Privacy Policy

Aligned Sovereign Intelligence Institute (“Aligned Institute”, “ALI”, “we”, “us”, or “our”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website asiinst.com, use our applications (including the ALI Signals Platform), participate in the ASIP research grant platform, or interact with our blockchain services (including ABC, AIC, and SAT tokens on Base Protocol).

Your use of our Services is also governed by our Terms of Service v1.2, which describes testnet participation limits, Sybil disqualification, compliance obligations, and blockchain risks. In the event of a conflict between this Privacy Policy and the Terms of Service regarding legal obligations or user conduct, the Terms of Service prevail.

1. Global Scope

This policy applies to users globally. By accessing our Services, you acknowledge that your personal information may be processed in jurisdictions with different data protection laws than your home country. We are committed to complying with applicable data protection regulations, including:

• GDPR — for users in the European Economic Area, where our centralized services process personal data
• Swiss Federal Act on Data Protection (FADP) — our targeted jurisdiction for Phase 2 domicile (2027–2028)
• CCPA / CPRA — for California residents
• Texas privacy and consumer protection laws — during Phase 1 US operations

Data Controller: Aligned Sovereign Intelligence Institute, domiciled in Texas, USA (Phase 1). Contact: [email protected]. A designated data protection contact will be published upon Swiss entity formation.

Children: Our Services are not directed to persons under 18 years of age. We do not knowingly collect personal information from children.

2. Information We Collect

2.1 Personal Information — Collected by Stage

We collect personal information at different stages depending on how you interact with ALI. The table below describes what we collect, when, and why.

We do not collect more data than is reasonably necessary for the purpose stated. Light identity registration at testnet (name, institution, email) is used for Sybil resistance and researcher credentialing; full KYC is required only when a real-value disbursement or token delivery is contemplated.

2.2 Blockchain and Testnet Data

2.3 Automated and Technical Data

We may automatically collect:

• IP addresses, browser type, and device information (security, fraud detection, analytics)
• Cookies and session data (platform performance and authentication)
• Log files and API usage data (service operation and debugging)
• Chain analytics data from third-party providers (wallet risk scoring, sanctions list matching)

We use cookies and similar technologies on our centralized web applications. You may manage cookie preferences through your browser settings. Essential cookies required for authentication and security cannot be disabled without affecting Service functionality. A separate Cookie Policy may be published for detailed cookie categories and opt-out mechanisms.

3. How We Use Your Information

We use your information to:

• Provide, operate, and maintain our Services, including the ALI Signals Platform and ASIP grant protocol
• Execute blockchain transactions you authorize (token transfers, veABC voting, grant submissions)
• Evaluate grant submissions, calculate Authority Score, and verify milestone completion via verifySubmission() and associated oracles
• Detect and prevent fraud, Sybil activity, security breaches, and sanctions violations
• Comply with legal and regulatory obligations, including KYC/AML and sanctions screening
• Communicate with you regarding your account, grant status, protocol updates, and support requests
• Improve our applications, researcher experience, and platform performance
• Generate aggregate, de-identified research curation data for the ASI Signals Platform and data licensing products — without identifying individual researchers in published outputs unless you have consented or the data is already public on-chain

Automated decision-making: Authority Score calculation and grant eligibility screening involve automated processing based on on-chain activity metrics and submission verification. Material adverse decisions (grant denial, Sybil disqualification) are subject to human review upon request. Contact [email protected] to request review of an automated decision affecting you.

4. KYC/AML and Regulatory Compliance

ALI applies identity verification and anti-money laundering screening to protect the integrity of the ASIP research grant ecosystem. Our compliance posture includes:

• FATF alignment: We voluntarily align our grant disbursement operations with Financial Action Task Force (FATF) Recommendation 15 guidance where applicable. ALI is not a registered Virtual Asset Service Provider (VASP) in Phase 1. This posture is subject to review by outside counsel and may change upon mainnet launch or Swiss domicile confirmation.
• Sanctions screening: We screen wallet addresses and grant recipients against OFAC, EU, UK, and UN consolidated sanctions lists using third-party screening providers before disbursement and on an ongoing basis where feasible.
• Travel Rule awareness: For grant disbursements or token transfers at or above USD 1,000 equivalent (or the applicable threshold in your jurisdiction), we may collect and retain originator and beneficiary information as required by applicable Travel Rule obligations.
• SySIL and fraud detection: We analyze registration patterns, wallet clustering, and submission metadata to identify coordinated Sybil activity. Data used for fraud detection may be retained beyond standard retention periods where an investigation is active.

Refusal to complete required KYC/AML verification will result in inability to receive grant disbursements or token deliveries. This is disclosed at the point of collection.

