This Privacy Policy describes how Onrail Inc., a Delaware corporation (“Onrail,” “we,” “us,” or “our”), and its affiliates (including Onrail SPV LLC, a Delaware series limited liability company, each of its series, and any other special purpose vehicle managed or sponsored by Onrail from time to time, each an “Issuer”) collect, use, share, and protect personal information when you access or use our website at https://onrail.xyz and its subdomains, our investor application at https://app.onrail.xyz, and the related applications, application programming interfaces, smart contracts, and services we make available (together, the “Platform”).
Our loan underwriting application for originators at https://underwriter.onrail.xyz is governed by the Onrail Underwriter Platform Terms and is not part of the Platform for purposes of this Privacy Policy. Section 8 describes how we handle information about borrowers and guarantors of the loans we hold.
This Privacy Policy is incorporated into our Terms of Service and applies in addition to any privacy or confidentiality provisions in the Offering Documents (as defined in the Terms of Service). Capitalized terms not defined in this Privacy Policy have the meanings given to them in the Terms of Service.
PLEASE READ THIS PRIVACY POLICY CAREFULLY. BY ACCESSING OR USING THE PLATFORM, YOU ACKNOWLEDGE THAT YOU HAVE READ AND UNDERSTOOD THIS PRIVACY POLICY.
Section 01Scope and Application#
This Privacy Policy applies to personal information that we collect through the Platform and through our other interactions with you, including in connection with marketing, support, identity and accreditation verification, and the administration of investments in tokenized notes (the “Notes”) and the digital tokens that represent them (the “Tokens”). It does not apply to information collected or processed by third parties whose services we link to or interoperate with (such as Wallet providers, custodians, stablecoin issuers, and blockchain networks), whose practices are governed by their own privacy policies.
For information that is subject to the Gramm-Leach-Bliley Act (“GLBA”) and its implementing regulations, the additional notice in Section 18 (Financial Privacy Notice) controls in the event of any conflict with this Privacy Policy.
Section 02Information We Collect#
2.1Information You Provide Directly#
We collect personal information that you submit to us when you use the Platform, including:
Identification information, such as your full legal name, date of birth, photograph, government-issued identification (including passport, driver’s license, or national identity card numbers and images), nationality, and signature;
Contact information, such as your email address, physical address, and telephone number;
Tax information, such as your taxpayer identification number, social security number, and IRS Forms W-9, W-8BEN, or W-8BEN-E and supporting information;
Financial and accreditation information, such as employment information, income, net worth, sources of funds and wealth, your responses to our investor qualification questionnaire, and any supporting documents or third-party verification letters (for example, from a licensed attorney, certified public accountant, registered broker-dealer, or registered investment adviser) that you provide to establish your eligibility to invest;
Beneficial ownership and entity information, where you participate through an entity, including organizational documents, ownership charts, and information about beneficial owners and authorized signatories;
Wallet and on-chain information, including blockchain addresses, transaction histories, and Token holdings;
Communications, such as the content of your emails, support requests, and other correspondence with us;
Account information, such as your login credentials and profile preferences; and
Other information you choose to provide.
2.2Information Collected Automatically#
When you access or use the Platform, we and our service providers automatically collect:
Device and technical information, such as your IP address, device identifier, browser type, operating system, language settings, and time zone;
Usage information, such as the pages and screens you view, the features you use, the dates and times of your access, and the duration of your sessions;
Server and application logs, which record requests to our systems together with IP addresses, device details, account identifiers, wallet addresses, and error information. We keep these logs for a limited period for security, troubleshooting, and performance monitoring; and
Cookies and similar technologies, as described in Section 12.
2.3Information from Third Parties#
We receive personal information about you from third parties, including:
Identity verification, accreditation verification, and know-your-customer providers;
Sanctions, politically exposed person (“PEP”), and adverse media screening providers;
Blockchain analytics and wallet screening providers;
Wallet providers, when you connect a Wallet to the Platform; and
Public sources, including government registries, court records, regulatory databases, and the public blockchains on which the Tokens are recorded.
