securities and Exchange Commission's Regulation S-P (17 CFR Part 248) and other applicable federal and state privacy laws.

Applicability
‍By using our Services, you voluntarily provide your personally identifiable information to us and consent to its collection and use as described in this Privacy Policy. Your use of our Services is also subject to our Terms of Service.
‍If you do not agree to the terms of this Privacy Policy or our Terms of Service, do not provide us with any information and do not use our Services.

You must be at least 18 years of age to use our Services. We do not knowingly collect, maintain, or use personal information from individuals under the age of 18. If you learn that a minor has provided us with personal information, please contact us at customersupport@procustody.com.

Modification
‍We may modify this Privacy Policy at any time. We will notify you of material changes by posting the updated policy on our website and, where required by applicable law, by delivering notice to you directly. Please review this policy periodically. Questions regarding this Privacy Policy may be directed to customersupport@procustody.com.
‍Information We Collect
‍We may collect a variety of personally identifiable information from or about you or your devices from various sources, as described below.

1. Information You Provide to Us
   
   Registration and Profile Information
   ‍When you register for an account, we may ask for personally identifiable information including your name, email address, phone number, residential address, password, date of birth, social security number, employment status, employer name, job description, annual income, net worth, identity documents (e.g., driver's license, passport), information on your trusted contacts, affiliations with companies and/or brokerage firms, and information on whether you or a family member are a senior military, governmental, or political official.
   
   Communications
   If you contact us directly, we may receive additional personal information about you, including your name, email address, and the contents of your message.
   
   Careers
   ‍If you apply for a job with us, we will collect personal information you provide as part of your application, including contact information and resume content.
2. Information We Collect When You Use Our Services .
   
   Use of our Services
   ‍When you use our Services, we collect the personal information you provide. For example, when transactions are executed or custodied through our platforms, we collect information regarding the transaction, including date, amount, security, and related account information.
   
   Location Information
   ‍We may infer your general location from your IP address or other signals when you use our Services.
   
   Device Information
   ‍We receive information about the device and software you use to access our Services, including IP address, device type, and operating system version.
   
   Usage Information
   ‍We automatically receive information about your interactions with our Services, such as time spent on pages, objects clicked, and session dates and lengths.
   
   Analytics Partners
   ‍We use analytics services such as Google Analytics to collect and process analytics data. You can learn about Google's practices at https://www.google.com/policies/privacy/partners/ and opt out at https://tools.google.com/dlpage/gaoptout.
   
   Cookies and Similar Technologies
   ‍We and our third-party partners may collect information using cookies, pixel tags, or similar technologies. We use both session cookies (which expire when you close your browser) and persistent cookies (which remain until deleted or expired). You may modify your cookie settings through your browser; however, disabling cookies may limit your ability to use certain features of our Services.
3. Information We Receive from Third Parties.
   
   Introducing Broker-Dealers
   If you access our Services through an introducing broker-dealer under a fully-disclosed clearing arrangement, that firm may transmit personal information about you to us, including account application information, identity verification documents, and transaction instructions. We are authorized to receive and store such information consistent with this Privacy Policy and our clearing agreement with the introducing firm.
   
   Partners and Service Providers
   We may receive personal information about you from third-party partners and service providers and combine it with other personal information we have about you.
   ‍
   We use the personal information we collect to:
   - Provide, maintain, improve, and enhance our Services;
   - Verify your identity and process account applications;
   -Execute, clear, settle, and custody transactions in crypto asset securities and cash;
   -Communicate with you about your account, transactions, and our Services;
   -Comply with applicable laws, regulations, and regulatory requests, including anti-money laundering, know-your-customer, and sanctions screening obligations;
   -Detect, investigate, and prevent fraud and other unlawful activity;
   -Generate de-identified and aggregated data for lawful purposes;
   -Send marketing communications where permitted and where you have not opted out;
   -Enforce our Terms of Service and other legal rights; and
   -For other purposes for which we provide specific notice at the time the information is collected.
   
