This Privacy Policy explains how Pricechain Labs, Inc. and its Crinkl service ("Crinkl," "we," "us," or "our") collect, use, disclose, retain, and protect information when you use the Crinkl application and related services (the "Service"). This Privacy Policy applies to users located in the United States.

Crinkl is operated by Pricechain Labs, Inc., a United States–based technology company. Pricechain Labs operates the verification service and related systems used for receipt processing, verification workflows, reward issuance, and operation of the Crinkl application.

Crinkl is designed to verify real-world spending without requiring your legal name or government-issued identity at the time you submit a receipt. However, receipt images, extracted receipt data, technical metadata, and optional account or wallet information may still contain or constitute personal information under applicable law. Our goal is to minimize the role of identity in verification and to separate durable spend attestations from raw receipt data wherever possible.

1. Core Design Principle: Facts First, Identity Minimized

Crinkl is designed to verify whether a purchase occurred, not to require your real-world identity at receipt capture.

Receipt submission and verification rely primarily on internal submission-scoped, session-scoped, device-scoped, and tenant-scoped identifiers, rather than requiring your name, mailing address, or government-issued identity to upload a receipt.

Any later association with an account, wallet, reward preference, or notification setting is optional, deferred, and separate from the initial act of receipt submission. Even so, some information processed by the Service may still be personal information, including receipt contents, network metadata, device identifiers, wallet addresses, and support communications.

2. Information We Collect

We collect the following categories of information.

A. Receipt and Verification Data

When you submit a receipt or other transaction evidence, we may process:

Receipt images or files you upload
Text extracted from receipts or files, including OCR output
Derived receipt attributes, such as merchant/store name, date, time, total, tax, currency, line items, payment indicators, or other structured transaction fields
Internal submission, session, device, or tenant identifiers used to process and validate the submission
Object keys, image references, or processing references used by internal systems

Receipt images and extracted text may contain personal information depending on what appears on the receipt or transaction record, including, where present, a name, delivery address, loyalty number, order number, partial payment-card information, or other transaction details.

To operate the Service, receipt images, extracted text, and derived receipt attributes may be processed by service providers and contractors acting on our behalf, including OCR, document-processing, and machine-learning providers used to extract, classify, normalize, or enrich receipt data.

B. Account, Wallet, Reward, and Preference Data

If you choose to use account or reward-related features, we may collect:

Username or display name
Profile image
Email address, if you provide one
Wallet reference, wallet address, or related public blockchain identifier used for reward claiming, commitments, or other wallet-connected features
Reward preference settings
Notification settings and subscription status

Account information is not required to upload a receipt, but some account, wallet, or preference data may be needed to access certain features, rewards, or user controls.

C. Device, Application, and Network Data

We automatically collect limited technical information when you use the Service, such as:

Device type
Operating system
Browser type
App version
IP address
Timestamps
Application usage events
Push notification subscription metadata, if enabled
Limited device or browser identifiers used for security, fraud prevention, or service integrity

D. Support and Communications Data

If you contact support or otherwise communicate with us, we may receive:

The information you include in your message
Any attachments or screenshots you send
Limited diagnostic or troubleshooting context, such as app version, device type, timestamp, or account identifier

3. Sources of Information

We collect information from the following sources:

Directly from you, such as when you upload a receipt, create an account, connect a wallet, configure preferences, claim rewards, or contact support
Automatically from your device or browser, such as technical and usage information generated when you access the Service
From service providers, contractors, and integrations, where needed to host, secure, process, message, support, or operate the Service
From public blockchains or verifiable systems, where applicable to wallet-connected activity, reward claims, or other public on-chain events

4. How We Use Information

We use information for the following purposes:

To ingest, process, OCR, normalize, classify, verify, score, and make decisions about receipt submissions
To determine whether a transaction or spend event satisfies verification criteria
To identify categories, merchant, line-item, or other receipt attributes using OCR, document-processing, and AI-assisted tools
To detect fraud, abuse, duplication, manipulation, or errors
To support internal reconciliation and linking of related submissions where necessary for fraud prevention, system integrity, or user-requested corrections
To provide user-requested review, edits, or corrections during the receipt retention window
To issue rewards, commitments, eligibility confirmations, or related outputs tied to verified spend
To operate, maintain, troubleshoot, secure, and improve the Service
To provide optional features such as profiles, wallets, notifications, preferences, or account management
To respond to support requests and communicate with you about the Service
To comply with applicable law, enforce our terms, protect rights and safety, and maintain records needed for auditing, dispute resolution, or system integrity

Receipt processing occurs through staged internal workflows with defined inputs and outputs rather than unrestricted access to all system data by all personnel or services.

