Privacy Policy
Shake Defi, Inc.
Effective Date: August 28, 2026
Last Updated: August 28, 2026
1. Introduction
Welcome to Shake Defi. This Privacy Policy explains how Shake Defi, Inc. ("Shake Defi," "we," "us," or "our") collects, uses, stores, and protects your personal information when you use our mobile application (the "App").
Shake Defi facilitates secure transactions between users who exchange goods or services for currency. As part of our commitment to transaction security and dispute resolution, we collect certain personal information, including facial images captured during the digital signature process.
By using the App, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree with this Privacy Policy, please do not use the App.
Company Information:
- Legal Name: Shake Defi, Inc.
- Physical Address: Brookfield, Wisconsin
- Governing Law: California state law
- Arbitration Venue: California
2. Information We Collect
2.1 Identity Verification Information (KYC Data)
To comply with legal and regulatory requirements, we collect the following Know Your Customer (KYC) information:
- Full legal name
- Email address
- Phone number
2.2 Facial Images
Important Notice: When you sign a transaction agreement using the App, our front-facing camera captures an image of you during the signing process.
Purpose: These facial images serve as a security measure to help verify the identity of the person signing the agreement. In the event of a transaction dispute, these images may be used to confirm whether the person who signed the agreement is the same person filing the dispute claim.
Prior Notification: You will be clearly notified before any image is captured. You have the right to cancel the process at any time before the image is taken if you do not wish to proceed.
Consent: By proceeding with the signature process after being notified, you provide explicit consent to have your facial image captured and stored in accordance with this policy.
2.3 Transaction Information
We collect the following information related to your transactions:
- Transaction amount
- Transaction date
- Transaction description
- Location data for each transaction (for both parties)
- Publicly available blockchain transaction hash
2.4 Information We Do NOT Collect
We do not collect:
- Device information (device ID, operating system details, etc.)
- Browsing history or in-app behavior analytics
- Biometric data other than the facial images described above
3. How We Use Your Information
3.1 Transaction Facilitation and Security
- To facilitate and process transactions between users
- To verify the identity of parties in a transaction
- To prevent fraud and unauthorized transactions
- To maintain transaction records
3.2 Dispute Resolution
Facial images, photographs, text descriptions, User statements, and transaction information are used exclusively for dispute resolution purposes. If a dispute arises regarding a transaction:
- The facial image and other evidence captured during the transaction may be shared only with the parties directly involved in the specific dispute
- The evidence will be used to verify the identity of the signing party and support dispute resolution
- No other personal information will be shared except as necessary to resolve the dispute
3.3 Customer Support and Service Improvement
We may use collected data internally for:
- Responding to customer support inquiries
- Improving App functionality and user experience
- Analyzing transaction patterns to enhance security measures
- Internal analytics (aggregated and anonymized where possible)
3.4 Legal Compliance
We use your information to:
- Comply with applicable laws and regulations
- Respond to lawful requests from authorities
- Enforce our Terms of Service and other agreements
3.5 Public Marketplace Broadcasting
When you elect to use the optional "Post to Marketplace" feature, we process and format your transaction listing information — including item photos, description, price, currency, escrow holding period, general location (City, State/Province, and Country), in-person preferences, and Mini App deep links — to transmit and broadcast the listing to public Telegram communication channels upon your request.
4. Facial Image Collection and Storage
4.1 Notification and Consent
Before any facial image is captured:
- You will receive clear, conspicuous notification that the front-facing camera will take your picture
- You will have the opportunity to review this Privacy Policy
- You may cancel the signature process if you do not wish to proceed
- Proceeding with the signature constitutes your explicit consent
4.2 Purpose Limitation
Facial images are collected solely for identity verification in the event of transaction disputes. We will never:
- Use facial images for facial recognition technology or biometric analysis
- Share facial images with third parties for marketing purposes
- Sell facial images to any party
- Use facial images for any purpose other than dispute resolution
4.3 Data Retention
During Escrow Period: Facial images are retained throughout the "Escrow Period" as defined in your written agreement with the other transaction party.
After Escrow Period (No Dispute): If no dispute arises, we will permanently delete your facial image within 24 hours of the end of the Escrow Period.
