Privacy Policy

2. Personal data we collect

Data you give us

• Account details: email address, password (stored only as a salted one-way hash), name, country, and the referral code or link you registered with.
• Identity verification: legal name, date of birth, nationality, country of residence, address, phone number, photos of your identity document, a selfie and short face-scan frames.
• Messages: what you send us when you contact support, raise a complaint or ask about your data.

Data created when you use Gold AH

• Financial activity: wallet balances, ledger transactions, deposits, withdrawals and their destination addresses, packages, prediction positions, rewards, promo codes and referral earnings.
• Verification results: the outcome of our automated document and face checks and the decisions our compliance staff make.
• Referral network: who invited you and who you invite.

Data collected automatically

• Device and security: IP address, approximate location worked out from the IP address, browser and device details, time zone, language, sign-in times, and signals collected while you verify your identity to help detect fraud.
• Notifications: the push notification token of each browser or device where you turn alerts on.
• Browser storage: the items described in our Cookie and Browser Storage Policy. We do not use advertising, analytics or third-party tracking cookies.

Data from Google

If you choose Sign in with Google, we receive the Google user data described in section 3.

3. Google user data

This section applies when you choose Sign in with Google. Using Google is optional; you can always create an account with an email address and password instead.

3.1 What Google user data we access

With your permission, Gold AH uses Google Sign-In (OAuth 2.0) and requests only the openid, email and profile scopes. Through them we access:

• your Google account ID, a number that identifies your account;
• your email address and whether Google has verified it;
• your name as shown on your Google account;
• the web address of your Google profile picture.

We do not request or access your Gmail, Google Drive, Contacts, Calendar, YouTube or any other Google service, and we never receive your Google password.

3.2 How we use Google user data

We use Google user data only to provide Sign in with Google and the account features you asked for:

• to create your Gold AH account and link it to your Google account;
• to sign you in securely without a separate password;
• to fill in your name and show your name and profile picture in the app;
• to send account and security messages to your email address, such as sign-in alerts and verification updates.

We do not use Google user data for advertising, for marketing profiles, to decide creditworthiness or for lending, and we do not sell it. We do not use Google user data to develop, improve or train generalised or non-personalised artificial intelligence or machine learning models.

3.3 How we store Google user data

Your Google account ID, email address, name and profile picture address are stored with your Gold AH account in our database on servers we control. We check the sign-in token Google sends at the moment you sign in and then discard it. We do not store Google access tokens or refresh tokens, because we do not need ongoing access to your Google account.

3.4 How we share, transfer or disclose Google user data

We do not sell, rent or trade Google user data, and we do not share it with advertisers, data brokers or information resellers. We only share it:

• with the service providers that run Gold AH for us, under contract and only to provide the service: our hosting provider, which runs the servers where the data is stored, and our email delivery provider, which delivers account emails to your address;
• when the law, a court order or a regulator requires it;
• as part of a merger, acquisition or sale of assets, only after we have asked for and received your explicit consent.

3.5 How we protect Google user data

• All data travels between your device and Gold AH over encrypted HTTPS (TLS).
• Our database and file storage run on servers we control, with access limited to authorised staff who need it for their work.
• Staff access to member records is logged.
• Sign-in sessions use random tokens that we store only as one-way hashes, and they expire.

3.6 How long we keep Google user data and how to delete it

We keep your Google account ID and profile picture address while your Gold AH account is open. If you close your account or ask us to delete your data, we delete your Google account ID and profile picture address within 30 days. Your email address and name also form part of the account and transaction records we must keep by law, so we keep those while your account is open and for 5 years after it closes, unless the law requires us to keep it longer, and then delete them.

To ask us to delete your data, email privacy@goldah.trade from the address on your account. You can also remove Gold AH's access to your Google account at any time at myaccount.google.com/permissions. After you remove access, we receive no further data from Google.

3.7 Limited Use

Gold AH's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

4. How we use personal data

If you use support chat, we keep your questions and the replies so you can continue the conversation. Ticket submission also collects the name and email you confirm for the support team. Your questions and conversation context are processed by our AI service provider to prepare automated replies. Do not share passwords, private keys, verification codes or identity documents in chat.

