How TraitLayer plans to handle personal information.

1. Who we are and scope

Mind Vault LLC is the designated owner and product operator of TraitLayer. Subject to qualified counsel confirming the applicable roles, Mind Vault LLC expects to determine why and how TraitLayer product information is processed.

Operator

Mind Vault LLC

Privacy contact

[PRIVACY EMAIL TO BE ADDED]

Mailing address

[MAILING ADDRESS TO BE ADDED]

EU or UK representative and DPO

[COUNSEL TO DETERMINE WHETHER REQUIRED]

This draft covers the planned TraitLayer website, assessment, account, cards and generated media, Pair and Circle experiences, public Team Deck embeds, purchases, and personal or group agent connections. It is written for adults in the United States, Canada, the United Kingdom, Ireland, Australia, and New Zealand. TraitLayer is an adults-only service for people who are 18 or older.

A company website displaying a public Team Deck may have its own privacy practices. This notice covers TraitLayer's handling, not the independent practices of that company or another site.

2. Information we plan to handle

TraitLayer is designed to collect the minimum information needed for a specific, disclosed purpose.

Separate research participation is optional. No research dataset is authorized yet. Before research collection, TraitLayer must provide a study-specific consent, protocol, de-identification method, recipient list, withdrawal rules, and retention period.

3. How we plan to use information

TraitLayer plans to use personal information only to:

• create and secure an account and provide recovery;
• administer the assessment and calculate versioned, deterministic results;
• show a private profile and create artifacts the person requests;
• honor separate publication, relationship, research, likeness, and agent-access choices;
• process purchases, deliver paid outputs, prevent fraud, and maintain required records;
• operate, secure, debug, and improve the service using minimized operational data;
• respond to support, privacy, safety, and legal requests; and
• comply with applicable law and protect users, the service, and others.

Lawful basis is not yet finalized

Privacy laws use different terms and legal tests. Before real-data launch, qualified counsel must map every purpose and data category to the applicable basis in each launch jurisdiction and identify any sensitive-information conditions. The final notice must distinguish processing needed to provide a requested service or purchase, processing based on a separate consent, processing needed for a legal obligation, and any processing supported by a documented legitimate-interest or comparable assessment. This draft makes none of those legal determinations.

When TraitLayer asks for consent, the choice must be specific to the purpose and capable of withdrawal. Product use, research, public sharing, Pair or Circle use, a Work Card, a public Team Deck, likeness generation, full redraw, personal agent access, and group agent access use separate choices. Payment, a company role, or an invitation never substitutes for consent.

No consequential profile decisions

TraitLayer will not use or provide profile data to make or recommend hiring, promotion, performance evaluation, task allocation, retention, termination, credit, insurance, housing, education-admission, medical, legal, immigration, or public-benefit decisions. It will not rank people for opportunity. The assessment score path is deterministic, and any AI-created narrative cannot change a score. TraitLayer is not designed to make decisions that produce legal or similarly significant effects about a person.

4. Who may receive information

Subject to final contracts and configuration, limited information may go to:

• Cloudflare, for website delivery, Workers, EU-jurisdiction D1 and R2 storage, security, and approved infrastructure services;
• Google, when you choose Google sign-in, for the OAuth exchange and account verification;
• an email delivery provider, for a requested one-time sign-in or service message;
• Stripe and payment-system participants, for checkout, payment processing, fraud prevention, tax features if enabled, refunds, disputes, and compliance;
• approved media, moderation, or model providers, only for a feature you request and only after the provider passes the region, retention, training, security, and deletion review;
• professional advisers and authorities, where appropriately required for legal, tax, accounting, security, or claims work; and
• the public, but only for information the profile owner deliberately publishes.

The default True Face design keeps the real face inside TraitLayer's sanitizer and compositor. An image model receives a personless fantasy-scene prompt, not the person's face, name, answers, scores, or account identifier. A full-likeness redraw remains off until a separate opt-in, provider notice, transfer review, retention contract, and approval workflow are complete.

TraitLayer does not plan to sell profile information, share it for cross-context behavioral advertising, use it for ad targeting, or allow providers to train models on private answers, free text, profiles, or photos. The final notice must use any jurisdiction-specific opt-out language that counsel determines applies.

