Privacy Policy

1. Introduction and Scope

Lattice Metals LLC (“Lattice Metals,” “we,” “us,” or “our”) is a Wyoming limited liability company operating the online precious metals retail platform at latticemetals.com (the “Site”). This Privacy Policy describes how we collect, use, disclose, retain, and protect personal information of individuals who visit the Site, place orders, receive marketing communications, or otherwise interact with us.

Our business involves selling physical precious metals bullion products online, accepting stablecoin payments, fulfilling orders through authorized third-party wholesale drop-ship partners, and engaging in marketing activities including targeted advertising, behavioral tracking, and acquisition of advertising leads. This Policy governs all of these activities. We also operate under federal Anti-Money Laundering and OFAC sanctions compliance obligations that interact with and in certain cases supersede state-level privacy rights, as described in Section 7.

This Policy is incorporated by reference into our Terms of Use and Sale. Capitalized terms not defined here have the meanings given in those Terms.

2. Information We Collect

2.1 Information You Provide Directly

We collect information that you provide to us in the course of using the Site or purchasing from us. This includes your full legal name, shipping address, email address, and telephone number collected at checkout or through contact forms; your blockchain wallet address, stablecoin type (USDC or PYUSD), blockchain network, on-chain transaction hash, payment amount in USD equivalent, and complete order details; account credentials and saved preferences if you create an account; the content of any email, inquiry, dispute correspondence, or feedback form you submit to us; government-issued identification or other documents we may request to satisfy our federal Anti-Money Laundering compliance obligations as described in Section 7; and your marketing and advertising consent choices, including opt-in and opt-out preferences for email and targeted advertising communications.

2.2 Information Collected Automatically

When you access the Site, we and our service providers automatically collect certain information about your device and usage. This includes your IP address, browser type and version, operating system, device type and identifiers, referring URL, pages viewed, and timestamps of Site interactions. We collect approximate geographic location inferred from your IP address, and where you grant permission, more precise location through browser geolocation APIs for jurisdiction-specific purposes. We do not collect precise geolocation for advertising purposes without your explicit consent where required by applicable law. We also collect behavioral and engagement data such as pages visited, products viewed, time spent on pages, click patterns, search queries on the Site, shopping cart contents, and conversion events. Through cookies, web beacons, pixel tags, and similar technologies described in Section 5, we and our advertising partners collect information about your interactions with our advertisements on the Site and on third-party platforms.

2.3 Information Received From Third Parties

We may receive personal information about you from third parties. We may acquire contact lists, demographic data, interest-based segments, and other personal information from third-party advertising lead providers and data brokers for use in direct marketing. Third-party advertising platforms, including Google and Meta, may share with us information about your engagement with our advertisements, including ad click and conversion data and audience segment membership for retargeting purposes. When you initiate a stablecoin payment, your sending wallet address is screened against OFAC sanctions lists using a blockchain analytics service, currently Chainalysis, and that screening generates a compliance record retained in our mandatory AML files. Our authorized wholesale drop-ship fulfillment partners receive your name and shipping address to process and ship your order; they do not receive payment, marketing, or behavioral data. We do not purchase personal information from data brokers for any purpose other than marketing activities described in Section 3.2.

3. How We Use Your Information

3.1 Order Fulfillment and Customer Service

We use the personal information you provide to process, confirm, and fulfill your purchase orders; communicate with you regarding order status, shipment, and delivery; manage returns, refunds, and dispute resolution; and respond to your inquiries and provide customer support.

3.2 Marketing and Advertising

We use personal information for a range of marketing and advertising activities. We send promotional emails, product announcements, precious metals market commentary, and special offers to individuals who have opted in or where permitted by applicable law based on a prior purchase relationship. We engage in targeted advertising by using behavioral data, demographic information, purchase history, and third-party audience segments to serve you relevant advertisements on the Site, in email, and on third-party platforms including search engines and social media. We conduct retargeting by using cookies, pixels, and advertising platform audience tools, including Google Customer Match and Meta Custom Audiences, to serve advertisements to individuals who have previously visited the Site or initiated but not completed a purchase. We create and share lookalike audiences by providing hashed or pseudonymized customer data to advertising platforms to identify new potential customers with characteristics similar to our existing customers. We contact advertising leads acquired from third-party providers, subject to consent requirements and applicable opt-out rights. We measure advertising effectiveness, attribute conversions to advertising channels, and optimize our marketing spend through analytics and attribution partners. We personalize Site content, product recommendations, and displays based on your browsing and purchase history and inferred preferences.

