Privacy Policy

Classification: Public. Served at protocolwealthllc.com/privacy. A notice of current practice, not a contract — never pinned. Prior versions are kept as part of the firm's records.

Protocol Wealth, LLC

Effective / Last Revised: October 14, 2026 Owner: Adam Blumberg, Chief Compliance Officer

This document is identified by its effective date, not a sequential version number. Last updated October 14, 2026; change reference v3.22. Prior versions are kept as part of the firm's records.

This notice explains, in one place, what personal information Protocol Wealth collects, why, who receives it, how we protect it, and the choices you have. You should not need any other document to understand it. Where a detail changes often, such as the full list of service providers, we also keep it at protocolwealthllc.com/subprocessors.

What changed in this version. We describe what Anthropic may keep under its zero-data-retention terms: content its safety systems flag, or that the law requires it to keep, for up to two years.

FACTS: What Does Protocol Wealth, LLC Do With Your Personal Information?

Why?

Protocol Wealth collects and develops personal information about clients, and some of that information is non-public personal information (Customer Information). The essential purpose for collecting Customer Information is to provide and service the appropriate financial products and services clients obtain from Protocol Wealth.

What?

The types of personal information we collect and share depend on the product or service you have with us. This information can include:

• Social Security number and income
• account balances and transaction history
• assets and credit card or other debt

When you are no longer our customer, we continue to share your information as described in this notice.

How?

All financial companies need to share customers' personal information to run their everyday business. In the section below, we list the reasons financial companies can share their customers' personal information; the reasons Protocol Wealth chooses to share; and whether you can limit this sharing.

Who We Are

Who is providing this notice? Protocol Wealth, LLC — an SEC-registered investment adviser (CRD #335298).

Why Can't I Limit All Sharing?

Federal law gives you the right to limit only:

• Sharing for affiliates' everyday business purposes — information about your creditworthiness
• Affiliates from using your information to market to you
• Sharing for nonaffiliates to market to you

State laws and individual companies may give you additional rights to limit sharing.

How Do I Limit Sharing?

If you choose to opt out now, at any time in the future, or wish to withdraw your opt out request, contact us at [email protected].

The Information We Collect

What we collect depends on the services in your advisory agreement. It can include:

• What you tell us on questionnaires and in conversations with your adviser: household details, income, spending, investment objectives, goals, assets and liabilities, and copies of statements.
• What we need to open and run your accounts: Social Security or taxpayer identification number, investment experience, assets, income and account balances.
• Data from accounts you choose to link (see "Third-Party Financial Data Services"): balances, up to 24 months of transaction history, and investment holdings and transactions.
• Data from the custodians that hold your advised accounts, such as Charles Schwab: account names and numbers, registration and account type, mailing address where the custodian supplies it, positions, balances, transactions, cost basis, and realized gain or loss.
• Statements and K-1s you or your adviser provide for outside investments (see "Use of AI Tools and Data Privacy").
• Work we produce for you: financial plans, analyses, and records of advisory transactions.
• Identity verification, only if your adviser turns it on for you: a government ID and selfie checked by Veriff, together with Veriff's politically-exposed-person and sanctions screening result.
• Records of how you use our portals, such as sign-ins and security events.

Some of this is sensitive personal information: government identifiers such as Social Security and taxpayer identification numbers; financial account numbers and the credentials or tokens used to reach an account; and detailed financial data such as balances, holdings, transactions and debts. We use it only to provide our services, to meet our legal and regulatory obligations, and for other purposes the law permits. We do not use it to infer characteristics about you, and we do not sell it.

Use of AI Tools and Data Privacy

We use AI tools to help with research, analysis, portfolio monitoring, document preparation and administration, under what we call our co-intelligence framework: AI and advisers check each other's work, and the fiduciary judgment stays with your adviser. AI does not replace your adviser, does not make final investment decisions, does not set your fees or account access, and does not override your adviser's judgment.

An adviser reviews material AI-assisted work before it reaches you or influences a recommendation made on your behalf, with two exceptions:

1. The AI assistant in your client portal (a limited beta). Its answers to your own questions are not reviewed by an adviser first and can be wrong. It answers questions about your own accounts, balances, transactions and risk profile, can do illustrative planning calculations, and can pass a planning note to your advisory team. It does not give investment, tax or financial advice, trade, move money, or change your accounts. Before your message is sent, it replaces email addresses, U.S. phone numbers and Social Security numbers with placeholders. It does not remove names, so we suggest using initials or a relationship ("my spouse"). Your conversations are saved so you can return to them, and are kept as part of our books and records. Its use is also governed by our AI Acceptable Use Policy.
2. Values read from documents you or your adviser provide. When you or your adviser place a statement or K-1 for an outside investment in the document folder we set up with you for outside investments, AI reads values from it: the investment's name, type, value and as-of date, and other figures the document reports. These values may appear to you before an adviser reviews them. Each one is labeled "Unverified" until an adviser confirms or corrects it. We use the latest statement; a K-1 figure appears only as a fallback, labeled "K-1 capital account (tax basis)" with its as-of date, and never as a market value. No returns or performance are calculated from these values, and no advice accompanies them. Choosing whether these values appear in your view changes only what you see; it does not change fee billing or statements. The document's text is read from the PDF and is not kept by the AI provider.

