Privacy Policy
Shake Defi, Inc.
Effective Date: October 13, 2026
Last Updated: October 13, 2026
1. Introduction
Welcome to Shake Defi. This Privacy Policy explains how Shake Defi, Inc. ("Shake Defi," "we," "us," or "our") collects, uses, stores, and protects your personal information when you use our mobile application (the "App").
Shake Defi facilitates secure transactions between users who exchange goods or services for currency. As part of our commitment to transaction security and dispute resolution, we collect certain personal information, including facial images captured during the digital signature process.
By using the App, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree with this Privacy Policy, please do not use the App.
Company Information:
- Legal Name: Shake Defi, Inc.
- Physical Address: Brookfield, Wisconsin
- Governing Law: California state law
- Arbitration Venue: California
2. Information We Collect
2.1 Identity Verification Information (KYC Data)
To comply with legal and regulatory requirements, we collect the following Know Your Customer (KYC) information:
This information is collected through our third-party identity verification partner, Persona, who may independently collect additional information as described in their privacy policy.
- Full legal name
- Email address
- Phone number
This information is collected through our third-party identity verification partner, Persona, who may independently collect additional information as described in their privacy policy.
2.2 Facial Images
Important Notice: When you sign a transaction agreement using the App, our front-facing camera captures an image of you during the signing process.
Purpose: These facial images serve as a security measure to help verify the identity of the person signing the agreement. In the event of a transaction dispute, these images may be used to confirm whether the person who signed the agreement is the same person filing the dispute claim.
Prior Notification: You will be clearly notified before any image is captured. You have the right to cancel the process at any time before the image is taken if you do not wish to proceed.
Consent: By proceeding with the signature process after being notified, you provide explicit consent to have your facial image captured and stored in accordance with this policy.
Purpose: These facial images serve as a security measure to help verify the identity of the person signing the agreement. In the event of a transaction dispute, these images may be used to confirm whether the person who signed the agreement is the same person filing the dispute claim.
Prior Notification: You will be clearly notified before any image is captured. You have the right to cancel the process at any time before the image is taken if you do not wish to proceed.
Consent: By proceeding with the signature process after being notified, you provide explicit consent to have your facial image captured and stored in accordance with this policy.
2.3 Transaction Information
We collect the following information related to your transactions:
For NFT registration and transactions, we record the authenticated participant/account, relevant name and representative-capacity snapshot, linked wallet, item/NFT and transaction identifiers, role, exact text/version/language and hashes presented, intentional acceptance action and server-recorded time. We use these records to establish what was agreed, authorize the identified action, support transaction performance and resolve disputes. The ownership-term modal does not capture camera images or require a drawn signature. We do not store session tokens or private keys as acceptance evidence.
- Transaction amount
- Transaction date
- Transaction description
- Location data for each transaction (for both parties)
- Publicly available blockchain transaction hash
For NFT registration and transactions, we record the authenticated participant/account, relevant name and representative-capacity snapshot, linked wallet, item/NFT and transaction identifiers, role, exact text/version/language and hashes presented, intentional acceptance action and server-recorded time. We use these records to establish what was agreed, authorize the identified action, support transaction performance and resolve disputes. The ownership-term modal does not capture camera images or require a drawn signature. We do not store session tokens or private keys as acceptance evidence.
2.4 Information We Do NOT Collect
We do not collect:
- Device information (device ID, operating system details, etc.)
- Browsing history or in-app behavior analytics
- Biometric data other than the facial images described above
3. How We Use Your Information
3.1 Transaction Facilitation and Security
- To facilitate and process transactions between users
- To verify the identity of parties in a transaction
- To prevent fraud and unauthorized transactions
- To maintain transaction records
NFT acceptance records described in Section 2.3 are used to establish what was agreed, authorize the identified action, support transaction performance and resolve disputes. Ownership-term modal acceptance is separate from signing-photo permissions.
3.2 Dispute Resolution
For ordinary transaction agreements, facial images, photographs, text descriptions, User statements, and transaction information are used exclusively for dispute resolution purposes. If a dispute arises regarding a transaction:
NFT ownership-document signing evidence has the additional, separately accepted retention and optional buyer-audit purposes described in Section 4.6.
