Privacy Policy

About this policy

Jumpstart Micro, Inc., doing business as Issuance Express ("we" or "us"), is a subsidiary of Issuance, Inc. This policy describes personal information collected through issuanceexpress.com, its offering pages, invest.issuanceexpress.com, and related Reg CF account, application, and portal services (the "Services"). It covers visitors, prospective investors, account holders, issuers, and their representatives.

Separate notices may apply to a particular transaction or financial service. This policy supplements those notices and does not replace required disclosures or consent. Our Terms of Service describes use of the Services. Other Issuance products and independently operated issuer or provider websites may have different policies.

Information you provide

The information we collect depends on how you use the Services. It can include:

• Contact and account details: your name, email, phone number, address, account identifiers, login information, preferences, and correspondence with us.
• Identity and verification information: date of birth, Social Security or other tax identification number, government ID details and images, photographs or a selfie submitted during verification, and verification results.
• Investor and transaction information: income, net worth, investment eligibility, prior Reg CF investments, tax certifications, investment selections and amounts, payment or bank information, transaction status, signatures, agreements, and related records.
• Issuer information: business and representative details, formation and ownership information, tax identifiers, offering and financial documents, payment details, and application responses such as fundraising goals and business stage.
• Communications and content: questions, support requests, form responses, documents you submit, and public comments.

Some information is collected directly by a verification or payment provider and then shared with us as needed for the service. If you provide information about someone else, you must have authority to do so and provide any required notice.

Information collected automatically

Our systems and integrated providers collect technical and activity information when you visit or use the Services. This includes IP address, browser and device information, approximate location derived from network information, referring pages, URLs, advertising and browser identifiers, pages viewed, errors, and interactions with forms and investment steps.

Cookies, local storage, pixels, scripts, and similar technologies support sign-in, preferences, forms, security, analytics, and advertising measurement. Information in links, such as campaign and referral identifiers, may pass from an offering page into the investment portal. Technical records may be associated with your account when you sign in or provide identifying information.

The public website loads Google Analytics and a Clearbit tag for traffic measurement and visitor analytics. Offering pages and portal features can use additional analytics, advertising, diagnostics, and embedded-content technologies. Where enabled, usage analytics tools can record browsing sessions and interactions with the portal to help identify errors and improve usability. The providers and information involved depend on the page, offering, and features used. Some provider requests occur when a page loads, before you submit a form or play embedded media.

Information from other sources

We receive information from identity and compliance providers, payment and escrow providers, issuers, and people authorized to act for you. This may include verification outcomes, transaction confirmations, ownership or investment records, and information needed to resolve a discrepancy.

If you choose a supported third-party sign-in service, we receive the account information that service shares for authentication. Public records and business information may support issuer review, fraud prevention, and verification. We may combine these sources with information already associated with an account or transaction.

How we use information

We use personal information to:

• Provide accounts, respond to inquiries, review issuer applications, and operate the portal.
• Verify identity and authority, assess investment eligibility and limits, prevent fraud, and conduct compliance checks.
• Process commitments, payments, escrow instructions, signatures, cancellations, and transaction records.
• Deliver account, offering, security, and service communications and manage communication preferences.
• Understand usage, diagnose problems, improve the Services, measure campaigns, and support marketing and advertising.
• Meet legal and regulatory duties, maintain records, respond to lawful requests, resolve disputes, and enforce agreements.

Marketing choices do not prevent processing needed to administer an investment, protect an account, or meet a legal obligation.

Verification, payments, and other providers

We disclose information to providers involved in operating the Services. The principal functions include:

• Identity and compliance: Trulioo receives identity and business information for verification. A verification workflow may collect ID images and a selfie, and we can receive and retain documents and results. Trulioo's Services Privacy Policy describes its practices. North Capital receives identity, financial, and transaction information for compliance checks and escrow-related processing.
• Payments and escrow: Stripe processes supported payments and receives payment, billing, and transaction information. North Capital and the financial institutions identified in the applicable transaction arrangements receive information needed to establish accounts and administer funds.
• Accounts and operations: Google Firebase supports authentication. Cloud hosting, storage, security, diagnostics, document, electronic-signature, email, and SMS providers process information needed for those functions.
• Forms and applications: Google services support address completion, application processing, and reCAPTCHA fraud prevention. Application information can also pass through email and workflow providers to our sales and onboarding teams.