Section 03KYC, AML, and Investor Verification Information#
To comply with anti-money laundering, counter-terrorist financing, sanctions, and securities laws (including the Bank Secrecy Act, the USA PATRIOT Act, regulations of the Office of Foreign Assets Control, and Rule 506(c) of Regulation D under the Securities Act), we collect, process, and retain identity, accreditation, sanctions-screening, beneficial ownership, source-of-funds, and source-of-wealth information about you. We rely on this information to perform customer due diligence, ongoing monitoring, sanctions screening, and suspicious activity detection, to make filings such as Form D, and to make any other reports that Applicable Law requires or permits.
We retain this information for the longer of (a) the period during which you have an active relationship with us and (b) the period required by Applicable Law, which for most anti-money laundering records is at least five (5) years after our relationship with you ends.
Section 04Biometric Information#
As part of identity verification, our identity verification provider captures a photograph or short video of your face and compares it to the photograph on your government-issued identification, and may perform a liveness check. This process may involve the creation of a facial geometry scan or similar biometric identifier as defined under the laws of certain states, including Illinois, Texas, and Washington.
We and our provider use biometric information only to verify your identity, to prevent fraud, and to meet our legal obligations. We do not sell, lease, or trade biometric information, and we do not use it for any other purpose. We obtain your consent before biometric information is captured. Biometric identifiers are permanently destroyed when the purpose for collecting them has been satisfied, and in any event no later than three (3) years after your last interaction with us, unless Applicable Law requires a longer retention period. Copies of your identification document and facial image that are not biometric identifiers are retained as described in Sections 3 and 14.
Section 05Automated Screening#
We use automated tools to verify identity documents, match facial images to identification photographs, screen names against sanctions and PEP lists, and assess the risk of Wallet addresses based on their on-chain history. The results of these checks may cause your onboarding or a transaction to be delayed, referred for manual review, or declined. If you believe an automated result is wrong, you may contact us at the addresses in Section 22 and request that a member of our team review it.
Section 06Blockchain Data and On-Chain Considerations#
Blockchain transactions are public, immutable, and cannot be deleted. Personal information that becomes associated with a blockchain address may remain publicly available indefinitely.
The Tokens are recorded on a public distributed ledger (such as Ethereum) that functions as the official record of ownership. When you connect a Wallet to the Platform, when we issue, redeem, or transfer Tokens, when distributions are made in USDC, and when Smart Contracts otherwise act upon your Wallet address, transaction data (including the Wallet addresses involved, transaction amounts, timestamps, and Smart Contract function calls) is recorded on the relevant blockchain and may be publicly viewable. Although blockchain addresses are pseudonymous, the combination of blockchain data with information held by us, by exchanges, by Wallet providers, by blockchain analytics providers, or by public sources can re-identify individuals.
Because of the inherent characteristics of public blockchains, we may not be able to alter, delete, or restrict access to information that has been recorded on a blockchain. Where you exercise rights under applicable privacy laws, we will use reasonable efforts to honor those rights with respect to information in our systems, but we cannot remove or modify information that has been recorded on a third-party blockchain that we do not control.
Section 07Financial Information — GLBA#
Where you interact with us in connection with the offer, sale, or administration of the Notes and Tokens, certain information you provide to us is “nonpublic personal information” under the GLBA. We treat such information as confidential and protect it in accordance with the additional notice set forth in Section 18.
Section 08Information About Borrowers and Guarantors#
Loan originators submit loan files to our Underwriter Platform under written agreements with us. Before an Issuer purchases a loan, we process the information in those files as the originator’s service provider, and the originator’s privacy notice governs. After an Issuer purchases a loan, the Issuer holds the loan file as owner of the loan, and our Privacy Notice for Borrowers and Guarantors, available at https://onrail.xyz/privacy/loan-parties, describes how we use, share, and protect that information.
