> For the complete documentation index, see [llms.txt](https://docs.sierra.money/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.sierra.money/additional-resources/privacy-and-cookie-policy.md). # Privacy & Cookie Policy Last Updated: November 2026 ### 1. Introduction This Privacy & Cookie Policy ("Policy") explains how Sierra Reserve Limited, a company incorporated in the British Virgin Islands ("BVI") with company number 2180053 and its registered office at Rough Point, P.O. Box 4203, Mount Healthy, Tortola, VG1110, British Virgin Islands ("Sierra Reserve", "we", "us" or "our"), collects, uses, stores, shares and protects personal data when you use our website, the Interface (including app.sierra.money), the Sierra Protocol, Sierra Tokens or any of our other services (together, the "Services"). We process personal data in accordance with the BVI Data Protection Act, 2021 ("DPA") and other applicable laws. Capitalised terms not defined in this Policy have the meaning given in the Sierra Terms & Conditions. ### 2. Who This Policy Applies To This Policy applies to personal data about: * Visitors to our website and the Interface; * Permissionless Users, who Mint or Redeem Permissionless Tokens through the Interface or directly through the Sierra Protocol; * Authorized Participants, and their directors, authorised signatories, beneficial owners and other relevant parties, who are onboarded to Mint and Redeem Permissioned Tokens; * Holders of Sierra Tokens, including holders who acquire Sierra Tokens on secondary markets and never interact with us directly, to the extent we screen and monitor their blockchain addresses; and * anyone who contacts us. Sierra Reserve is the data controller for the processing described in this Policy. ### 3. Personal Data We Collect | Category | Examples | Whose data | | --------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------- | | Identification data | Full name, date of birth, nationality, government-issued ID, entity details, ownership and control information | Authorized Participants and their relevant parties | | Contact data | Email address, business or residential address, telephone number | Authorized Participants; anyone who contacts us | | Due diligence data | Source of funds and source of wealth information, sanctions, politically exposed person and adverse media screening results, risk ratings | Authorized Participants and their relevant parties | | Blockchain data | Wallet addresses, on-chain transaction history, token balances, Mint and Redemption records, transaction hashes | All Users and Holders | | Screening and monitoring data | Wallet risk ratings and their drivers, exposure to risk categories, Sanctions Oracle results, alerts, Blocklist status | All Users and Holders | | Technical and location data | IP address, IP-derived country, device identifiers, browser type, operating system, access times, pages viewed, activity logs, indicators of VPN or proxy use | Visitors and Users of the Interface | | Compliance records | Records of reviews, decisions, blocks, freezes and reports to authorities | Any person subject to a review | | Communications and marketing data | Correspondence with us and communication preferences | Anyone who contacts us | We do not collect identity documents from Permissionless Users. A wallet address alone may not identify you, but it is personal data where it can be linked to you, including through blockchain analytics. We also use aggregated or anonymised data that does not identify you. ### 4. How We Collect Personal Data We collect personal data: * from you, for example during Authorized Participant onboarding and reviews, or when you contact us; * automatically, when you use the Interface, through server logs, cookies and similar technologies, and when you connect a wallet; * from public blockchains, which record wallet addresses, balances and transactions; and * from third parties, including blockchain analytics and wallet screening providers, sanctions lists and on-chain sanctions oracles, IP geo-location and VPN detection providers, identity verification and screening databases, and public registers. ### 5. Lawful Bases for Processing We process personal data only where at least one lawful basis under the DPA applies: * Legal obligation: to comply with anti-money laundering, counter-terrorist financing, proliferation financing and sanctions laws, and with requests and orders from competent authorities; * Contractual necessity: to enter into and perform our agreements with you, including the Terms & Conditions and the Mint User Agreement; * Legitimate interests: to protect Sierra Tokens, the Sierra Protocol and the Services from illicit use, to enforce our Terms & Conditions, and for security, fraud prevention, analytics and service improvement, where these interests are not overridden by your rights; * Consent: for non-essential cookies and marketing, which you may withdraw at any time; and * Vital interests: where processing is necessary to protect a person's life or safety. ### 6. How We Use Personal Data | Purpose | Data used | Lawful basis | | ------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------- | -------------------------------------- | | Providing the Interface and processing Mints and Redemptions | Blockchain, technical data | Contract; legitimate interests | | Geo-blocking access from Prohibited Jurisdictions and detecting VPN, proxy and other circumvention | Technical and location data | Legal obligation; legitimate interests | | Sanctions screening of wallets and transactions, including through blockchain analytics and on-chain sanctions oracles | Blockchain, screening and monitoring data | Legal obligation; legitimate interests | | Wallet risk assessment at connection and ongoing monitoring of connected wallets and all Holders using blockchain analytics | Blockchain, screening and monitoring data | Legal obligation; legitimate interests | | Onboarding and periodic review of Authorized Participants (know-your-business, due diligence, PEP and adverse media screening) | Identification, contact, due diligence data | Legal obligation; contract | | Blocking addresses, maintaining the Blocklist, freezing Sierra Tokens and holding or refusing Mints and Redemptions | Blockchain, screening, compliance data | Legal obligation; legitimate interests | | Investigating and reporting suspicious activity, sanctions matches and frozen assets to competent authorities | All relevant categories | Legal obligation | | Keeping records required by law and responding to authorities | All relevant categories | Legal obligation | | Preventing fraud and securing our systems | Technical, blockchain data | Legitimate interests | | Communicating with you and sending service notices | Contact, communications data | Contract; legitimate interests | | Marketing | Contact, communications data | Consent | | Enforcing our rights and defending claims | All relevant categories | Legitimate interests | Automated decisions. When you connect