Privacy Policy

Medaleon Investment Group ("Medaleon," "we," "us," or "our") respects your privacy and is committed to protecting the personal and financial information you share with us. This Privacy Policy explains what information we collect, how we use and protect it, and the choices and rights you have. It applies to our website, client portal, and related services (the "Services").

1. Information We Collect

We collect the following categories of information:

• Information you provide: name, email address, phone number, mailing address, and account or investment details you submit when you register, communicate with us, or use the Services.
• Financial account information (via Plaid): when you choose to connect a bank account, our third-party provider Plaid Inc. ("Plaid") securely retrieves information such as account name, account type, the last four digits of the account number, and account balances. This connection is read-only — Medaleon cannot move, transfer, or withdraw funds through it.
• Technical and usage information: log data, IP address, browser type, and activity within the Services, collected to operate and secure the platform.

2. How We Use Your Information

• To provide, maintain, and improve the Services, including displaying account balances and portfolio information you have chosen to connect.
• To communicate with you about your account, transactions, and support requests.
• To secure our systems, prevent fraud, and comply with legal and regulatory obligations.

3. Plaid

We use Plaid to connect your financial accounts. By using the connection feature, you also agree to Plaid's privacy practices. You can review Plaid's End User Privacy Policy at plaid.com/legal. Plaid handles your bank credentials directly through its own secure interface; Medaleon never sees or stores your online banking username or password.

4. How We Share Information

We do not sell your personal information, and we do not share your information with third parties for their own purposes. We never sell or share any information from our users with advertisers, data brokers, or any other party for marketing or other independent use. The only parties that ever access your information are:

• the service providers that operate the platform on our behalf (for example, our hosting provider and Plaid), which are bound to safeguard your data and may use it only to provide our Services to you; and
• authorities or others where disclosure is required by law, regulation, subpoena, or other legal process, or is necessary to protect the rights, safety, and property of Medaleon, our clients, or others.

5. How We Protect Your Information

• Encryption in transit: data exchanged between your browser and our servers is protected with TLS 1.2 or higher.
• Encryption at rest: sensitive financial data we store, including data received from Plaid, is encrypted using AES-256 with keys held outside the public web directory.
• Access controls: administrative access to client data requires authenticated accounts protected by two-factor authentication (2FA), and credentials are stored only as salted hashes.

6. Data Retention and Deletion

We retain personal and financial information only for as long as necessary to provide the Services and to meet legal, accounting, and regulatory requirements. When information is no longer needed, we delete or de-identify it. You may request deletion of your data as described below, subject to any records we are legally required to keep. This policy is reviewed periodically.

7. Your Rights and Choices

Depending on your location, you may have the right to request access to, correction of, or deletion of the personal information we hold about you, and to withdraw a bank-account connection at any time. To exercise these rights, contact us using the details below. We will verify your identity and respond within the timeframe required by applicable law.

8. Consent

By using the Services and by connecting a financial account, you consent to the collection, processing, and storage of your information as described in this policy. You may withdraw your consent at any time by disconnecting your account or contacting us; this will not affect processing carried out before withdrawal.

9. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date above and, where appropriate, notify you.

10. Contact Us

If you have questions about this Privacy Policy or wish to exercise your rights, contact us at:

Medaleon Investment Group
1395 Brickell Ave, Suite 900, Miami, FL 33131
Email: privacy@medaleon.com