Privacy Policy — 17VLT

1. Introduction

Ambersoft FZE LLC (“we,” “us,” or “our”), operating the 17VLT Fund platform (“Platform”) at 17vlt.com, is committed to protecting the personal data of founders, applicants, and users (“you”) who interact with our services. This Privacy Policy explains how we collect, use, store, and share your personal information in accordance with UAE Federal Decree-Law No. 45/2021 on the Protection of Personal Data (PDPL) and, where applicable, the EU General Data Protection Regulation (GDPR).

By accessing or using our Platform, you consent to the data practices described in this Policy. If you do not agree, please discontinue use of our services.

2. Information We Collect

2.1 Information You Provide Directly

We collect information you voluntarily submit when you:

Apply to the Platform (name, email, nationality, country of residence, business description, app or product details)
Create an account or complete onboarding forms
Submit KYC documentation (passport, proof of address, source of funds — at applicable tiers)
Execute agreements with us (Master Cooperation Agreement, IP Assignment Deed)
Communicate with our team via email, messaging tools, or video calls

2.2 Information Collected Automatically

When you visit our Platform, we may automatically collect:

IP address, browser type, and device identifiers
Pages visited, time spent, and navigation paths
Cookies and similar tracking technologies (see Section 8)
Referral URLs and geographic location (country/city level)

2.3 Information from Third Parties

We may receive information about you from:

App stores (Apple App Store, Google Play) in connection with publisher account transfers
Payment processors (Stripe) in connection with revenue distributions
KYC and identity verification providers
Sanctions and PEP screening providers

3. How We Use Your Information

We process your personal data for the following purposes:

Evaluating and processing your application to the Platform
Administering your participation and Tier progression
Processing revenue distributions and payments under the Master Cooperation Agreement
Facilitating publisher account transfers and IP assignment registration
Conducting KYC, AML, and sanctions compliance checks
Communicating platform updates, milestone reviews, and opportunities
Improving our Platform and services
Sending marketing communications (only with your consent)
Complying with legal obligations under UAE and applicable international law

4. Legal Basis for Processing

We process your data on the following legal bases:

Contractual necessity — to fulfil obligations under the Master Cooperation Agreement and related agreements
Legal obligation — KYC/AML compliance under UAE Federal Decree-Law No. 20/2018
Legitimate interests — platform operations, fraud prevention, and network development
Consent — for marketing communications and non-essential cookies

5. AI-Assisted Processing

Our Platform uses artificial intelligence tools (including large language model APIs) to assist with founder application assessment, document analysis, and workflow automation. AI-assisted assessments are reviewed by human personnel before any final decision is made that materially affects a Founder.

You have the right to request human review of any AI-assisted decision affecting you. To exercise this right, contact us at privacy@17vlt.com. We will respond within thirty (30) days. For further information on our AI compliance approach, see our AI Act Conformity Statement at 17vlt.com/ai-policy.

6. Data Sharing and Disclosure

6.1 Service Providers

We engage third-party vendors who process data on our behalf under Data Processing Agreements. These include: cloud hosting providers, payment processors (Stripe), scheduling tools (Calendly), analytics providers (PostHog), KYC/identity verification providers, sanctions screening providers, and AI API providers (Anthropic, OpenAI). Each vendor processes data only as necessary to deliver the relevant service.

6.2 Regulatory Disclosure

We may disclose your data when required by UAE law, court order, or regulatory authority (including UAE FIU for AML purposes), or when necessary to protect our legal rights or prevent fraud.

6.3 App Store Platforms

In connection with publisher account transfers, certain business information (app name, category, and associated identifiers) is shared with Apple and Google in accordance with their developer programme terms.

6.4 No Sale of Data

We do not sell, rent, or trade your personal data to third parties for marketing purposes.

7. International Data Transfers

Your data may be transferred to and processed in countries outside the UAE in connection with the services of our third-party processors (including Anthropic, OpenAI, Stripe, and Google). When we transfer data internationally, we ensure appropriate safeguards are in place, including:

Data Processing Agreements with each processor incorporating standard contractual clauses (SCCs) where required under GDPR
Adequacy decisions or equivalent protections under UAE PDPL
Contractual obligations on processors to maintain confidentiality and implement appropriate technical and organisational security measures

You may request details of the specific safeguards applicable to any transfer by contacting privacy@17vlt.com.

8. Data Retention

We retain your personal data as follows:

Application data (Tier 1–2): 3 years from last activity
Active founder data (Tier 3+): Duration of relationship plus 5 years
KYC and AML records: 7 years per UAE Federal Decree-Law No. 20/2018
Financial and legal records (MCA, IP assignments): 7 years
Marketing data: Until you withdraw consent

You may request deletion of your data at any time, subject to our legal retention obligations.

9. Cookies and Tracking

Our Platform uses cookies and similar technologies. We use:

Essential cookies — required for basic Platform functionality; no consent required
Analytics cookies (PostHog) — are not activated until you give prior consent
Payment processing cookies (Stripe) — required where payment services are used
Scheduling cookies (Calendly) — require prior consent for EU users

You can manage cookie preferences via our cookie consent tool or at 17vlt.com/cookies. Withdrawing consent for non-essential cookies does not affect your ability to use the Platform.

10. Your Rights

Under UAE PDPL and applicable GDPR provisions (where applicable), you have the right to:

Access your personal data
Correct inaccurate data
Request erasure (subject to legal retention obligations)
Restrict processing
Receive your data in portable format
Object to processing based on legitimate interests
Withdraw consent at any time (without affecting the lawfulness of prior processing)
Request human review of any AI-assisted decision affecting you

To exercise any of these rights, contact us at privacy@17vlt.com. We will respond within thirty (30) days.

11. Data Security

We implement appropriate technical and organisational measures including: encryption of data in transit and at rest; access controls and role-based permissions; regular security assessments; and secure vendor agreements. In the event of a personal data breach, we will notify you and relevant authorities as required by UAE PDPL and, where applicable, GDPR Article 33.

12. Children’s Privacy

Our Platform is not directed at individuals under the age of 18. We do not knowingly collect personal data from minors. If we become aware that we have collected personal data from a minor, we will delete it promptly.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by posting a notice on our Platform at least fourteen (14) days before the changes take effect. Your continued use of the Platform after such notification constitutes acceptance of the updated Policy.

14. 17VLT Community Mobile App

14.1 Scope and controller

This section applies specifically to the 17VLT Community mobile application. Ambersoft FZE LLC is the controller. The app is intended for people aged 18 or older and may be available worldwide through supported app stores, subject to sanctions and applicable law. The Fund, KYC, MCA, payment and founder AI provisions elsewhere in this Policy apply only when you use those separate services.

14.2 Community data we process

account and sign-in data: email address, email one-time passwords, X or Sign in with Apple provider identifiers, optional first-use name/email, opaque session records and a random app-install device identifier;
profile data: display name, avatar reference, biography, positioning, roles, industries and mentor/investor preferences;
Community Content: posts, answers, polls, votes, helpful marks, projects, applications, journey updates and direct messages;
safety data: blocks, moderation reports, filtered-content events, moderation decisions and account restrictions;
product records: Terms acceptance, notification preferences, token ledger/escrow, mock Store history and feature interaction required to operate the product;
limited technical data: request IP address, timestamps, app/platform version, security events and error context needed for authentication, rate limiting and diagnosis.

14.3 Purposes and legal bases

We use this data to create and secure accounts; provide profiles, Community feeds, polls, projects, applications and messaging; apply member preferences; maintain the server-authoritative token ledger; enforce Terms; receive reports and blocks; prevent fraud and abuse; provide support; comply with law; and delete accounts. The applicable bases are contractual necessity, legitimate interests in operating and securing the service, legal obligation and consent where specifically requested.

14.4 Providers and international processing

Community data may be processed for us by cloud hosting/database infrastructure, transactional email delivery and support/security providers. Apple and X process data when you choose their authentication method under their own terms. We use contractual and other appropriate safeguards for international transfers where required. We do not sell Community data. The native Community app communicates with 17vlt-api for Community functions and does not connect directly to a database. It has no push notification runtime and does not collect payment-card details, contacts, precise GPS location or data for Fund scoring.

Optional campaign measurement uses the AppsFlyer SDK after separate device consent. On iOS it also requires App Tracking Transparency authorization. AppsFlyer processes available advertising and installation identifiers, device and app information, network information such as IP address (which may indicate an approximate country, region or city), app installs and launches, and two conversion events: onboarding completion and a successful Community application submission. We do not attach names, email addresses, Community account identifiers, message or application contents, session tokens, or purchase values to these events. Configured advertising partners may receive campaign measurement data through AppsFlyer; this includes Meta Ads only when that integration is enabled. You may decline or withdraw measurement consent in the app's Account settings and continue using Community. Withdrawal stops future SDK measurement. Requests about previously processed data may be sent to privacy@17vlt.com.

If you join through an invited agent's referral link and permit measurement, we may match the AppsFlyer installation identifier and agent code to your first verified Community join and record confirmed foreground intervals and session counts to calculate the agent's rewards. We also process relevant application and verified funding stages for the program. Agents see pseudonymous progress and award statuses, not your name, email, device identifier, messages or project contents. Authorised staff review program disputes, fraud flags and external payout records. Refusing measurement does not prevent Community access; it means the join is not eligible for measured referral rewards. Account settings allow you to stop future measurement and foreground collection.

14.5 Community retention

active account, profile and Community Content: while the account is active;
email one-time password: 15 minutes; mobile session: up to 30 days unless revoked;
X/Apple linking attempt: until its short-lived expiry or successful use;
encrypted pending Apple revocation token and retry metadata: only while provider revocation remains unresolved, then removed when the revocation attempt is resolved;
moderation reports and abuse evidence: 3 years after closure;
security, rate-limit and access logs: up to 12 months;
Terms acceptance and token/mock Store audit records: 7 years after account closure;
support, privacy and deletion requests: 3 years after closure;
referral installation identifiers and raw foreground evidence: up to 30 days; longer-lived pseudonymous qualification and award records remain while the associated Community account and agent program exist, unless deleted earlier;
a server-only internal account identifier and deletion timestamp: while the shared operational account or required integrity record exists, solely to prevent deleted Community access from being restored;
backups containing deleted Community data: overwritten or rendered inaccessible within 90 days through the normal backup cycle.

A legal hold, active safety investigation or dispute may require longer restricted retention. We do not use retained records to recreate a deleted Community account.

14.6 Account deletion

You may delete your Community account in the app. If you cannot access it, email privacy@17vlt.com from the account email when possible. We may use a privacy-minimising verification step. The Community profile and Community Content are deleted, authentication identities are removed, and active mobile sessions and applicable Apple authorisation are revoked. Any retained safety, consent and audit records follow the periods above, cannot authenticate or recreate the account, and do not retain the member's Community Content. The minimal server-only deletion marker described above contains no email, provider identity, profile, Content or session credential.

Community deletion also removes your person-level referral attribution, identifiers, activity, award postings, funding facts and review evidence, and ends eligibility for future referral awards. We do not retain referral fingerprints or hashed identifiers to restore this history. A shared external transfer record may remain solely as an agent-level amount and payment reference without your referral allocation. Deleting an agent's Community account removes their agent program profile and history without deleting other members. Existing external transfers cannot be undone. Previously exported files, provider records and backups require their separate deletion and retention processes; contact privacy@17vlt.com for those requests.

14.7 Cookies and local mobile storage

The Cookie Policy describes browser cookies used by 17vlt.com. The native Community app does not use browser cookies. It uses protected device storage for the opaque mobile session and ordinary local storage for app preferences, including the device's campaign measurement choice. With the consent described above, AppsFlyer also maintains installation and attribution state on the device. These SDK records are distinct from the app's authentication session. On Android, SecureStore and AppsFlyer state are excluded from app backup and device transfer.

15. Contact

17VLT Fund — Ambersoft FZE LLC

BLA-SP1-39, AMC Boulevard-A Building, Ajman Media City, UAE

General enquiries: legal@17vlt.com

Data protection: privacy@17vlt.com

Website: 17vlt.com

17VLT Platform — Ambersoft FZE LLC · Privacy Policy · October 13, 2026 · 17vlt.com