- The facial image and other evidence captured during the transaction may be shared only with the parties directly involved in the specific dispute
- The evidence will be used to verify the identity of the signing party and support dispute resolution
- No other personal information will be shared except as necessary to resolve the dispute
NFT ownership-document signing evidence has the additional, separately accepted retention and optional buyer-audit purposes described in Section 4.6.
3.3 Customer Support and Service Improvement
We may use collected data internally for:
- Responding to customer support inquiries
- Improving App functionality and user experience
- Analyzing transaction patterns to enhance security measures
- Internal analytics (aggregated and anonymized where possible)
3.4 Legal Compliance
We use your information to:
- Comply with applicable laws and regulations
- Respond to lawful requests from authorities
- Enforce our Terms of Service and other agreements
3.5 Public Marketplace Broadcasting
When you elect to use the optional "Post to Marketplace" feature, we process and format your transaction listing information — including item photos, description, price, currency, escrow holding period, general location (City, State/Province, and Country), in-person preferences, and Mini App deep links — to transmit and broadcast the listing to public Telegram communication channels upon your request.
4. Facial Image Collection and Storage
4.1 Notification and Consent
Before any facial image is captured:
- You will receive clear, conspicuous notification that the front-facing camera will take your picture
- You will have the opportunity to review this Privacy Policy
- You may cancel the signature process if you do not wish to proceed
- Proceeding with the signature constitutes your explicit consent
4.2 Purpose Limitation
For ordinary transaction agreements, facial images are collected solely for identity verification in the event of transaction disputes. We will never:
NFT ownership-document signing evidence is governed by the separate purposes and choices in Section 4.6.
- Use facial images for facial recognition technology or biometric analysis
- Share facial images with third parties for marketing purposes
- Sell facial images to any party
- Use facial images for any purpose other than dispute resolution
NFT ownership-document signing evidence is governed by the separate purposes and choices in Section 4.6.
4.3 Data Retention
The following escrow retention schedule applies to ordinary transaction-agreement signing evidence. NFT ownership-document evidence follows Section 4.6.
During Escrow Period: Facial images are retained throughout the "Escrow Period" as defined in your written agreement with the other transaction party.
After Escrow Period (No Dispute): If no dispute arises, we will permanently delete your facial image within 24 hours of the end of the Escrow Period.
In Case of Dispute: If a dispute is initiated, facial images will be retained until the dispute is fully resolved and any applicable appeal periods have expired, after which they will be permanently deleted within 30 days.
During Escrow Period: Facial images are retained throughout the "Escrow Period" as defined in your written agreement with the other transaction party.
After Escrow Period (No Dispute): If no dispute arises, we will permanently delete your facial image within 24 hours of the end of the Escrow Period.
In Case of Dispute: If a dispute is initiated, facial images will be retained until the dispute is fully resolved and any applicable appeal periods have expired, after which they will be permanently deleted within 30 days.
4.4 Storage Security
Facial images are stored in our secure database with the following protections:
- Database access is restricted to whitelisted IP addresses only
- Database encryption keys are stored in Azure KeyVault, a secure key management service
- Access is limited to authorized personnel on a need-to-know basis
- Regular security audits are conducted
4.6 NFT Ownership-Document Signing Evidence
Before signing an NFT ownership document, you are shown the NFT signing permissions and make separate choices for front-facing camera capture, private long-term signing-photo retention, and optional buyer audits. The current wording and consent version are maintained in nft-signing-permissions.json.
NFT signing-camera photos and other private signing evidence remain separate from the public signed ownership PDF and item photos. With your retention permission, this private evidence is retained beyond an individual transaction or escrow period to support ownership verification and disputes.
If you permit buyer audits, current and future verified owners may grant a named buyer temporary access to specified signing evidence. This permission does not publish the evidence or automatically disclose it to owners. Declining buyer audits does not prevent NFT registration.
You may request withdrawal or deletion by contacting contact@shakedefi.com, subject to applicable legal or dispute retention. Any disclosure must remain within the signer's permitted purposes and the applicable access grant. These NFT provisions do not extend the retention schedule for ordinary transaction signing evidence.
NFT signing-camera photos and other private signing evidence remain separate from the public signed ownership PDF and item photos. With your retention permission, this private evidence is retained beyond an individual transaction or escrow period to support ownership verification and disputes.
If you permit buyer audits, current and future verified owners may grant a named buyer temporary access to specified signing evidence. This permission does not publish the evidence or automatically disclose it to owners. Declining buyer audits does not prevent NFT registration.
