Privacy Policy

AutoXOnboard operates a decentralized finance (DeFi) platform that tokenizes motor vehicles as XLS-20 NFTs on the XRP Ledger to facilitate peer-to-peer collateral-backed lending. In doing so, we collect, process, and in some cases permanently publish personal information associated with your identity, your vehicle, and your financial transactions.

This Policy is designed to comply with the New York SHIELD Act (General Business Law § 899-aa et seq.), the federal Gramm-Leach-Bliley Act (GLBA) to the extent applicable, and applicable federal privacy principles. We treat all user data with the care and security appropriate to its sensitivity.

By using the Platform you acknowledge that you have read this Privacy Policy and consent to the data practices described herein, including the permanent public publication of certain data on the XRP Ledger as described in § 04.

AutoXOnboard Inc. is the data controller responsible for personal information collected through the Platform. We are incorporated and operate in the State of New York. Our designated privacy contact is listed in § 16 of this Policy.

Where the Platform facilitates transactions between Borrowers and Lenders, each Lender who receives personal information about a Borrower (such as wallet address and loan details via the XRPL) is an independent data controller with respect to that information and is solely responsible for their own compliance with applicable privacy law.

We collect the following categories of personal information when you use the Platform:

Data we do not collect. AutoXOnboard does not collect or store: government-issued ID numbers (SSN, driver's license, passport); credit scores or credit reports; financial account numbers or routing numbers; seed phrases, private keys, or wallet recovery codes. We will never ask you to provide these.

Data permanently written to the XRP Ledger includes:

Data stored on IPFS includes:

Pseudonymity vs. anonymity. Your XRPL wallet address is pseudonymous — it does not contain your name by itself, but AutoXOnboard's internal records link your wallet address to your onboarding data (vehicle, photos, communications). Law enforcement requests or legal process may require us to disclose this linkage. Additionally, blockchain analytics tools operated by third parties may independently link wallet addresses to real-world identities.

We use personal information only for the following purposes:

We do not use your personal information for targeted advertising, behavioral profiling for marketing, or sale to data brokers.

We share personal information only in the following circumstances:

We do not sell personal information to third parties, data brokers, or advertisers under any circumstances.

As part of the Platform's core function, certain vehicle and lien information is shared with the New York Department of Motor Vehicles. This sharing is required by law and is not optional. Specifically:

The NY DMV's handling of information submitted to it is governed by NY DMV's own privacy policies and applicable state law, which AutoXOnboard does not control.

We retain personal information for as long as necessary to fulfill the purposes described in this Policy, comply with legal obligations, resolve disputes, and enforce our agreements. The following schedule applies:

After applicable retention periods, off-chain data is securely deleted or anonymized in accordance with the NY SHIELD Act's data disposal requirements (General Business Law § 899-aa(h)).

The New York SHIELD Act (Stop Hacks and Improve Electronic Data Security Act, General Business Law § 899-aa et seq.) requires any person or business that owns or licenses computerized data including private information of New York residents to implement and maintain reasonable safeguards to protect that data. AutoXOnboard complies with this obligation through the following measures:

Breach notification. Under the NY SHIELD Act, if AutoXOnboard discovers a security breach involving private information of New York residents, we will notify affected individuals in the most expedient time possible and without unreasonable delay, as required by GBL § 899-aa(8). Notification will include a description of the breach, the type of information involved, and steps being taken to address it.

As a user and New York resident, you have the following rights with respect to your personal information. To exercise any right, contact us at [email protected]. We will respond within 30 days.

The Platform is intended solely for users who are 18 years of age or older. We do not knowingly collect personal information from individuals under 18. If we learn that we have collected personal information from a person under 18, we will delete that information from our off-chain systems as promptly as practicable and terminate the associated account. If you believe a minor has submitted information through the Platform, please contact us immediately at [email protected].

The Platform uses a minimal set of cookies and similar tracking technologies necessary for operation:

We do not use advertising cookies, cross-site tracking pixels, or third-party behavioral advertising technologies. We do not participate in any ad networks or data broker ecosystems.

The Platform integrates with the following third-party services, each of which has its own privacy practices:

AutoXOnboard is not responsible for the privacy practices of third-party services. We encourage you to review the privacy policies of any third-party services you interact with through the Platform.

AutoXOnboard is based in New York and primarily processes data in the United States. However, because the XRP Ledger is a decentralized global network, on-chain data published to XRPL is accessible and replicated by validator nodes worldwide. This constitutes an inherent international transfer of any on-chain data and cannot be prevented or reversed.

Off-chain personal data processed by AutoXOnboard and its service providers is handled in the United States. If you access the Platform from outside the United States, you understand that your data will be transferred to and processed in the U.S., which may have different data protection laws than your jurisdiction. By using the Platform, you consent to this transfer.

AutoXOnboard does not currently operate in the European Economic Area (EEA) and does not represent that it is compliant with the EU General Data Protection Regulation (GDPR). If you are an EEA resident, use of the Platform is at your own risk and regulatory responsibility.

AutoXOnboard may update this Privacy Policy from time to time to reflect changes in our data practices, legal obligations, or Platform features. When we make material changes, we will update the version number and effective date at the top of this Policy and notify you via the Platform interface and, where practicable, by email or Xaman notification, at least 14 days before changes take effect.

Prior versions of this Privacy Policy are archived at autoxonboard.app/privacy/history. Your continued use of the Platform after the effective date of any update constitutes your acceptance of the revised Policy.

To exercise your rights under § 10, report a privacy concern, request your data, or ask questions about this Policy, please contact our Privacy Team:

We will verify your identity before processing any data access, correction, or deletion request. Requests may be submitted by email with sufficient identifying information to confirm your association with the Platform (e.g., the XRPL wallet address used to access your account).