Last updated August 20, 2026
Privacy Policy
Version 1.2 · Effective August 20, 2026
Mezzanine Labs, Inc. (“Mezzanine,” “we,” “us”) builds financial operating software for companies. We are a technology company. We are not a bank, a custodian, a payment processor, or a money services business, we do not hold your money or your digital assets, and we do not hold your keys. Regulated money movement is provided by licensed companies, and section 5 explains how that changes who holds your information.
This policy explains what personal information we handle, why, who we disclose it to, and the choices and rights you have.
It covers mezzanine.xyz (the “Site”) and the Mezzanine application at app.mezzanine.xyz (the “Platform”), together the “Services.”
1. The short version
- We collect what you give us when you enquire, book a call, or use the Platform, and a limited amount of information about how you use the Site.
- We use advertising and measurement technologies, and you can turn them off. We honour the Global Privacy Control signal automatically.
- Regulated money movement is provided by other companies, not by us. When you use those services, the provider becomes your provider and holds your information under its own policy. Section 5 explains this.
- Information our customers upload about other people is theirs, not ours, and we act on their instructions. Section 17 explains what to do if that is you.
- We do not sell your information for money, and we do not use it to train machine learning models.
- Write to privacy@mezzanine.xyz about any of it.
The rest of this policy is the detail. It is written to be read, not to be got past.
2. The three roles we play, and why the difference matters to you
We are the controller (the “business,” in US state privacy law) for information about people who deal with Mezzanine directly: visitors to the Site, people who request a demonstration or start onboarding, people who contact us, and the administrators and users of our customers’ accounts. Sections 3 through 16 describe how we handle that information, and the rights in section 13 apply to it.
We are a processor (a “service provider”) for information our customers put into the Platform about other people. A customer using Mezzanine to pay a contractor, verify a vendor, or manage a counterparty is uploading information about someone who is not our user and who never dealt with us. We handle that only on the customer’s documented instructions, under the terms of our agreement with that customer and a data processing addendum. We do not sell it, do not share it for advertising, and do not use it for our own purposes. Section 17 is for the people that information is about.
A regulated provider is a controller in its own right. When you use regulated money movement, identity verification, or bank connectivity through the Platform, the licensed provider that performs it becomes your provider. It is an independent controller of the information it holds. It is not our processor and we are not its processor, and we are not joint controllers with it. It decides what it collects, why, how long it keeps it, and how it answers your requests, under its own privacy policy. Section 5 explains what that means in practice, and section 10 explains what we share with it and what it shares with us.
That three-way split is not a technicality. It determines who you ask when you want something done about your information.
3. Information we collect about Site visitors and prospects
What you give us. When you request a demonstration, start onboarding, or contact us we collect your name, work email address and its domain, your phone number if you give one, your role, and the answers you provide in our sign-up flow. Those answers cover what kind of organization you are, what you are trying to do, your treasury size band, your annual volume band, the custody arrangements you use, and your current relationship to stablecoins. Every field is optional except those marked required, and we ask for the fewest we can.
Partial submissions. Our sign-up flow saves your answers as you go, so closing a tab does not lose your progress. If you enter your email address and then leave without finishing, we hold what you entered up to that point. To have it deleted, write to privacy@mezzanine.xyz.
Scheduling. If you book a call we receive the booking details from our scheduling provider: your name, email address, the time you chose, and anything you write in the booking form.
Information collected automatically. We record the pages you view, the page that referred you, the marketing campaign parameters in the link you arrived through (utm_source, utm_medium, utm_campaign, utm_content), which calls to action you click, and which step of our sign-up flow you reached. We derive an approximate country or region from your IP address. Where you have already given us your email address these events are associated with your enquiry; where you have not, they are not linked to you.
IP address. We use your IP address in memory to rate-limit form submissions and block abuse. We do not store it in our own database alongside your enquiry. Our hosting provider processes IP addresses in its server logs as part of delivering the Site, under its own retention schedule.
Business information from other sources. We may supplement an enquiry with publicly available or commercially available business information, such as company size, industry, or funding, to prepare for a conversation.