Which AI providers receive client information:

• Anthropic (Claude) is our main AI provider. It runs advisor chat and research, advisers' review of agreements, the portal assistant, the reading of statements and K-1s described above, and the sorting of email sent to the firm's inbound addresses that our rules cannot sort (the sender's name and address, the subject, and up to about 2,000 characters of the body). It operates under a zero-data-retention agreement: it does not train on our data, and otherwise does not keep what we send or what it returns beyond the request. Under those terms, Anthropic may keep content its safety systems flag, or that the law requires it to keep, for up to two years. Inference runs only in the United States.
• SpaceXAI LLC (SpaceX) — xAI / Grok is a model an adviser can choose in advisor chat. That conversation can include client information. It operates under zero data retention, which our systems check on every response; a response without that confirmation is discarded. The check happens when the response arrives, after the request has been sent. Requests go only to its U.S. endpoints. xAI states that it does not train on our inputs or outputs without permission. Its Trust Center lists an ISO/IEC 27001:2022 certificate and a SOC 2 Type 2 report covering its Grok API; we have viewed that report there but have not obtained a copy for our files. Grok is also used for drafting the firm's own marketing material and for work on our own source code, neither of which involves client information.
• Google (Gemini) is used for image and graphics generation for advisers, and for search indexing of documents added to advisor chat: the text is split into passages and sent to Google's model, and the numeric index that comes back is kept so an adviser can find a passage later. These requests go through Google Cloud's Vertex AI at U.S. endpoints under our Google Cloud agreement, which bars Google from training on our data.
• OpenAI drafts the firm's own non-client material and works on our source code. It receives no client information, because we have not arranged zero data retention with it.

We do not currently operate self-hosted AI models. If external zero-data-retention terms change, we may deploy self-hosted alternatives, and we will update this policy before doing so.

What we do before client information reaches an AI provider. Our systems replace identifiers they recognize, such as Social Security numbers, account numbers, tax identification numbers, email addresses, phone numbers, addresses and dates of birth, with placeholders. This works by recognizing common formats, so it is not complete, and it does not remove names. It does not cover PDF and image files attached in advisor chat, which are sent as files, or an agreement an adviser submits for review, which is sent as written; the list at protocolwealthllc.com/subprocessors describes each case. A statement or K-1 you or your adviser provide is different: its text is read from the PDF and scanned in the same way before it is sent, so the same limits apply, and a document with no readable text is not sent at all; a person reviews it instead.

We keep records of AI-assisted work, and we never sell or share AI outputs that include your information for purposes unrelated to serving you.

How We Share Information with Third Parties

We share Customer Information with custodians, financial institutions, other investment advisers where your agreement provides for one, and the service providers below, only to run your accounts and our business, to comply with law, and as described in the table above. We do not sell client information. We do not share it with anyone for their own marketing. Our service providers may use it only to provide services to us. We may also disclose information where the law requires or permits, for example in response to a subpoena or a regulatory examination.

The service providers that receive client information:

Custody, trading, banking and billing

• Charles Schwab & Co., Inc. — qualified custodian for advisory accounts on Schwab Advisor Services; holds the assets, executes trades, and produces official statements.
• Performance Technologies, Inc. d/b/a Schwab Intelligent Technologies — operates Schwab OpenView Gateway; the account data we request is copied into its database before delivery. It is a separate company from Charles Schwab & Co., Inc.
• Nexhelm AI, Inc. — delivers the Schwab account data for the accounts we advise into a read-only daily package in a shared drive we control. It stores the data in the United States and states that no AI model is used in this service.
• Bridge Financial Technology, Inc. (BridgeFT) — prepares that Schwab data for Nexhelm under the data-access request we submitted. It is engaged by Nexhelm; we have no agreement with it. It is a U.S. company; we have not confirmed where it processes the data.
• Altruist Financial LLC — custody and advisory billing.
• Interactive Brokers LLC — brokerage.
• Anchorage Digital Bank — qualified digital-asset custodian (federally chartered).
• FalconX — digital-asset trading, where Anchorage Digital Bank remains the custodian.
• Fordefi — multi-party computation (MPC) wallet infrastructure for onchain holdings.
• Coincover — an encrypted backup of Fordefi key material, for clients who choose to use it; only the client can receive the decryption key.
• Mercury — the firm's business bank; fees clients pay us directly arrive there, and some clients' fees are invoiced through it.
• Stripe, LLC — card payments for client invoices and monthly retainers. We send Stripe your name and email address, and the amount and description of each invoice or retainer. You enter your card details only on Stripe's own payment pages, and we never receive them. Stripe's own privacy policy also applies to what it collects on those pages, including its use of payment information to prevent fraud.