   How We Share the Personal Information We Collect
   
   We do not share or disclose personal information except as described below.
   
   Affiliates
   ‍We may share personal information among our affiliated entities — Prometheum Ember ATS, Inc., Prometheum Capital LLC, ProFinancial, Inc., and Prometheum Inc. — for purposes consistent with this Privacy Policy, including facilitating Services, account maintenance, compliance, and data processing. Each affiliate is a separate legal entity; none is responsible for the obligations of the others.
   
   Introducing Broker-Dealers
   If you have an account introduced to us through a fully-disclosed introducing broker-dealer, we may share your account information, statements, transaction records, and related information with that introducing firm as necessary to service your account, fulfill our obligations under our clearing agreement, and comply with applicable regulations.
   
   Clearing and Settlement Counterparties
   ‍We share information regarding your transactions with counterparties, settlement agents, and service providers — including Broadridge Financial Solutions and other third-party service bureaus — as necessary to execute, clear, and settle your transactions and maintain required books and records.
   
   Vendors and Service Providers
   We share personal information with vendors and service providers retained in connection with our Services, including technology providers, compliance vendors, identity verification services, and statement and tax reporting vendors. We require our service providers by contract to implement appropriate safeguards to protect customer information and to notify us promptly of any security incident affecting your information.
   
   Marketing
   ‍We do not rent, sell, or share personal information about you with nonaffiliated companies for their direct marketing purposes unless we have your permission.
   
   Analytics Partners
   We may use analytics services such as Google Analytics. See the Analytics Partners section above for opt-out options.
   
   As Required by Law
   ‍We may disclose personal information to comply with applicable laws, regulations, court orders, subpoenas, regulatory examinations, or requests from law enforcement or governmental agencies, or to protect the rights, property, or safety of ourselves, our customers, or others.
   
   Aggregate and De-Identified Information
   ‍We may share aggregate, de-identified, statistical information regarding our customers, traffic patterns, and usage with partners and affiliates. This information does not identify any individual customer and is maintained in a manner designed to prevent re-identification.
   
   Merger, Sale, or Asset Transfer
   ‍We may transfer personal information to third parties in connection with a merger, acquisition, sale of assets, or similar corporate transaction. We will notify you of such a transfer where required by applicable law.
   
   Consent
   ‍We may also disclose your personal information with your permission.
   
   Your Opt-Out Rights
   ‍
   Sharing with Nonaffiliated Third Parties
   You have the right to opt out of our sharing your nonpublic personal information with nonaffiliated third parties for purposes other than those required or permitted by law (such as processing transactions, complying with legal obligations, or preventing fraud). To exercise your opt-out right, contact us at:
   
   ‍Email: customersupport@procustody.com
   ‍
   ‍Phone: (212) 333-3316
   ‍
   ‍Mail: Prometheum Capital LLC, 29 Broadway, Suite 1110, New York, NY 10006
   
   Please note that opting out of certain sharing may limit our ability to open or service your account, as some information sharing is necessary to provide our Services.
   
   ‍Marketing Communications
   You may unsubscribe from promotional emails at any time using the unsubscribe link in those emails. You will continue to receive administrative and transactional communications even if you opt out of marketing communications.
   
   ‍Do Not Track
   There is no accepted industry standard for responding to Do Not Track signals, and we do not currently respond to such signals.
   
   Annual Privacy Notice
   We will deliver this Privacy Notice to you at the time your account is opened and annually thereafter for the duration of our relationship, in accordance with Regulation S-P. Annual notices will be delivered electronically to your email address of record or posted to your account portal, consistent with your electronic delivery preferences.
   ‍
   Data Security and Safeguards
   We implement reasonable physical, technical, and administrative safeguards designed to protect your personal information from unauthorized access, use, disclosure, alteration, and destruction. These measures include:
   
   - Defense-in-depth security architecture with multiple layers of access controls;
   - Restriction of network access to authorized users based on job function;
   - Infrastructure and network monitoring, logging, and alerting systems;
   - Encryption of data in transit and at rest;
   - Multi-factor authentication for system access;
   - Vendor security requirements, including contractual obligations to maintain appropriate safeguards and notify us of security incidents; and
   - Regular cybersecurity risk assessments and penetration testing.
   