What we do not want. Please do not send us government identifiers, financial account numbers, payment card details, health information, biometric data, or information about your race, religion, politics, union membership, sexual orientation, or immigration status through the Site. The Platform collects some of these where the law requires it; section 5 covers that.
4. Information we collect about Platform account users
For each person who holds an account or is invited into a customer’s workspace we hold: name, work email address, the customer organization they belong to, their role and permissions, authentication information, and a record of their activity in the Platform, including sign-ins, approvals, and other actions. We keep this activity log because a financial application needs an audit trail, and because our customers rely on it for their own internal controls.
Where a customer signs in through a single sign-on or identity provider, we receive the identifying information that provider sends us. We do not receive your password.
Billing. We hold the billing contact, billing address, plan, invoices, payment history, and the usage records a plan is billed against. Payment card and bank details are collected and held by our payment processor, not by us. We receive only a token and limited identifying details such as the card brand and last four digits.
What is in your organization’s workspace. A financial operating system holds commercially sensitive material. Depending on which features your organization uses, its workspace may contain financial records and ledgers, contacts and counterparty details, vendor and contractor information, invoices and bills, agreements and uploaded documents, entity and account information, wallet addresses and signer configurations, approval rules and permission settings, payment instructions, and transaction histories. Most of that is your organization’s own data and we handle it on its instructions, as sections 2 and 17 describe.
Your organization’s administrators can see what you do in its workspace. If you use Mezzanine through an account your employer or another organization controls, that organization controls the account and the information in it. Administrators and other authorized users may be able to see your profile, your activity and audit log, the approvals and payments you make, the documents and contacts you add, and messages and notes you enter. They may also change your permissions, export the workspace, and retain or delete its contents after you leave. This is how workplace software works, and it is worth knowing before you enter something personal. Requests about that information go to your organization, not to us.
5. Regulated services, identity verification, and financial connections
5.1 Who holds what. Regulated money movement is provided by licensed providers, currently including 1Money USA, Inc. When you use those services you become that provider’s customer. It collects and holds the information it needs to onboard you, verify your identity, meet its anti-money-laundering and sanctions obligations, and operate your account and transactions, and it does so as an independent controller under its own privacy policy. We do not control those decisions and cannot make them on its behalf.
5.2 Identity verification. Identity verification is required by law for regulated money movement. Information collected for that purpose, which may include identification documents and government identifiers for individuals and beneficial owners, is collected for the licensed provider that performs the verification and makes the decision. We collect only what that provider requires or specifically requests, we do not use it for any other purpose, we never sell it and never share it for advertising, and the provider holds the authoritative record. Where we hold a copy, we delete or anonymize it once the provider confirms onboarding, unless we need it to answer a support question, to establish or defend a legal claim, or to meet a record-keeping obligation described in section 12.
This category is treated as sensitive personal information under several privacy laws, and we handle it accordingly.
5.3 Financial account connections. If you connect a bank or other financial account, we and our service providers access the account information you direct us to access. Access is read-only unless you separately authorize a payment through the relevant regulated provider. You may revoke a connection at any time in the Platform, and revocation applies going forward.
5.4 Wallets, including multisignature wallets. You may connect a wallet you already control or create a new one through the Platform. Either way the wallet is yours: you hold the keys and you control the signers and thresholds. We hold the wallet addresses you add or create, the labels and contacts you associate with them, the signer configuration you set, and records of transactions you initiate or approve.
We never hold your keys. Mezzanine does not access, store, generate access to, escrow, back up, or recover private keys, seed phrases, signing credentials, or recovery secrets, and creating a wallet through the Platform does not change that. If you lose your key material we cannot recover it and cannot restore access to anything secured by it.
5.5 Blockchains are public and permanent. Information recorded on a public blockchain is public, permanent, and outside anyone’s control, including ours. We cannot delete or amend it, and no deletion request can reach it.
5.6 Information we receive from sources you connect. When your organization connects something to the Platform, we receive information from it. Depending on what you connect, that includes: account details, balances, and transaction history from banks and other financial accounts, on your instruction and read-only unless you separately authorize a payment; publicly available data from blockchain networks, including addresses, balances, and transaction records; account status and transaction data from licensed providers, as section 10 describes; records from accounting, payroll, document, and other business systems you connect; and information you or your counterparties upload, including documents, agreements, invoices, and contact details. Where that information is about a person, it is usually your organization’s data and we handle it on your organization’s instructions.