5. AI, OCR, and Automated Processing

Crinkl uses OCR, document-processing, and AI-assisted tools to help extract, classify, normalize, enrich, and verify receipt data.

For example, these tools may help identify merchant, category, line-item, or other receipt attributes, improve extraction quality, and support verification workflows.

These tools may be operated by Crinkl directly or by service providers and contractors acting on our behalf. Their use does not change the limits described in this Privacy Policy regarding what partners and network participants receive.

6. How We Disclose Information

We do not disclose information to partners or third parties in the same way for all purposes. Different categories of information may be disclosed to different recipients depending on the function being performed.

A. Service Providers and Contractors

We may disclose personal information to service providers and contractors that help us host, store, secure, process, analyze, message, support, or otherwise operate the Service. Depending on how the Service is configured, these providers may include:

Cloud hosting and storage providers
OCR, document-processing, and machine-learning providers
Analytics providers
Push-notification or messaging providers
Customer support vendors
Fraud, abuse-prevention, and security vendors
Reward, payment, or wallet-integration providers

These parties are authorized to use the information only on our behalf and for limited business purposes, subject to contract and applicable law.

B. Partners and Network Participants

Partners or network participants may interact with certain Crinkl outputs in limited forms, such as:

Aggregate or population-level analytics
Verified spend attestations or eligibility confirmations
Commitment or unlock signals needed to issue rewards or enable programs
Protocol-level confirmations that defined conditions were met

These outputs are intended to be identity-minimized and not designed to provide partners with raw receipt data or personal consumer profiles.

C. Legal, Safety, and Compliance Disclosures

We may disclose information when we believe disclosure is reasonably necessary to:

Comply with applicable law, regulation, subpoena, court order, or valid government request
Protect the rights, property, or safety of Crinkl, our users, or others
Detect, investigate, or prevent fraud, abuse, security incidents, or illegal activity
Enforce our agreements, policies, or terms

D. Corporate Transactions

We may disclose information in connection with a merger, acquisition, financing, asset sale, bankruptcy, or other corporate transaction, subject to applicable law.

7. What Partners and Network Participants Do Not Receive

Unless we specifically tell you otherwise for a particular feature or program, partners and network participants do not receive from us:

Your name, username, or email address
Your full personal profile
Raw receipt images
Full OCR text
Data we intend to use to directly identify you as an individual consumer
Persistent identifiers intentionally provided for cross-service or cross-context advertising profiles

This section does not limit disclosures to service providers and contractors acting on our behalf, including OCR, document-processing, and machine-learning providers used to analyze receipt content, or disclosures required by law.

8. Sale, Sharing, and Advertising

Crinkl does not operate as an advertising data broker.

We do not sell personal information. We also do not share personal information for cross-context behavioral advertising as those terms are defined under applicable law.

If this changes, we will update this Privacy Policy and provide any rights or notices required by applicable law.

9. How Information Leaves Internal Processing Boundaries

When information leaves internal processing boundaries for partner, network, or protocol interaction, we aim to limit those outputs to constrained forms such as:

Verified spend attestations
Aggregate measurements derived from many receipts or events
Eligibility, commitment, or unlock signals
Minimal protocol metadata required for verification, settlement, or auditability

These outputs are intended to be detached from raw receipt contents and personal identity wherever feasible. Even so, no data architecture can eliminate all theoretical reidentification risk in every context, especially where very small cohorts, narrow predicates, or public blockchain activity are involved.

10. On-Chain and Verifiable Systems

Where blockchain or other verifiable systems are used, Crinkl publishes only the minimum metadata we determine is needed for verification, settlement, proof, or auditability.

We do not place names, email addresses, raw receipt images, or full OCR text on-chain.

If you use wallet-connected or blockchain-based features, please understand:

Public blockchain addresses and transactions may be visible to others
Public blockchain data may be persistent
Third parties may be able to observe, analyze, or link public addresses and activity using information outside of Crinkl's control

We aim to minimize what is published and to avoid publishing identity information on-chain, but public blockchain activity may still be observable.

11. Receipt Images, Redaction, and 45-Day Retention

Receipt image redaction is a technology under development and cannot guarantee complete removal of all personal information.

