Privacy Policy

Elagon Inc. (DBA "Netaro") is a Delaware-incorporated financial technology company headquartered in Wilmington, Delaware, USA, with operational presence in GIFT City, Gujarat, India. Netaro is a Registered Money Services Business (MSB) under FinCEN and is actively pursuing VASP, VARA, and Money Transmitter Licenses (MTLs) across relevant jurisdictions.

Netaro provides API-first stablecoin payment infrastructure that enables business clients to execute cross-border fiat settlements using fiat-backed stablecoins (such as USDC) as the underlying settlement rail.

This Privacy Policy applies exclusively to: (a) business entities that have entered into a services agreement with Netaro ("Client(s)"); and (b) authorized representatives of those entities who access Netaro's platform, dashboard, or API. This Policy does NOT apply to retail consumers or individuals seeking personal payment services. Netaro does not offer consumer-facing payment products.

Service Delivery

To execute cross-border settlement instructions, fulfill API requests, and manage Client accounts.

Regulatory Compliance — AML & KYB

To conduct mandatory Anti-Money Laundering (AML) screening, Know Your Business (KYB) due diligence, and ongoing transaction monitoring as required by FinCEN, the Bank Secrecy Act (BSA, 31 U.S.C. § 5318 et seq.), and applicable global regulatory frameworks including FATF recommendations.

Sanctions Screening

To screen Clients, counterparties, and transactions against OFAC's Specially Designated Nationals (SDN) list and other applicable international sanctions regimes to prevent engagement with prohibited persons, entities, or jurisdictions.

Fraud Prevention & Platform Integrity

To detect and prevent fraud, unauthorized API access, account takeover, and abuse of the Netaro platform.

Regulatory Recordkeeping

To maintain audit trails, comply with suspicious activity reporting (SAR) obligations, and respond to lawful requests from regulatory and law enforcement authorities.

Platform Improvement

To analyze API performance metrics, improve dashboard UX, and enhance platform reliability and uptime.

Client Communications

To deliver service updates, compliance notifications, incident alerts, and account management communications.

Netaro does not sell personal data to third parties. Data is shared only in the following circumstances:

Payment Execution Partners

Licensed local Payment Service Providers (PSPs), OTC desks, and correspondent banking partners required to execute fiat-to-stablecoin-to-fiat conversion and cross-border settlement.

Compliance & Verification Vendors

Third-party AML screening, KYB, and identity verification service providers who act as data processors under binding Data Processing Agreements (DPAs).

Regulatory & Law Enforcement Authorities

FinCEN, OFAC, FIUs (Financial Intelligence Units), and equivalent international regulatory bodies when legally required or in response to lawful legal process, including subpoenas, court orders, or national security directives.

Infrastructure Providers

Cloud hosting providers (e.g., AWS, GCP) that process data as sub-processors under DPAs consistent with applicable data protection law.

International Data Transfers: Data may be transferred to countries outside the European Economic Area (EEA) and India. For EEA-originating personal data, Netaro relies on EU Standard Contractual Clauses (SCCs) as the transfer mechanism. For India-origin data, Netaro complies with the Digital Personal Data Protection Act, 2023 (DPDP Act).

Netaro maintains an information security program aligned with SOC 2 Type 2 controls and ISO 27001 standards, including:

Encryption

AES-256 encryption for data at rest; TLS 1.2 and TLS 1.3 for data in transit.

Access Controls

Role-Based Access Control (RBAC) enforced on the principle of least privilege; multi-factor authentication required for all administrative access.

Monitoring & Testing

Continuous security monitoring, vulnerability management, and periodic third-party penetration testing.

Incident Response

A documented incident response plan with breach notification procedures consistent with applicable law, including GDPR Article 33 timelines where applicable.

Notwithstanding the above, no security system is impenetrable. Clients remain solely responsible for the security of their API keys, access credentials, and endpoint security configurations.

BSA/FinCEN Compliance

Transaction records, AML/KYB documentation, and SAR-related materials are retained for a minimum of five (5) years from the date of the transaction or the conclusion of the client relationship, as required by 31 U.S.C. § 5318 and associated FinCEN regulations.

FATF Alignment

Netaro aligns its international recordkeeping practices with FATF Recommendation 11 standards.

Post-Relationship Retention

Following termination of a client relationship, Netaro may retain data as required for legal defense, regulatory examination, dispute resolution, and audit purposes.

Deletion & Anonymization

Upon expiry of all applicable legal retention periods, personal data is securely deleted or anonymized in accordance with Netaro's data lifecycle management procedures, where legally permissible.

Given Netaro's strictly B2B operating model, privacy rights are subject to the qualifications below:

To submit a privacy rights request, contact: hello@netaro.xyz. Note that exercise of certain rights may be limited or delayed by Netaro's mandatory regulatory and legal obligations.

Netaro's platform operates as a B2B API and dashboard environment — not a consumer-facing website.

Strictly Necessary Cookies

Used for session authentication, CSRF protection, and platform security. These cannot be disabled without impairing platform functionality.

Analytics Cookies

Aggregate usage analytics are collected to monitor platform performance and improve service quality. Non-essential analytics tracking may be opted out of via dashboard settings.

Advertising & Behavioral Tracking

Netaro does not deploy third-party advertising, behavioral profiling, or cross-site tracking cookies on its platform.

Netaro reserves the right to update this Privacy Policy at any time. For material changes, Netaro will provide at least thirty (30) days' advance notice via email to the registered contact of record and/or via a prominent dashboard notification. Non-material changes (e.g., typographical corrections or clarifications) may be made without notice. Continued use of Netaro's services following the effective date of an updated Policy constitutes acceptance of the revised terms.

For privacy-related inquiries, data subject requests, or concerns regarding this Policy:

For GDPR-related inquiries, EU/EEA-based individuals may also contact the relevant data protection supervisory authority in their jurisdiction.