5.7 Where to send a request about this information. If your request concerns information a licensed provider holds, that provider is the one who can act on it, and we will forward your request to it promptly and help it respond. If it concerns information we hold, section 14 applies.
6. Cookies, storage, and similar technologies
6.1 What runs, and what it does. This is the complete list. If you find something in your browser that is not here, tell us at privacy@mezzanine.xyz and we will either remove it or add it.
Strictly necessary. These make the Services work, are not used to profile you, and we do not ask for consent to set them.
| Name | Type | Purpose | Lifetime |
|---|---|---|---|
| mzn_lead_id | Cookie | Links a sign-up form you started to the one you finish, so opening a new tab does not start you over | 7 days |
| mzn_lead_state | Session storage | Holds your own answers so refreshing does not lose them | Until you close the tab |
| mzn_cookie_consent | Local storage | Remembers the choice you made about the categories below. We store it in your browser rather than in a cookie, so that recording a preference does not itself set one | 12 months |
| Platform session cookie | Cookie | Keeps you signed in to the Mezzanine application. Set only when you sign in | Session, or until you sign out |
We also set cookies used only by Mezzanine staff signing in to our internal tools. They are never set in your browser.
Analytics. We use Vercel Web Analytics, which sets no cookies, uses no persistent identifier, does not follow you to other websites, and reports only in aggregate. Where we use any analytics technology that does set an identifier, it is listed in the advertising category below and is gated in the same way.
Scheduling. If you reach the scheduling step, a Calendly calendar is embedded on the page. It loads only at that step, sets its own cookies, and provides its own controls. See calendly.com/legal.
Advertising and measurement. We work with advertising platforms that place cookies and identifiers to measure our advertising and to show you Mezzanine ads on other sites and apps. These are LinkedIn (Insight Tag), Meta (Pixel and Conversions API), and Google (Ads and Analytics). They allow those platforms to recognise your device across other websites and services. Sending the same information from our servers rather than from your browser does not change your choice: our server-side measurement carries your consent decision with it.
6.2 Before anything new is added. Before we enable any new advertising, analytics, or measurement technology, we will name it in the table above and in section 9, and update the date at the top of this page. It will load only through our consent gate. We publish this commitment because a policy that names technologies a site does not run is as inaccurate as one that omits technologies it does.
6.3 Your controls.
- The cookie notice. You can accept or reject non-essential technologies when you first visit. Accepting and rejecting are equally prominent and take the same number of clicks.
- Where you are. In the United Kingdom, the European Economic Area, and Switzerland, no advertising or non-essential analytics technology runs until you accept it. Elsewhere, they run unless you turn them off.
- Changing your mind. The Your Privacy Choices control in the footer of every page reopens the notice at any time. Withdrawing is as easy as giving.
- Global Privacy Control. We detect and honour the Global Privacy Control signal. If your browser or extension sends it, we treat it as an instruction to opt out of any sale or sharing of your personal information for advertising, with no further step by you, we do not ask you to verify your identity to make it count, and we pass that opt-out on to the advertising platforms we have disclosed your information to.
- Your browser. You can block or clear cookies and site data in your browser settings.