5. Disclosure of Your Information

We may share your information with:

• KYC/AML Service Providers: Third-party identity verification and sanctions screening vendors (e.g., chain analytics, document verification platforms) acting as data processors on our behalf under contractual confidentiality obligations
• Cloud Infrastructure Providers: Hosting and storage providers (including AWS and GCP) operating under data processing agreements
• Analytics Providers: Platform usage and performance analytics (de-identified where practicable)
• Institutional Funders and Counterparties: We may share KYC/AML verification status, compliance screening outcomes, and aggregate protocol compliance data with institutional investors, co-investors, banking counterparties, and regulated entities where required for their diligence, onboarding, or compliance obligations. We do not share raw government identification documents with third parties except as required by law or with your explicit consent.
• Legal Requirements: Courts, regulators, law enforcement, or government authorities where required by applicable law, regulation, subpoena, or court order
• Business Transfers: In connection with a merger, acquisition, Swiss entity formation, or asset transfer, subject to the acquirer honoring this Privacy Policy or providing equivalent protections

We do not sell your personal data to third parties.

6. Data Retention and Storage

We retain personal information only as long as necessary for the purposes described in this Policy, unless a longer retention period is required by law:

• KYC/AML records: Retained for a minimum of five (5) years following the end of the business relationship or last transaction, or longer where required by applicable AML regulations (typically up to seven years under FATF-aligned standards)
• Grant and researcher records: Retained for the duration of the grant relationship plus five (5) years for audit and dispute resolution purposes
• Testnet registration data: Retained until mainnet activation processing is complete, plus two (2) years, unless a Sybil or fraud investigation extends retention
• Signals Platform account data: Retained for the duration of the subscription plus two (2) years
• Technical logs and analytics: Typically retained for twelve (12) to twenty-four (24) months
• On-chain data: Permanent and immutable on the public blockchain — not subject to deletion requests (see §8)

Storage location: During Phase 1, personal data is stored on servers located in the United States. Upon Swiss entity formation and FINMA authorization (targeted 2027–2028), ALI will publish an updated Privacy Policy describing any migration of data processing to Switzerland and applicable cross-border transfer mechanisms (including Standard Contractual Clauses where required for EU/EEA data subjects).

7. Security of Your Information

We implement administrative, technical, and physical security measures to protect personal data held in our centralized systems, including encryption in transit and at rest, access controls, and employee confidentiality obligations. However:

• We cannot guarantee the security of public blockchains (Base Protocol) or your non-custodial wallet. You are solely responsible for securing your private keys and seed phrases.
• No method of transmission over the Internet is 100% secure. We cannot guarantee absolute security of data transmitted to or from our Services.

In the event of a data breach affecting personal information in our centralized systems, we will notify affected users and relevant supervisory authorities as required by applicable law.

8. Your Data Rights

Depending on your jurisdiction, you may have the following rights regarding personal data we hold in our centralized systems:

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate or incomplete data
• Deletion: Request deletion of your personal data, subject to legal retention obligations and blockchain immutability limitations
• Objection / Restriction: Object to or request restriction of certain processing activities
• Portability: Request transfer of your data in a structured, machine-readable format (where technically feasible)
• Withdraw Consent: Where processing is based on consent, withdraw consent at any time (without affecting prior lawful processing)
• Lodge a Complaint: File a complaint with your local data protection supervisory authority (e.g., ICO (UK), CNIL (France), FDPIC (Switzerland), Texas Attorney General (Texas residents))

CCPA (California residents): You have the right to know what personal information we collect, the right to deletion (subject to exceptions), and the right to opt out of the sale of personal information. We do not sell personal information. To exercise CCPA rights, contact [email protected].

Legal basis for processing (GDPR / FADP): We process personal data on the following bases: (a) performance of a contract (grant agreements, SAFT, Signals subscriptions); (b) compliance with legal obligations (KYC/AML, sanctions); (c) legitimate interests (fraud prevention, Sybil detection, protocol integrity, aggregate research data); and (d) consent where explicitly obtained (marketing communications).

To exercise any of these rights, contact: [email protected]. We will respond within the timeframe required by applicable law (typically 30 days under GDPR).

9. International Data Transfers

As a globally accessible protocol, your personal data may be transferred to and processed in the United States and other jurisdictions where our service providers operate. Where required by applicable law (including GDPR), we implement appropriate safeguards for cross-border transfers, including Standard Contractual Clauses approved by the European Commission. Upon Swiss domicile confirmation, we will assess whether data localization or additional transfer mechanisms are required under Swiss FADP.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be posted on this page with an updated Effective Date and, where practicable, communicated by email to registered users. Your continued use of our Services after revisions become effective constitutes acceptance of the updated policy, except where applicable law requires affirmative consent.

11. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data rights, please contact us at:
[email protected]

Document: ASII Privacy Policy v2.1  |  Status: Draft — Pending CLO Review  |  Supersedes: Privacy-v2 (February 2026)  |  Companion document: TCs-v1-2 (Terms of Service)  |  Next review: Upon Swiss domicile confirmation