Privacy Policy

1. Scope and Controller

This Privacy Policy explains how I & A Industries ("I & A," "we," "us," or "our") collects, uses, discloses, retains, and protects personal information in connection with Drakoa, our website, qualification process, communications, payments, educational services, community access, and related support (collectively, the "Services").

I & A Industries is the controller of personal information described in this Policy unless a separate notice identifies another controller. This Policy applies to website visitors, applicants, customers, community members, and authorized users. It does not replace our Terms of Service, Software Access and Services Agreement, Trading Risk Disclosure, or Refund and Cancellation Policy.

By using the Services, you acknowledge this Policy. Where consent is required, we request it separately. Nothing in this Policy waives any right or remedy that applicable law does not permit a person to waive.

2. Eligibility and International Availability

The Services are intended only for persons age 18 or older. I & A may accept users located outside the United States where offering and receiving the Services is lawful, operationally supported, and consistent with applicable sanctions, trade controls, payment restrictions, and privacy requirements. International availability is determined by I & A and does not guarantee that every feature will be offered in every location.

I & A is based in the United States. Overseas users understand that their information may be transferred to and processed in the United States and in other countries where our service providers operate. Those countries may have privacy laws that differ from the laws where the user resides.

Mandatory local privacy rights remain available where applicable. International access does not create a waiver of the EU GDPR, UK GDPR, Canadian privacy law, or another non-excludable law. Before offering processing that legally requires a local representative, transfer mechanism, or additional notice, I & A will put the applicable measure in place or will not offer that processing in the affected location.

Access is unavailable where providing or receiving the Services would violate applicable law or restrictions. Sanctions may apply to jurisdictions, regions, persons, organizations, or transactions and change over time. Users should review current official restrictions at OFAC Sanctions Programs and Country Information.

3. Information We Collect

We collect information you provide, information generated through use of the Services, and limited information received from the providers used to operate the Services.

• Identity and contact information, including name, email address, telephone number, country or state, and age confirmation.
• Qualification information, including trading experience, goals, challenges, reasons for requesting access, and form responses.
• Assessment answers, initial A1, A2, B1, C0, or C1 route, review status, and any later reclassification.
• Account, enrollment, preference, community, and support information.
• Communications, including emails, form submissions, feedback, call notes, Telegram or Discord communications directed to official channels, and information voluntarily discussed during calls.
• Call and meeting recordings when notice and legally required consent have been provided.
• Payment-related records received from Stripe, such as billing contact details, transaction identifiers, payment status, subscription status, refunds, card brand, and last four digits. Complete card details are handled by Stripe.
• Technical information generated by the website and service providers, such as IP address, browser, device type, operating system, approximate location, timestamps, referring page, diagnostic information, login attempts, and security logs.
• Marketing preferences and records of opt-in, opt-out, or withdrawal.

4. Qualification and Classification Process

The qualification form uses disclosed answers to apply predetermined routing rules and generate an initial A1, A2, B1, C0, or C1 classification. That initial classification may route an applicant toward a representative call, a qualifying or foundation video, onboarding content, requalification, or an Drakoa group. This initial routing occurs automatically and is intended to organize the intake process.

Authorized I & A personnel review qualification information before or during the next stage of the process. The initial route does not by itself create a contract, approve credit, determine employment, provide financial advice, guarantee paid access, or produce a legal or similarly significant effect.

An applicant may ask a representative to explain or reconsider the classification. Reclassification may occur verbally during a call after human review of the applicant's answers and additional information. A person may also request human review by emailing legal@iandaindustries.com. I & A records the final route and material changes when reasonably necessary to administer the process.

5. Current Technology and Data-Use Boundaries

At the date of this Policy, the launch-stage Services do not connect to brokerage accounts and do not collect brokerage credentials, positions, orders, balances, or trading-account activity through a brokerage integration.

At the date of this Policy, I & A does not use Meta Pixel, Meta Conversions API, retargeting pixels, custom-audience uploads, or a separate behavioral analytics platform. I & A also does not use a standalone customer relationship management platform or generative-AI system to determine applicant qualification.