Investors receive loan-level information about the loans that back their Notes, such as property location, loan amount, terms, valuation, and payment status.
Section 09How We Use Your Information#
We use personal information for the following purposes:
To provide, operate, maintain, secure, and improve the Platform;
To verify your identity, eligibility, accreditation status, and beneficial ownership, and to perform sanctions, PEP, and adverse media screening;
To facilitate the issuance, settlement, transfer, redemption, and servicing of the Notes and Tokens, including by transmitting necessary information to our Issuers, fund administrator, blockchain participants, and other counterparties;
To process payments, distributions, and other transactions, and to maintain records of those transactions;
To communicate with you about your Account, transactions, security alerts, support requests, and other administrative matters;
To send marketing communications about our products and services, subject to your right to opt out at any time;
To detect, investigate, prevent, and respond to fraud, abuse, security incidents, and other illegal or unauthorized activity;
To comply with Applicable Law and to respond to lawful requests from regulatory authorities, law enforcement, and other governmental authorities;
To enforce our Terms of Service, the Offering Documents, and our other agreements with you; to protect the rights, property, or safety of us, our affiliates, our users, or any other person; and to establish, exercise, or defend legal claims; and
For other purposes for which we obtain your consent or that are compatible with the purposes described above.
Section 10Legal Bases for Processing#
Where applicable privacy laws require us to identify a legal basis for processing your personal information, we rely on the following legal bases, as relevant: (a) performance of a contract with you (for example, providing the Platform and administering your investment); (b) compliance with a legal obligation (for example, anti-money laundering, sanctions, and securities reporting); (c) our legitimate interests in operating, securing, and improving the Platform and our business, in marketing our products and services, and in protecting our and others’ rights; and (d) your consent, where required.
Section 11How We Share Your Information#
11.1Affiliates and Issuers#
With Onrail’s affiliates, including each Issuer, for the purposes described in this Privacy Policy.
11.2Service Providers#
With third-party service providers that perform services on our behalf, including:
Identity verification, accreditation verification, anti-money laundering, and sanctions screening providers;
Blockchain analytics, wallet screening, and transaction monitoring providers;
Our fund administrator, which maintains the register of Note holders and processes subscriptions, redemptions, and distributions;
Electronic signature and document management providers;
Cloud hosting, data storage, and infrastructure providers;
Application monitoring, logging, and security providers;
Stablecoin issuers (including Circle Internet Financial, LLC, the issuer of USDC), custodians, and other digital asset infrastructure providers;
Wallet connection and on-chain infrastructure providers;
Email, communications, and customer support providers;
Website analytics providers; and
Professional advisers, including attorneys, accountants, and auditors.
We require our service providers to use personal information only for the purposes for which we engage them and to maintain appropriate confidentiality and security measures. A current list of our principal service providers is available on request from privacy@onrail.xyz.
11.3Counterparties#
With indenture trustees, paying agents, and other counterparties to the extent necessary to issue, hold, service, transfer, redeem, or administer the Notes and the Tokens or to comply with the Offering Documents.
11.4Legal and Regulatory Disclosures#
With governmental authorities, regulators, courts, law enforcement, and other third parties where we believe in good faith that disclosure is required or permitted by Applicable Law, including in response to subpoenas, court orders, regulatory examinations, and filings and reports required under securities and anti-money laundering laws.
11.5Business Transactions#
In connection with a merger, acquisition, financing, reorganization, sale of assets, or other business transaction, in which case personal information may be transferred to the relevant parties and their advisers as part of the transaction or due diligence process.
11.6With Your Consent#
For any other purpose disclosed to you at the time of collection or with your consent.
Except as described in this Privacy Policy or in the Financial Privacy Notice in Section 18, we do not sell personal information or share it for cross-context behavioral advertising as those terms are defined under California law.
