Data Governance Notice

THE HERO platform by ALL‑SCRATCH!® is built on a foundational principle of data sovereignty. Unlike conventional social networks or public Web3 platforms that rely on third-party cloud infrastructure or external AI providers, THE HERO operates entirely within the ALETHRA™ governed ecosystem.

ALETHRA™ is the sovereign governance layer responsible for blockchain verification and certification, data sovereignty enforcement, identity management, authorization, and audit trail preservation. All data generated on THE HERO platform is governed by ALETHRA™ and remains within sovereign infrastructure unless explicitly authorized to leave. This means:

• User photographs, stories, and personal data are never transmitted to third-party AI providers for processing or training.
• Hero Card metadata, ownership records, and transaction histories are recorded on a private, permissioned blockchain that is not accessible to the public.
• Financial data is routed exclusively through Stripe, a PCI DSS-compliant payment processor, and is never stored in raw form on ALL‑SCRATCH!® servers.

This architecture is not a marketing claim; it is a technical and contractual mandate enforced at the infrastructure level by ALETHRA™.

The platform does not rely on third-party AI models. The intelligence powering THE HERO is ALETHA™, a proprietary, sovereign-grade AI built directly on the ALETHRA™ architecture.

ALETHA™ is not a chatbot. ALETHA™ is the autonomous operating intelligence of the platform. She performs the following functions without human intervention:

Because ALETHA™ operates entirely within the ALETHRA™ sovereign infrastructure, user data and children's interactions are never transmitted to external AI providers. This is a core data sovereignty guarantee.

All Hero Cards undergo a mandatory two-step process before they are issued to the blockchain ledger:

Step 1 — ALETHRA™ Certification. After ALETHA™ evaluates and approves a user's submission, ALETHRA™ certifies the resulting card. Certification creates an immutable record of the card's provenance, including the timestamp, the user's abstracted identifier, the ALETHA™ evaluation score, and the moderation outcome. This certification record is the authoritative proof of authenticity for every Hero Card.

Step 2 — Blockchain Issuance. Only after ALETHRA™ certification is complete does the Hero Card get minted as an ERC-721 NFT on the private Hyperledger Besu blockchain. The on-chain record references the ALETHRA™ certification hash, creating a verifiable link between the physical scratch, the AI evaluation, and the digital asset.

This two-step architecture, protected by US Patent 12,293,681 B2 and its international equivalents, ensures that every Hero Card on the platform is authentic, moderated, and traceable to its origin.

THE HERO utilizes a private, permissioned Hyperledger Besu blockchain to record the minting, ownership, and trading of Hero Cards. This ledger provides an immutable, tamper-proof audit trail of digital assets. However, ALL‑SCRATCH!® recognizes the tension between blockchain immutability and global privacy laws, including the GDPR right to erasure and the COPPA right to deletion.

ALL‑SCRATCH!® resolves this tension through a strict abstraction architecture:

1. 01On-chain data contains zero PII. The blockchain ledger records only abstracted wallet addresses (managed by the ALETHRA™ Key Management Service) and transaction hashes. No names, email addresses, or other identifying information are ever written to the ledger.
2. 02All PII is stored off-chain. Personal information is stored in traditional, governed databases within the ALETHRA™ sovereign infrastructure, entirely separate from the blockchain.
3. 03Deletion severs the link. When a user requests account deletion, the off-chain PII is permanently and irreversibly destroyed. The associated on-chain Hero Cards are cryptographically burned (sent to a null address), rendering them permanently inaccessible. The blockchain retains an anonymous record of the burn transaction, but the link between that record and any human identity is permanently severed.

This architecture ensures that ALL‑SCRATCH!® can honor deletion requests under the GDPR, CCPA/CPRA, LFPDPPP, and COPPA without requiring modification of the immutable ledger.

In strict compliance with COPPA and GDPR-K, parents and legal guardians maintain absolute control over the data generated by users under the age of 13. Through the Parent Dashboard, guardians can:

• Review all Hero Cards minted by the minor, including the original scratch photograph and submitted story.
• Review all marketplace activity, including ALETHA™ trade fairness evaluations and the reasoning behind any flagged transactions.
• Approve or deny any pending fiat sale, purchase, or peer-to-peer trade.
• Set daily and weekly spending limits and minimum acceptable sale prices.
• Export a complete, machine-readable record of the minor's platform data.
• Request immediate and permanent deletion of the minor's account and all associated data.

Parental access is governed by the same ALETHRA™ authorization controls as all other platform access. A parent's ability to view their child's data is contingent on the parent account maintaining active VPC status.

All user data, AI-generated content, and blockchain records reside on ALETHRA™ governed infrastructure. The following table describes the data residency model.

Because THE HERO is a sovereign platform, third-party data sharing is strictly limited to essential operational partnerships. ALL‑SCRATCH!® does not sell personal information. ALL‑SCRATCH!® does not share personal information with third-party advertisers or data brokers.

Stripe: We share the minimum necessary financial and identity data with Stripe to process fiat payments, execute marketplace payouts, and perform KYC/AML identity verification, including Verifiable Parental Consent for minor accounts.

Charitable Partners (WWF/WHO): 100% of marketplace transaction fees are donated to charity. We share only aggregated, anonymized transaction volume data with these partners for transparent donation reporting. No individual user data, usernames, or account identifiers are shared.

Legal and Regulatory Authorities: We may disclose data to law enforcement, tax authorities (IRS, Mexico SAT), or courts when required by law, subpoena, or court order, or when necessary to protect the safety of users or investigate fraud.

ALL‑SCRATCH!® retains data only for as long as necessary to fulfill the operational, legal, and tax requirements of the platform.

In compliance with the 2025 LFPDPPP AI governance requirements and the EU AI Act (Article 52), ALL‑SCRATCH!® discloses the following:

• ALETHA™ is an AI system. Users are informed when they are interacting with ALETHA™.
• Moderation decisions are automated. Content moderation, rarity scoring, and trade fairness evaluations are performed by ALETHA™ without individual human review.
• Appeals are available. Users who believe an automated decision was incorrect may submit an appeal to legal@allscratch.com. ALL‑SCRATCH!® will conduct a human review of the decision within 10 business days.
• No external AI training. User data is never used to train external AI models. ALETHA™ is a proprietary, sovereign-grade AI and does not share training data with third parties.

For questions about this Data Governance Notice, data sovereignty, or your rights under applicable privacy law, contact:

ALL‑SCRATCH! INC.

Email: privacy@allscratch.com