Website hosting, security, email, forms, payments, calls, and community providers may generate ordinary operational records as described in this Policy. Before introducing brokerage connectivity, advertising or retargeting technology, material analytics, a CRM, or AI processing of personal information, I & A will evaluate the data flow, revise this Policy and point-of-collection notices, and obtain consent or provide opt-out controls where required. A new practice will not be described as active before it is implemented.

6. How We Use Information

• Operate, maintain, secure, troubleshoot, and improve the Services.
• Administer qualification, automatic initial routing, human review, calls, reclassification, onboarding, and account access.
• Provide educational services, community access, support, and customer communications.
• Process payments, subscriptions, refunds, tax records, and fraud-prevention activities.
• Send operational, security, contractual, and policy notices.
• Send marketing communications when permitted and honor opt-out requests.
• Detect, investigate, and prevent fraud, misuse, unauthorized access, and security incidents.
• Comply with sanctions, legal process, accounting duties, disputes, and enforcement of our agreements.
• Create aggregated or de-identified information that is not reasonably linked to an identifiable person.

7. Legal Bases for EEA and UK Processing

Where the EU GDPR or UK GDPR applies, I & A relies on one or more of the following legal bases:

• Contract: to provide requested Services, administer accounts, payments, support, community access, and onboarding.
• Steps before contract: to process a requested qualification or access application.
• Legitimate interests: to secure and improve the Services, prevent misuse, administer the business, communicate with users, and organize qualification routing, balanced against individual rights.
• Consent: for optional marketing, call recordings where required, and nonessential cookies or future integrations where applicable.
• Legal obligation: to comply with tax, accounting, sanctions, fraud-prevention, lawful-process, and regulatory requirements.

Consent may be withdrawn at any time without affecting processing already completed lawfully. When information is necessary to provide a requested service or comply with law, declining to provide it may prevent access.

8. Calls and Recordings

Representatives may use Zoom or another disclosed provider for qualification, onboarding, support, training, documentation, quality assurance, security, or compliance. I & A will provide notice and obtain consent as required by applicable law before recording.

Where affirmative consent is required, continuing the call is not the sole consent mechanism. I & A may obtain written consent before the call and audible confirmation before recording begins. If consent is declined or withdrawn, recording will not begin or will stop, and I & A may offer an unrecorded call or another communication method when reasonably available.

9. Marketing Communications

I & A may send marketing email after providing clear notice and obtaining an opt-in where required. Marketing consent is not a condition of receiving a purchased Service unless expressly and lawfully stated. Marketing messages will provide an accessible unsubscribe method. Users may also opt out by contacting legal@iandaindustries.com.

Operational, security, billing, contractual, and legal communications may continue after a marketing opt-out when necessary to administer the relationship.

10. Cookies and Similar Technologies

The Services may use cookies or similar technologies necessary for security, authentication, session continuity, preferences, payment flow, forms, and basic website operation. We do not currently use separate behavioral analytics or targeted-advertising cookies.

If I & A later adopts nonessential analytics, Meta tools, retargeting, custom audiences, or similar technologies, we will update this Policy before or when the change becomes effective and provide consent, rejection, or opt-out controls where required. Browser settings may restrict cookies, but disabling necessary cookies may prevent parts of the Services from working.

11. How We Disclose Information

I & A does not currently sell personal information or use it for targeted advertising. We disclose information only as reasonably necessary to:

• Authorized personnel and contractors who need it for qualification, account administration, support, security, compliance, or service delivery.
• Website hosting and infrastructure providers used to operate the website.
• Google services used for forms, documents, productivity, and Gmail communications.
• Stripe for payments, billing, fraud prevention, and compliance.
• Zoom for calls, meetings, and recordings when applicable.
• Discord or Telegram when a user chooses to participate in an official community or communication channel.
• Professional advisers, auditors, insurers, legal counsel, and compliance providers.
• Government authorities or other parties when required by law, legal process, sanctions obligations, protection of rights or safety, or investigation of misuse.
• A successor or relevant counterparty in a merger, financing, reorganization, sale, or transfer, subject to appropriate confidentiality and legal requirements.