When you are signed in, you can attach an account record to a support question, for example a deposit, withdrawal, wallet, transfer, package, prediction, signal grant, verification, referral or VIP record, or ask about one of them directly. Gold AH then checks that the record belongs to your account and sends a short summary of it to our AI service provider so the reply can answer your question. The summary is limited to details such as the record type, status, amounts, dates and counts such as your team size, and never includes your name, email address, phone number, payout addresses, identity documents or verification decision reasons. We store only a pointer to the attached record in the conversation and check it again whenever you view it, but the AI's reply may repeat details from the summary and is kept with the conversation. Authorised support staff may see which records you attached. We only send account details you attach or ask about; the AI cannot browse your account.

• To provide Gold AH: open and run your account, keep the ledger, process deposits, transfers and withdrawals, run packages, predictions, signals, referrals and rewards.
• To verify your identity: check that you are who you say you are, that you are at least 18, and that you may use Gold AH where you live.
• To keep Gold AH safe: prevent fraud, multiple accounts, referral abuse and unauthorised access.
• To contact you: send account, security and transaction emails and the push alerts you turn on, and answer your requests.
• To meet legal obligations: keep records, meet anti-money-laundering and sanctions rules, and respond to lawful requests.

We process personal data because we need it to provide the service you signed up for, because the law requires it, because we have a legitimate interest in keeping Gold AH secure, or because you gave your consent, for example when you turn on push alerts. We do not sell personal data and we do not use it for advertising.

5. Who receives personal data

These service providers process personal data for us, only on our instructions and only to provide Gold AH:

• Our hosting provider, which runs the servers for the website, app, database and file storage.
• Our email delivery provider, which delivers our emails.
• Our push notification provider, which delivers push alerts, only where you turn them on.
• Our payment processor, which processes crypto deposits.
• Our AI support provider, which processes support questions, conversation context and summaries of account records you attach or ask about to prepare automated replies (section 4). Authorised support staff can read conversations and tickets to answer your requests.

Identity checks and IP location run on our own servers and are not sent to outside verification services. We also disclose personal data when the law, a court order or a regulator requires it, or to protect members and Gold AH from fraud.

6. International transfers

AH Gold LLC is based in the United States, and our service providers may process data in the United States and other countries. Where data leaves your country, we use service providers that are bound by contract to protect it.

7. How we protect personal data

• Data is encrypted in transit with HTTPS (TLS).
• Identity documents and selfies are encrypted at rest with AES-256 and can only be opened by authorised compliance staff.
• Passwords are stored only as salted PBKDF2-SHA256 hashes.
• Staff access is limited to what each role needs, and administrative actions are recorded in an audit log.

No system is perfectly secure. If a breach affects your personal data, we will tell you and the relevant authorities as the law requires.

8. How long we keep personal data

• Identity documents, account records and transaction records: kept while your account is open and for 5 years after it closes, unless the law requires us to keep it longer.
• Email delivery records: deleted after 30 days.
• Push delivery records: deleted after 7 days.
• Push notification tokens: deleted when you turn alerts off or when the push service reports the token is no longer valid.
• Google user data: as described in section 3.6.
• Support conversations and tickets: deleted 90 days after closure. Open tickets remain available until resolved. This does not change the retention period for account, transaction or identity records.

When a retention period ends, we delete the data or make it anonymous.

9. Your rights and choices

Depending on where you live, you may ask us to:

• give you a copy of the personal data we hold about you;
• correct data that is wrong or incomplete;
• delete your data, subject to the records the law requires us to keep;
• restrict or object to how we use your data;
• send your data to you or another service in a portable format;
• withdraw consent you gave, such as for push alerts.

Email privacy@goldah.trade from the address on your account. We may ask you to confirm your identity, and we reply within 30 days. You can turn push alerts off at any time in Settings, and you can remove Gold AH's access to your Google account at myaccount.google.com/permissions. You may also complain to the data protection authority where you live.

10. Children

Gold AH is only for people aged 18 or over. We do not knowingly collect data from anyone younger. If we learn that we have, we close the account and delete the data unless the law requires us to keep it.

11. Changes to this policy

When we change this policy, we update the effective date at the top. If a change is material, including any change to how we use Google user data, we tell members by email or in the app before it takes effect.

• Version 1.1, effective 1 October 2026: support chat can use a summary of account records you attach or ask about, as described in section 4.
• Version 1.0, effective 29 September 2026: first published version.

12. Contact us

AH Gold LLC, c/o Avalon Group Realty (statutory agent), 3401 Enterprise Parkway #340-483, Beachwood, OH 44122, United States.

• Privacy questions and requests: privacy@goldah.trade
• General support: support@goldah.trade
• Complaints: complaints@goldah.trade

This policy is governed by the laws of the State of Ohio, United States.