5. Private profiles and public sharing

• A completed profile is private by default.
• The person described controls publication. A friend, host, manager, company administrator, or payer cannot publish or broaden it.
• A publication contains only the exact display name or alias, version, and highlights the person approves.
• A retest creates a new private version. Existing publications do not follow it automatically.
• Pair Cards require both adults to approve the same preview.
• Work Cards and Team Deck tiles require the member's current, version-pinned approval.

A public share or public company Team Deck embed is intentionally public. People, search or archiving services, and third-party sites may copy, screenshot, download, or cache it. Revocation makes the live TraitLayer publication unavailable and TraitLayer will purge controlled caches where possible, but TraitLayer cannot recall copies held outside its control. The interface must disclose this before publication.

6. Retention and deletion

An account holder will be able to export and delete their account without paying. Deletion is designed to revoke live shares and credentials, stop queued work, remove profile data and requested generated assets from primary stores, and retain only narrowly justified records or irreversible digests. A production restore must run an independent deletion scrubber before traffic resumes. This restore-safe process is not yet active and remains a real-data launch blocker.

7. Storage and international processing

TraitLayer's product D1 database, planned separate account D1 database, and private R2 buckets use Cloudflare's EU jurisdiction. That selection constrains those storage services. It does not mean every Worker execution, network edge, security service, OAuth exchange, email delivery, payment, support action, or model inference occurs only in the European Union.

Google, email providers, Stripe, Cloudflare services outside the selected stores, and any approved media provider may process information across borders. Before launch, Mind Vault LLC must publish a verified processor and subprocessor inventory, practicable destination countries, roles, contractual safeguards, and transfer mechanism for each launch jurisdiction. [TRANSFER ASSESSMENT AND DESTINATION LIST TO BE COMPLETED]

8. Your choices and rights

Depending on where you live and which law applies, you may have rights to:

• know whether and how personal information is handled;
• access, export, or receive a copy of it;
• correct inaccurate information;
• delete information or close an account;
• withdraw a consent for future processing;
• object to or restrict certain processing;
• receive portable data where the law provides it;
• appeal or complain about a privacy response; and
• receive equal service and pricing when exercising a privacy right where applicable.

TraitLayer plans self-service export, publication revocation, and account deletion. A privacy request may require proportionate identity verification. The final notice must name the request method, response process, authorized-agent process, appeal method, and legally required timeframes. [RIGHTS REQUEST WORKFLOW TO BE COMPLETED]

Withdrawing optional research, likeness, publication, or agent-access consent does not make earlier lawful processing disappear, and it cannot recall a public copy held outside TraitLayer. It does stop the corresponding future TraitLayer use once the live revocation is processed.

9. Cookies, security, and age

TraitLayer plans to use host-only, secure, strictly necessary cookies for account sessions. It does not plan advertising cookies. Google, Stripe, and another site hosting a Team Deck may use their own technologies under their own notices. A verified cookie and local-storage inventory, including any consent requirement, must be completed before launch.

Planned safeguards include encryption in transit, platform encryption at rest, separate account and product databases, pseudonymous identifiers, digest-only credentials, private photo quarantine, least-privilege access, bounded logs, and deletion monitoring. No system is perfectly secure. The security and incident-response program must pass staging and independent review before real sensitive data is accepted.

TraitLayer is only for adults 18 and older. Do not create an account, answer the assessment, upload a photo, or submit personal information if you are under 18. If Mind Vault LLC learns that an under-18 person submitted data, the final policy and operational procedure must address prompt deletion and any legally required notice.

10. Contact and complaints

Privacy questions, requests, or complaints should be sent to [PRIVACY EMAIL TO BE ADDED] or mailed to [MAILING ADDRESS TO BE ADDED]. The final notice must identify an accountable privacy owner and explain how complaints are investigated and answered.

You may also be entitled to complain to the privacy or data-protection authority where you live or work. Mind Vault LLC must identify any required lead authority, EU representative, UK representative, or data protection officer before launch. This draft does not claim that any one authority or role applies.

11. Changes to this notice

The effective notice will have an effective date and version. Material changes will be explained before they apply, and TraitLayer will ask for a new choice when the law or the changed purpose requires it. A new notice does not silently broaden an existing publication, research, likeness, or agent-access grant.