3.3 Analytics and Product Improvement

We analyze Site traffic, user behavior, conversion funnels, and product engagement to improve the Site and our offerings. We conduct A/B testing and user experience research. We generate aggregate, de-identified market and user insights that do not identify any individual.

3.4 Legal and Regulatory Compliance

We use personal information to screen all transactions and customers against OFAC sanctions lists and other applicable government watchlists prior to order fulfillment; to maintain complete transaction records as required by the Bank Secrecy Act with a mandatory minimum five-year retention period that cannot be shortened by any consumer privacy request; to file Currency Transaction Reports, Suspicious Activity Reports, or Blocked Transaction Reports with FinCEN or OFAC as required by federal law; to comply with lawful requests, subpoenas, court orders, and demands from law enforcement, regulatory agencies, and government authorities; and to enforce our Terms of Use and Sale and detect, prevent, and investigate fraud.

3.5 Operational Communications

We send transactional order confirmations and operational notices required to deliver the service and notify you of material changes to this Policy or our Terms of Use and Sale.

4. Legal Basis for Processing

We process your personal information under the following legal bases. Contract performance justifies processing necessary to fulfill your purchase order and deliver products you have purchased. Legitimate interests support processing for fraud prevention, Site security, analytics, and marketing activities where our business interests do not override your rights and freedoms. Legal obligation requires processing mandated by BSA, OFAC regulations, and other federal requirements that cannot be overridden by state privacy law or consumer request. Consent applies where expressly required by applicable state law for targeted advertising, cross-context behavioral advertising, and data sharing for advertising purposes; we provide clear mechanisms to exercise opt-out rights and you may withdraw consent at any time by the methods described in Section 10.

5. Cookies, Tracking Technologies, and Advertising

5.1 Types of Tracking Technologies We Use

We use strictly necessary cookies required for core Site functionality including session management, checkout, and security that cannot be disabled without disrupting essential operations. We use analytics cookies and web beacons to understand how visitors use the Site, including pages visited, time spent, and conversion events, which data we use to improve the Site and understand audience behavior. We use marketing and retargeting cookies, pixels, and tags — both first-party and third-party — to track your interactions with the Site and our advertisements across the internet, enabling us to serve you relevant advertisements on third-party platforms and measure advertising effectiveness. Third-party advertising platforms that may set cookies or pixels through the Site include Google (Google Ads, Google Analytics), Meta (Facebook and Instagram), and programmatic display advertising networks. We may use session replay and heatmap tools that record anonymized or pseudonymized sessions to understand user experience and identify usability issues; these tools do not capture payment credentials or sensitive personal information. We do not use browser or device fingerprinting as a primary tracking mechanism, though we may use device signals in combination with other data for fraud detection purposes only.

5.2 Third-Party Advertising Technologies

We use third-party advertising technologies that may independently collect information about your browsing behavior across websites and applications under those third parties’ own privacy policies. We contractually require third-party advertising vendors to comply with applicable privacy laws, including restrictions on the use of data from minors and sensitive categories. Third-party advertising partners we currently use or may use include Google LLC, Meta Platforms Inc., and programmatic advertising networks.

5.3 Your Choices Regarding Tracking and Advertising

You may configure your browser to refuse, delete, or limit cookies, though doing so may impair certain Site features. We recognize and honor the Global Privacy Control (GPC) browser signal as a valid opt-out of data sharing that constitutes a sale or sharing under applicable state law, including California, Colorado, and Oregon, where recognition of universal opt-out mechanisms is legally required, and as a best practice for all other states. You may opt out of our use of your personal information for targeted advertising purposes at any time by contacting us at hello@latticemetals.com or using the opt-out mechanism in Section 10; you may also opt out through the Digital Advertising Alliance at optout.aboutads.info, the Network Advertising Initiative at optout.networkadvertising.org, or your device-level advertising identifier settings. You may unsubscribe from marketing emails at any time by clicking the unsubscribe link in any marketing email or contacting us directly; transactional emails related to your orders are not subject to marketing opt-out. We do not currently respond to Do Not Track signals where not legally required, but we honor GPC as described above.