You may request withdrawal or deletion by contacting contact@shakedefi.com, subject to applicable legal or dispute retention. Any disclosure must remain within the signer's permitted purposes and the applicable access grant. These NFT provisions do not extend the retention schedule for ordinary transaction signing evidence.
5. Information Sharing and Disclosure
5.1 Our Commitment to Privacy
We take your privacy seriously. We will never share your personal information, including:
...with third parties except as specifically described in this Privacy Policy (such as user-elected broadcasts to the public Marketplace Channel described in Section 5.6 or dispute resolution evidence sharing described in Section 5.2).
Authorized access to NFT agreement and acceptance evidence by identified transaction parties is described in Section 5.7. This does not authorize publication of detailed acceptance records or provide access to private signing evidence beyond Section 4.6 and specific permitted grants.
- Home or business addresses
- Email addresses
- Facial images
- Phone numbers
- Transaction details
...with third parties except as specifically described in this Privacy Policy (such as user-elected broadcasts to the public Marketplace Channel described in Section 5.6 or dispute resolution evidence sharing described in Section 5.2).
Authorized access to NFT agreement and acceptance evidence by identified transaction parties is described in Section 5.7. This does not authorize publication of detailed acceptance records or provide access to private signing evidence beyond Section 4.6 and specific permitted grants.
5.2 Transaction Disputes
Limited Disclosure: In the event of a transaction dispute, we may share relevant information with involved parties to facilitate resolution. This may include facial images, photographs, text descriptions, and User statements provided as evidence only with:
No Other Sharing: Facial images, photographs, text descriptions, User statements, and personal information will not be shared with any other third parties for dispute resolution purposes.
Access to relevant NFT agreement and acceptance evidence is described in Section 5.7 and remains subject to authorized access controls. Private signing evidence continues to follow Section 4.6 and applicable permitted grants.
- The other party or parties directly involved in the disputed transaction
- Legal representatives of the parties, if applicable
- Arbitrators or mediators involved in resolving the dispute
No Other Sharing: Facial images, photographs, text descriptions, User statements, and personal information will not be shared with any other third parties for dispute resolution purposes.
Access to relevant NFT agreement and acceptance evidence is described in Section 5.7 and remains subject to authorized access controls. Private signing evidence continues to follow Section 4.6 and applicable permitted grants.
5.3 Third-Party Service Providers
We work with the following third-party service providers who may independently collect and process your information:
Persona: Our identity verification partner who collects and processes KYC information. Persona operates under its own privacy policy, which you should review.
Microsoft Entra ID: Our authentication and identity management service provider that handles OAuth2 login processes for the App. Microsoft Entra ID may collect and process authentication-related information in accordance with Microsoft's privacy policies.
Coinbase: Payment processor who facilitates cryptocurrency wallet services, payment infrastructure, and blockchain transaction capabilities. "Coinbase" refers to the Coinbase entity or entities described in Section 1 above. Coinbase may independently collect user data in accordance with their own Terms of Service and Privacy Policy.
Telegram: Third-party messaging platform that hosts public Marketplace Channels and powers bot and Mini App integrations. When you choose to broadcast listings, Telegram receives and hosts the broadcasted listing content. Telegram processes data in accordance with its own Privacy Policy.
We do not share your facial images, full legal name, phone number, or email address with Telegram.
Persona: Our identity verification partner who collects and processes KYC information. Persona operates under its own privacy policy, which you should review.
Microsoft Entra ID: Our authentication and identity management service provider that handles OAuth2 login processes for the App. Microsoft Entra ID may collect and process authentication-related information in accordance with Microsoft's privacy policies.
Coinbase: Payment processor who facilitates cryptocurrency wallet services, payment infrastructure, and blockchain transaction capabilities. "Coinbase" refers to the Coinbase entity or entities described in Section 1 above. Coinbase may independently collect user data in accordance with their own Terms of Service and Privacy Policy.
Telegram: Third-party messaging platform that hosts public Marketplace Channels and powers bot and Mini App integrations. When you choose to broadcast listings, Telegram receives and hosts the broadcasted listing content. Telegram processes data in accordance with its own Privacy Policy.
We do not share your facial images, full legal name, phone number, or email address with Telegram.