7. How we use information, and our legal basis
| What we do | Why | Legal basis (UK and EU) |
|---|---|---|
| Reply to your enquiry, schedule and hold a call, set your organization up | Steps you asked for before entering a contract | Art. 6(1)(b) |
| Provide, operate, secure, and support the Platform | Performance of our contract with your organization | Art. 6(1)(b), and Art. 6(1)(f) where you are not the contracting party |
| Maintain an audit trail of actions taken in the Platform | Our and our customers’ legitimate interest in accountability and fraud prevention | Art. 6(1)(f) |
| Refer you to a licensed provider and pass on what it needs to verify you | Performance of your contract with that provider, and its legal obligations | Art. 6(1)(b) and Art. 6(1)(c) |
| Track and reconcile referrals, and show you the status of an account you hold with a provider | Our legitimate interest in operating and reconciling the service you asked for | Art. 6(1)(f) |
| Rate-limit forms, detect and block spam, fraud, and abuse | Keeping the Services available and secure | Art. 6(1)(f) |
| Measure which pages and campaigns work, in aggregate | Understanding and improving the Site | Art. 6(1)(f) |
| Advertising, retargeting, and campaign measurement | Because you agreed to it | Art. 6(1)(a) |
| Send you marketing email, if you asked for it | Because you asked for it | Art. 6(1)(a), or Art. 6(1)(f) for existing customers where permitted |
| Meet our legal, tax, accounting, and regulatory obligations, and establish or defend legal claims | Because we must, or to protect our rights | Art. 6(1)(c) and Art. 6(1)(f) |
Where we rely on legitimate interests we have considered whether our interest is overridden by your rights, and you may object at any time under section 13. Where we rely on consent you may withdraw it at any time, and withdrawal does not affect what we did before you withdrew it.
Messages you can turn off, and messages you cannot. While you hold an account, some messages are part of the service: transaction and approval notifications, security and authentication alerts, service and availability notices, billing messages, and legal and policy notices. You cannot opt out of those without closing the account, because they are how the service works. Product announcements, newsletters, research, and other marketing messages are different, and you can unsubscribe from them at any time using the link in any such message or by writing to privacy@mezzanine.xyz, without affecting the service messages above. Inside the Platform you can also choose which optional notifications you receive.
8. Automated decisions, profiling, and artificial intelligence
We do not make decisions producing legal or similarly significant effects about you by automated processing alone. Decisions about whether to approve an account for regulated money movement are made by the licensed provider under its own process and its own policy, and questions about such a decision should go to that provider.
We do not use your personal information, or our customers’ data, to train large language models or other machine learning models, and we do not sell or otherwise make it available to any third party for that purpose.
Where a Platform feature is powered by a third-party artificial intelligence service, we identify that service in section 10, and the feature’s output is provided for your review rather than as a decision.
We do sort enquiries internally by size and type so that the right person responds. That is a workflow aid, it is reviewed by a person, and it does not determine whether you can use the Services.
9. Selling, sharing, and targeted advertising
We do not sell your personal information for money.
Under California and several other US state privacy laws, using advertising and retargeting technologies is treated as “sharing” personal information for cross-context behavioural advertising, and in some states as a “sale,” even where no money changes hands. We do this, using the platforms named in section 6: LinkedIn, Meta, and Google. The categories involved are identifiers, internet or other electronic network activity, approximate geolocation derived from IP address, and professional information.
To opt out, use the Your Privacy Choices control in our footer, or browse with Global Privacy Control enabled, which we detect and honour automatically. We pass your opt-out on to the advertising platforms we have disclosed your information to. We will not treat you differently for opting out.
What is never in this category. We do not sell or share for advertising: information our customers upload about other people; identity verification information; financial account information; wallet or transaction records; or anything we receive from or send to a licensed provider to operate the services you asked for. We do not use information about your transactions to market other products to you without your consent. We do not knowingly collect, sell, or share the personal information of anyone under 18.
We do not use or disclose sensitive personal information for purposes that would give you a right to limit that use, and we do not use it to infer characteristics about you.
10. Who we disclose information to
Service providers, which process on our instructions and under contract. A current list is at mezzanine.xyz/subprocessors, which we update before a change takes effect. As at the date above:
| Provider | What it does | Where |
|---|---|---|
| Vercel Inc. | Hosting, content delivery, and cookieless aggregate analytics | United States |
| Supabase, Inc. | The database holding enquiries and account records | United States |
| Calendly LLC | Call scheduling | United States |
| Slack Technologies (Salesforce, Inc.) | Internal notification when an enquiry arrives | United States |
| Google LLC | Sign-in for Mezzanine staff accessing internal tools | United States |
| Our email provider | Sending email to you | United States |
| Our payment processor | Taking payment for subscriptions and issuing invoices | United States |
| Our bank connectivity provider | Connecting the financial accounts you authorize, on your instruction | United States |
| Our consent management platform | Recording and enforcing your cookie choices | European Union |
Advertising platforms, which act for their own purposes as well as ours. LinkedIn Corporation · Meta Platforms, Inc. · Google LLC. Section 9 explains the basis and the opt-out.
