Privacy Policy

1. Who is responsible for your data

The controller of your personal data is Unicorn Private LLC, 16192 Coastal Highway, Lewes, Delaware 19958, United States of America.

For any question about this policy or about your data, and to exercise your rights, write to [email protected].

2. Data we collect

We collect only the data we need to provide the App and the Site and to meet our legal obligations.

• Account data (Sign in with Apple or Google Sign-In): the unique identifier that Apple or Google assigns to you, your email address (with Apple this can be a private relay address) and your name, if you choose to share it. We never receive your Apple or Google password. We also assign you a member code, used as a payment reference.
• Membership and payment data: the payment method you choose (Google Play on Android, card through Stripe, bank transfer or crypto), payment references and status, amount, dates, membership start and expiry dates, and transaction identifiers (for example the Stripe session identifier, the Google Play order identifier and a protected form of the purchase token). Card details are entered on pages operated by Stripe: we do not receive or store your card number or security code. Google Play purchases are processed by Google. For bank transfers we receive the information that banks attach to the transfer (for example the name of the sender, the account, the amount and the reference). For crypto payments we receive the sending address and the transaction identifier, which are also visible on the public blockchain.
• Investment commitments and declarations: the company you select, the amount, the payment reference, the status of the commitment, the date and time, and the declarations you confirm (for example that you are a qualified or accredited investor and that you have read the risks), with the version of the text you accepted.
• Accredited investor verification: the documents you upload or the verification letter from a third party (for example an accountant, attorney, broker-dealer or registered investment adviser), together with your notes, the status of the review and its outcome. These documents can contain financial information such as income, assets or account statements. They are kept in a private storage area that is not publicly accessible and can be opened only by authorized staff.
• Country of access: the country of your internet connection, derived from your IP address, recorded at your first sign-in and with each commitment and used to apply country restrictions. We record the country only, not your precise location.
• Site contact form: your name, email address, phone number and indicative investment amount (both optional), your message, the language of the page and the date.
• Communications: the content of the emails you send us and of our replies.
• Technical data: when you use the App or the Site, our hosting provider processes your IP address and technical information about your device and browser to deliver the service and protect it against abuse. On the Site we produce aggregate statistics with Cloudflare Web Analytics and Google Analytics, as described in section 12.

The App contains no advertising and does not track you across apps or websites of other companies.

3. Why we use your data and on what legal basis

We use personal data for the following purposes. For users in the European Economic Area, the United Kingdom and Switzerland, we indicate the legal basis under the General Data Protection Regulation (GDPR) and the equivalent local laws.

• To create and manage your account and let you sign in: performance of the contract with you (Article 6(1)(b) GDPR).
• To activate, extend and administer your club membership and record payments: performance of the contract; compliance with accounting and tax obligations (Article 6(1)(c) GDPR).
• To record your commitments and declarations and send you the bank transfer instructions: performance of the contract and steps taken at your request before entering into it; compliance with legal obligations.
• To verify that you are an accredited or qualified investor, and to carry out identity, anti-money laundering and sanctions checks: compliance with legal obligations, including the verification required for offerings under Rule 506(c) of Regulation D; our legitimate interest in preventing fraud (Article 6(1)(f) GDPR).
• To apply country restrictions: compliance with legal obligations and our legitimate interest in offering the service only where it is permitted.
• To answer requests sent through the contact form or by email: steps taken at your request before entering into a contract, or our legitimate interest in answering you.
• To keep the App and the Site secure and working, and to prevent abuse: our legitimate interest.
• To produce aggregate statistics about the use of the Site: our legitimate interest in improving the Site, or your consent where the law requires it.
• To establish, exercise or defend legal claims: our legitimate interest.

We do not sell personal data and we do not share it for cross-context behavioral advertising. We do not take decisions that produce legal effects for you based solely on automated processing: every accreditation review is carried out by a person.

4. Who we share data with

We share personal data only with the following recipients, and only as far as needed for the purposes above:

• Cloudflare, Inc.: hosting of the App servers and of the Site, database, private storage of verification documents, network security, email routing and Cloudflare Web Analytics.
• Stripe: processing of card payments. Stripe also processes some data as an independent controller, under its own privacy policy.
• Google: Google Sign-In, Google Play distribution and in-app purchases on Android, Google Analytics on the Site, and email services.
• Apple: Sign in with Apple and distribution through the App Store.
• Email service providers (Google Gmail, Cloudflare Email Routing and Resend), used to receive and send our emails and notifications.
• Our banks and payment service providers, to receive and reconcile payments.
• The special purpose vehicles (SPVs) through which club deals are made, their administrators and, where involved, a broker-dealer or a verification service, as far as necessary for your participation.
• Our professional advisers (for example lawyers, accountants and auditors), bound by confidentiality.
• Public authorities, courts and regulators, when the law requires it or to protect our rights.

