Slice Financial Privacy Policy

Last updated: 16 September 2026

This Policy explains what personal information Slice Financial collects, why we collect it, who we share it with, how long we keep it and what rights you have. It applies to this website, to our mobile applications and to every service we provide.

1. Who we are

Slice Financial Inc., a Delaware corporation doing business as Slice Financial (“Slice Financial”, “we”, “us” or “our”), is the controller of the personal information described in this Policy. Our registered office is 340 Royal Poinciana Way, Suite 317, Palm Beach, FL 33480, United States.

We operate through group companies including Slice GmbH for our European operations and a Dubai subsidiary regulated under the Virtual Assets Regulatory Authority (“VARA”) and Dubai Land Department frameworks. Where a group company determines how your information is used, it acts as a joint controller with us under this Policy.

2. Scope and consent

This Policy covers information we obtain when you visit www.slicefinancial.ai (the “Site”), create an account, apply to invest, contact us by post, email, telephone or in person, or use any of our applications or services (together, the “Services”).

By using the Services you consent to the handling of your personal information as described here. Your information may be processed in the country where it was collected and in other countries where we or our providers operate, including the United States, the European Union, the United Arab Emirates and Singapore, where data protection law may differ from that of your own country. If you upload personal information about another person, you confirm you are entitled to do so.

If you do not agree with this Policy, please do not use the Services.

3. Information we collect

3.1 Information you give us

• Registration information. Your name, email address, telephone number and password when you create an account, subscribe to updates or send us an enquiry.
• Identity and verification information. If you apply to invest, regulation requires us to verify who you are. We collect your full legal name, date of birth, residential address, nationality and a copy of a government-issued identity document (passport, national identity card or driver’s license) together with proof of address. Verification is carried out with our partner Sumsub.
• Financial information. Bank account details, payment details, wallet addresses used for distributions, source of funds information and, where relevant to an application, financial standing.
• Blockchain information. The public address of any self-custody wallet you choose to link, and the cryptographic signatures you produce to prove ownership of it or to record a commitment. We never ask for, receive or store your private keys or seed phrase, and no member of our staff will ever request them.
• Correspondence. The content of messages, complaints and support requests you send us, and our replies.
• Content you publish. Anything you choose to post to a public area of the Services may be visible to other users and may be indexed by search engines. Please do not post information you wish to keep private.

3.2 Information we collect automatically

Like most website operators we record technical information that your browser provides: browser type and version, language preference, operating system, referring page, and the date, time and IP address of each request. We use this to keep the Services secure and working correctly, and to investigate abuse.

When you sign in, register, ask for a password reset or change a security setting, we record the event, the account it relates to and the IP address it came from in a security log. We do not record passwords, authentication codes or reset links in it. This log exists so that we can detect and investigate attempts to break into accounts, and so that you can be told if yours is targeted.

3.3 Information from third parties

We receive verification results and risk indicators from identity providers, screening results from sanctions and politically-exposed-person databases, payment confirmations from our banking and payment partners, and, where relevant, information from public registers and from your professional advisers.

4. How we use your information

We use personal information to:

• create and administer your account, and authenticate you when you sign in;
• verify your identity and carry out know-your-customer, anti-money-laundering, sanctions and fraud checks;
• assess and process an application to subscribe for an asset, and administer the resulting holding;
• operate the tokenization process, including smart contract deployment and reconciliation on networks such as Ethereum, Polygon, Base and Hedera;
• process payments and distributions in fiat or digital assets;
• respond to your questions, complaints and requests;
• send you service messages, and marketing messages where you have asked for them or where we are otherwise permitted to do so;
• maintain the security, availability and integrity of the Services, and investigate misuse;
• analyze and improve our services, features and asset offerings;
• keep the records we are required to keep, and comply with our obligations to regulators including VARA and the Dubai Land Department in the UAE, the Securities and Exchange Commission in the United States, and authorities applying MiFID and MiCA in Europe;
• establish, exercise or defend legal claims; and
• any other purpose to which you have consented.