6. Disclosure of Your Personal Information

6.1 Service Providers

We share personal information with service providers who support our operations, including authorized wholesale fulfillment partners who receive your name and shipping address only; blockchain analytics services that receive your wallet address for OFAC screening; web hosting and database infrastructure providers; transactional and marketing email platforms; advertising platforms and networks that receive behavioral and contact data as described in Section 5; analytics service providers; and payment infrastructure providers. Service providers are bound by written data processing agreements prohibiting use of your information for their own commercial purposes except as required to provide the contracted service or as permitted by their own terms to which you are also subject, as is the case with third-party advertising platforms.

6.2 Advertising Partners and Data Sharing for Marketing

We may share personal information with advertising partners in ways that constitute a sale or sharing for advertising purposes under certain state privacy laws, for each of which we provide opt-out rights. We may share hashed email addresses or pseudonymized device identifiers with advertising platforms such as Google and Meta to create custom audiences for retargeting and lookalike audience targeting, which data is processed under each platform’s own terms and privacy policy. We may acquire contact and demographic information from third-party data providers for direct marketing, and recipients of such communications may opt out at any time. We may share conversion event data with advertising attribution and measurement services to assess the effectiveness of our marketing. You may opt out of all advertising-related data sharing by submitting an opt-out request pursuant to Section 10; opting out will not affect your ability to purchase from us.

6.3 Government Authorities and Law Enforcement

We disclose personal information to government agencies, regulators, law enforcement, and courts as required by applicable federal and state law, including BSA and AML reporting and OFAC compliance. Federal law may prohibit disclosure to you of certain reports filed. See Section 7.

6.4 Business Transfers

In the event of a merger, acquisition, or sale of all or substantially all of our assets, your personal information may be transferred to a successor entity. We will provide advance notice and describe your options before any such transfer becomes effective.

6.5 Protection of Legal Rights

We may disclose personal information to enforce our Terms of Use and Sale, prevent fraud, protect customer or public safety, or protect the legal rights or property of Lattice Metals LLC.

7. Federal Anti-Money Laundering Obligations and the Limits of State Privacy Rights

Mandatory Recordkeeping. All transaction records, including your name, shipping address, sending blockchain wallet address, transaction hash, stablecoin type and amount, order details, and OFAC screening results, are retained for a minimum of five (5) years from the date of the applicable transaction as required by 31 CFR Part 1010. This retention period cannot be shortened by any deletion request submitted under state law.

Suspicious Activity Report Confidentiality. Federal law (31 U.S.C. § 5318(g)(2)) prohibits us from disclosing to any person that a Suspicious Activity Report has been filed. We are legally required to refuse to confirm or deny the existence of any SAR, and any request seeking this information will be declined regardless of its basis.

Currency Transaction Report Filing. Transactions in excess of ten thousand dollars ($10,000) in cash-equivalent value are subject to mandatory Currency Transaction Report filing with FinCEN. These filings cannot be suppressed or withheld at consumer request.

OFAC Blocked Transaction Reporting. If your wallet address or name matches an OFAC sanctions list entry, we are required to block the transaction, freeze associated funds, and file a Blocked Transaction Report with OFAC within ten (10) business days. Such records are subject to mandatory five-year retention and cannot be deleted pursuant to any privacy rights request.

Government Access. Records retained pursuant to the Bank Secrecy Act and OFAC regulations may be accessed by federal or state law enforcement and regulatory authorities without your consent, and in many cases without advance notice to you.

Effect on Privacy Rights. When you submit a deletion, access, or correction request under applicable state law, we will honor it to the maximum extent permitted. BSA-mandated records will be identified and placed on legal hold. We will inform you that such records cannot be deleted until the mandatory retention period expires. This constitutes a disclosure of a legal limitation, not a denial of your rights.

8. Data Security

We maintain a comprehensive written data security program consistent with our obligations under the New York SHIELD Act and the security requirements imposed by other applicable state laws. Our measures include encrypted storage for all personal information at rest; encrypted transmission using TLS/HTTPS; access controls restricting internal data access to authorized personnel; written data processing agreements with service providers requiring appropriate security standards; incident response procedures for detection, containment, investigation, and notification; and designated personnel responsible for our privacy and data security program.

In the event of a security breach involving your personal information that triggers notification obligations under applicable state breach notification law, we will notify affected individuals and all required regulatory agencies within the timeframes mandated by each applicable state law.

