Spout Finance Inc.
Privacy Policy
How Spout collects, uses, and protects personal data, including blockchain data and identity verification, and the rights you have over it.
Last Updated: October 21, 2026
This Privacy Policy explains how Spout Finance Inc. ("Spout," "we," "us," or "our") collects, uses, shares, and protects personal data when you use our website at spout.finance, including our documentation (the "Website"), our application at app.spout.finance (the "App"), and related services (together, the "Services"). It should be read together with our Terms of Service. You can browse the Website without giving us any personal data.
1. Who We Are
1.1. Spout Finance Inc., a Delaware corporation, is the controller of the personal data described in this Privacy Policy.
1.2. Our affiliates are entities that control, are controlled by, or are under common control with Spout. Our affiliate Beluga Technologies Corporation, a Panama company, holds the shares behind the protocol's collateral pools, deals with token issuers, and sells the protocol's call options. It works with pool-level and position-level data, and does not receive your name, contact details, or identity documents.
1.3. You can contact us about this Privacy Policy at [email protected].
2. Personal Data We Collect
2.1. Data you give us.
(a) Your email address, if you sign in to the App with email, subscribe to our newsletter, or write to us.
(b) Identity verification data, if you use a feature of the App that requires it: your full legal name, date of birth, residential address, government-issued photo identification, and a selfie used to confirm that you are the person shown in the identification.
(c) The content of any message you send us.
2.2. Data created when you use the App.
(a) The wallet addresses linked to your account, including any wallet created for you when you sign in with email.
(b) Your positions, deposits, loans, withdrawals, and transaction history.
(c) Your points balance, your referral code, the referral code you added, and the accounts you referred.
(d) Authentication data, such as session tokens and sign-in times.
2.3. Data collected automatically.
(a) When you visit the Website, our analytics provider, Plausible, records page views, referring sites, browser and device type, and country, in aggregate and without cookies.
(b) When you use the App, we and our providers collect technical data such as IP address, browser and device type, and error and performance data. Our authentication provider, Privy, uses IP address and device data to secure your sign-in.
2.4. Data from other sources.
(a) From Persona: the result of your identity verification and sanctions screening and, where we need it for our compliance records, the identity data described in Section 2.1(b).
(b) From public blockchains: the transactions associated with your wallet addresses.
(c) From blockchain analytics providers: risk information about wallet addresses, such as links to sanctioned persons or illicit activity.
2.5. We do not collect your phone number, bank account details, or payment card details.
3. How We Use Personal Data
3.1. We use personal data for the purposes below. If you are in the European Economic Area, the United Kingdom, or Switzerland, the table also shows the legal basis we rely on.
| Purpose | Data used | Legal basis |
|---|---|---|
| Provide the App, keep you signed in, and show your account | Email address, wallet addresses, account and transaction data, authentication data | Performance of a contract |
| Verify identity where a feature requires it, and screen for sanctions | Identity verification data, wallet addresses, screening results | Legitimate interests in preventing financial crime, and legal obligation where it applies |
| Apply the geographic restrictions in our Terms | IP address, country, identity verification data | Legitimate interests, and legal obligation where it applies |
| Detect and prevent fraud, abuse, and market manipulation, including abuse of points and referrals | Account, transaction, referral, and device data | Legitimate interests in protecting users and the protocol |
| Calculate points and referral rewards | Account, transaction, and referral data | Performance of a contract |
| Send service messages, such as security alerts and changes to our terms | Email address | Performance of a contract |
| Send our newsletter, including a welcome email when you subscribe | Email address | Consent, which you can withdraw at any time |
| Measure and improve the Services | Aggregated usage data, error and performance data | Legitimate interests in running reliable services |
| Meet legal, regulatory, and tax obligations, and respond to lawful requests | Any of the above, as required | Legal obligation |
| Establish, exercise, or defend legal claims | Any of the above, as required | Legitimate interests |
3.2. Automated checks. Identity verification and sanctions screening are partly automated. If a check declines you or restricts your account, you can ask for a person to review the decision under Section 11.4 of our Terms of Service.
3.3. We do not use personal data for advertising, and we do not build profiles of you across other websites.
4. How We Share Personal Data
4.1. We do not sell your personal data, and we do not share it for targeted advertising.
4.2. We share personal data only with:
(a) service providers that process it on our behalf, under contracts that limit their use of it, including those listed in Section 4.3;
(b) our affiliates, for the purposes in this Privacy Policy;
(c) the issuer of a tokenized stock you buy through the App, which receives the order details it needs to quote and settle your purchase and processes them under its own privacy policy;
(d) the U.S. broker-dealer that holds the shares behind the protocol's collateral pools, only where the law requires it;
(e) authorities and other third parties where the law requires it, such as in response to a court order or a regulator's request, or where disclosure is necessary to prevent fraud or harm;
(f) a successor, if we are involved in a merger, acquisition, financing, or sale of assets, subject to this Privacy Policy; and
(g) anyone else, with your consent.