In Case of Dispute: If a dispute is initiated, facial images will be retained until the dispute is fully resolved and any applicable appeal periods have expired, after which they will be permanently deleted within 30 days.
4.4 Storage Security
Facial images are stored in our secure database with the following protections:
- Database access is restricted to whitelisted IP addresses only
- Database encryption keys are stored in Azure KeyVault, a secure key management service
- Access is limited to authorized personnel on a need-to-know basis
- Regular security audits are conducted
5. Information Sharing and Disclosure
5.1 Our Commitment to Privacy
We take your privacy seriously. We will never share your personal information, including:
- Home or business addresses
- Email addresses
- Facial images
- Phone numbers
- Transaction details
5.2 Transaction Disputes
Limited Disclosure: In the event of a transaction dispute, we may share relevant information with involved parties to facilitate resolution. This may include facial images, photographs, text descriptions, and User statements provided as evidence only with:
- The other party or parties directly involved in the disputed transaction
- Legal representatives of the parties, if applicable
- Arbitrators or mediators involved in resolving the dispute
5.3 Third-Party Service Providers
We work with the following third-party service providers who may independently collect and process your information:
Persona: Our identity verification partner who collects and processes KYC information. Persona operates under its own privacy policy, which you should review.
Microsoft Entra ID: Our authentication and identity management service provider that handles OAuth2 login processes for the App. Microsoft Entra ID may collect and process authentication-related information in accordance with Microsoft's privacy policies.
Coinbase: Payment processor who facilitates cryptocurrency wallet services, payment infrastructure, and blockchain transaction capabilities. "Coinbase" refers to the Coinbase entity or entities described in Section 1 above. Coinbase may independently collect user data in accordance with their own Terms of Service and Privacy Policy.
Telegram: Third-party messaging platform that hosts public Marketplace Channels and powers bot and Mini App integrations. When you choose to broadcast listings, Telegram receives and hosts the broadcasted listing content. Telegram processes data in accordance with its own Privacy Policy.
We do not share your facial images, full legal name, phone number, or email address with Telegram.
5.4 Legal Requirements
We may disclose your information when required by law, including:
- In response to valid legal process (subpoenas, court orders, etc.)
- To comply with applicable laws and regulations
- To protect the rights, property, or safety of Shake Defi, our users, or others
- In connection with an investigation of fraud, intellectual property infringement, or other illegal activity
5.5 Business Transfers
In the event of a merger, acquisition, bankruptcy, or sale of assets, your information may be transferred to the successor entity. We will notify you via email or prominent notice in the App before your information becomes subject to a different privacy policy.
5.6 Public Marketplace Channel Broadcasts
When a User (such as a Merchant) chooses to use the optional "Post to Marketplace" feature, the following privacy practices apply:
- Voluntary and User-Initiated: Broadcasting a listing to the Marketplace Channel is entirely optional and occurs only when affirmatively initiated by the User.
- Publicly Broadcast Data: Information transmitted to the public Telegram channel includes item photographs, item descriptions, price, currency, escrow terms, the seller's general location (City, State/Province, and Country), in-person transaction preferences, and transaction ID keywords or Mini App deep links.
- Protected Data (Omitted from Broadcasts): We strictly exclude direct personal identifiers from public broadcasts. The seller's full legal name, phone number, email address, exact physical street address, and facial signature verification images are never included in Marketplace Channel broadcasts.
- Public Environment & Third-Party Persistence: Content posted to public Telegram channels is visible to all channel members and viewers. While the App provides tools to update listing details, reflect status changes (e.g., "Pending" or "Sold"), or delete listings, the Company cannot control or erase copies, message forwards, screenshots, or local device caches retained by third-party users or external platform archives.
6. Data Security
6.1 Security Measures
- Database Access Control: Our database is accessible only from whitelisted IP addresses
- Encryption: Database encryption keys are securely stored in Azure KeyVault
- Access Restrictions: Personal information access is limited to authorized personnel only
- Regular Audits: We conduct periodic security assessments
- Secure Transmission: Data transmitted between your device and our servers is encrypted
6.2 Limitations
While we strive to protect your information, no method of transmission or storage is 100% secure. We cannot guarantee absolute security but will notify you of any data breach affecting your personal information as required by applicable law.