Receipt images are used for purposes including:

OCR extraction
Verification and decisioning
Fraud prevention and abuse detection
Internal reconciliation or linking of related submissions
User-requested review, edits, or corrections during the retention window

As part of these functions, receipt images and related extracted data may be processed by service providers and contractors acting on our behalf, including AI, OCR, and machine-learning providers used for extraction, classification, and verification support.

Receipt images are:

Not distributed to partners for their own marketing or profiling use
Not published on-chain
Not intentionally used to build third-party advertising profiles

Receipt images are stored temporarily and retained for up to 45 days, after which they are deleted or otherwise made inaccessible in the ordinary course of our system operations, subject to backup, disaster recovery, legal hold, or security requirements.

Redaction attempts may be applied to certain verified receipts, but users should not assume that all personal information is fully removed. Users are encouraged to review receipt images within the app during the retention window and avoid submitting receipts that contain information they do not want processed.

12. Client-Side Storage and Local Security

On supported clients, certain values may be stored locally on your device or browser to support functionality, security, or privacy-preserving features.

For example:

Certain sensitive values, such as reward secrets or blinders, may be encrypted locally and stored in client-side storage mechanisms such as IndexedDB
Limited preferences, such as reward preference, notification state, or a device identifier, may be stored locally, including through browser storage such as localStorage

Client-side storage is controlled in part by your device, browser, and app environment. If you clear local storage or reset your device or browser, some functionality may be affected.

13. Data Retention

We retain information only for as long as reasonably necessary for the purposes described in this Privacy Policy, including to provide the Service, maintain integrity and security, issue rewards, investigate fraud, resolve disputes, comply with legal obligations, and preserve records needed for auditability.

Retention varies by category:

Receipt images: retained for up to 45 days, then deleted or made inaccessible in the ordinary course, subject to backup, legal hold, or security requirements
Extracted receipt text and derived receipt attributes: retained as long as needed to support verification records, fraud prevention, duplicate detection, reward issuance, internal reconciliation, dispute handling, system integrity, auditability, and legal compliance
Account, wallet, and preference data: retained until you delete your account or as long as needed to provide the Service, operate reward-related features, maintain records, and comply with law
Support communications: retained as long as reasonably needed to respond to your request, improve support, preserve records, or comply with law
Security, fraud, and application logs: retained as long as reasonably necessary for debugging, abuse prevention, incident response, system integrity, and legal compliance

Aggregated information or information no longer reasonably associated with your account may be retained longer where permitted by law.

Not all retention or deletion timelines are user-configurable at this time.

14. User Controls and Requests

Depending on how you use the Service, you may be able to:

Access and update certain profile information
Manage notification settings
Disconnect optional features or integrations
Request deletion of your account and associated data, subject to operational, security, fraud-prevention, auditability, backup, and legal constraints
Opt out of optional uses that are not required to provide the Service, where such options are offered

Requests may be made through in-app controls or by contacting support at support@crinkl.xyz.

15. U.S. State Privacy Rights

Depending on where you live, you may have rights under applicable U.S. state privacy laws, including rights to request access to, correction of, deletion of, or portability of certain personal information, and rights to opt out of certain uses or disclosures of personal information.

If you are a California resident, you may also have rights related to:

Knowing what categories of personal information we collect, use, disclose, sell, or share
Requesting deletion of certain personal information
Requesting correction of certain personal information
Opting out of sale or sharing, if applicable
Limiting certain uses of sensitive personal information, if applicable
Not being discriminated against for exercising applicable privacy rights

To exercise applicable rights, contact us at support@crinkl.xyz or use any in-app tools we make available for that purpose.

We may need to verify your request before acting on it. In some cases, we may deny or limit a request where permitted by law, including where necessary to protect security, prevent fraud, complete a transaction you requested, maintain required records, or comply with legal obligations.

16. Rewards and Incentive Programs

Crinkl may offer rewards, commitments, or other benefits tied to verified spend or participation in certain features.

To administer these programs, we may use receipt and verification data, account data, wallet-related data, and eligibility signals.

If applicable law requires a separate notice describing any financial incentive or bona fide loyalty program tied to personal information, we may provide that notice separately. California residents should review our California Notice of Financial Incentive below.

17. Security Practices

We use reasonable administrative, technical, and organizational safeguards designed to protect information, including measures such as:

Encryption in transit
Access controls
Scoped internal services
Logging, monitoring, and security review for system integrity
Fraud and abuse detection controls

No system can guarantee absolute security, and no transmission or storage method is completely secure.