9. Data Retention

We retain personal information only for as long as necessary to fulfill the purposes for which it was collected, to comply with our legal obligations, to resolve disputes, and to enforce our agreements. Transaction records subject to mandatory AML retention are held for a minimum of five (5) years from the date of the transaction and are not subject to deletion requests. Customer and marketing contact data is retained while you are an active customer or have not opted out, and for up to three (3) years following your last interaction or purchase, whichever is later. Advertising and behavioral data collected through cookies and tracking technologies is retained for up to twenty-four (24) months from the date of collection, after which it is deleted or aggregated into anonymized datasets. Third-party lead data is retained for up to twelve (12) months from acquisition unless you make a purchase, in which case your record is governed by the customer retention period above, or unless you opt out, in which case we delete your information within thirty (30) days. Site log data is retained for up to twelve (12) months, then deleted or permanently anonymized. Customer service communications are retained for three (3) years from the date of the communication, or longer if required for an open dispute or legal claim. Upon expiration of applicable retention periods, to the extent not subject to a mandatory legal hold, we securely delete or irreversibly anonymize personal information.

10. Universal Privacy Rights Extended to All U.S. Residents

Regardless of your state of residence, Lattice Metals voluntarily extends the following baseline privacy rights to all U.S. customers. These rights are subject to the federal AML limitations in Section 7 and to verification of your identity before we process any request.

You have the right to know and access the categories and specific pieces of personal information we have collected about you, the sources from which we collected it, the purposes for which we use it, and the categories of third parties to whom we have disclosed it, including advertising and lead data partners. You have the right to correct inaccurate personal information we hold about you. You have the right to request deletion of personal information we hold about you; we will delete all information within our legal authority and identify any records subject to a mandatory legal retention hold. You have the right to opt out of the sale of your personal information and the sharing of your personal information for cross-context behavioral advertising or targeted advertising purposes, including data shared with advertising platforms, data brokers, and lookalike audience programs; we will process opt-out requests within fifteen (15) business days. You have the right to opt out of email marketing and direct marketing at any time by using the unsubscribe link in any marketing communication or by contacting hello@latticemetals.com. If we acquired your information from a third-party lead provider and you have not previously purchased from us, you have the right to request that we cease use of your information and delete it from our systems within thirty (30) days. You have the right to data portability in a common machine-readable format to the extent technically feasible and not subject to a mandatory legal hold. You will not be denied products or services, charged different prices, or receive a lower quality of service because you exercised any right described in this Policy.

To exercise any of these rights, submit a written request to hello@latticemetals.com, Subject: “Privacy Rights Request,” including your full name, email address on file, state of residence, and the specific right you wish to exercise. We will verify your identity and respond within forty-five (45) calendar days unless a shorter period is required by your state’s law. Authorized agents must provide written authorization.

11. Children’s Privacy

The Site is not directed to individuals under the age of eighteen (18). We do not knowingly collect personal information from minors. We do not sell or share personal information of any consumer known or reasonably known to be under the age of sixteen (16). We do not target advertising at minors and will suppress any individual confirmed to be a minor from our advertising audiences, lead lists, and marketing communications. If we learn that we have collected personal information from a minor, we will promptly delete it.

12. State-Specific Supplemental Privacy Disclosures

The following subsections address the supplemental privacy rights of residents of states with enacted consumer privacy laws. All rights described below are subject to the federal AML limitations in Section 7, which are incorporated into each subsection by this reference. All rights requests must be submitted per the process described in Section 10. We honor these rights regardless of whether our processing activities exceed any statutory applicability threshold; we treat privacy compliance as a baseline obligation owed to all customers.

12.1 California Residents

If you are a California resident, the California Consumer Privacy Act and California Privacy Rights Act (CCPA/CPRA) grant you the following rights. You have the right to know the categories and specific pieces of personal information we have collected about you, the categories of sources, the business purposes for collection, and the categories of third parties with whom we have shared it, including advertising and lead data partners. You have the right to request deletion of personal information we hold about you, subject to statutory exceptions including our AML retention requirements. You have the right to request correction of inaccurate personal information we maintain. You have the right to opt out of the sale or sharing of your personal information, including through our advertising and lookalike audience programs; you may exercise this right by submitting a request to hello@latticemetals.com or by enabling the Global Privacy Control in your browser, which we recognize as a legally sufficient opt-out signal under the CPRA. You have the right to limit our use of sensitive personal information to purposes specifically permitted by the CPRA. You will not be discriminated against for exercising any CCPA/CPRA right.