7. International Data Transfers
Shake Defi operates internationally. Your information, including facial images, may be transferred to and stored on servers located outside your country of residence, including in the United States.
By using the App, you consent to the transfer of your information to countries that may have different data protection laws than your country of residence. We take steps to ensure that your information receives an adequate level of protection wherever it is processed.
8. Your Rights and Choices
8.1 Access and Correction
You have the right to:
- Access the personal information we hold about you
- Request correction of inaccurate or incomplete information
- Receive a copy of your personal information in a portable format
8.2 Account and Data Deletion
You have the right to delete your account and associated data at any time through the App settings or by contacting us directly.
Upon Account Deletion:
- Your account will be permanently closed
- Your personal information, including facial images, will be permanently deleted within 30 days
- Some information may be retained as required by law or for legitimate business purposes (e.g., transaction records for tax compliance)
8.3 Withdrawal of Consent
You may withdraw your consent to facial image collection at any time by:
- Declining to proceed when notified before image capture
- Deleting your account
- Contacting us to request deletion of specific facial images (subject to legal retention requirements)
8.4 Marketing Communications
We do not currently send marketing communications. If this changes in the future, you will have the right to opt out of marketing emails while continuing to receive service-related communications.
9. Children's Privacy
The App is not intended for use by individuals under the age of 18 or under the age of majority in their jurisdiction, whichever is greater. We do not knowingly collect personal information from minors.
To use the App, you must:
- Be at least 18 years of age or the age of majority in your jurisdiction, whichever is greater
- Meet all account registration and verification requirements as outlined in our Terms of Service
10. Third-Party Links and Services
The App may contain links to third-party websites or services. This Privacy Policy does not apply to those third parties. We encourage you to review the privacy policies of:
- Persona: Privacy Policy
- Microsoft: Privacy Policy
- Coinbase: Privacy Policy
- Telegram: Privacy Policy
11. Data Storage and Infrastructure
11.1 Database Security
Our primary database infrastructure includes:
- Access Control: IP whitelist-based access restrictions
- Key Management: Encryption keys stored in Microsoft Azure KeyVault
- Redundancy: Regular backups to prevent data loss
- Monitoring: Continuous monitoring for unauthorized access attempts
11.2 Data Location
User data, including facial images, is stored on secure servers. The specific geographic locations may vary based on our infrastructure needs, but all locations maintain appropriate security standards.
12. California Privacy Rights
If you are a California resident, you may have additional rights under the California Consumer Privacy Act (CCPA) and other California privacy laws. While Shake Defi, Inc. is currently not subject to CCPA due to revenue thresholds, we respect California residents' privacy rights.
13. European Union and International Privacy Rights
If you are located in the European Union, European Economic Area, United Kingdom, or other jurisdictions with comprehensive data protection laws, you may have additional rights under regulations such as GDPR, including:
- Right to erasure ("right to be forgotten")
- Right to restrict processing
- Right to data portability
- Right to object to processing
- Right to lodge a complaint with a supervisory authority
14. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors.
Notification of Changes:
- We will notify you of material changes via email or prominent notice in the App
- The "Last Updated" date at the top of this policy will be revised
- Continued use of the App after changes constitutes acceptance of the updated policy
15. Contact Us
If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:
Shake Defi, Inc.
280 N. Market St, Unit 321
Brookfield, Wisconsin 53045
Email: contact@shakedefi.com
For dispute resolution matters, any dispute arising out of or relating to this Privacy Policy or the Services shall be resolved through binding arbitration in accordance with the Commercial Arbitration Rules of the American Arbitration Association. The arbitration shall be conducted in California. Please refer to Section 12 of our Terms of Service for complete arbitration procedures.
16. Consent and Acknowledgment
By using the Shake Defi App, you acknowledge that:
- You have read and understood this Privacy Policy
- You consent to the collection, use, and storage of your information as described
- You understand that facial images will be captured during transaction signing
- You have been notified of your right to cancel before image capture
- You consent to international data transfers as described
- You agree to the dispute resolution provisions regarding information sharing
- You understand that opting into the Marketplace Channel broadcasts your listing details and general location to a public third-party channel
Looking for our End User License Agreement? Read it here.