Section 12Cookies and Similar Technologies#
We and our service providers use cookies and similar technologies (“Cookies”) to operate, secure, analyze, and improve the Platform. We use:
Strictly necessary Cookies that are required for the Platform to function (for example, to authenticate you and to maintain your session);
Functional Cookies that remember your preferences and settings; and
Analytics Cookies that help us understand how the Platform is used so that we can improve it.
We do not use Cookies for advertising. You can manage Cookies through your browser settings and, where applicable, through any cookie banner or preference center we make available on the Platform. Disabling Cookies may impair the functioning of the Platform. We do not currently respond to browser “Do Not Track” signals.
Section 13Marketing Communications#
We may send you marketing communications about our products and services that we believe may be of interest to you, subject to your opt-out preferences. You can opt out by following the unsubscribe instructions in the relevant communication or by contacting us at the addresses set forth in Section 22. Opting out will not affect transactional, account-related, or legally required communications.
Section 14Data Retention#
We retain personal information for as long as necessary to fulfill the purposes for which it was collected, including for the duration of your relationship with us, to comply with our legal, regulatory, accounting, tax, and reporting obligations, to resolve disputes, and to enforce our agreements. In particular, we retain:
Anti-money laundering and customer due diligence records for at least five (5) years after our relationship with you ends, or longer where required;
Records related to the offering of the Notes in accordance with the Securities Act, the Securities Exchange Act, and applicable state securities laws;
Tax records for the periods required under applicable tax law;
Biometric information as described in Section 4; and
Server and application logs for a limited period, typically measured in weeks or months, unless we need to keep specific records longer to investigate a security incident or to comply with a legal obligation.
When we no longer need personal information, we will securely delete or anonymize it, except to the extent we are required to retain it by Applicable Law.
Section 15Data Security#
We maintain administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, use, alteration, disclosure, or destruction, and we require our service providers to maintain reasonable security measures. These safeguards include, where appropriate, encryption in transit and at rest, access controls based on least privilege, multi-factor authentication, secure software development practices, monitoring and logging, independent audits of our smart contracts, vulnerability management, and employee training. No method of transmission over the internet or method of electronic storage is, however, completely secure, and we cannot guarantee absolute security. You are responsible for safeguarding your Account credentials and the cryptographic keys controlling your Wallet.
Section 16International Transfers#
We are based in the United States, and the personal information we collect is processed in the United States and in any other country where we or our service providers maintain operations. If you access the Platform from outside the United States, your information may be transferred to, stored in, and processed in jurisdictions that may have data protection laws that are different from those of your jurisdiction. Where required by Applicable Law, we implement appropriate safeguards (such as standard contractual clauses) in connection with such transfers.
Section 17Your Rights and Choices#
17.1General Rights#
Subject to certain exceptions and limitations under Applicable Law, you may have rights to (a) request access to the personal information we hold about you; (b) request that we correct inaccurate or incomplete personal information; (c) request that we delete certain personal information; (d) request that we restrict or object to certain processing; (e) receive a copy of certain personal information in a portable format; and (f) withdraw any consent that you have previously provided. You may also have the right to lodge a complaint with a data protection or other regulatory authority.
17.2California (CCPA/CPRA)#
If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, the “CCPA”), provides you with the following rights, subject to certain exceptions:
The right to know the categories of personal information we have collected about you, the categories of sources, the business or commercial purposes for which we use that information, the categories of third parties with whom we share it, and the specific pieces of personal information we have collected about you;
The right to request deletion of personal information we have collected from you;
The right to request correction of inaccurate personal information;
The right to opt out of any “sale” or “sharing” of personal information for cross-context behavioral advertising (we do not currently sell or share personal information for cross-context behavioral advertising as defined under the CCPA);
The right to limit the use or disclosure of sensitive personal information beyond what is necessary to provide the Platform and to perform the functions permitted under the CCPA; and
The right not to be discriminated against for exercising your CCPA rights.
