PRIVACY NOTICE

This Privacy Notice describes how Native Markets, Inc. ("we", "us", "our") collects, uses and discloses information about you when you use our websites (nativemarkets.com and usdh.com), other Native Markets products or services, or when you interact with us, such as through customer support or a partner (collectively, the "Services").

Please read this Privacy Notice carefully. By using the Services, you agree to the collection, use, and disclosure of your information as described here. If you do not understand or agree to this Privacy Notice, please do not use the Services.

CHANGES TO THIS PRIVACY NOTICE

We may update this Privacy Notice from time to time. If we make material changes, we will update the "Last Updated" date above. Continued use of the Services after any update constitutes acceptance of the revised Notice.

COLLECTION AND USE OF YOUR INFORMATION

We collect information in three ways: (1) what you provide to us, (2) what we collect automatically, and (3) what we obtain from other sources. In addition to the specific uses discussed below, we may use this information to provide and improve the Services, maintain our business relationship, enhance safety and security, detect and prevent fraud, provide customer support, conduct research and development, comply with legal obligations, enforce terms of service, and protect the Services, our rights and the rights of our employees, users or other individuals.

Information You Provide

Some features of the Services may require you to provide certain information directly. You may decline, but doing so may limit your ability to use those features.

• Contact information — name, address, email address, and phone number. Used to create and maintain your account and provide the Services, and to communicate with you.
• Account information — username, password, security questions, account handle, and other profile details. Used to provide the Services, and to create, maintain, and secure your account. Keep your credentials safe and confidential; contact us immediately if you believe your account has been compromised.
• Additional identification information — maiden name, tax ID, marital status, photograph, date of birth, gender and any other information contained in any identification documents you provide to us, such as a copy of your driver's license, passport, utility bills or proof of residence. Collected via our identity verification integration to verify your identity and comply with legal obligations, including anti-money laundering laws, and to detect and prevent fraudulent and other unauthorized activities.
• Financial and transaction information — bank account details, digital wallet addresses, transaction history, and balance information. Used to provide the Services and enable you to transact with us.
• Communications — messages or other content you send us through the Services or when contacting support. Used to respond to you and improve our Services.

Information Collected Automatically

We and our third-party service providers automatically collect certain information when you use the Services, using cookies, pixels, and similar tracking technologies ("Tracking Technologies"). This information is collected and used to personalize the Services and tailor your experience, run analytics, and better understand user interactions with the Services. Such information includes:

• Device information — device type, operating system, and unique device identifiers.
• IP address — collected by our service providers to determine approximate location, for security purposes, and to tailor the Services displayed to you based on your jurisdiction.
• Usage information — browser type, log data, timestamps, clickstream data (pages viewed, time spent, interactions), and interactions with emails.

See Cookies and Other Tracking Technologies below for more detail.

Information from Third Parties

We may obtain information about you from outside sources to help deliver our Services or verify your account, including:

• Public blockchain data — transaction IDs, timestamps, amounts, and wallet addresses.
• Business partners — information from partners through whom you access our platform.
• Third-party account providers — if you choose to log in via Google or a similar service, we receive basic account and login information from that provider.
• Any third-party information such as your name, email address, and additional account information that is publicly available.

Any information we receive from outside sources will be treated in accordance with this Privacy Notice. We are not responsible for third-party accuracy or practices. For more information, see the section below, Third-Party Websites and Materials.

Deidentified Information

We may deidentify or anonymize your information and use it for any purpose.

Summary

The table below summarizes how we use your data.

Data Retention

We retain your information for as long as necessary to fulfill the purposes for which it was collected, including to provide you with the Services, comply with legal and regulatory obligations (including applicable record-keeping requirements), resolve disputes, and enforce our agreements. We apply retention periods based on the amount, nature, and sensitivity of the information, the potential risk of harm from unauthorized use or disclosure, and applicable legal requirements. When your information is no longer needed, we will securely delete or anonymize it where technically feasible.

COOKIES AND OTHER TRACKING TECHNOLOGIES

As described above, we and third parties use Tracking Technologies to collect information about your interactions with the Services. Most browsers accept these automatically, but you can adjust your settings to block or delete them — though doing so may affect login and other functionality.

Our website does not respond to "Do Not Track" signals. You may opt out of interest-based advertising through tools offered by the National Advertising Initiative or the Digital Advertising Alliance.

DISCLOSURE OF YOUR INFORMATION

We may disclose your information for legitimate purposes, including to:

• Service providers — vendors who help us operate the Services, including for identity verification, transaction monitoring, fraud detection, on-chain analytics and wallet screening (which may result in automated denial of access to the Services), cloud storage, security, customer support, analytics, payment processing, and marketing.
• Bridge (our stablecoin issuance partner) — Bridge processes USDH minting and redemption and independently conducts identity verification, AML, and OFAC screening. When you use the Services, your information will also be processed by Bridge in accordance with its own privacy policy.
• Affiliates — other companies within our corporate group.
• Business partners — partners through whom you access our platform or services, including banking partners when you link a bank account to process transactions.
• Professional advisors — auditors, legal counsel, and accountants, to protect and enforce our rights and comply with legal and regulatory obligations.
• Corporate transaction parties — in connection with a merger, acquisition, asset sale, or similar transaction.
• Legal and regulatory authorities — to cooperate with law enforcement, respond to judicial orders or regulatory inquiries, prevent fraud or illegal activity, exercise or defend legal claims, ensure the safety of our business, employees, and users, and enforce our terms of service.
• With your consent — or otherwise at your direction.