Licensed providers, which act as independent controllers. Where you use regulated money movement, your personal information may be shared with 1Money USA, Inc., and 1Money USA, Inc. may share information with us. This is required for the service to work, and both directions are limited:
- What we share with 1Money USA, Inc., so that it can receive the referral, assess and onboard you as its customer, perform identity verification, anti-money-laundering, sanctions and fraud checks, operate and support your account and transactions, provide its services, meet its servicing and support obligations, and comply with its regulatory, legal, audit, and reporting obligations.
- What 1Money USA, Inc. shares with us, so that we can track and verify the referral, show you limited status information about your account with it, such as an account identifier or high-level status, and carry out related reconciliation, reporting, dispute resolution, and fraud prevention.
Neither company uses information received from the other in a way inconsistent with this policy, with the notices you were given, or with applicable law. 1Money USA, Inc. handles what it holds under its own privacy policy and cookie policy, which you are given access to before onboarding.
Applications and integrations your organization enables. The Platform can connect to applications, wallets, accounting and payroll systems, data providers, and other services we do not operate. When your organization enables one, it instructs us to send information to it, which may include workspace data of the kind described in section 4 and personal information about your people and counterparties. Once it arrives there it is governed by that service’s privacy policy and terms, not ours, and we are not responsible for what it does with it. Your organization chooses what to enable and can disconnect an integration at any time, which stops further sharing but does not retrieve what was already sent. Administrators can see the current list in the Platform.
Others, in specific circumstances. Our professional advisers, under duties of confidence; government authorities, regulators, or litigants where we are legally required or permitted to disclose, and where we will give you notice unless prohibited; a licensed provider’s regulators and banking providers to the extent reasonably necessary to meet regulatory expectations; and an acquirer or investor in connection with a merger, financing, or sale of all or part of our business, subject to confidentiality and to this policy continuing to apply.
11. Categories of information, in the form California law requires
This table covers the period since we began collecting the information described, up to the date at the top of this page. It describes information we handle as a controller, except where a row is marked “processor,” which means we handle it on a customer’s instructions as sections 2 and 17 describe. “Sold or shared” has the meaning given in the California Consumer Privacy Act.
| Statutory category | Collected? | Source | Why | Disclosed to | Sold or shared? |
|---|---|---|---|---|---|
| A. Identifiers (name, email, phone, IP address, account and online identifiers) | Yes | You; automatically | Respond to you, operate accounts, secure the Services, advertising | Hosting, database, scheduling, email, notification providers; advertising platforms | Yes, for cross-context behavioural advertising |
| B. Customer records (Cal. Civ. Code § 1798.80: name, contact details, employment, financial details). Where a customer uploads these about its own contractors, vendors, or employees, we hold them as processor | Yes | You; your organization | Operate the Services, billing | Hosting, database, payment providers | No |
| C. Protected classifications | No | No | |||
| D. Commercial information (services obtained, transaction records) | Yes | You; your use | Operate the Services, billing, support | Hosting, database providers | No |
| E. Biometric information | No | No | |||
| F. Internet or network activity (pages viewed, referrer, clicks, campaign parameters, device and browser information) | Yes | Automatically | Understand and improve the Site, secure it, advertising | Hosting and analytics providers; advertising platforms | Yes, for cross-context behavioural advertising |
| G. Geolocation (approximate region derived from IP address; not precise geolocation) | Yes | Automatically | Aggregate analytics, security, advertising | Hosting and analytics providers; advertising platforms | Yes, for cross-context behavioural advertising |
| H. Audio, electronic, visual information (support and sales correspondence) | Yes | You | Support and sales | Communications providers | No |
| I. Professional or employment information (role, company, seniority) | Yes | You; publicly available sources | Route your enquiry, tailor a demonstration, advertising | Hosting, database providers; advertising platforms | Yes, for cross-context behavioural advertising |
| J. Education information | No | No | |||
| K. Inferences (organization size band, likely fit) | Yes | Derived from the above | Route and prioritise enquiries internally | Not disclosed externally | No |
| L. Sensitive personal information: government identifiers and financial account information, in connection with identity verification and financial connections only. See section 5 | Yes, in that context only | You | To provide to the licensed provider that performs verification, and to operate connections you authorize | The licensed provider you contract with; the connectivity provider you authorize | No |
We do not use or disclose sensitive personal information for any purpose other than those permitted without a right to limit under 11 CCR § 7027(m), so no “Limit the Use of My Sensitive Personal Information” link is required. Retention is in section 12.