The information disclosed varies with the service. A provider may also have its own legal duties and privacy notice. A provider's independent practices are governed by that notice and applicable law.

Issuers and other recipients

Issuers receive information about prospective and actual investors as needed for their offering and investor relationship. This can include contact details, investment and agreement records, eligibility information, and relevant tax or ownership details. Issuer-connected customer relationship management and communications services may receive contact, financial eligibility, and investment information. An issuer's independent use is subject to its own obligations and privacy disclosures.

Our parent, Issuance, Inc., and personnel supporting the Services may process information for technology, administration, and support. We may also disclose information to professional advisers, regulators, law enforcement, courts, or other parties where needed to comply with law, protect rights and security, or handle a dispute.

Information may be disclosed in connection with a proposed or completed merger, acquisition, financing, reorganization, or transfer of the relevant business, subject to applicable law. We may disclose information at your direction or with a separate authorization.

Analytics and advertising

Offering and portal configurations may enable Google, Meta, and other advertising or social-platform tags. These can receive page and device information, browser or account identifiers, referral details, and events associated with registration and investment steps. Event data may include the offering, investment reference, quantity, and dollar value.

Some Google and Meta integrations transmit hashed contact details, such as email, phone number, or name, for matching and measurement. Hashing changes the format of information; it does not make it anonymous. Providers may match those values or identifiers to information they already hold.

Where configured, Segment receives analytics events from the browser and our servers. Server events may include ordinary, unhashed contact or account information as well as investment activity and campaign identifiers. Issuers may configure measurement for their own campaigns.

These activities may qualify as a sale, sharing, or targeted advertising under some privacy laws, depending on the information, relationship, and applicable law. See the choices below for requests and available controls.

Public discussions and outside services

Offering questions and comments can be visible to anyone. Do not post account credentials, tax identifiers, identity documents, or other information you want to keep private. Public content may be retained for regulatory purposes.

Some offering pages use discussion services such as Disqus, embedded media, or other externally hosted content. Those services can receive browser, page, and network information when their content loads, and additional information if you interact. Links to issuer websites and other services lead to their own privacy practices.

Your choices and privacy requests

You can update available account information through the portal or contact us for help. Use the unsubscribe instructions in marketing emails and available text-message opt-out instructions to change those preferences. Necessary account, transaction, security, and legal communications may continue.

Browser settings can block or delete cookies and restrict some tracking. Provider settings may offer additional advertising choices. Blocking storage can affect sign-in or other features. Browser controls generally apply to that browser and do not automatically stop information sent from our servers or erase information already collected.

Depending on your location, the information involved, and applicable law, you may have rights to request access, a copy, correction, or deletion of information; to object to or restrict certain processing; or to opt out of certain sales, sharing, or targeted advertising. These rights are subject to applicable exceptions, including financial-services and recordkeeping requirements, and are not identical for every user.

Send requests to privacy@issuance.com and identify Issuance Express as the service involved. We may need to verify your identity or an agent's authority before acting. We will address applicable requests and explain relevant limitations as required by law. Do not send a Social Security number or ID image in the initial email.

Retention and security

We retain information according to its purpose, the account or transaction involved, and applicable legal, regulatory, accounting, security, and dispute-resolution needs. Some investment, identity, agreement, and communications records must remain after a transaction ends or an account closes. Account closure therefore does not necessarily result in deletion of all associated information.

We use safeguards designed to protect personal information. No system or transmission method can guarantee security. Protect your account credentials and contact us promptly if you suspect unauthorized access.

Children, updates, and contact

The Services are intended for adults, and accounts require users to be at least 18. If you believe a child has provided personal information to us, contact us so we can review and address it.

Updates to this policy will identify their effective date. We will give additional notice or obtain consent when required by applicable law. Publication of a policy does not itself provide consent for practices that require it.

For privacy questions or requests, contact privacy@issuance.com. For account or investment support, contact support@issuanceexpress.com. Please identify Jumpstart Micro, Inc. d.b.a. Issuance Express in your message.