We respond to verifiable consumer requests within forty-five (45) days, extendable by forty-five (45) additional days with notice. You may designate an authorized agent to submit requests on your behalf with written authorization. To the extent we disclose personal information to third parties for their direct marketing purposes, you may request information about those disclosures under California Civil Code § 1798.83 by contacting hello@latticemetals.com, Subject: “California Shine the Light Request.”

Submit California requests to: hello@latticemetals.com, Subject: “California Privacy Request CCPA.”

12.2 New York Residents

If you are a New York resident, your data security is protected under the New York SHIELD Act, which requires us to maintain a comprehensive data security program as described in Section 8. In the event of a breach of your private information, we will notify you and the required state agencies, including the New York Attorney General, Department of State, and Division of State Police, without unreasonable delay. You have the right to confirm whether we hold personal information about you and to access it; the right to request correction of inaccurate personal information; the right to request deletion of personal information we hold about you, subject to the AML limitations in Section 7; and the right to opt out of targeted advertising and all data sharing with advertising partners.

Submit New York requests to: hello@latticemetals.com, Subject: “New York Privacy Request.”

12.3 Colorado Residents

If you are a Colorado resident, the Colorado Privacy Act grants you the right to confirm whether we are processing your personal data and to access it; the right to request correction of inaccuracies; the right to request deletion of personal data you provided or that we collected about you; the right to obtain a portable copy of your personal data; and the right to opt out of the processing of your personal data for targeted advertising, sale, and profiling in furtherance of decisions with legal or significant effects. You may exercise your opt-out right by contacting us or by enabling the Global Privacy Control in your browser, which we recognize as a legally sufficient opt-out signal. If we deny your request, you may appeal in writing within a reasonable period; we will respond within forty-five (45) days, and denied appeals may be reported to the Colorado Attorney General.

Submit Colorado requests to: hello@latticemetals.com, Subject: “Colorado Privacy Request CPA.”

12.4 Connecticut Residents

If you are a Connecticut resident, the Connecticut Data Privacy Act grants you the right to confirm whether we process your personal data and access it; the right to request correction; the right to request deletion; the right to obtain a portable copy of your personal data; and the right to opt out of the processing of your personal data for targeted advertising, sale, and profiling. You may exercise your opt-out right by contacting us or by enabling the Global Privacy Control in your browser. If we deny your request, you may appeal in writing within sixty (60) days; we will respond within sixty (60) days, and denied appeals may be reported to the Connecticut Attorney General.

Submit Connecticut requests to: hello@latticemetals.com, Subject: “Connecticut Privacy Request CTDPA.”

12.5 Delaware Residents

If you are a Delaware resident, the Delaware Personal Data Privacy Act grants you the right to confirm whether we process your personal data and access it; the right to request correction; the right to request deletion; the right to obtain a portable copy of your personal data; and the right to opt out of the processing of your personal data for targeted advertising, sale, and profiling. If we deny your request, you may appeal in writing within a reasonable period; we will respond within forty-five (45) days and may extend by up to sixty (60) additional days with notice. Denied appeals may be reported to the Delaware Department of Justice.

Submit Delaware requests to: hello@latticemetals.com, Subject: “Delaware Privacy Request DPDPA.”

12.6 Florida Residents

If you are a Florida resident, the Florida Digital Bill of Rights grants you the right to confirm whether we process your personal data and access it; the right to request correction of inaccurate personal data; the right to request deletion of personal data we hold about you; and the right to opt out of the processing of your personal data for targeted advertising, sale, and profiling. You may also appeal any denial of a rights request by submitting a written appeal to hello@latticemetals.com; we will respond within forty-five (45) days, and denied appeals may be reported to the Florida Attorney General.

Submit Florida requests to: hello@latticemetals.com, Subject: “Florida Privacy Request FDBR.”

12.7 Indiana Residents

If you are an Indiana resident, the Indiana Consumer Data Protection Act grants you the right to confirm whether we process your personal data and access it; the right to request correction; the right to request deletion; the right to obtain a portable copy of your personal data; and the right to opt out of the processing of your personal data for targeted advertising, sale, and profiling in furtherance of decisions with legal or significant effects. If we deny your request, you may appeal in writing within a reasonable period; we will respond within forty-five (45) days, extendable with notice, and denied appeals may be reported to the Indiana Attorney General.