Planning and account linking

• RightCapital, Inc. — financial planning platform; the information a plan is built from is held there, and your written plan may be delivered through it.
• Quiltt, Inc., with MX Technologies, Inc., Finicity, Inc. (a Mastercard company) and FinGoal — account linking (see "Third-Party Financial Data Services").

AI services — Anthropic, SpaceXAI LLC (SpaceX) — xAI / Grok, and Google (see "Use of AI Tools and Data Privacy").

Technology, identity and communications

• Google Cloud and Google Workspace — hosting, databases, file storage, email, documents and identity.
• Cloudflare — website delivery and network security.
• Veriff — identity verification, only when your adviser turns it on.
• Hadrius — our compliance platform, which holds our compliance records and our email and social-media archives.
• Wealthbox — client relationship management.
• Postmark — system email, newsletters and webinar mail, and email sent to our inbound addresses.
• DocuSign, Inc., through Charles Schwab's integration — electronic signature of client agreements.

We review these providers before we use them and oversee them under a written program. The current list, with more detail on each, is at protocolwealthllc.com/subprocessors and is available on request.

Sharing within your household. If you are part of a household we serve, you can let another member see your accounts and their values in their portal view. You can start or stop this at any time from the Sharing card in your portal, or ask your adviser to, who will record it. Sharing is one-way: the member you choose can see your accounts but cannot act on them, and you do not see theirs unless they choose to share. It ends automatically when either of you leaves the household. We keep a record of each choice.

Third-Party Financial Data Services

Advisory clients can link accounts at other financial institutions through the client portal, using Quiltt with MX or Finicity for the connection and FinGoal to clean up transaction data. Prospects and website visitors cannot use this feature.

• When you link an account, we send Quiltt your name and email address and nothing else from your profile.
• We receive balances, up to 24 months of transactions, and investment holdings and transactions.
• You sign in to your institution through the provider's secure screen. We never receive or store your banking login.
• You can disconnect any linked account at any time in the client portal or by asking your adviser.

Linked-account data is encrypted, used only to provide advisory services, never sold, and kept under the retention rules in "Data Retention for Advisory Services".

PW Nexus API and MCP Server

Protocol Wealth operates PW Nexus (nexusmcp.site), a research API and Model Context Protocol (MCP) server with investment analysis tools, market data and portfolio analytics. If you use it, we collect:

• Sign-in data: email address, sign-in tokens and session identifiers. Tokens are encrypted in transit and stored with standard security controls.
• Usage logs: which tools and endpoints you call, when, from which IP address, and related request details, used for rate limits, abuse prevention and reliability.
• What you ask: ticker symbols, wallet addresses and other inputs, which may be cached briefly (from 30 seconds to 24 hours) to return results faster.

We use it to run and improve the service, enforce rate limits, prevent abuse, fix problems, and produce aggregate statistics that identify no one. We do not sell this data, build marketing profiles from it, or share non-client usage data except as the law requires. Sign-in tokens last for the session or until revoked. Routine access logs are deleted automatically after a short period (currently 30 days); interactions by clients that relate to advice are kept for at least five years as required records.

If you connect to PW Nexus through another company's AI assistant, your questions and our answers pass through that company's systems, and its own privacy policy applies. We filter our responses for client personal information, but please do not send account numbers, Social Security numbers or detailed financial data through third-party AI assistants. Use the client portal (pwportal.app) or contact your adviser instead.

How Does Protocol Wealth Protect My Information?

• Encryption in transit (TLS 1.2 or higher) and at rest (AES-256).
• Multi-factor authentication and role-based access, so only authorized staff can reach client data.
• Each client's data is separated from every other client's at the database level.
• Documents you upload through the portal are held in quarantine and scanned for malware before your adviser can open them; a document that fails is not released.
• An append-only audit trail of actions that create, change or delete client data.
• Our primary systems store client data in the United States, in Google Cloud U.S. regions, and new systems can be created only in U.S. locations. Some service providers process data outside the United States or have not confirmed where; the list at protocolwealthllc.com/subprocessors says which.
• An incident response program, and ongoing review of the service providers who handle client information.

If a breach affects you. If your sensitive information is accessed without authorization, we will notify you as soon as practicable, and no later than 30 days after becoming aware of the incident, unless, after a reasonable investigation, we determine it has not been and is not reasonably likely to be used in a way that would cause substantial harm or inconvenience, as SEC Regulation S-P provides.

Data Retention for Advisory Services

• Advisory records required by Investment Advisers Act Rule 204-2: at least five years from the end of the fiscal year of the last entry, the first two years in an easily accessible place.
• Audit logs, with identifying details removed: at least seven years.
• Email and document-signing records: at least five years where they are required records; our systems currently keep them for seven.
• Identity verification and sanctions screening records: as the provider's settings and our compliance obligations require.
• AI-assisted work that becomes part of an advisory record: kept with that record.

After the required period we may delete or anonymize the information. Data with no client identifiers, such as aggregate statistics, may be kept longer.

Cookies and Tracking Technologies

We use only the cookies needed to run our sites securely: sign-in and session cookies on the client and advisor portals (pwportal.app, pwos.app), and short-lived security cookies set by Cloudflare on our public website. We do not use advertising, retargeting or cross-site tracking. Because these cookies are strictly necessary, there is no consent banner; you can block cookies in your browser, but the portals will not work without them. If we ever add analytics or other non-essential tracking, we will update this notice first and honor the choices the law requires, including Global Privacy Control signals where required.

Recording and Transcription of Client Meetings

We do not record or transcribe a client meeting without telling you in advance and getting the participants' consent. You can decline recording at any time.

Your Data Rights

You can ask us to:

• give you a copy of the personal information we hold about you;
• correct information that is wrong;
• delete your information, except records the law requires us to keep;
• disconnect a linked account, or revoke API keys and sign-in tokens;
• explain the human review behind any AI-assisted output that affected your account, and tell you which AI tools were involved in an analysis or recommendation;
• keep your information out of external AI services, including any added later. We will tell you which services remain available and any effect on timing or cost, and we will not penalize you for choosing this;
• not use AI at all for work on your account, as far as feasible; we will discuss the scope with you.

To make a request, contact [email protected]. We respond to verified requests as promptly as we can.

California residents. Most of what we hold about advisory clients is financial information covered by the Gramm-Leach-Bliley Act and governed by this notice, not by the California Consumer Privacy Act. The CCPA/CPRA does apply to information we collect from California prospects and website visitors outside that relationship, for example through contact forms, diagnostics and risk questionnaires. For that information you have the right to know what we collected, where it came from, why, and who received it; to delete or correct it; to opt out of its sale or sharing for cross-context behavioral advertising; and not to be treated differently for using these rights. We do not sell personal information or share it for cross-context behavioral advertising, so there is nothing to opt out of today. Where required, we honor Global Privacy Control signals. You or an authorized agent can make a request at [email protected]; we will verify it, respond within the time the law requires, and will not require you to create an account.

International Clients and Cross-Border Data Processing

We serve a limited number of clients outside the United States, for example in Singapore and the United Arab Emirates. If you are one of them:

• Our primary systems store and process your information in the United States, and it is subject to U.S. law, including lawful access by U.S. authorities. The United States may not provide the same privacy protections as your country. By entering into an advisory relationship with us, you consent to this transfer.
• Some service providers process data outside the United States or have not confirmed where they do; the list at protocolwealthllc.com/subprocessors says which.
• Non-U.S. relationships are also subject to our sanctions screening, FATCA and, where applicable, CRS procedures, and to the non-U.S. terms of your advisory agreement.

Definitions

Affiliates: Companies related by common ownership or control. They can be financial and nonfinancial companies. Protocol Wealth does not share with affiliates.

Nonaffiliates: Companies not related by common ownership or control. They can be financial and nonfinancial companies. Protocol Wealth does not share with nonaffiliates so they can market to you.

Joint Marketing: A formal agreement between nonaffiliated financial companies that together market financial products or services to you. Protocol Wealth may enter into joint marketing agreements with other financial companies. Protocol Wealth does not share your personal information with those companies for joint marketing purposes, which is why the table above answers "No" for joint marketing.

Client: An individual or entity that has executed a written Investment Advisory Agreement with Protocol Wealth, LLC.

Prospect: A registered user of a Protocol Wealth digital property who has not executed an Investment Advisory Agreement.

Questions?

Contact [email protected], or write or call:

Protocol Wealth, LLC Attn: Chief Compliance Officer (Adam Blumberg) 201 Milwaukee St., Suite 200 Denver, CO 80206 Phone: 720-383-4550

Protocol Wealth, LLC | SEC-Registered Investment Adviser | CRD #335298

Form ADV | Form ADV Part 2A | Form CRS | Terms of Service | Subprocessors | Disclosures