Privacy Policy

ALL‑SCRATCH!® operates THE HERO, a family-friendly educational digital collectible platform designed for universal participation across all ages. The platform utilizes sovereign blockchain infrastructure governed by ALETHRA™, autonomous AI moderation and scoring by ALETHA™, and the patented physical-to-digital scratch mechanism protected by US Patent 12,293,681 B2 and its international equivalents. This Privacy Policy explains how ALL‑SCRATCH!® collects, uses, discloses, protects, and retains personal information in connection with those services.

This Policy applies to adult users, minors participating with Verifiable Parental Consent, parents and legal guardians managing child accounts, brand partners, and individuals whose information is submitted through ALL‑SCRATCH!® systems. It also applies to personal information processed through integrated service providers, including Stripe for payment processing and identity verification, QuickBooks for US entity accounting, and Xero for Mexico entity accounting.

ALL‑SCRATCH!®'s privacy model is built around one foundational principle: user-generated content, AI-moderated interactions, marketplace transaction histories, and identity verification records must remain distinguishable, traceable, and governed entirely within sovereign ALETHRA™ infrastructure.

THE HERO platform operates on sovereign, private infrastructure governed by ALETHRA™. Data never leaves this sovereign infrastructure unless explicitly authorized by the user or required for essential payment processing through Stripe. The platform does not rely on third-party AI models. ALETHA™ is a proprietary, sovereign-grade AI built directly into the ALETHRA™ architecture, ensuring that user data and children's interactions are never transmitted to or used by external AI providers.

ALETHRA™ serves as the governance layer for blockchain verification, certification, data sovereignty, identity management, authorization, and audit trail preservation. All Hero Cards must be ALETHRA Certified before they are issued to the blockchain ledger. This two-step process (certification first, then blockchain issuance) ensures that only moderated, verified, and safe assets enter the permanent record.

Because the platform utilizes a private, permissioned Hyperledger Besu blockchain, transaction hashes and abstracted wallet addresses are recorded immutably. To ensure compliance with global privacy laws, including the GDPR right to erasure and COPPA data minimization requirements, ALL‑SCRATCH!® abstracts all personally identifiable information (PII) from the on-chain record. If an account deletion is requested, the associated on-chain tokens are cryptographically burned, and all off-chain PII is permanently destroyed.

THE HERO is a universal platform designed to be safe for all ages. Protecting children's privacy is a fundamental architectural mandate, not a policy afterthought. ALL‑SCRATCH!® strictly complies with the United States Children's Online Privacy Protection Act (COPPA), including the 2025 and 2026 amendments, and the GDPR-K.

Before any user under the age of 13 (or the applicable age of digital consent in their jurisdiction) can activate an account, mint a Hero Card, or engage in the marketplace, ALL‑SCRATCH!® requires Verifiable Parental Consent (VPC). This is achieved by linking the child's account to a Parent Dashboard and completing a secure identity verification flow, such as a nominal credit card authorization via Stripe Identity or a “text plus” SMS confirmation.

Data Minimization for Minors: We do not collect a minor's real name, precise geolocation, or exact date of birth. Only the birth year is collected to calibrate ALETHA™'s educational content complexity. Usernames are system-generated and contain no PII. Minors cannot engage in direct messaging with strangers; all peer-to-peer communication is mediated by ALETHA™. All fiat marketplace sales and peer-to-peer trades initiated by a minor require explicit, transaction-level approval from the linked Parent Dashboard before execution on the blockchain.

Parental Rights Under COPPA: Parents have the right to review the personal information collected from their child, request deletion of that information, and revoke consent at any time. To exercise these rights, contact privacy@allscratch.com.

ALL‑SCRATCH!® collects information needed to operate a governed, safe, and compliant digital collectible ecosystem. The categories below describe our data inventory.

Under California privacy law (CCPA/CPRA), personal information includes information that identifies, relates to, or could reasonably be linked with a person or household, and sensitive personal information may include account credentials, precise geolocation, and certain other protected categories. Under Mexico's LFPDPPP, personal data is information concerning an identified or identifiable individual. ALL‑SCRATCH!® does not collect health, medical, biometric, or financial account data beyond what is described above.

ALL‑SCRATCH!® may collect personal information directly from you, from parents or legal guardians creating accounts on behalf of minors, from your device interactions with the mobile application, from the photographs and stories you submit, from Stripe regarding transaction completion and identity verification status, and from ALETHRA™ governance records generated by your platform interactions.

