OLLA Investment Portal

Controlled global founder working draft

Template/version
PRIVACY_POLICY / PRIVACY-SG-0.5
Document integrity hash
400577a4863e3d1cb715cce9950613014c3628e56a57e10147492e0e54b17270
This SHA-256 value identifies the exact displayed working-draft bytes. It is not blockchain verification or legal approval.

PRIVACY POLICY

Singapore Founder Working Draft Version 0.5

Founder Working Draft

Not Yet Reviewed by Singapore Counsel

Not for Execution

This founder-prepared draft describes the current local P1/P2/P3/P4/P5 portal scope. It is not a final PDPA compliance determination and does not identify an incorporated operator or data protection officer.

  1. Purpose

    To explain current development-stage collection and use of limited investor, application, security, and document data.

  2. Data collected

    Name, email, email-verification timestamp, investor type, organization name where applicable, investment-application information, limited audit/security metadata, generated investment-document content; document IDs, hashes, and versions; review-acknowledgement references, timestamps, definition version and hash, document-binding snapshots, and bundle fingerprints; and deliberately submitted EVM wallet addresses, chain IDs, UNVERIFIED connectivity status, and connection timestamps.

  3. Current exclusions

    P5 collects only deliberately submitted wallet-connectivity observations. It does not collect wallet signatures, blockchain transaction history, payment data, passport or KYC documents, biometric data, seed phrases, private keys, or secret keys.

  4. Purposes of processing

    Development testing, verified-session access, application configuration, controlled document generation, integrity verification, review-acknowledgement evidence, unverified wallet-connectivity records, security, troubleshooting, and audit history.

  5. Wallet-connectivity limitation

    A connected wallet candidate is a browser-reported technical observation only. It does not verify wallet control, legal identity, payment authority, acceptance, or closing eligibility.

  6. Security

    Controls include private storage, access qualification, CSRF protection, security headers, hashed verification tokens, and limited logs. No system can promise absolute security.

  7. Document storage

    Case documents may contain PII and are stored outside the public web root with PII-free filenames and owner-qualified access.

  8. Retention

    Retention periods and secure deletion procedures are not finalized and require legal and operational review.

  9. Access and correction

    A request process, identity-verification method, exceptions, and response contact are to be finalized.

  10. Cross-border services

    Hosting locations, subprocessors, service providers, and cross-border safeguards are to be finalized before production.

  11. Legal requirements

    Data may later need to be handled for applicable legal, regulatory, security, and dispute purposes, subject to finalized policies.

  12. Updates and versioning

    Material changes create a new controlled version and hash. Version 0.x remains founder working-draft status.

  13. Contact

    Operator, DPO, postal address, and privacy contact: To be established before production use.

  14. Wallet-control evidence

    P6 may collect a server-issued wallet-control challenge, its nonce within the retained canonical payload, payload and Ethereum-message hashes, a successful canonical wallet signature, recovered EVM address, protocol and environment bindings, and issue, expiry, and verification timestamps associated with the investor, case, wallet candidate, and current review acknowledgement. This technical evidence is used to demonstrate moment-in-time control of a cryptographic key. It does not prove legal identity or beneficial ownership. Olla never requests or collects a seed phrase or private key. Malformed and failed submitted signatures are not retained. Successful evidence is retained subject to a later formally approved investment-record retention and access policy.

  15. Country / jurisdiction and compliance eligibility

    Olla may collect country or jurisdiction information as part of investment onboarding. For individuals, this means the submitted country of residence. For organizations, this means the submitted country of incorporation or formation. Olla may use this information to determine whether investment onboarding is available under applicable legal, regulatory, sanctions, and compliance restrictions. This country-level eligibility control does not establish that a person or entity is or is not subject to sanctions and does not replace later identity, beneficial-ownership, sanctions, AML, restricted-territory, or other compliance screening.