18. Children's Privacy

Crinkl is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided personal information to us, contact us and we will take appropriate steps consistent with applicable law.

19. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we may provide notice through the Service, in-app, by email where appropriate, or by updating the "Last Updated" date above.

Your continued use of the Service after an updated Privacy Policy becomes effective is subject to the revised policy.

20. Contact Us

If you have questions about this Privacy Policy or want to submit a privacy-related request, contact us at:

Email: support@crinkl.xyz

Commerce produces facts. Crinkl is designed to make them more portable, more verifiable, and less dependent on personal identity.

Legal

California Notice of Financial Incentive — Crinkl

Effective Date: March 9, 2026

Last Updated: March 9, 2026

This California Notice of Financial Incentive applies to California residents and supplements the Crinkl Privacy Policy.

Crinkl may offer rewards, commitments, points, bonuses, tokens, or other promotional or program benefits in connection with verified spend, participation in the Service, or use of certain features. Under California law, these programs may be considered "financial incentives" or "bona fide loyalty programs" because they may involve the collection, retention, use, or disclosure of personal information.

1. Summary of the Program

Crinkl may provide benefits to users who choose to participate in eligible reward or incentive features. These benefits may include, for example:

Reward eligibility tied to verified spend
Points, tokens, credits, bonuses, or similar benefits
Access to promotions, unlocks, or other program features
Other incentives described in the applicable program terms

Participation is voluntary.

2. Material Terms

To participate in a reward or incentive feature, you may need to:

Submit eligible receipts or other transaction evidence
Maintain an account, wallet, or reward preference setting for certain features
Satisfy verification, anti-fraud, or program eligibility requirements
Accept any additional program-specific terms we provide

The specific rewards, qualifications, and conditions may vary by program, feature, or campaign. We may modify or discontinue a program or particular reward at any time, subject to applicable law and any terms governing that program.

3. Categories of Personal Information Implicated

The categories of personal information reasonably related to these programs may include:

Receipt and verification data, including receipt images, OCR output, derived transaction attributes, and internal submission or device-linked processing identifiers
Account, wallet, reward, and preference data, such as username, email address if provided, wallet reference or wallet address, and reward settings
Device, application, and network data, such as IP address, timestamps, app version, and usage events
Communications or support data, if you contact us in connection with a reward or incentive feature

Not every program uses every category listed above.

4. How to Opt In

You opt in to an applicable reward or incentive feature by voluntarily participating in it, such as by:

Uploading receipts for reward-eligible verification
Enabling a reward preference
Connecting a wallet for reward-related functionality
Accepting program terms or otherwise choosing to participate in a specific offer, promotion, or incentive feature

By participating, you agree to the terms of the applicable program and to the handling of your information as described in the Crinkl Privacy Policy and this Notice.

5. How to Withdraw

You may withdraw from participation in a financial incentive or reward program at any time by:

Stopping participation in the applicable feature
Changing or disabling applicable reward settings
Disconnecting optional wallet-connected functionality where available
Requesting account deletion, subject to operational, anti-fraud, auditability, backup, and legal constraints
Contacting us at support@crinkl.xyz

Withdrawing will not reverse rewards or decisions already made before withdrawal, and some information may still be retained as described in the Privacy Policy for fraud prevention, recordkeeping, legal compliance, and system integrity.

6. Good-Faith Estimate of the Value of Consumer Data

The value of personal information associated with participation in Crinkl reward and incentive programs depends on multiple factors and may vary by user, feature, campaign, fraud risk, and level of participation.

In good faith, we estimate the value of consumer data associated with these programs by considering, as applicable:

The commercial value generated by verified spend participation and related program engagement
The operational value of verification, fraud reduction, and reward qualification tied to that participation
The costs of collecting, processing, storing, securing, reviewing, and verifying submissions
The costs of fraud prevention, compliance, customer support, infrastructure, and reward administration
The costs and value of the specific rewards or benefits offered

Based on these considerations, we determine in good faith that the value of the benefits or rewards provided through a particular program is reasonably related to the value of the consumer data involved in that program.

If we offer a program that requires a more specific valuation disclosure under applicable law, we may provide supplemental terms or notices for that program.

7. Non-Discrimination

You will not be discriminated against for exercising any rights you may have under California law. However, if you choose not to participate in a reward or incentive feature, or if you withdraw from participation, you may not have access to the rewards, benefits, or features tied to that program.

8. Contact Us

If you have questions about this Notice or want to withdraw from a reward or incentive program, contact us at: