Privacy Policy

Effective date: May 26, 2026 Protected by patented Secure Virtual Space™ technology — U.S. Patent 9,092,120 · Canadian Patent 2,777,611

BlockCertsAI is committed to being a responsible custodian of the information you entrust to us. We built the Secure Virtual Space™ (SVS) — our patented, cryptographically isolated environment — precisely so that your data lives under your control, not ours. This Policy explains, in plain language, what we collect, how we collect it, how we use it, who we share it with, and the choices and rights you have.

BlockCertsAI is made up of several legal entities, including BlockCerts Blockchain Canada, Inc. (which operates the Platform, the Website, and the MAIAi® application) and BlockCerts Blockchain Inc. (which is responsible for the BCERT token offering). References to "BlockCertsAI," "BlockCerts," "we," "us," or "our" mean the relevant entity responsible for processing your data. (Confirm the exact operating entity for the MAIAi App store listing before publishing.)

This Policy covers our "Services," which include: the BlockCertsAI platform and Secure Virtual Space™ (the Platform); the MAIAi® AI assistant; the MAIAi mobile and desktop applications for iOS, Android, macOS, and Windows (the Apps); our websites, including www.blockcerts.com, www.blockcertsai.com, and www.securevirtualspace.com, together with all subdomains (the Website); our SMS service; the BCERT token offering; and any future services we provide.

Your use of the Platform and Apps requires acceptance of our End User License Agreement (EULA), which governs your license to the patented SVS technology and should be read alongside this Policy.

Quick summary (the short version)

• What the MAIAi App collects to create your account: your first name, a verified email address, a verified mobile number, and the content of the requests you make to MAIAi.
• Why we verify your email and phone: to provision and lock your Secure Virtual Space™ to you, prevent unauthorized access, and enable account recovery — not for marketing.
• AI processing: to answer a request, MAIAi may transmit the minimum content necessary to trusted third-party AI model providers. We ask for your permission before this happens, and those providers are contractually required to protect your data to the same or a higher standard than we do, and are prohibited from using it to train their models or for advertising.
• What we never do: we do not sell your personal information, and we do not share your content with advertising networks or data brokers.
• Your data lives in your SVS: your information is encrypted and bound to your authenticated identity inside your Secure Virtual Space™.

The full detail follows.

The Secure Virtual Space™ and how it protects you

MAIAi® operates inside the Secure Virtual Space™ (SVS) — a private, sovereign, cryptographically isolated digital environment created for each licensed user under U.S. Patent 9,092,120 and Canadian Patent 2,777,611. The SVS is the foundation of how we protect your data:

• Your data, workflows, and content reside within your own SVS, encrypted and bound to your authenticated identity.
• Authentication and session integrity are enforced by our VaultCERTin® security system.
• Governance and access are anchored on our blockchain using Proof of Authentication, with the BCERT identity/access token and the INK™ metered-compute protocol.
• We do not aggregate your SVS content into a shared pool, sell it, or expose it to data brokers, and we do not use it to train public AI models.

Important clarification on AI processing. Some requests you make to MAIAi require inference from an external AI model to generate a result. In those cases, only the minimum content necessary to fulfil your request is transmitted to a trusted third-party AI model provider, solely to deliver the service you asked for, under contract terms described in the "AI model processing" section below. Outside of that disclosed, consented processing, your SVS content is not made available to third parties.

Learn more about the patented SVS technology and licensing at www.securevirtualspace.com.

The information we collect

"Personal information" is any information that identifies you or that we can link to you. We collect it when you provide it, automatically when you use the Services, and, in limited cases, from third parties.

1. Information you provide directly

To create and secure your MAIAi account / Secure Virtual Space:

• First name
• Verified email address
• Verified mobile phone number

When you use MAIAi:

• The content of the requests, prompts, files, and instructions you submit to the assistant, and the results generated for you within your SVS.

When you contact us or opt in: your name, contact details, and the content of your communications (support requests, emails, social channels, survey responses), and your SMS opt-in if you choose to receive text messages.

Only if you purchase BCERT tokens or use regulated financial features (these are not required to use the MAIAi App), we collect the additional information described in our Know-Your-Client (KYC) and Anti-Money-Laundering (AML) policies, which may include date of birth, nationality, country of residence, government identification details, and wallet or transaction information recorded on the public blockchain. If you do not use these regulated features, we do not collect this information.

2. Information we collect automatically

When you use the Apps or Website, we and our service providers may automatically collect technical and usage data through cookies and similar technologies and through software development kits (SDKs) integrated into our Apps. This may include device type and identifiers, app version, operating system, IP address, general (city/region-level) location derived from IP, crash and diagnostic logs, and how you interact with features. We use the most privacy-protective settings we reasonably can and request consent where required.

You can control cookies through your browser or device settings, and you can manage app-level permissions (such as notifications) in your device settings. Disabling certain technologies may limit functionality.

3. Information from third parties

We may receive information from service providers that help us verify identity, secure the Platform, prevent fraud, or operate the Services. Information from third parties is governed by their own privacy practices, which may differ from this Policy.

How we collect your information

We collect personal information through three methods: (a) directly from you, when you register, communicate with us, or use MAIAi; (b) automatically, through cookies, SDKs, and server logs as you use the Apps and Website; and (c) from third-party sources, such as verification and fraud-prevention providers. We do not purchase personal profiles from data brokers.

How we use the information we collect

We use your information to:

• create, provision, and secure your Secure Virtual Space™, and verify that it belongs to you;
• authenticate access, prevent unauthorized intrusion, and maintain the integrity of your protected environment;
• enable account recovery;
• operate MAIAi and process the requests you make, including, where necessary, transmitting the minimum required content to trusted AI model providers (see below);
• respond to your enquiries and provide technical, support, and administrative notices;
• maintain, secure, and improve the Services, including diagnosing problems and analyzing aggregated usage trends;
• develop new features and services;
• detect, prevent, and respond to fraud, abuse, security incidents, and IP infringement;
• with your separate consent where required, send you communications you have asked to receive (you can opt out at any time); and
• comply with legal and regulatory obligations, including KYC/AML obligations that apply to the token offering and regulated financial features.

We may also create aggregated or de-identified data that can no longer identify you; such data is not treated as personal information under this Policy.

AI model processing

MAIAi is designed to keep your data inside your Secure Virtual Space™. To generate certain results, MAIAi may need to use one or more third-party AI model providers for inference.

When that is the case:

• What is shared: only the content reasonably necessary to fulfil your specific request (for example, the relevant portion of your prompt and the minimum supporting context), and never more than is required to produce your result.
• Why: solely to deliver the service you requested — never for advertising, profiling, or building independent profiles of you.
• Your permission: the App presents a clear, standalone consent notice that identifies the AI model provider(s) and describes what will be sent before any content is transmitted for AI processing. You can review the providers in use at the point of consent and in the App's settings.
• Provider protections: each AI model provider is contractually required to protect your data to the same or a higher standard than this Policy, to use it only to provide the requested processing, and not to use your content to train their models or for advertising.
• What stays in your control: outside of this disclosed and consented processing, your SVS content is not made available to third-party AI services.

We reference "AI model providers" generally in this Policy; the specific provider(s) in use are identified to you within the App at the point of consent so the information stays accurate as our infrastructure evolves.

How we share information

We share personal information only as described here:

• Within BlockCertsAI entities, as needed to operate the Services.
• With service providers (including cloud infrastructure, AI model providers, security, analytics, and communications vendors) who perform services on our behalf under contracts that impose confidentiality and data-protection obligations providing equal or greater protection than this Policy, and that limit them to using the data only to provide the service.
• For legal and safety reasons, to comply with applicable law, respond to lawful requests, enforce our agreements, or protect the rights, safety, and property of you, us, or others.
• In a corporate transaction, such as a merger, acquisition, financing, or asset transfer, subject to appropriate safeguards.

We do not sell, rent, or trade your personal information, and we do not share it with advertising networks or data brokers.

When you voluntarily post information in shared or public environments (for example, message boards, social media, or shared spaces), others may see and use it; please be mindful of what you share in those contexts.

Third-party services and SDKs

Our Apps and Website may include third-party software development kits (SDKs), integrations, and links. These are used for functions such as security, crash reporting, analytics, communications, and AI model inference. Third-party services are governed by their own privacy practices, which may differ from this Policy. We require our providers to maintain protections equivalent to or greater than ours, but we are not responsible for the independent practices of third parties you choose to engage with directly.

Legal grounds for processing

Where applicable law requires a legal basis, we rely on: performance of a contract (to provide the Services and your SVS); consent (for AI model processing as disclosed in the App, for marketing communications, and where otherwise required — which you may withdraw at any time); legal obligation (for example, KYC/AML requirements); and legitimate interests (to secure, maintain, and improve the Services), balanced against your rights and freedoms.

How we protect and store your information

We deploy administrative, technical, and physical safeguards — including the cryptographic isolation of the Secure Virtual Space™, VaultCERTin® authentication, and encryption of data in transit and at rest — designed to protect your information. Where third parties may access your data, we obtain assurances that they will protect it with safeguards providing a level of protection equivalent to or greater than ours.

No system can be guaranteed 100% secure, and we cannot guarantee the security of information transmitted over networks we do not control.

The Platform and Website are operated by BlockCerts Blockchain Canada, Inc. and directed from British Columbia, Canada. We and our service providers may store and process information in secure data centers in multiple jurisdictions, which means your information may be transferred to countries whose data-protection laws differ from those in your country. We retain information only as long as reasonably necessary to provide the Services and meet our legal obligations.

Your choices and rights

Subject to applicable law, you may have the right to access, correct, delete, or port your personal information, to object to or restrict certain processing, and to withdraw consent. To exercise these rights, or to withdraw consent (including consent to AI model processing or marketing), contact us using the details below. Marketing messages also include an opt-out mechanism, and you can text STOP to 1-855-624-2422 to stop SMS messages.

Please note that withdrawing certain consents — for example, consent required to operate your Secure Virtual Space™ — may mean we can no longer provide some or all of the Services. Please keep your information accurate and let us know if it changes.

Children

The Services are not directed to anyone under the age of eighteen, and we do not knowingly collect personal information from individuals under eighteen.

How to contact us

For privacy questions, to withdraw consent, or to exercise your rights, email info@blockcerts.com or use the contact form at www.blockcerts.com/contact-us. You can also reach our 24/7 support team or text STOP to 1-855-624-2422. Please include "Privacy Policy" in the subject line so we can route your request quickly.

Complaints

We will work with you to resolve any privacy concern. If you believe we have not adequately addressed it, you may have the right to complain to the data-protection authority or regulator in your jurisdiction.

Changes to this Policy

We may update this Policy from time to time. If we make material changes to how we collect, use, or share your personal information, we will post a clear and conspicuous notice on the Website and, where appropriate, within the Apps.

This document is a draft prepared for review and should be reviewed by your legal counsel before publication. Use of the Platform and Apps is subject to the BlockCertsAI End User License Agreement and the patented Secure Virtual Space™ license terms.

© 2026 BlockCertsAI. Secure Virtual Space™, VaultCERTin®, MAIAi®, BCERT, and INK™ are marks of BlockCertsAI. Protected by U.S. Patent 9,092,120 · Canadian Patent 2,777,611.