When you sign in with Apple or Google or pay through Google Play or Stripe, those companies also process your data under their own privacy policies.

5. International transfers

Unicorn Private is based in the United States, and our providers process data in the United States and in other countries. If you are in the European Economic Area, the United Kingdom or Switzerland, your data is transferred to the United States. We rely on the EU-U.S. Data Privacy Framework and its UK and Swiss extensions where the provider is certified, on the Standard Contractual Clauses approved by the European Commission and their UK and Swiss equivalents, or, where applicable, on the necessity of the transfer for the contract you requested. You can ask us for more information about these safeguards.

6. How long we keep data

• Account data: for as long as your account exists. It is deleted when you delete your account, except for the data listed below.
• Investment commitments, declarations, verification documents and membership payment records: kept for as long as securities, anti-money laundering, tax and accounting laws require, also after your account is deleted, as a rule for at least five years after the end of the relationship or of the investment, and for the time needed to establish or defend legal claims.
• Contact form requests and emails: for up to 24 months after the last contact, unless they become part of a client relationship.
• Technical logs: for short periods, according to the settings of our hosting provider.

7. Your rights

Wherever you live, you can ask us to access, correct or delete your personal data by writing to [email protected]. We may ask you to confirm your identity before acting on a request.

European Economic Area, United Kingdom and Switzerland. Under the GDPR and the equivalent local laws you have the right to access your data, to have it corrected or erased, to restrict its processing, to receive it in a portable format, to object to processing based on our legitimate interest, and to withdraw your consent at any time where processing is based on consent, without affecting processing that took place before. You can also lodge a complaint with the data protection authority of the country where you live or work, or where the alleged infringement took place. We answer within one month, which can be extended where the law allows.

California. Under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA), you have the right to know which categories and which specific pieces of personal information we have collected, the sources, the purposes and the categories of recipients; to request deletion and correction; to opt out of the sale or sharing of personal information (we do not sell or share it); to limit the use of sensitive personal information (we use it only for the purposes allowed by the CCPA, such as providing the service and verifying accreditation); and not to be discriminated against for exercising these rights. You can make a request yourself or through an authorized agent. We answer within 45 days, which can be extended where the law allows.

In the last 12 months we collected the following categories of personal information, from you, from Apple, Google and Stripe and from your device, for the purposes described in section 3: identifiers (name, email, account identifiers, IP address); customer records and financial information (payments, commitments, verification documents); commercial information (membership and commitments); internet activity (use of the App and of the Site); approximate location (country of connection only); professional or financial information contained in verification documents. We disclosed these categories for business purposes only to the recipients listed in section 4.

Residents of other US states with consumer privacy laws can exercise similar rights in the same way.

8. Deleting your account

You can delete your account at any time:

• in the App, from the profile section, with "Delete account";
• from the web, without installing the App, at https://app.unicorn-club.com/delete-account;
• by writing to [email protected] from the email address linked to your account.

When you delete your account we delete your account data (identifier, email address and name) and end your sessions; if you signed in with Apple, we also revoke the access granted to the App. Investment commitments, declarations, verification documents and payment records are kept, separated from the account where possible, for the periods required by law described in section 6. Deleting the account does not cancel investments already made, which remain governed by the offering documents.

9. Security

Data travels over encrypted connections (HTTPS). Access to the administration area and to verification documents is restricted to authorized staff, and documents are kept in private storage that is not publicly accessible. No system is completely secure: if a breach affects your data, we will inform you and the competent authorities as required by law.

10. Minors

The App and the club are reserved for adults: you must be at least 18 years old, or of the age of majority in your country if higher. The App and the Site are not directed to children and we do not knowingly collect data from minors. If we learn that we hold data of a minor, we delete it.

11. Store information

The privacy information shown on the App Store and on Google Play (privacy labels and data safety section) summarizes this policy. In case of doubt, this policy prevails.

12. Cookies and similar technologies

The App does not use cookies or advertising identifiers.

On the Site we use only technical cookies and similar technologies that are strictly necessary for it to work and to be secure (for example, protection against abuse by our hosting provider). We do not use advertising cookies or other non-essential cookies. Cloudflare Web Analytics measures visits without cookies. Google Analytics runs with storage of analytics and advertising cookies denied: it does not place cookies on your device and receives only basic technical information about page views, which we use for aggregate statistics.

You can block or delete cookies in your browser settings; the Site may then not work correctly.

13. Changes to this policy

We may update this policy, for example when the App or the law changes. The date at the top shows the latest version. If the changes are significant, we will inform you in the App or by email before they take effect.

14. Contact

Unicorn Private LLC, 16192 Coastal Highway, Lewes, Delaware 19958, United States of America. Email: [email protected].