a wallet to the Interface or submit a transaction to the Sierra Protocol, your wallet address is screened automatically. A wallet rated as severe risk by our blockchain analytics settings, or flagged by the Sanctions Oracle, is blocked automatically, and an on-chain transaction involving it reverts. These decisions are needed to comply with sanctions and anti-money laundering laws. You may ask us to review a block by contacting us (section 15), but where the law prohibits it we will not explain the reasons. ### 7. Who We Share Personal Data With We share personal data only as needed for the purposes in section 6, with: * blockchain analytics and wallet screening providers including Chainalysis Inc., which receive wallet addresses and transaction data and return risk ratings, attributions and alerts; * our outsourced compliance and technology service provider OpenTrade Technology Ltd, which operates screening and monitoring, reviews alerts and supports onboarding on our behalf; * IP geo-location and VPN detection providers, including Amazon Web Services, which receive IP addresses; * identity verification and screening database providers, for Authorized Participants; * other service providers, including IT, hosting, analytics and communications providers; * professional advisers, including lawyers, auditors, accountants and insurers; * competent authorities, including financial intelligence units, sanctions authorities, regulators and law enforcement in the BVI, the Cayman Islands, the United Kingdom and other jurisdictions, where required by law or where we report suspicious activity, sanctions matches or frozen assets; * our affiliates, including Sierra Foundation, where needed to provide the Services; and * a buyer or successor, in connection with a merger, sale or reorganisation, subject to this Policy. On-chain sanctions oracles, such as the RedStone Sanctions Oracle, are queried by the Sierra Protocol on the public blockchain and do not receive any personal data from us beyond what is already public on-chain. Wallet addresses that we add to the on-chain Blocklist become publicly visible on the blockchain. We do not sell personal data. We require our service providers to protect personal data in line with the DPA and equivalent standards. ### 8. International Transfers Personal data may be transferred to and stored outside the BVI, including in the United Kingdom, the United States and the European Union, where our service providers operate. Where we transfer personal data to a jurisdiction that does not provide equivalent protection, we use safeguards permitted by the DPA, such as contractual data protection clauses. ### 9. Data Security We use appropriate technical and organisational measures to protect personal data from unauthorised access, disclosure, alteration or destruction. Access is limited to staff and service providers who need it and are bound by confidentiality obligations. Records of suspicious activity reports are restricted to our Money Laundering Reporting Officer and Deputy. If a personal data breach occurs, we will notify affected individuals and authorities as required by law. ### 10. Data Retention We keep personal data only as long as necessary for the purposes for which it was collected, including legal and regulatory requirements. We keep the following records for at least the periods below, or longer where the law, a court order or a legal hold requires: | Record | Minimum retention | | -------------------------------------------------------------------- | ------------------------------------------------------------------------------ | | Authorized Participant onboarding and due diligence files | 5 years after the end of the relationship | | Wallet screening logs, risk ratings and blockchain analytics outputs | 5 years from the date of the record | | Geo-blocking logs | 5 years from the date of the record | | Mint and Redemption records | 5 years from the date of the transaction | | Monitoring alerts and reviews, Blocklist records and freezes | 5 years from the date of the record, or from unblocking or unfreezing if later | | Suspicious activity and sanctions reports | 5 years from the closure of the case | | Website analytics and non-essential cookie data | 13 months | At the end of the retention period we securely delete or anonymise personal data. Data recorded on a public blockchain, including transactions and on-chain Blocklist entries, cannot be deleted by us. ### 11. Your Rights Subject to the DPA and other applicable law, you have the right to: * access the personal data we hold about you; * have inaccurate or incomplete data corrected; * have your data erased; * restrict or object to our processing, including for direct marketing; * receive your data in a structured, commonly used format; and * withdraw your consent at any time, without affecting processing already carried out. These rights are limited where we must keep data to comply with the law (for example, the retention periods in section 10), where disclosure would prejudice the prevention or detection of crime or would amount to tipping off, and for data recorded on public blockchains. To exercise your rights, contact us (section 15). We will respond to verified requests within one month, extendable for complex or numerous requests. ### 12. Cookies 12.1 What cookies are. Cookies are small files placed on your device that let us recognise your browser and understand how you use our website and the Interface. Similar technologies include local storage and pixels. 12.2 How we use them. | Type | Purpose | Consent needed | | ------------------------- | -------------------------------------------------------------- | -------------- | | Strictly necessary | Security, wallet connection, geo-blocking and fraud prevention | No | | Performance and analytics | Measuring usage to improve the Services | Yes | | Functional | Remembering your preferences | Yes | | Advertising | Delivering relevant advertising | Yes | 12.3 Managing cookies. You can accept or reject non-essential cookies through our cookie banner or settings panel, and block or delete cookies in your browser settings. Blocking strictly necessary cookies may stop the Interface from working, including wallet connection. ### 13. Children The Services are not directed at anyone under 18, and we do not knowingly collect personal data from minors. If you believe a minor has given us personal data, please contact us. ### 14. Changes to This Policy We may amend this Policy at any time by publishing a revised version with a new "Last Updated" date. Material changes will be announced through the Interface or our official channels. ### 15. Contact Us For questions, requests or complaints about this Policy or our data practices, contact: Sierra Reserve Limited, Rough Point, P.O. Box 4203, Mount Healthy, Tortola, VG1110, British Virgin Islands. Email: If you are not satisfied with our response, you may contact the Office of the Information Commissioner of the British Virgin Islands.