Privacy Policy

Effective Date: April 24, 2026  ·  Last Updated: May 20, 2026

Cresium Capital Partners LLC ("Cresium," "we," "our," or "us") operates the CresiumCapital mobile application (the "App"). This Privacy Policy explains how we collect, use, store, and protect information when you use our App.

By using the App you agree to the practices described in this policy. If you do not agree, please do not use the App.

1. Information We Collect

We collect only the information necessary to operate the member portal:

• Account & Identity: Your email address, full name, membership role, and officer status provided at account creation.
• Financial Data: Capital account balances, contribution history, portfolio holdings and valuations, withdrawal requests, and trade records associated with your partnership account.
• Authentication Credentials: Your password is never stored on your device. Access tokens and refresh tokens are stored exclusively in the iOS Keychain with device-only, locked-state encryption.
• Biometric Preference: If you enable Face ID or Touch ID, the App stores only a flag indicating your preference in the Keychain. No biometric data is ever transmitted to our servers.
• Usage & Audit Data: Meeting attendance, votes cast, and account actions are recorded for partnership record-keeping and regulatory audit purposes.
• Mailbox Credentials & Email Content (In-App Mail feature only): If you opt in to the in-app mail feature, the App asks for the password to your @cresiumgroup.com mailbox so it can connect to the partnership's own mail server (mail.cresiumgroup.com) on your behalf. The password is encrypted with AES-256-GCM on our server before it is stored, and it is never transmitted to any third party. Your email content — messages, attachments, folder structure, and sender/recipient addresses — is fetched and sent only on your behalf and is not read, scanned, indexed, or shared by us. You can disconnect your mailbox at any time from Mail → Settings, which deletes the encrypted credentials.

We do not collect location data, advertising identifiers, health data, or any third-party analytics. No tracking SDKs are included in the App.

2. How We Use Your Information

• Authenticate you and maintain your session securely.
• Display your capital account, portfolio, and partnership activity.
• Process withdrawal requests and record contributions.
• Conduct partnership votes and meeting administration.
• Maintain an immutable audit log for legal and compliance purposes.
• Detect and prevent unauthorized access (jailbreak detection, certificate pinning).
• If you opt in to the in-app mail feature, connect to your @cresiumgroup.com mailbox to display incoming messages and send messages you compose. Only your IMAP/SMTP credentials are stored, and only on our server (encrypted). Mail content is fetched on demand and not retained beyond the request that displays it.

3. How We Share Your Information

We do not sell, rent, or trade your personal information to any third party. Information may be shared only in the following limited circumstances:

• Within the Partnership: Officers of Cresium Capital Partners may access partner account data as necessary for fund administration.
• Legal Requirements: We may disclose information if required by law, court order, or governmental authority.
• Business Transfer: In the event of a merger or acquisition, your data would transfer subject to the same privacy protections.

4. Data Security

We implement industry-standard security measures including:

• TLS encryption for all data in transit, with certificate pinning to prevent interception.
• iOS Keychain storage with WhenUnlockedThisDeviceOnly protection for all tokens.
• Automatic session expiry after 15 minutes of inactivity.
• Privacy overlay that blurs sensitive content when the App is backgrounded.
• Jailbreak detection that warns users of compromised device environments.
• Mailbox passwords (when the in-app mail feature is used) are encrypted with AES-256-GCM using a server-side key before being stored, and are decrypted only in-memory to establish IMAP/SMTP connections on your behalf.

5. Data Retention

Account and financial data is retained for as long as your partnership membership is active and for a minimum of seven (7) years thereafter to satisfy regulatory and audit requirements. You may request deletion of your personal profile data by contacting us, subject to any legal retention obligations.

6. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate information.
• Request deletion of your personal profile (subject to legal retention obligations).
• Object to or restrict certain processing of your data.

To exercise any of these rights, contact us at [email protected].

7. Children's Privacy

The App is not directed to children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us so we can delete it.

8. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last Updated" date at the top. Continued use of the App after any changes constitutes your acceptance of the revised policy.

9. Contact Us

If you have questions or concerns about this Privacy Policy, please contact:

Cresium Capital Partners LLC
Email: [email protected]
Website: cresiumgroup.com

---

This policy applies to the CresiumCapital iOS application (bundle ID: com.cresiumgroup.CresiumCapital) and any future versions of the App.