Poket Privacy Policy

Last updated: 18th September, 2026

1. Who this policy covers

Quantum Works LLC, trading as GradientFI ("GradientFI," "Quantum Works," "we," "us"), strives for transparency and trust in how we protect your privacy. This policy explains how we collect, use, and share information when you use Poket, our digital wallet, whether accessed directly through our app or through a partner business's app that has embedded Poket (see Section 4). This policy applies to anyone interacting with Poket: registered users, prospective users, and merchant/partner contacts.

You should read this policy alongside our Terms of Use. We may update this policy from time to time; check back regularly.

2. Information we collect

Information you give us:

• Name, email address, phone number
• Date of birth (self-attested at registration; verified against government ID at Tier 1)
• Government-issued ID and liveness data (Tier 1)
• Proof of address (Tier 2)
• Source of Funds Declaration and supporting documents (Tier 3)
• Payment details (linked bank account or card)

Information we collect automatically:

• Device information, browser, IP address, and internet connection
• Approximate location, collected at every login and at every transaction (see Section 5)
• The pages you visit and how you arrived at them
• Session data and timestamps for every login, deposit, and withdrawal

Information from third parties:

• Identity, liveness, and document verification data from our identity verification partner
• Sanctions, PEP, and adverse media screening results from our identity verification partner's AML screening service
• Bank-link risk signals from our bank-link risk partner
• Card transaction risk signals from our payment processing partners
• Blockchain wallet-address screening results from our blockchain screening partner

Information we do not collect: we do not track or collect sensitive categories such as race, religion, ethnicity, or political opinion.

3. How we use your information

We use your information to:

• Verify your identity and age, and determine your account tier
• Screen you and your transactions against sanctions, PEP, and watchlists
• Enforce geolocation restrictions at login and at the time of each transaction
• Process deposits, withdrawals, and transfers through our banking and payment partners
• Detect and prevent fraud, including device and velocity monitoring
• Monitor for money-laundering patterns and comply with the Bank Secrecy Act and other applicable law
• Respond to regulator, law enforcement, or partner-bank requests
• Manage your account, provide customer support, and send service notifications (e.g., transaction confirmations, security alerts)
• Improve our products, with your information analyzed on an aggregated basis where possible

We rely on our contract with you, our legal obligations (e.g., AML/KYC law), and, in limited cases, our legitimate interests (e.g., fraud prevention, product improvement) as the basis for these uses. Where we rely on legitimate interests, you may object; contact us and we will consider your request, though there may be legal reasons we need to continue certain processing.

4. If you access Poket through a partner app

You may access Poket directly through our app, or through a third-party business's app that has integrated Poket as an embedded wallet. In the embedded case, the partner business may see information related to your activity within its own app, but Quantum Works remains the sole operator of identity verification, screening, geolocation, and transaction monitoring, and independently collects and processes the information in this policy regardless of which app you used. The partner business does not receive your verification documents or compliance screening results; those are handled solely by Quantum Works and its verification providers.

5. Location data

We determine your location using IP geolocation, VPN/proxy/Tor detection, and device signals (OS location where permitted, timezone, language, carrier). We check your location at every login and at every transaction. If you're in a restricted jurisdiction, you'll be blocked from proceeding, and the attempt is logged.

6. Cookies and social media

Cookies are small files created in your browser when you visit our website. We use cookies to operate and personalize our website; we do not use cookies for advertising.

We publish content on social media platforms (e.g., LinkedIn, Twitter/X) through both organic and paid methods. We may place social media "tags" on our website to understand engagement and avoid showing you offers you've already acted on (e.g., removing a signup prompt if you're already a user). We do not have direct access to your personal data on social media platforms.

7. Who we share your information with

• Banking and payment partners to process your transactions
• Our identity verification partner for identity verification and AML/sanctions screening
• Our bank-link risk partner for bank-link risk assessment
• Our blockchain screening partner for blockchain address screening
• Regulators, auditors, and law enforcement, where required by law, contract, or a valid request
• Other service providers who help us operate Poket (e.g., customer support, analytics), bound by contract to keep your information secure and limited in use

We do not sell your personal information. Where we don't have a legitimate business or legal reason to share your information, we will ask for your consent first.

8. External links

This policy applies only to Quantum Works' use of data. Our website, app, and Poket Widget may link to or appear within external sites and apps. We are not responsible for the privacy practices of those third parties, and we recommend reviewing their policies directly.

9. How long we keep your information

We retain account, transaction, and verification records for at least 5 years, consistent with Bank Secrecy Act recordkeeping requirements, longer than the general "as long as needed for the service" standard that applies to non-compliance data (e.g., customer support records). Logs are retained in an append-only, tamper-evident format and can be exported in response to a valid regulator, partner-bank, or law-enforcement request within 48 hours.

10. Your rights

Depending on your jurisdiction (e.g., under GDPR or CCPA), you have the right to ask us for the information we hold about you, and to ask us to correct, delete, or stop processing it. To exercise these rights, contact us with the subject line "Information Access Request" (see Section 13).

Note that full erasure or cessation of processing may not always be possible, for example where we're required to retain records for regulatory compliance (Section 9) or where you remain an active user requiring ongoing service.

11. Security

We use industry-standard safeguards to protect your information, including hash-chained, tamper-evident logging of account and transaction activity, and we limit access to your information to those bound by confidentiality obligations. No system is completely secure, and we cannot guarantee absolute security.

12. Age requirements

Poket is not intended for anyone under 18. We verify age at registration (self-attestation), again at first deposit (against your verified government ID), and again at withdrawal. Accounts that fail age verification are blocked.

13. International data transfers

We may transfer your information to, and process it in, countries other than your own. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses to protect your information in these transfers.

14. Changes to this policy

We may update this policy from time to time, including in response to changes in law, regulatory guidance, or our services. Material changes will be communicated to you before they take effect.

15. Who we are and how to contact us

Quantum Works LLC (trading as GradientFI)

support@poket.finance