Where ALL‑SCRATCH!® receives data from a parent or guardian on behalf of a minor, that party is responsible for ensuring they have the legal authority and consent necessary to submit the information.

ALL‑SCRATCH!® processes user data, user-generated content, and transaction records to operate the sovereign NFT platform, govern marketplace integrity, and ensure a safe community environment.

ALETHA™ is the autonomous operating intelligence of THE HERO platform. ALETHA™ processes all uploaded photographs (via Vision-Language Models) and text stories (via Natural Language Processing) to generate rarity scores, compose card art, and moderate content before it is visible to any other user. ALETHRA™ preserves source identity, timestamp, device provenance, user consent, and access authorization before ALETHA™ evaluates any submission.

ALETHA™ also evaluates every peer-to-peer trade proposal to calculate a Fairness Score. Trades deemed exploitative are hard-blocked. Trades deemed imbalanced are routed to the Parent Dashboard for guardian review. ALETHA™ operates without human review of individual moderation decisions, but ALL‑SCRATCH!® maintains an appeals process for users who believe a moderation decision was incorrect. Contact legal@allscratch.com to initiate an appeal.

ALL‑SCRATCH!® discloses to all users, in compliance with the 2025 LFPDPPP AI governance requirements, that ALETHA™ is an AI system and that automated decisions, including moderation rejections and trade evaluations, are made without individual human review. Users have the right to request a human review of any automated decision that materially affects their account.

ALL‑SCRATCH!® does not sell your personal information. We do not share your data with third-party AI providers for training purposes. We may disclose personal information to the following categories of recipients when reasonably necessary for the purposes described in this Policy.

United States (CCPA/CPRA and other state laws): You have the right to know what personal information we collect and how it is used, the right to access that information, the right to request correction of inaccurate data, the right to request deletion, and the right to opt-out of the sale or sharing of your personal information. ALL‑SCRATCH!® does not sell or share data for cross-context behavioral advertising. To exercise your rights, submit a request to privacy@allscratch.com.

Mexico (LFPDPPP — Derechos ARCO): Users in Mexico have the right to Access, Rectify, Cancel, or Oppose (ARCO) the processing of their personal data. To exercise your ARCO rights, submit a written request to privacy@allscratch.com. We will respond within 20 business days as required by Mexican law. You may also file a complaint with the competent Mexican authority (currently the Ministry of Anti-Corruption and Good Governance, following the 2025 INAI transition).

Right to Erasure vs. Blockchain Permanence: If you request account deletion, ALL‑SCRATCH!® will permanently destroy all off-chain PII. To satisfy the right to erasure while respecting blockchain architecture, any Hero Cards you own will be cryptographically burned on the private ledger, rendering them permanently inaccessible and severing any link between the blockchain record and your identity.

Parental Rights (COPPA): Parents may review, correct, or request deletion of their child's personal information at any time by contacting privacy@allscratch.com or through the Parent Dashboard.

ALL‑SCRATCH!® implements robust technical, administrative, and physical safeguards to protect personal information. Our sovereign ALETHRA™ infrastructure ensures data remains within governed boundaries. Passwords and PINs are hashed using Argon2id. All data in transit is protected by TLS 1.3. All inter-service communication uses mutual TLS (mTLS). Cryptographic keys are managed by a dedicated Key Management Service (KMS) that never exports private keys.

ALL‑SCRATCH!® retains personal information only for as long as necessary to fulfill the purposes outlined in this Policy, comply with legal and tax obligations, and resolve disputes. In compliance with the 2025 COPPA amendments, child accounts inactive for 12 consecutive months are subject to automated data purging. Financial transaction records required for tax reporting are retained for the legally mandated period, typically five to seven years.

ALL‑SCRATCH!® complies with the CAN-SPAM Act. All marketing emails include a clear identification of the sender, a physical mailing address, and an unsubscribe mechanism. Transactional emails related to account security, marketplace activity, and parental approval requests are not subject to CAN-SPAM opt-out requirements.

We may update this Privacy Policy to reflect changes in our practices, technology, or legal requirements. We will notify you of material changes by posting the updated Policy on our website and, where required by law, obtaining your consent or the consent of a parent or guardian.

ALL‑SCRATCH! INC.

Email: privacy@allscratch.com