Access within I & A is limited to legitimate business functions. Personnel and contractors are not permitted to use personal information for unrelated personal purposes.

12. International Transfers

Information may be transferred to and processed in the United States and other locations where our providers operate. I & A remains responsible for selecting providers and applying safeguards required by applicable law.

Where a restricted transfer under the EU GDPR or UK GDPR requires a transfer mechanism, I & A will use an available lawful mechanism, such as an adequacy decision, approved contractual clauses, or another legally recognized basis, together with supplementary measures where required. Users may request information about applicable safeguards at legal@iandaindustries.com.

Where required because I & A offers Services to individuals in the EEA or UK, I & A will identify an appointed representative in a supplemental notice accessible from this Policy. If a representative is legally required but has not been appointed, I & A will not intentionally offer the affected processing until that requirement is addressed.

13. Data Retention and Deletion

I & A follows the default schedule below. Deletion is performed through configured automated deletion where available and documented manual review where automation is unavailable. Completion may be recorded for accountability.

I & A may pause scheduled deletion only when reasonably necessary to comply with a specific legal obligation, preserve evidence for an active dispute or investigation, protect security, or honor a valid legal hold. The exception will be limited to the affected information and documented. It does not create a general right to keep information indefinitely.

Deletion from active systems may not immediately remove information from protected backups. Backup information remains isolated from ordinary use and is deleted or overwritten through the provider's normal backup cycle unless restoration is legally required.

14. Security and Incident Response

I & A uses reasonable administrative, technical, and organizational measures appropriate to the nature of the Services and information. Measures may include data minimization, role-based access, authentication, secure transmission, provider review, logging, personnel restrictions, retention controls, and incident-response procedures. No system can guarantee prevention of every unauthorized access, cyberattack, outage, error, or loss.

When I & A becomes aware of a suspected incident, it will take reasonable steps to investigate, contain, remediate, document, and assess notification obligations. I & A will notify affected individuals and authorities when required by applicable law. Users should report suspected unauthorized access to legal@iandaindustries.com.

15. Privacy Requests and Human Review

Depending on applicable law, users may request access, correction, deletion, restriction, objection, portability, information about disclosures, withdrawal of consent, or human review of a classification. Users may also have a right to appeal a denied request or complain to a privacy regulator.

Requests may be submitted to legal@iandaindustries.com. The request should identify the relevant account or email and describe the right being exercised. I & A may take reasonable steps to verify identity and authority. We respond within the period required by applicable law and do not unlawfully discriminate against a person for exercising privacy rights.

I & A may deny or limit a request where permitted by law, including to protect another person, preserve security, comply with law, maintain privileged information, or retain records subject to a valid legal hold. When required, we will explain the decision and available appeal method.

16. United States State Disclosures

Residents of certain states may have additional rights when the relevant state privacy law applies to I & A and the processing. Rights may include access, correction, deletion, portability, opt-out of sale, targeted advertising, or qualifying profiling, and an appeal process.

I & A does not currently sell personal information or process it for targeted advertising. The automatic intake route is followed by an available human-review process and is not intended to produce a legal or similarly significant decision. If our practices change, we will revise the notices and provide required controls.

17. Canada

Where Canadian privacy law applies, I & A identifies the purposes for collection, limits collection to what is reasonably necessary, obtains meaningful consent when required, safeguards information, and provides access and correction procedures. I & A remains accountable for information transferred to a provider for processing, subject to applicable law.

Canadian users may contact legal@iandaindustries.com with questions or complaints. Cross-border providers may process information outside Canada, where it may be subject to lawful access under the laws of that jurisdiction.

18. European Economic Area and United Kingdom

Where applicable, individuals in the EEA or UK may have rights to access, rectify, erase, restrict, object, port information, withdraw consent, and complain to a supervisory authority. Users may object to direct marketing at any time.