5.4 Legal Requirements
We may disclose your information when required by law, including:
- In response to valid legal process (subpoenas, court orders, etc.)
- To comply with applicable laws and regulations
- To protect the rights, property, or safety of Shake Defi, our users, or others
- In connection with an investigation of fraud, intellectual property infringement, or other illegal activity
5.5 Business Transfers
In the event of a merger, acquisition, bankruptcy, or sale of assets, your information may be transferred to the successor entity. We will notify you via email or prominent notice in the App before your information becomes subject to a different privacy policy.
5.6 Public Marketplace Channel Broadcasts
When a User (such as a Merchant) chooses to use the optional "Post to Marketplace" feature, the following privacy practices apply:
- Voluntary and User-Initiated: Broadcasting a listing to the Marketplace Channel is entirely optional and occurs only when affirmatively initiated by the User.
- Publicly Broadcast Data: Information transmitted to the public Telegram channel includes item photographs, item descriptions, price, currency, escrow terms, the seller's general location (City, State/Province, and Country), in-person transaction preferences, and transaction ID keywords or Mini App deep links.
- Protected Data (Omitted from Broadcasts): We strictly exclude direct personal identifiers from public broadcasts. The seller's full legal name, phone number, email address, exact physical street address, and facial signature verification images are never included in Marketplace Channel broadcasts.
- Public Environment & Third-Party Persistence: Content posted to public Telegram channels is visible to all channel members and viewers. While the App provides tools to update listing details, reflect status changes (e.g., "Pending" or "Sold"), or delete listings, the Company cannot control or erase copies, message forwards, screenshots, or local device caches retained by third-party users or external platform archives.
5.7 NFT Acceptance Records and Readable Copies
You may obtain a readable copy of your accepted terms and acceptance receipt. Identified transaction parties may access the relevant agreement and acceptance evidence for their transaction under authorized access controls. Public item views show limited provenance or whether acceptance has been recorded; they do not publish detailed private acceptance records. Ownership-term acceptance does not provide access to another signer's private evidence, which remains governed by Section 4.6 and specific permitted grants.
6. Data Security
6.1 Security Measures
- Database Access Control: Our database is accessible only from whitelisted IP addresses
- Encryption: Database encryption keys are securely stored in Azure KeyVault
- Access Restrictions: Personal information access is limited to authorized personnel only
- Regular Audits: We conduct periodic security assessments
- Secure Transmission: Data transmitted between your device and our servers is encrypted
6.2 Limitations
While we strive to protect your information, no method of transmission or storage is 100% secure. We cannot guarantee absolute security but will notify you of any data breach affecting your personal information as required by applicable law.
7. International Data Transfers
Shake Defi operates internationally. Your information, including facial images, may be transferred to and stored on servers located outside your country of residence, including in the United States.
By using the App, you consent to the transfer of your information to countries that may have different data protection laws than your country of residence. We take steps to ensure that your information receives an adequate level of protection wherever it is processed.
8. Your Rights and Choices
8.1 Access and Correction
You have the right to:
To exercise these rights, contact us at contact@shakedefi.com.
Readable copies of accepted NFT terms and acceptance receipts are addressed in Section 5.7.
- Access the personal information we hold about you
- Request correction of inaccurate or incomplete information
- Receive a copy of your personal information in a portable format
To exercise these rights, contact us at contact@shakedefi.com.
Readable copies of accepted NFT terms and acceptance receipts are addressed in Section 5.7.
8.2 Account and Data Deletion
You have the right to delete your account and associated data at any time through the App settings or by contacting us directly.
Upon Account Deletion:
NFT ownership acceptance records are addressed separately in Section 8.5. This does not extend signing-photo retention beyond its applicable rules.
Upon Account Deletion:
- Your account will be permanently closed
- Your personal information, including facial images, will be permanently deleted within 30 days
- Some information may be retained as required by law or for legitimate business purposes (e.g., transaction records for tax compliance)
NFT ownership acceptance records are addressed separately in Section 8.5. This does not extend signing-photo retention beyond its applicable rules.
8.3 Withdrawal of Consent
You may withdraw your consent to facial image collection at any time by:
- Declining to proceed when notified before image capture
- Deleting your account
- Contacting us to request deletion of specific facial images (subject to legal retention requirements)
8.4 Marketing Communications
We do not currently send marketing communications. If this changes in the future, you will have the right to opt out of marketing emails while continuing to receive service-related communications.