We do not use your personal information to make decisions producing legal effects about you by automated means alone. Verification checks may be automated, but an adverse result is reviewed by a person before it is acted upon.

5. Legal bases for processing

Where the GDPR or a comparable law applies, we rely on the following bases:

Purpose	Legal basis
Creating and operating your account; processing a subscription	Performance of a contract with you
Identity verification, AML and sanctions screening; record keeping	Compliance with a legal obligation
Securing the Services; preventing fraud and abuse; improving our offering	Our legitimate interests
Optional marketing communications	Your consent, which you may withdraw at any time
Establishing or defending legal claims	Our legitimate interests, or a legal obligation

6. Who we share information with

We share personal information only where it is necessary, and only with parties bound to protect it. These include:

• Group companies — including Slice GmbH, Slice Management and Slice REIT Holding Co. — where they perform part of the service.
• Identity and compliance providers, principally Sumsub, for verification and screening.
• Banks and payment providers, including Zand Bank, Wio Bank and Total Processing, to move and reconcile funds.
• Custodians and technology providers, including Hex Trust and Brandbox Limited, in connection with the holding of digital assets.
• Asset service providers, such as property managers, vehicle and collection managers, insurers, valuers and the operators of the bonded storage facilities in Vienna, Dubai, New Jersey, Florida and Hong Kong.
• A password breach service. When you choose a password we check whether it already appears in a published breach, using the Have I Been Pwned range API. Your password never leaves our server: we send only the first five characters of its SHA-1 hash, receive back every known hash beginning with those five characters, and do the comparison here. The service cannot tell which password, account or person the query relates to. If the service cannot be reached, the check is skipped rather than blocking you.
• Professional advisers — lawyers, auditors and accountants — under a duty of confidence.
• Administrators of special purpose vehicles established to hold an asset.
• Regulators, law enforcement and courts, where we are required to disclose by law, or where disclosure is reasonably necessary to protect the rights, property or safety of Slice Financial, our clients or the public.
• A buyer or successor, if our business or part of it is sold or reorganized. You will be told if that happens and this Policy continues to apply to information transferred.

We may publish or share aggregated information that does not identify any individual without restriction.

Please note that information recorded on a public blockchain — including wallet addresses and transaction records — is public, permanent and outside our control. It cannot be edited or deleted by us or by you.

7. International transfers

Our operations span the United States, Europe, the United Arab Emirates and Asia, so your information will cross borders. Where we transfer personal information out of the European Economic Area or the United Kingdom, we rely on an adequacy decision where one exists, and otherwise on Standard Contractual Clauses together with any additional safeguards the transfer requires. You may ask us for details of the safeguards applying to a particular transfer.

8. Cookies and similar technologies

A cookie is a small text file stored by your browser. We keep our use of them deliberately minimal.

This website sets one cookie. It is strictly necessary and it is described in full below. We do not run advertising networks, analytics packages, social media pixels or cross-site tracking on this Site, and we do not share browsing behavior with third parties for marketing.

Cookie	Purpose	Type	Expires
sf_portal	Keeps you signed in to the investor portal or the staff area and protects forms against cross-site request forgery. Without it you cannot sign in.	Strictly necessary	When you sign out, or when the browser session ends

Because this cookie is strictly necessary to deliver a service you have asked for, it does not require consent. Your browser stores it only after you visit a portal page. We also use your browser’s own local storage for small conveniences such as remembering a filter you selected; that information stays on your device and is never sent to us.

You can block or delete cookies in your browser settings. If you block this one, you will not be able to sign in.

If we introduce analytics or marketing technologies in future, we will update this section and, where the law requires it, ask for your consent first.

9. How we protect your information

We maintain technical and organizational measures appropriate to the sensitivity of the data we hold. These include encryption of traffic in transit, hashing of passwords using a modern algorithm, optional two-step verification on your account — which we require before a wallet can be linked or a subscription signed — a minimum password length checked against known breached passwords, access controls limiting staff access to what their role requires, segregation of identity documents from publicly served content, protection against cross-site request forgery, rate limiting of sign-in attempts by both address and account, automated checks that refuse submissions from scripted clients, an append-only security log reviewed for unusual activity, and regular review of our systems and providers.