The initial A1/A2/B1/C0/C1 route is generated by predetermined rules, but a person may request human review and may receive verbal reclassification during a call. I & A does not currently use the classification to make a solely automated decision producing legal or similarly significant effects.

19. Children's Privacy

The Services are not directed to anyone under 18. I & A does not knowingly collect personal information from a person under 18. If we learn that such information was collected, we will take reasonable steps to delete it. A parent or guardian may contact legal@iandaindustries.com.

20. Third-Party Services

Third-party services process information under their own terms and privacy notices. Users should review the policies of Stripe, Google, Zoom, Discord, Telegram, the website host, and any other service they choose to use. I & A does not control an independent third party's separate processing, but remains responsible for its own provider selection and obligations under applicable law.

21. Changes to This Policy

I & A may update this Policy when the Services, vendors, data flows, law, or business practices change. We will post the revised Policy with a new Last Updated date. If a change materially expands collection, use, or disclosure, we will provide additional notice and obtain consent or offer an opt-out where required before applying the new practice.

Installing Meta tools, retargeting, a material analytics service, a CRM, AI processing of personal information, or a brokerage connection will trigger a data-flow review and policy update. Material changes will not be applied retroactively where prohibited by law.

22. Contact Us

Questions, privacy requests, classification-review requests, marketing opt-outs, security reports, or complaints may be directed to:

I & A Industries
Attn: Privacy and Legal
Email: legal@iandaindustries.com

Appendix A. Required Point-of-Collection Notices

These short notices supplement this Policy and should appear where the relevant information is collected.

Qualification form notice

I & A Industries will use your responses to generate an initial Drakoa classification and route you to an appropriate next step. Predetermined rules perform the initial routing. Authorized personnel may review your responses, and you may request human review or discuss reclassification during a call. Submission does not guarantee acceptance or paid access. Do not provide brokerage passwords, authentication codes, account numbers, government identification numbers, or other unnecessary sensitive information. See the Drakoa Privacy Policy for details.

Optional marketing consent

I agree to receive marketing emails from I & A Industries. Consent is optional, and I may unsubscribe at any time. This choice does not affect necessary account, security, billing, or legal communications.

Recording-consent notice

This call may be recorded for onboarding, training, quality assurance, documentation, security, or compliance. Recording will begin only after required notice and consent. You may decline or withdraw consent before or during the call; I & A Industries may offer an unrecorded call or another communication method when reasonably available.

SMS Communications

I & A Industries offers an optional Drakoa SMS program for recurring automated informational and promotional messages, including application follow-up, qualification updates, scheduling reminders, product updates, educational content and service offers. Message frequency varies. Message and data rates may apply. Participation is optional and is not a condition of applying or purchasing. Providing a phone number alone does not constitute marketing consent. Live-call, SMS and email permissions are collected separately.

When SMS messaging is activated, reply STOP to opt out or HELP for help. You may also request help, withdraw consent or request that we do not contact you by emailing support@iandaindustries.com. We are currently collecting communication permissions only; automated SMS sending is not active.

We use mobile numbers and related information to administer the Drakoa messaging program, record consent, provide permitted communications and honor opt-outs. We do not sell or share mobile information, SMS consent or opt-in data with third parties or affiliates for their marketing or promotional purposes. Service providers may process this information solely to operate the program under our instructions, or where disclosure is legally required.

Communication evidence retention

Qualification application records, including Accepted clients, are deleted 30 days after submission. As a compliance exception, minimum contact identifiers, consent yes/no selections, timestamps, displayed consent text and versions, privacy-consent evidence, opt-outs, do-not-contact and suppression records are retained separately after application deletion for as long as needed to honor communication preferences, demonstrate consent and comply with applicable obligations. These retained records are restricted to authorized personnel and are not used to reconstruct deleted qualification answers or private notes. A later application or checkbox selection does not automatically clear a recorded opt-out or do-not-contact request.