Submit Indiana requests to: hello@latticemetals.com, Subject: “Indiana Privacy Request ICDPA.”

12.8 Iowa Residents

If you are an Iowa resident, the Iowa Consumer Data Protection Act grants you the right to confirm whether we process your personal data and access it; the right to request deletion of personal data you provided directly to us; the right to obtain a portable copy of personal data you provided to us; and the right to opt out of the sale of personal data and the processing of personal data for targeted advertising. We voluntarily extend to Iowa residents the right to correct inaccurate personal data and a broader deletion right covering all personal data we hold about you, as part of our Universal Rights in Section 10.

Submit Iowa requests to: hello@latticemetals.com, Subject: “Iowa Privacy Request ICDPA.”

12.9 Kentucky Residents

If you are a Kentucky resident, the Kentucky Consumer Data Protection Act grants you the right to confirm whether we process your personal data and access it; the right to request correction; the right to request deletion; the right to obtain a portable copy of your personal data; and the right to opt out of the processing of your personal data for targeted advertising, sale, and profiling in furtherance of decisions with significant effects. If we deny your request, you may appeal in writing within a reasonable period; we will respond within forty-five (45) days, extendable with notice, and denied appeals may be reported to the Kentucky Attorney General.

Submit Kentucky requests to: hello@latticemetals.com, Subject: “Kentucky Privacy Request KCDPA.”

12.10 Maryland Residents

If you are a Maryland resident, the Maryland Online Data Privacy Act grants you the right to confirm whether we process your personal data and access it; the right to request correction; the right to request deletion; the right to obtain a portable copy of your personal data; and the right to opt out of the processing of your personal data for targeted advertising, sale, and profiling in furtherance of decisions with legal or significant effects. Maryland law imposes strict data minimization requirements; we represent that we collect only personal data reasonably necessary for the purposes disclosed in this Policy. Maryland law prohibits the sale of sensitive personal data, and we do not sell any personal data. We will respond within sixty (60) days, extendable by thirty (30) additional days with notice. If we deny your request, you may appeal in writing; we will respond to your appeal within thirty (30) days, and denied appeals may be reported to the Maryland Attorney General.

Submit Maryland requests to: hello@latticemetals.com, Subject: “Maryland Privacy Request MODPA.”

12.11 Minnesota Residents

If you are a Minnesota resident, the Minnesota Consumer Data Privacy Act grants you the right to confirm whether we process your personal data and access it; the right to request correction; the right to request deletion; the right to obtain a portable copy of your personal data; the right to opt out of the processing of your personal data for targeted advertising, sale, and profiling in furtherance of decisions with legal or significant effects; and the right to request an explanation of any profiling decision that produced legal or significant effects concerning you, which right we will honor to the extent our processing includes any such automated decision-making. If we deny your request, you may appeal in writing; we will respond within forty-five (45) days, extendable with notice, and denied appeals may be reported to the Minnesota Attorney General.

Submit Minnesota requests to: hello@latticemetals.com, Subject: “Minnesota Privacy Request MCDPA.”

12.12 Montana Residents

If you are a Montana resident, the Montana Consumer Data Privacy Act grants you the right to confirm whether we process your personal data and access it; the right to request correction; the right to request deletion; the right to obtain a portable copy of your personal data; and the right to opt out of the processing of your personal data for targeted advertising, sale, and profiling. If we deny your request, you may appeal in writing; we will respond within forty-five (45) days, extendable with notice, and denied appeals may be reported to the Montana Attorney General.

Submit Montana requests to: hello@latticemetals.com, Subject: “Montana Privacy Request MCDPA.”

12.13 Nebraska Residents

If you are a Nebraska resident, the Nebraska Data Privacy Act grants you the right to confirm whether we process your personal data and access it; the right to request correction; the right to request deletion; the right to obtain a portable copy of your personal data; and the right to opt out of the processing of your personal data for targeted advertising, sale, and profiling. If we deny your request, you may appeal in writing; we will respond within forty-five (45) days, and denied appeals may be reported to the Nebraska Attorney General.

Submit Nebraska requests to: hello@latticemetals.com, Subject: “Nebraska Privacy Request NDPA.”

