Privacy Policy

• Account and profile data: name, email address, phone number, username, password, investor or issuer profile details, company information, role, preferences, and communications settings.
• KYC, identity, and accreditation information: date of birth, tax identification information, government identification, identity documents, accreditation verification materials, anti-money-laundering screening data, sanctions screening data, and related review results.
• Investment and subscription data: offering viewed, investment amount, subscription documents, signatures, investment limits, cancellation or reconfirmation records, transaction status, communications with issuers, and regulatory records.
• Payment and banking data: bank account or payment method information, ACH, wire, check, card, escrow, payment processor, reconciliation, refund, and transaction records.
• Communications: emails, support requests, platform messages, call notes, forms, surveys, issuer updates, and notices.
• Device, browser, and log data: IP address, device identifiers, browser type, operating system, pages viewed, referrer, timestamps, session identifiers, diagnostics, fraud signals, and security logs.
• Cookie and marketing attribution data: consent choices, cookie identifiers, advertising or click identifiers, campaign parameters, event-level listing activity, and issuer marketing attribution data where allowed by consent and privacy choices.

Depending on the service, we may collect sensitive personal information, including Social Security number or tax ID, financial account data, identity documents, KYC and accreditation information, payment information, and information needed for legal, regulatory, fraud-prevention, or securities-compliance purposes.

• Operate accounts, authenticate users, and provide platform features.
• Process investments, subscriptions, payments, ACH transactions, wires, escrow instructions, refunds, reconciliations, and transaction confirmations.
• Support securities-law compliance, investment limits, cancellation and reconfirmation rights, issuer obligations, regulatory filings, and legally required records.
• Perform KYC, accreditation, identity verification, sanctions screening, fraud prevention, security monitoring, and abuse prevention.
• Provide customer support, investor education, issuer support, account notices, offering communications, and service updates.
• Maintain legal, tax, audit, regulatory, and business records.
• Improve platform performance, reliability, analytics, and user experience.
• Support issuer marketing attribution only when allowed by consent, privacy choices, and applicable law.

We may share personal information with the following categories of recipients as needed for the purposes described in this policy:

• Issuers: information needed to administer an investment, communicate with investors, comply with offering obligations, maintain investor records, or complete subscriptions.
• Escrow, payment, bank, and financial providers: providers such as Enterprise Bank & Trust, SPPX/North Capital, Luminate, payment processors, ACH providers, banks, escrow agents, and reconciliation providers designated for an offering or transaction.
• KYC, accreditation, identity, fraud, and compliance vendors: providers that help verify identity, accreditation, eligibility, sanctions status, fraud risk, or regulatory compliance.
• E-signature, document, cloud, communications, and support vendors: vendors that host documents, obtain signatures, send notices, manage records, or provide operational support.
• Analytics and marketing providers: only when allowed by consent and privacy choices, including issuer-configured marketing providers described in this policy and the Cookie & Tracking Policy.
• Regulators, law enforcement, courts, and legal process: when required or appropriate to satisfy law, regulation, subpoena, examination, audit, investigation, or legal rights.
• Business transfers: in connection with a merger, financing, reorganization, sale, or transfer of business assets, subject to appropriate protections.

Some issuer listing pages may use issuer-configured marketing analytics or pixels. When marketing sharing is permitted, providers may receive event-level or pseudonymous data such as listing views, checkout starts, investment-recorded events, click identifiers, campaign identifiers, listing ID, regulation track, event ID, or a hashed email only where consent and product settings allow it.

Invown does not share the following with marketing providers for issuer pixels: raw email address, name, phone number, Social Security number or tax ID, address, bank or account numbers, KYC documents, identity documents, accreditation documents, or KYC/accreditation status.

For more detail, see the Cookie & Tracking Policy and Marketing Providers Invown May Share With.

Required cookies are used to operate the platform, keep users signed in, secure sessions, and support transactions. Analytics and marketing cookies are optional. First visits with no consent choice are treated as rejected until the user chooses. Rejecting cookies, opting out, or sending a Global Privacy Control signal suppresses issuer pixels and marketing sharing. See the Cookie & Tracking Policy and Your Privacy Choices / Do Not Sell or Share My Personal Information.

Invown provides the privacy controls below to California residents where required and may apply them globally for operational consistency:

• Right to know/access: request information about the personal information we collect, use, disclose, sell, or share.
• Right to delete: request deletion of personal information, subject to exceptions including securities, regulatory, tax, audit, fraud-prevention, transaction, legal, and recordkeeping obligations.
• Right to correct: request correction of inaccurate personal information.
• Right to opt out of sale or sharing: opt out of sale or sharing of personal information for cross-context behavioral advertising.
• Right to limit use and disclosure of sensitive personal information: where applicable, request limits on certain uses or disclosures of sensitive personal information.
• Non-discrimination: we will not unlawfully discriminate against you for exercising privacy rights.
• Authorized agents: you may use an authorized agent where permitted by law. We may require proof of authorization and may need to verify your identity directly.

To opt out of sale or sharing, use Your Privacy Choices / Do Not Sell or Share My Personal Information. Invown honors Global Privacy Control when detected and treats it as an opt-out from sale or sharing for the browser or session and, for signed-in users where applicable, the account.

We retain personal information for as long as needed for the purposes described in this policy, including platform operation, securities and financial regulatory recordkeeping, tax and audit obligations, dispute resolution, fraud prevention, security, and legal compliance. Regulatory records may be retained as required by law. Marketing pixel logs are retained according to applicable product specifications and legal requirements. Opt-out records are retained until changed or withdrawn where allowed, and as needed to honor the opt-out.

We use administrative, technical, and physical safeguards designed to protect personal information. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Invown services are intended for adults and are not directed to children under 18. We do not knowingly collect personal information from children under 18.

We may update this Privacy Policy from time to time. Changes are effective when posted with a new effective date unless a different effective date is stated.