Privacy Policy

1. Who we are

Stellar Crest Bank ("we", "our", "us") is the controller of your personal data. Our registered address is 100 Financial District, New York, NY 10004, United States. If you have any questions about this policy, contact our Data Protection Officer at [email protected].

2. What data we collect

3. How we use your data

We use your personal data to: • Create and manage your Stellar Crest Bank account. • Process transactions, transfers, and investment subscriptions. • Verify your identity and comply with KYC / AML regulations. • Detect and prevent fraud, money laundering, and security threats. • Send transactional emails (receipts, OTPs, security alerts). • Provide customer support and resolve disputes. • Improve our platform through aggregated, anonymised analytics. • Comply with applicable laws, regulations, and court orders.

4. Legal basis for processing

We process your data on the following legal bases: • **Contract** — processing necessary to provide the banking services you signed up for. • **Legal obligation** — processing required to comply with AML, KYC, and financial regulation. • **Legitimate interests** — fraud prevention, security monitoring, and platform improvement. • **Consent** — where we ask for your permission before processing (e.g., marketing emails).

5. How we share your data

We do not sell your personal data. We may share it with: • **Service providers** — payment processors, cloud infrastructure, email delivery, and identity verification partners, under strict data processing agreements. • **Regulators and law enforcement** — when required by law or to protect our legal rights. • **Fraud prevention agencies** — to detect and prevent fraudulent activity. • **Business transfers** — in the event of a merger, acquisition, or sale of assets, subject to the same privacy protections.

6. Data retention

We retain your personal data for as long as your account is active, and for a minimum of 7 years after account closure to comply with financial regulations. Aggregated, anonymised analytics data may be retained indefinitely.

7. Your rights

Depending on your jurisdiction, you may have the following rights: • **Access** — request a copy of the personal data we hold about you. • **Rectification** — ask us to correct inaccurate or incomplete data. • **Erasure** — request deletion of your data where no legal obligation to retain it exists. • **Restriction** — ask us to limit how we use your data. • **Portability** — receive your data in a structured, machine-readable format. • **Objection** — object to processing based on legitimate interests. • **Withdraw consent** — where processing is consent-based, you can withdraw at any time. To exercise any right, contact us at [email protected]. We will respond within 30 days.

8. Security

We implement industry-standard security measures including 256-bit SSL encryption in transit, AES-256 encryption at rest, two-factor authentication, and continuous intrusion monitoring. No method of transmission over the internet is 100% secure; we strive to use commercially acceptable means to protect your data.

9. Cookies

We use cookies and similar tracking technologies. For details, see our Cookie Policy.

10. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or a prominent notice on our platform. The "Last updated" date at the top will always reflect the most recent revision.

11. Contact us

For any privacy-related enquiries, contact our Data Protection Officer: Email: [email protected] Address: 100 Financial District, New York, NY 10004, United States