12. How long we keep information
Three different things, and it is worth separating them. Some information we can delete on request, and will. Some we must keep for a defined period because the law, a regulator, or our agreement with a licensed provider requires it, and a deletion request cannot override that; where that applies we tell you which part and why, and we delete it when the period ends. And some information cannot be deleted by anyone, because it is recorded on a public blockchain. Once a transaction is confirmed on a public network, the address, amount, and timing are permanent and public. We can delete the labels, notes, and contact details we hold about an address; we cannot delete the chain.
| Information | How long |
|---|---|
| Enquiries that do not become customers | 24 months from your last contact with us, then deleted |
| Partially completed sign-up forms | 90 days, then deleted |
| Customer account records and audit logs | The life of the relationship, then 7 years, for tax, accounting, and regulatory record-keeping |
| Records relating to a referral to a licensed provider, the consents and disclosures you accepted, complaints, and related support communications | 10 years from creation. Our agreement with the provider requires this, and the obligation survives the end of that agreement |
| Identity verification information we hold a copy of | Deleted or anonymized once the provider confirms onboarding, unless needed for support, legal defence, or a record-keeping obligation above |
| Information a customer uploaded about other people | Deleted or de-identified within 30 days after the end of the export period following termination, unless the customer instructs otherwise or the law requires longer |
| Support correspondence | 36 months |
| Cookie consent records | 12 months from the decision, so we can show what you chose and when |
| Server logs held by our hosting provider, including IP addresses | Under that provider’s retention schedule |
| Aggregate analytics that cannot identify anyone | Indefinitely |
| Backups | Deleted on their ordinary cycle, no later than 35 days after the underlying record is deleted |
We may keep information longer where the law requires it, or where it is needed to establish, exercise, or defend a legal claim, and then only what is needed for that purpose.
13. Your rights
Everyone, wherever you live, may ask us for a copy of the personal information we hold about you, to correct it if it is wrong, or to delete it, subject to the retention periods in section 12 and to our legal, tax, accounting, and regulatory record-keeping obligations. Where we cannot act on part of a request for one of those reasons, we will tell you which part and why. We will not treat you differently, deny you a service, or charge you a different price for asking.
Depending on where you live, you may also have the right to: know the categories and specific pieces of information we collect, the sources, the purposes, and the categories of third parties we disclose to; obtain a list of the specific third parties we disclosed your information to; receive your information in a portable, machine-readable format; opt out of the sale or sharing of your information and of targeted advertising; opt out of profiling in furtherance of decisions producing legal or similarly significant effects; limit our use of sensitive personal information; object to or restrict processing; withdraw a consent you gave; and appeal a decision we make on your request.
If you are in the UK or EEA, you may lodge a complaint with your local supervisory authority. We would appreciate the chance to address your concern first.
If you are in the UK, you may complain to us directly about our handling of your information. We will acknowledge your complaint within 30 days and respond without undue delay. Write to privacy@mezzanine.xyz with “Complaint” in the subject line.
If your request concerns a licensed provider, see section 5.7. If it concerns information a customer uploaded, see section 17.
14. How to exercise your rights
Email privacy@mezzanine.xyz. Tell us what you want and, if you can, the email address you used with us. You may also write to the address in section 21. This inbox is monitored on business days and we will acknowledge your message.
- Timing. We respond within 45 days in California and most US states, extendable once by a further 45 days where reasonably necessary, and within one month in the UK and EEA, extendable by two further months for complex requests. We will tell you if we need an extension.