Identity documents are stored outside the publicly reachable area of our platform and are retrievable only by authorized compliance staff through an audited route.

No system can be guaranteed completely secure. If a breach occurs that is likely to present a risk to you, we will notify you and the relevant supervisory authority within the periods the law requires. Please tell us immediately if you believe your account has been compromised.

10. How long we keep it

We keep personal information for as long as we need it for the purpose we collected it, and then for any further period the law requires.

• Account and transaction records — for the life of your relationship with us and afterwards for the retention period required by financial services and anti-money-laundering law in the relevant jurisdiction.
• Identity verification records — as required by applicable AML regulation, which in the UAE is a minimum of five years after the relationship ends.
• Complaints records — a minimum of eight years, as set out in our Complaints Procedure.
• Correspondence and enquiries — normally two years from the last contact, unless it relates to a transaction or a dispute.

When a retention period ends, information is deleted or irreversibly anonymized.

Security log entries are kept for up to twelve months and then discarded, except where an entry forms part of an open investigation or we are required to keep it for longer.

11. We do not sell your information

Slice Financial does not sell, rent or exchange personal information for monetary or other valuable consideration, and has no plans to do so. Because we do not engage in those practices, there is no “opt out of sale” for us to offer. We do not share personal information for cross-context behavioral advertising.

12. Your rights

Subject to the law that applies to you, you may ask us to:

• Access the personal information we hold about you, and receive a copy;
• Correct information that is inaccurate or incomplete;
• Delete information we no longer have a lawful reason to keep;
• Restrict or object to our use of your information, including for direct marketing;
• Port information you provided to us to another controller in a machine-readable format; and
• Withdraw consent you previously gave, without affecting processing already carried out.

To exercise any of these, write to info@slicefinancial.ai. We will ask you to verify your identity before we act, and we will respond within one month, or tell you why we need longer.

Two limits you should know about. We cannot delete records we are legally required to retain, such as identity verification and transaction records. And we cannot alter or remove anything already written to a public blockchain, because that ledger is not ours to change.

If you are unhappy with our response you may complain to your data protection supervisory authority. In the European Union that is the authority in your country of residence; in the United Arab Emirates it is the authority responsible for the Personal Data Protection Law. We would prefer you raise it with us first, and our Complaints Procedure explains how.

13. Regional disclosures

13.1 European Union and United Kingdom

We process personal information in accordance with the GDPR and applicable member state law, with our European operations managed through Slice GmbH. Section 5 sets out our legal bases and section 12 your rights.

13.2 California

California Civil Code section 1798.83 permits California residents to request information about disclosures of personal information to third parties for their direct marketing purposes. As set out in section 11, we do not sell or share personal information for such purposes. California residents also have the rights described in section 12 and will not be discriminated against for exercising them.

13.3 Nevada

Nevada law allows a consumer to direct an operator not to sell their personal information. Slice Financial does not sell or exchange personal information for monetary consideration.

13.4 United Arab Emirates

Our Dubai operations process personal data in accordance with Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, alongside the VARA rulebooks applicable to our activity.

14. Children

The Services are not intended for anyone under 18, and we do not knowingly collect information from children. Our onboarding rejects a date of birth indicating an applicant under 18. If you are a parent or guardian and believe a child has given us information, contact us and we will delete it from our records.

15. Third-party websites

The Services may link to sites we do not operate, including those of financing and lending providers. A link is offered for convenience and is not an endorsement. Once you leave our Site, this Policy no longer applies — please read the privacy policy of any site you visit.

16. Changes to this Policy

We may update this Policy from time to time. When we do, we will revise the date at the top of this page and, where the change is material, notify registered clients by email and take any further steps the law requires. Please review this page periodically.

17. How to contact us

For any question about this Policy, about how we handle your information, or to exercise a data right:

• Email: info@slicefinancial.ai
• Post: Slice Financial Inc., 340 Royal Poinciana Way, Suite 317, Palm Beach, FL 33480, United States
• Online: our contact page