   We require our service providers and vendors who handle customer information to implement comparable security measures and to notify us promptly of any unauthorized access to or acquisition of your information.
   
   Despite these measures, no security system is impenetrable. The security of your information also depends on steps you take to protect your account credentials, devices, and email access. You should keep your username, password, and multi-factor authentication credentials confidential at all times.
   
   Incident Response and Data Breach Notification
   ‍We maintain a written incident response program designed to detect, respond to, and recover from unauthorized access to or acquisition of customer nonpublic personal information. In the event of a data breach or security incident involving your information, we will:
   ‍
   - Investigate promptly upon discovering the incident;
   - Notify affected customers within 30 days of discovering that their information was or is reasonably likely to have been accessed or used without authorization, unless a law enforcement agency requests a delay;
   - Provide notice describing the nature of the incident, the categories of information involved, the steps we have taken or are taking in response, and any steps you can take to protect yourself; and
   - Notify applicable regulatory authorities as required by law.
   
   If you believe your account has been compromised or you have experienced unauthorized access, contact us immediately at customersupport@procustody.com or (212) 333-3316.
   
   International Visitors
   ‍Our Services are hosted in the United States. By using our Services and providing personal information, you consent to the transfer, storage, and processing of your information in the United States. If you reside outside the United States, you may have additional privacy rights under the laws of your jurisdiction. Where applicable, you may have the following rights:
   
   - Right to access — request copies of your personal data;
   - Right to rectification — request correction of inaccurate or incomplete information;
   - Right to erasure — request deletion of your personal data, subject to applicable legal and regulatory retention requirements;
   - Right to restrict processing — request that we limit how we use your information;
   - Right to object — object to our processing of your personal data; and
   - Right to data portability — request transfer of your data to another organization or directly to you.
   
   To exercise these rights, contact us at customersupport@procustody.com. We will respond within one month of receiving your request.
   
   California Residence
   If you are a California resident, you have the following additional rights under the California Consumer Privacy Act ("CCPA") and California Privacy Rights Act ("CPRA"):
   
   - Right to know — request disclosure of the categories and specific pieces of personal information we have collected about you, the sources of that information, the purposes for which it is used, and the categories of third parties with whom it is shared. You may make this request up to twice per year, free of charge.
   - Right to delete — request deletion of personal information we have collected from you, subject to exceptions for information we are required to retain by law or regulation.
   - Right to correct — request correction of inaccurate personal information.
   - Right to opt out of sale or sharing — request that we stop selling or sharing your personal information. We do not sell personal information.
   - Right to limit use of sensitive personal information — request that we limit our use of sensitive personal information (such as social security numbers, financial account information, and precise geolocation data) to the purposes necessary to provide our Services.
   - Right to non-discrimination — we will not discriminate against you for exercising your privacy rights.
   
   To exercise your California privacy rights, contact us at customersupport@procustody.com or (212) 333-3316. We will respond within 45 days, with a possible extension of an additional 45 days where reasonably necessary.
   
   Third-Party Links and Services
   Our Services may contain links to websites or services operated by third parties. This Privacy Policy does not apply to those third-party services. We are not responsible for the privacy practices of third parties and encourage you to review their privacy policies before providing any personal information.
   
   Contact Us
   For questions about this Privacy Policy, to exercise your privacy rights, or to report a privacy concern, contact us at:
   
   ‍Prometheum Capital LLC 29 Broadway, Suite 1100, NY 10006 customersupport@procustody.com or (212) 333-3316
   
   This Privacy Policy applies to Prometheum,. Inc., Prometheum Ember ATS, Inc., Prometheum Capital LLC, and ProFinancial, Inc. Each entity is a separate legal entity. This policy does not create any rights or obligations beyond those required by applicable law.
   ‍