- Verification. We may need to confirm your identity, usually by asking you to reply from the address we already hold, and we ask for the least information that will do. We will never require you to create an account, or to verify your identity, in order to act on an opt-out request.
- Authorised agents. You may use an authorised agent. We may ask for proof of their authority and for confirmation directly from you.
- Appeals. If we decline a request you may appeal by replying with “Appeal” in the subject line. We will respond within 45 days with our decision and the reasons, and tell you how to contact your state Attorney General if you disagree.
We also give you notice of the categories of personal information we collect, and the purposes, at or before the point we collect it, on the forms where we collect it.
15. International transfers
Mezzanine is in the United States and our service providers are primarily there. If you are outside the United States, your information will be transferred to and processed in the United States, which may not provide the same level of protection as your own country.
Where we transfer personal information out of the UK, the EEA, or Switzerland, we rely on the European Commission’s Standard Contractual Clauses, together with the UK International Data Transfer Addendum where applicable, and on transfer risk assessments and supplementary measures where those are required. Where a recipient is certified under the EU-US Data Privacy Framework, or its UK or Swiss extension, we may also rely on that certification. The Standard Contractual Clauses are our primary mechanism and we do not rely on the Data Privacy Framework alone, so a change in its status does not leave a transfer unsupported.
For a copy of the safeguards we use, write to privacy@mezzanine.xyz.
16. Security
We maintain an information security programme designed to protect the confidentiality, integrity, and availability of personal information, appropriate to its nature and to our risk profile. It includes role-based access controls on a least-privilege basis, multi-factor authentication for administrative access, encryption of sensitive data in transit and at rest, network security controls, regular security testing and vulnerability remediation, logging and monitoring, incident response planning, personnel training, and diligence on the providers we use. We maintain Cyber and Privacy Liability insurance. Our current practices are described at mezzanine.xyz/security.
No system is completely secure, and we do not claim ours is.
What we secure is the Platform. We do not control, and make no promise about, the security of your devices and credentials, your identity provider, your wallet software or signing devices, smart contract wallets and the networks they run on, or any third-party service or integration you connect. Section 18.6 of our Terms of Service sets out that split in full.
If a security incident affects your personal information, we will notify you and the relevant regulators as and when the law requires, including any notification the Federal Trade Commission’s Safeguards Rule requires within the period that rule specifies. Where we hold the information on a customer’s behalf we notify that customer, and they decide what is communicated to the individuals concerned.
17. Information our customers upload about other people
If a Mezzanine customer has uploaded information about you, for example because you are their contractor, vendor, employee, investor, or counterparty:
- That customer decides what happens to your information, not us. They are the controller and we act on their instructions.
- To access, correct, or delete it, contact them. If you do not know who they are, write to privacy@mezzanine.xyz. We will tell you where we lawfully can, and pass your request on.
- We will help that customer respond to you within the time the law allows.
- When our relationship with that customer ends, their data is returned or deleted as our agreement with them and section 12 describe.
18. Children
The Services are business tools for organizations and for people acting in a professional capacity. They are not directed to children, and we do not knowingly collect personal information from anyone under 18. If you believe a child has provided us with personal information, write to privacy@mezzanine.xyz and we will delete it.
19. Other sites and services
The Services link to and embed things we do not control, including licensed providers, scheduling and documentation tools, and public blockchain explorers. Their privacy practices are their own, and we encourage you to read their policies.
20. Changes to this policy
We post any change here and update the date at the top. If a change is material, and in particular if we begin using a technology described in section 6.2, we will update this policy before the change takes effect and, where required, tell you by email or a notice on the Site and obtain your consent.
We keep a dated copy of each published version. To request the version that applied on a particular date, write to privacy@mezzanine.xyz.
21. Contact us
Mezzanine Labs, Inc. 135 Madison Avenue, 5th Floor New York, NY 10016
privacy@mezzanine.xyz · support@mezzanine.xyz
If you are in the United Kingdom or the European Economic Area and have a question about how we handle your information, write to privacy@mezzanine.xyz. Section 13 explains your rights and how to exercise them.