12.14 New Hampshire Residents

If you are a New Hampshire resident, the New Hampshire Privacy Act grants you the right to confirm whether we process your personal data and access it; the right to request correction; the right to request deletion; the right to obtain a portable copy of your personal data; and the right to opt out of the processing of your personal data for targeted advertising, sale, and profiling. If we deny your request, you may appeal in writing; we will respond within forty-five (45) days, and denied appeals may be reported to the New Hampshire Attorney General.

Submit New Hampshire requests to: hello@latticemetals.com, Subject: “New Hampshire Privacy Request NHPA.”

12.15 New Jersey Residents

If you are a New Jersey resident, the New Jersey Data Protection Act grants you the right to confirm whether we process your personal data and access it; the right to request correction; the right to request deletion; the right to obtain a portable copy of your personal data; and the right to opt out of the processing of your personal data for targeted advertising, sale, and profiling. If we deny your request, you may appeal in writing; we will respond within forty-five (45) days, and denied appeals may be referred to the New Jersey Division of Consumer Affairs.

Submit New Jersey requests to: hello@latticemetals.com, Subject: “New Jersey Privacy Request NJDPA.”

12.16 Oklahoma Residents

Oklahoma’s Consumer Privacy Law was signed on March 20, 2026. Implementing regulations and effective date are pending as of the date of this Policy. In the interim, Oklahoma residents may exercise all Universal Rights described in Section 10, including the right to opt out of targeted advertising and data sharing with advertising partners. We will update this section with full implementing disclosures upon the law’s effective date.

Submit Oklahoma requests to: hello@latticemetals.com, Subject: “Oklahoma Privacy Request OCPL.”

12.17 Oregon Residents

If you are an Oregon resident, the Oregon Consumer Privacy Act as amended effective January 1, 2026 grants you the right to confirm whether we process your personal data and access it; the right to request correction; the right to request deletion; the right to obtain a portable copy of your personal data; and the right to opt out of the processing of your personal data for targeted advertising, sale, and profiling. Oregon’s 2026 amendments prohibit the sale of precise geolocation data and personal data of consumers under sixteen (16); we comply with both requirements. You may exercise your opt-out right by enabling the Global Privacy Control in your browser, which we recognize as a valid opt-out signal under Oregon law. If we deny your request, you may appeal in writing; we will respond within forty-five (45) days, and denied appeals may be reported to the Oregon Attorney General.

Submit Oregon requests to: hello@latticemetals.com, Subject: “Oregon Privacy Request OCPA.”

12.18 Rhode Island Residents

If you are a Rhode Island resident, the Rhode Island Data Transparency and Privacy Protection Act grants you the right to confirm what personal data we hold about you and access it; the right to request correction; the right to request deletion of personal data you provided directly to us; and the right to opt out of the sale of personal data and the processing of personal data for targeted advertising. We voluntarily extend a broader deletion right to Rhode Island residents covering all personal data we hold about you, as part of our Universal Rights in Section 10.

Submit Rhode Island requests to: hello@latticemetals.com, Subject: “Rhode Island Privacy Request RIDTPPA.”

12.19 Tennessee Residents

If you are a Tennessee resident, the Tennessee Information Protection Act grants you the right to confirm whether we process your personal data and access it; the right to request correction; the right to request deletion; the right to obtain a portable copy of your personal data; and the right to opt out of the processing of your personal data for targeted advertising, sale, and profiling.

Submit Tennessee requests to: hello@latticemetals.com, Subject: “Tennessee Privacy Request TIPA.”

12.20 Texas Residents

If you are a Texas resident, the Texas Data Privacy and Security Act grants you the right to confirm whether we process your personal data and access it; the right to request correction; the right to request deletion; the right to obtain a portable copy of your personal data; and the right to opt out of the processing of your personal data for targeted advertising, sale, and profiling. The Texas Data Privacy and Security Act is enforced exclusively by the Texas Attorney General; no private right of action exists under the statute.

Submit Texas requests to: hello@latticemetals.com, Subject: “Texas Privacy Request TDPSA.”

12.21 Utah Residents

If you are a Utah resident, the Utah Consumer Privacy Act grants you the right to confirm whether we process your personal data and access it; the right to request deletion of personal data you provided directly to us; the right to obtain a portable copy of personal data you provided to us; and the right to opt out of the sale of personal data and the processing of personal data for targeted advertising. We voluntarily extend to Utah residents the right to correct inaccurate personal data and a broader deletion right covering all personal data we hold about you, as part of our Universal Rights in Section 10.