THIRD-PARTY WEBSITES AND MATERIALS

The Services may contain links to third-party websites and tools. Their privacy practices are their own — please review their policies, notices and other terms before sharing any information.

CHILDREN'S PRIVACY

Our Services are not intended for children under 13, and we do not knowingly collect information from children under 13. If you believe your child has shared information with us, please contact us and we will make commercially reasonable efforts to delete it.

DATA SECURITY

We implement safeguards designed to protect your information, but no system is completely secure. We recommend that you avoid sending sensitive information over unsecured channels.

We are based in the United States. If you use the Services from outside the United States, your information may be transferred to, stored, and processed in the United States or other countries.

ADDITIONAL DISCLOSURES FOR U.S. STATE PRIVACY LAWS

This section applies to residents of states with comprehensive consumer privacy laws and supplements the rest of this Privacy Notice.

Categories of Personal Information Collected

In the preceding 12 months, we have collected: identifiers (name, email, phone number, IP address, account name); financial information (bank account details, transaction history, wallet addresses); internet or network activity (browsing history, interactions with our Services); and inferences drawn from the above.

Sources and Purposes

We collect personal information from you directly, automatically through your use of the Services, and from third-party sources (identity verification providers, business partners, public blockchains). We use it for the business and commercial purposes described in this Privacy Notice.

Disclosure for Business Purposes

In the preceding 12 months, we have disclosed identifiers, financial information, commercial information, internet or network activity, and geolocation data to service providers, business partners, and as otherwise described in this Privacy Notice.

Sale and Sharing of Personal Information

We do not sell your personal information for money. Separately, certain state privacy laws define "sale" or "sharing" broadly to include disclosures to third-party analytics providers even without payment. To the extent our data practices fall within those definitions, you have the right to opt out, as described under Your Privacy Rights below.

Your Privacy Rights

Depending on your state of residence, you may have the following rights:

• Know/Access — request information about the categories and specific pieces of personal information we have collected, the sources, purposes, and third parties with whom it has been shared.
• Delete — request deletion of personal information we have collected, subject to certain exceptions.
• Correct — request correction of inaccurate personal information.
• Opt Out of Sale/Sharing — opt out of sale or sharing of your personal information for targeted advertising.
• Limit Sensitive Data Use — if applicable, limit our use of sensitive personal information to purposes necessary to provide the Services.
• Data Portability — request a copy of your personal information in a portable, commonly used format.
• Non-Discrimination — we will not discriminate against you for exercising any of these rights.

How to Exercise Your Rights

Email us at [email protected] with the subject line "Privacy Rights Request." We will verify your identity before processing your request. You may also designate an authorized agent to submit a request on your behalf.

Right to Appeal

If we deny your request, you may appeal by emailing [email protected] with the subject line "Privacy Rights Appeal." We will respond in accordance with applicable law.

ADDITIONAL DISCLOSURES FOR USERS OUTSIDE THE UNITED STATES

If you are located in the European Economic Area ("EEA"), United Kingdom ("UK"), or Switzerland, this section applies to you and supplements the information in this Privacy Notice.

Controller

Native Markets, Inc. is the controller of your personal data for purposes of applicable data protection laws.

Legal Bases for Processing

We process your personal data on the following legal bases:

• Performance of a Contract — processing necessary to provide you with the Services and fulfill our obligations to you.
• Legal Obligation — processing necessary to comply with applicable laws, including AML and KYC requirements.
• Legitimate Interests — processing for fraud prevention, security, improving our Services, and direct marketing, where those interests are not overridden by your rights.
• Consent — where you have provided consent for specific processing activities, such as marketing communications. You may withdraw consent at any time.

Your Data Subject Rights

Under applicable data protection laws, you have the following rights:

• Access: Request access to your personal data and information about how we process it.
• Rectification: Request correction of inaccurate or incomplete personal data.
• Erasure: Request deletion of your personal data in certain circumstances.
• Restriction: Request restriction of processing of your personal data in certain circumstances.
• Data Portability: Request a copy of your personal data in a structured, commonly used, machine-readable format.
• Object: Object to processing based on legitimate interests or for direct marketing purposes.
• Withdraw Consent: Withdraw consent at any time where processing is based on consent.
• Lodge a Complaint: Lodge a complaint with your local supervisory authority.

Please note that because blockchain transactions are recorded on public, decentralized networks, it may not be technically possible to erase or alter on-chain data in response to a deletion or rectification request. Applicable law generally recognizes this limitation.

We use automated systems to screen wallet addresses for compliance purposes. These systems may make automated decisions that affect your access to the Services.

To exercise your rights, please contact us at [email protected].

International Transfers

Your personal data may be transferred to and processed in the United States and other countries outside the EEA, UK, or Switzerland. When we transfer personal data outside these regions, we rely on appropriate safeguards, such as Standard Contractual Clauses approved by the European Commission or the UK Secretary of State.

HOW TO CONTACT US

For questions about this Privacy Notice or our privacy practices, please email us at [email protected].