Personal information that we collect, process, and disclose in connection with our financial services activities is, to the extent it qualifies as nonpublic personal information under the GLBA, generally exempt from certain CCPA requirements. For information about how we collect, use, and share that information, please see the Financial Privacy Notice in Section 18.
17.3Other State Privacy Rights#
If you are a resident of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, or another U.S. state that has enacted a comprehensive consumer privacy law, you may have similar rights to those described above, subject to the exceptions and limitations under the applicable state law. Many of these laws contain broad exemptions for information processed in connection with the GLBA and similar financial-services regimes.
17.4How to Exercise Your Rights#
To exercise any of the rights described in this Section 17, you (or an authorized agent acting on your behalf) may contact us at privacy@onrail.xyz or at the postal address set forth in Section 22. We will need to verify your identity before responding to your request and may require additional information for that purpose. We will respond to verified requests within the timeframes required by Applicable Law.
Section 18Financial Privacy Notice (GLBA)#
This Section 18 constitutes our financial privacy notice required by the Gramm-Leach-Bliley Act and its implementing regulations, as applicable to nonpublic personal information that we collect about you as a consumer or customer of financial products or services.
18.1Information We Collect#
We collect nonpublic personal information about you from (a) information you provide to us on applications, subscription agreements, investor questionnaires, and other forms; (b) information about your transactions with us, our affiliates, and others; and (c) information we receive from consumer reporting agencies, identity verification providers, accreditation verification providers, sanctions and PEP screening providers, and other third parties.
18.2Information We Disclose#
We may disclose nonpublic personal information about you to (a) our affiliates and each Issuer; (b) nonaffiliated third parties that perform services on our behalf (such as identity verification, accreditation verification, anti-money laundering and sanctions screening, fund administration, custody, technology, and professional services providers); (c) governmental authorities and other parties as permitted or required by law (for example, in response to subpoenas, regulatory examinations, and reports required under securities and anti-money laundering laws); and (d) other nonaffiliated third parties with your consent or direction.
18.3Your Right to Opt Out#
We do not share nonpublic personal information about you with nonaffiliated third parties for marketing purposes, and we therefore do not currently offer a GLBA opt-out. If our practices change in the future, we will provide you with a revised notice and an opportunity to opt out before sharing your nonpublic personal information for those purposes.
18.4How We Protect Your Information#
We maintain physical, electronic, and procedural safeguards designed to protect your nonpublic personal information, as described in Section 15. We limit access to nonpublic personal information to employees, contractors, and service providers who need it to provide products or services to you or to perform their duties.
Section 19Children’s Privacy#
The Platform is not directed to, and we do not knowingly collect personal information from, children under the age of eighteen (18). If we learn that we have inadvertently collected personal information from a child under eighteen, we will take steps to delete it as soon as practicable. If you believe that a child under eighteen has provided personal information to us, please contact us using the contact information in Section 22.
Section 20Third-Party Links and Services#
The Platform may contain links to, or interoperate with, third-party websites, applications, blockchains, and services. This Privacy Policy does not apply to those third-party services, and we are not responsible for their content or privacy practices. We encourage you to review the privacy policies of any third-party services you use.
Section 21Changes to This Privacy Policy#
We may update this Privacy Policy from time to time. The “Last Updated” date at the top of this Privacy Policy indicates when it was last revised. We will notify you of material changes by posting the updated Privacy Policy on the Platform and, where appropriate, by providing additional notice (for example, by email). Your continued use of the Platform after the effective date of any changes constitutes your acceptance of the updated Privacy Policy.
Section 22How to Contact Us#
If you have any questions, comments, or complaints about this Privacy Policy or our privacy practices, or if you wish to exercise any of your privacy rights, please contact us at:
Onrail Inc.
Address: 6001 Broken Sound Parkway, Suite 610, Boca Raton, FL 33487, USA
Email: support@onrail.xyz
Legal: legal@onrail.xyz
If you are not satisfied with our response, you may have the right to lodge a complaint with the data protection or consumer protection authority in your jurisdiction.