Privacy Policy

Effective Date: October 1, 2026

1. Introduction

Welcome to the Kryon Network ("we," "our," "us," or "the Protocol"). We respect your privacy and are deeply committed to protecting your personal data, corporate trade secrets, financial records, and cryptographic identity. This Privacy Policy ("Policy") explains comprehensively how we collect, use, process, disclose, and safeguard your information when you access our decentralized application (dApp), interact with our Soroban smart contracts, utilize our Zero-Knowledge Machine Learning (ZKML) Oracles, or engage with our API endpoints and Web3 interfaces (collectively, the "Services").

By accessing or using the Services, you unequivocally consent to the data practices described in this Policy. If you do not agree with the terms of this Policy, you must immediately cease all use of the Services, disconnect your Web3 wallet (e.g., Freighter), and revoke any active OAuth tokens connected to your Enterprise Resource Planning (ERP) systems.

2. Zero-Knowledge Architecture & Privacy Guarantees

The fundamental premise of the Kryon Network is mathematical privacy through Zero-Knowledge (ZK) cryptography. Unlike legacy Web2 factoring platforms or traditional Web3 lending protocols, we operate under a strict "Trustless Privacy" mandate:

• Cryptographic Obfuscation: When you generate a proof of an invoice, the underlying data (e.g., your client's name, the line items, the exact fiat amount, and proprietary margins) is NEVER published to the Stellar blockchain. Only the resulting `proof_bytes` and `public_inputs` (commitments and nullifiers) are submitted to the Soroban execution environment.
• Client-Side Proving: Wherever feasible, SNARK generation occurs within your local execution environment (via WebAssembly or local Node orchestrators), meaning raw plaintext data does not traverse our servers.
• ZKML Disassociation: Our EZKL Risk Oracle evaluates your financial standing in an enclave or localized circuit. The generated credit score is proven mathematically, meaning the underlying transactions that contributed to that score remain entirely opaque to the public and to us.

3. Information We Collect

Despite our heavy reliance on Zero-Knowledge proofs, the practical operation of a frontend interface and ERP bridging requires the temporary handling of certain data vectors:

A. Information You Provide Directly

When you connect external systems (such as Stripe, QuickBooks, or ERPNext), you explicitly grant us OAuth access tokens or API keys. We use these credentials strictly to fetch invoice metadata for the sole purpose of feeding the local or secure-enclave ZK Prover.

B. Blockchain Data (Publicly Available)

We index and query public Stellar blockchain data, including your public wallet address (e.g., `G...`), transaction hashes, XLM balances, and interactions with the KryonEscrow smart contract (`C...`). Because blockchain ledgers are immutable and public by design, we cannot delete or alter this information.

C. Telemetry and Usage Data

We utilize standard web analytics tools to collect non-identifiable usage metrics, such as IP addresses (anonymized where required), browser types, operating systems, clickstream data, and latency metrics to optimize our RPC node routing and Next.js edge caching.

4. How We Use Your Information

We process the collected data under the principles of data minimization and purpose limitation. Your data is used exclusively to:

• Facilitate the compilation of Noir circuits and the generation of Groth16/Halo2 SNARKs.
• Authenticate your Web3 session via Soroban authorization (`require_auth()`).
• Execute automated fiat-to-XLM conversions using real-time oracle price feeds (e.g., CoinGecko API).
• Maintain persistent Zero-Knowledge Identity states in our KV databases to prevent Sybil attacks and redundant verification computations.
• Comply with applicable Anti-Money Laundering (AML) and Know Your Customer (KYC) regulations via W3C Verifiable Credentials without storing the raw underlying PII.

5. Data Retention & Deletion

We retain your temporary ERP API tokens and localized invoice cache only for the duration of the active browser session or until the ZK proof is successfully generated and broadcasted. Once the Soroban smart contract emits the `factored` event, the localized plaintext cache is aggressively purged. You may request the deletion of your persistent ZK Identity mapping by contacting our support channels, though be advised that on-chain cryptographic nullifiers cannot be reversed.

6. Third-Party Disclosures

We do not sell, rent, or trade your corporate financial data. We may share necessary cryptographic hashes with trusted third-party RPC providers (e.g., Stellar Horizon nodes) strictly to broadcast your transactions to the decentralized network. If compelled by a valid subpoena or court order, we will comply with law enforcement; however, due to our ZK architecture, we often possess zero mathematically decryptable plaintext data to surrender.

7. International Data Transfers

The Kryon Network is a decentralized, globally accessible protocol. Your interaction with the Services may result in the routing of data through servers located in various jurisdictions. By utilizing the Services, you consent to the cross-border transmission of your localized session data.

8. Modifications to this Policy

We reserve the right to unilaterally amend, update, or modify this Privacy Policy at any time and for any reason. We will notify you of any material changes by updating the "Effective Date" at the top of this document. It is your strict responsibility to periodically review this Policy to stay informed of our privacy practices.

9. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy, our Zero-Knowledge data handling practices, or your rights under applicable data protection frameworks (e.g., GDPR, CCPA), please contact the protocol maintainers via the official GitHub repository or our decentralized community channels.