Biometric Privacy Disclosure and Consent

Last updated: June 11, 2025

We take your privacy seriously and are committed to protecting and respecting your personal information. This Biometric Privacy Disclosure and Consent (“Biometric Policy”) sets out and explains how CoinJar, Inc. ("CoinJar", "we", "us", "our") as well as its third party service providers, including but not limited to Plaid and its sub-processors (“Service Providers”) may collect, capture, receive, obtain, process, disclose, retain and destroy (“Process” or “Processing”) a scan of individual’s facial geometries and measurements (“Biometric Data”) where we provide our services (“Services”) via our digital currency exchange found at , and our sub-domains, associated web-based and mobile applications, and APIs. For more information about our Services, please visit our website and refer to our Terms of Service (which can be found at ). For more information about our privacy practices and collection of other types of personal information, please visit our Privacy Policy which can be found at .

1. Purposes of Collection

CoinJar and/or its Service Providers may Process users’ Biometric Data to verify the identity of customers, for legal or security purposes, for purposes required or permitted by law, and for purposes related to fraud detection and prevention (collectively, “Purposes of Collection”).

2. Disclosure

CoinJar may disclose Biometric Data to Service Providers, and may permit Service Providers to disclose Biometric Data for the Purposes of Collection, for purposes required or permitted by law, for legal purposes and for purposes related to fraud detection and prevention. This may include, without limitation, disclosing the Biometric Data if such disclosure is required pursuant to a valid warrant or subpoena issued by a court of competent jurisdiction or pursuant to applicable law. CoinJar may also disclose Biometric Data to regulators in order to demonstrate our compliance with applicable law. CoinJar does not sell, lease, trade for financial gain, or otherwise profit from Biometric Data.

3. Retention Schedule and Destruction Guidelines

In general, CoinJar may retain, and permit Service Providers to retain, Biometric Data until the Biometric Data is no longer reasonably necessary to fulfill the Purposes of Collection, but in any event, not for a period longer than one (1) year after closing your account with CoinJar (“Retention Period”).

Once the Retention Period has expired, CoinJar will take, and will require Service Providers to take, then-current industry standard measures designed to securely delete and/or destroy the Biometric Data.

4. Biometric Data Safeguards

CoinJar uses, and requires Service Providers to use, reasonable industry standard information security safeguards designed to protect Biometric Data Processed pursuant to this disclosure. These safeguards may include, as applicable to the Processing at issue, firewalls, physical and digital security measures, encryption, access restrictions, password authorization, and system logging.

5. Consent and Release

I ACKNOWLEDGE THAT I HAVE READ, UNDERSTAND, AND AGREE TO THIS POLICY. BY CONTINUING, I EXPRESSLY AUTHORIZE COINJAR AND ITS SERVICE PROVIDERS TO PROCESS BIOMETRIC DATA AS DESCRIBED IN THIS POLICY.

I affirm that I am over the age of 18 or the age of majority, whichever is older, in my jurisdiction of residence, and that I have the authority to agree to this disclosure and to provide my consent and release for the Processing of my Biometric Data as described in this disclosure.

I agree that, if any part of this disclosure shall be held unenforceable, only that part shall be unenforceable, and the remainder will be effective.