8.5 NFT Ownership Acceptance Record Retention
Ownership acceptance records are distinct from signing-camera images and may be retained for transaction performance, disputes and applicable legal recordkeeping. Deletion of signing photos does not by itself erase previously made agreement statements. Retention and deletion of personally identifying acceptance evidence follow the approved acceptance-record schedule and applicable law; withdrawal of optional buyer-audit consent does not grant future access or cancel an already performed purchase.
We retain identifiable NFT ownership acceptance records while the person remains the recognized owner, and then for four years after their recorded ownership has ended and their related obligations have been completed. Account deletion does not by itself shorten this period. We retain the necessary records longer only where an unresolved dispute or an applicable legal requirement requires it. When identifiable records are no longer needed, we delete them or minimize the identifying information. This schedule does not extend the separate retention rules for signing-camera photos or optional buyer-audit evidence.
We retain identifiable NFT ownership acceptance records while the person remains the recognized owner, and then for four years after their recorded ownership has ended and their related obligations have been completed. Account deletion does not by itself shorten this period. We retain the necessary records longer only where an unresolved dispute or an applicable legal requirement requires it. When identifiable records are no longer needed, we delete them or minimize the identifying information. This schedule does not extend the separate retention rules for signing-camera photos or optional buyer-audit evidence.
9. Children's Privacy
The App is not intended for use by individuals under the age of 18 or under the age of majority in their jurisdiction, whichever is greater. We do not knowingly collect personal information from minors.
To use the App, you must:
- Be at least 18 years of age or the age of majority in your jurisdiction, whichever is greater
- Meet all account registration and verification requirements as outlined in our Terms of Service
10. Third-Party Links and Services
The App may contain links to third-party websites or services. This Privacy Policy does not apply to those third parties. We encourage you to review the privacy policies of:
- Persona: Privacy Policy
- Microsoft: Privacy Policy
- Coinbase: Privacy Policy
- Telegram: Privacy Policy
11. Data Storage and Infrastructure
11.1 Database Security
Our primary database infrastructure includes:
- Access Control: IP whitelist-based access restrictions
- Key Management: Encryption keys stored in Microsoft Azure KeyVault
- Redundancy: Regular backups to prevent data loss
- Monitoring: Continuous monitoring for unauthorized access attempts
11.2 Data Location
User data, including facial images, is stored on secure servers. The specific geographic locations may vary based on our infrastructure needs, but all locations maintain appropriate security standards.
12. California Privacy Rights
If you are a California resident, you may have additional rights under the California Consumer Privacy Act (CCPA) and other California privacy laws. While Shake Defi, Inc. is currently not subject to CCPA due to revenue thresholds, we respect California residents' privacy rights.
13. European Union and International Privacy Rights
If you are located in the European Union, European Economic Area, United Kingdom, or other jurisdictions with comprehensive data protection laws, you may have additional rights under regulations such as GDPR, including:
- Right to erasure ("right to be forgotten")
- Right to restrict processing
- Right to data portability
- Right to object to processing
- Right to lodge a complaint with a supervisory authority
14. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors.
Notification of Changes:
- We will notify you of material changes via email or prominent notice in the App
- The "Last Updated" date at the top of this policy will be revised
- Continued use of the App after changes constitutes acceptance of the updated policy
15. Contact Us
If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:
Shake Defi, Inc.
280 N. Market St, Unit 321
Brookfield, Wisconsin 53045
Email: contact@shakedefi.com
For dispute resolution matters, any dispute arising out of or relating to this Privacy Policy or the Services shall be resolved through binding arbitration in accordance with the Commercial Arbitration Rules of the American Arbitration Association. The arbitration shall be conducted in California. Please refer to Section 12 of our Terms of Service for complete arbitration procedures.
16. Consent and Acknowledgment
By using the Shake Defi App, you acknowledge that:
- You have read and understood this Privacy Policy
- You consent to the collection, use, and storage of your information as described
- You understand that facial images will be captured during transaction signing
- You have been notified of your right to cancel before image capture
- You consent to international data transfers as described
- You agree to the dispute resolution provisions regarding information sharing
- You understand that opting into the Marketplace Channel broadcasts your listing details and general location to a public third-party channel
Looking for our End User License Agreement? Read it here.