Submit Utah requests to: hello@latticemetals.com, Subject: “Utah Privacy Request UCPA.”

12.22 Virginia Residents

If you are a Virginia resident, the Virginia Consumer Data Protection Act grants you the right to confirm whether we process your personal data and access it; the right to request correction; the right to request deletion; the right to obtain a portable copy of your personal data; and the right to opt out of the processing of your personal data for targeted advertising, sale, and profiling in furtherance of decisions with legal or similarly significant effects. If we deny your request, you may appeal in writing within a reasonable period; we will respond within sixty (60) days, and denied appeals may be reported to the Virginia Attorney General.

Submit Virginia requests to: hello@latticemetals.com, Subject: “Virginia Privacy Request VCDPA.”

12.23 Residents of States Without Comprehensive Privacy Legislation

As of March 30, 2026, the following states have not enacted a comprehensive consumer privacy law: Alabama, Alaska, Arizona, Arkansas, Georgia, Hawaii, Idaho, Illinois, Kansas, Louisiana, Maine, Massachusetts, Michigan, Mississippi, Missouri, Nevada, North Carolina, North Dakota, Ohio, Pennsylvania, South Carolina, South Dakota, Washington (which has enacted health-data-specific legislation only), West Virginia, Wisconsin, and Wyoming.

Residents of these states are not without protection. All residents are entitled to the Universal Rights described in Section 10, including the right to opt out of targeted advertising and all data sharing with advertising partners; protections under their state’s breach notification law; FTC Act prohibitions on unfair or deceptive data practices; and applicable federal sector-specific privacy protections. We apply consistent privacy and advertising opt-out practices to all U.S. customers regardless of state law status.

Submit requests to: hello@latticemetals.com, Subject: “Privacy Request — [Your State].”

13. Data Breach Notification

In the event of a security breach involving your personal information, we will notify affected individuals in accordance with applicable state breach notification law. Every U.S. state has enacted a breach notification statute, and our procedures are designed to satisfy all applicable state requirements concurrently. Notification will generally be provided by email to the address on file, or by a substitute method permitted by applicable law. Notifications to state attorneys general, regulatory agencies, and consumer reporting agencies will be completed as required by each applicable state law.

14. Third-Party Sites, Advertising Platforms, and Blockchain Infrastructure

The Site links to and interacts with third-party platforms including advertising networks, blockchain networks, stablecoin issuers, and wallet providers, each of which is governed by its own privacy policy. We are not responsible for the privacy practices of any third party. We encourage you to review the privacy policies of Google, Meta, Circle (USDC), PayPal/Paxos (PYUSD), Chainalysis, and any wallet provider or advertising platform you interact with.

Blockchain transactions are recorded on public, immutable ledgers. Once your payment transaction is broadcast to a blockchain network, the transaction data, including sending and receiving wallet addresses, amounts, and timestamps, becomes permanently visible on the public blockchain and is outside our ability to alter or delete. When we share data with advertising platforms such as Google and Meta for custom audience or lookalike audience programs, that data becomes subject to those platforms’ own terms of service and privacy policies, and you may manage your advertising preferences directly through those platforms.

15. Changes to This Policy

We review and update this Policy at least annually and following the enactment of any new state privacy law, significant regulatory development, or material change to our data practices, particularly changes that expand our advertising data practices or the categories of third parties with whom we share personal information. We will post the revised Policy with an updated Last Updated date. For material changes, we will provide advance notice by email to customers with a transaction on record within the preceding twelve (12) months and/or via prominent notice on the Site. Your continued use of the Site following posting of an updated Policy constitutes acceptance of the revised terms.

16. Contact Information

For all privacy inquiries, rights requests, advertising opt-outs, or questions about this Policy, contact us at:

Lattice Metals LLC
Attn: Privacy and Compliance Officer
hello@latticemetals.com
latticemetals.com/privacy

When submitting a request, include your full name, email address on file, state of residence, and the specific right you wish to exercise, including if you are opting out of targeted advertising, data sharing with advertising partners, or marketing communications. We verify your identity before processing any request. Authorized agents must provide written authorization and be subject to identity verification.

This Privacy Policy is incorporated into and forms part of the Lattice Metals LLC Terms of Use and Sale. Continued use of the Site constitutes acceptance of this Policy.