4.3. Our main service providers are:
| Provider | Service | Data involved |
|---|---|---|
| Privy | Sign-in, and wallets for email users | Email address, wallet addresses, IP address, device data |
| Persona | Identity verification and sanctions screening | Identity verification data |
| Blockchain analytics providers | Wallet screening | Wallet addresses |
| Amazon Web Services | Hosting and performance monitoring | Data we hold |
| Helius, Alchemy, and Triton | Solana network access | Transactions you submit |
| Supabase | Website content and newsletter subscriptions | IP address and browser data when the Website loads content, email address |
| Resend | Email delivery | Email address, message content |
| Plausible Analytics | Website analytics | Aggregated usage data |
4.4. Solana network requests from the App pass through our own relay, so our network providers do not normally see your IP address.
5. Blockchain Data
5.1. Public blockchains such as Solana are open, permanent records. When you transact through the protocol, your wallet address and transaction details are published to the Solana blockchain, where anyone can see them and link them to other activity.
5.2. We do not control public blockchains and cannot edit, delete, or hide data recorded on them. This includes the verified flag recorded for a wallet when its owner completes identity verification. That flag does not contain your name, documents, or other personal details.
6. Cookies, Browser Storage, and Embedded Content
6.1. We do not set cookies on the Website, and our analytics are cookieless.
6.2. We use your browser's storage only for the following, each of which is needed for a feature you use or remembers a choice you made:
| Item | Where | Purpose |
|---|---|---|
| spout:chat-hinted | Website | Remembers that you have seen the help assistant prompt |
| docsLocale | Website | Remembers the documentation language you chose |
| Session data | App | Keeps you signed in, set by the App and Privy |
6.3. The help assistant on the Website answers from a set of questions held in your browser. What you type is not sent to us or anyone else.
6.4. Some Website pages include content from other companies. Podcast episodes are played through Spotify's embedded player, which loads when you reach it on the page and may set its own cookies. Video thumbnails are loaded from YouTube, and a video is played through YouTube's privacy-enhanced mode only when you choose to play it. Thumbnails for videos posted on X are loaded from X's servers, and selecting one opens it on X. These companies receive your IP address and browser data and handle them under their own privacy policies.
6.5. We do not respond to Do Not Track or Global Privacy Control signals, because we do not track you across other websites.
7. International Transfers
7.1. Our App infrastructure is hosted by Amazon Web Services in the European Union, in Stockholm, Sweden. Our service providers and affiliates also process data in other countries, including the United States and Panama.
7.2. Where we transfer personal data from the European Economic Area, the United Kingdom, or Switzerland to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, the equivalent Swiss safeguards, or the EU-U.S. Data Privacy Framework where the recipient is certified. You can request a copy of the relevant safeguards at [email protected].
8. Retention
8.1. We keep personal data only for as long as we need it for the purposes in this Privacy Policy, including to meet legal obligations and resolve disputes. In particular:
| Data | Retention |
|---|---|
| Identity verification and sanctions screening records | 5 years after our relationship with you ends, or longer if the law requires it |
| Account, wallet, and transaction records | While your account is active, and for 5 years after your last activity |
| Points and referral records | While your points can be used, and for 2 years after that |
| Newsletter subscription | Until you unsubscribe |
8.2. Data recorded on a public blockchain cannot be deleted. See Section 5.
9. Security
9.1. We protect personal data with technical and organizational measures, including encryption in transit and at rest, and access controls that limit access to the people who need it.
9.2. No system is completely secure. You are responsible for the security of your wallet, your private keys, and, if you sign in with email, your email account. We will never ask for your recovery phrase or private key.
10. Your Rights
10.1. Depending on where you live, you may have the right to:
(a) access the personal data we hold about you;
(b) correct inaccurate data;
(c) delete your data;
(d) restrict or object to our processing, including processing based on legitimate interests;
(e) receive your data in a portable format;
(f) withdraw your consent at any time, where we rely on it; and
(g) ask for a person to review a decision made by automated means.
10.2. To exercise these rights, write to [email protected]. We will verify your request, for example by asking you to confirm control of your email address or wallet, and respond within 30 days, or sooner where the law requires it. We will not treat you differently for exercising your rights.
10.3. Some data cannot be deleted. Data recorded on a public blockchain is permanent, and we keep identity verification and transaction records for the periods in Section 8 where the law requires it.
10.4. You have the right to complain to a data protection authority, in particular in the country where you live or work. In the United Kingdom, that is the Information Commissioner's Office. In Switzerland, it is the Federal Data Protection and Information Commissioner.
11. Children
The Services are not intended for anyone under 18, and we do not knowingly collect personal data from children. If you believe a child has given us personal data, contact [email protected] and we will delete it.
12. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. The date at the top shows when it was last changed. If we make a material change, we will tell you through the App or by email before it takes effect.
13. Contact
Spout Finance Inc. [email protected]