Legal

Privacy Policy

Lunar Rails · Last updated: June 2026

Introduction

Lunar Rails is the trade name of 40 ACRES, S.A. DE C.V., a company incorporated in El Salvador with registered office at Calle Cuscatlán #4312, Colonia Escalón, San Salvador, El Salvador ("Lunar Rails", "We", "Us", "Our"). 40 ACRES, S.A. DE C.V. is the data controller responsible for your personal data. It is registered as a digital asset service provider in El Salvador (DASP Registration No. PSAD-0046) and is authorised and supervised by the Comisión Nacional de Activos Digitales (CNAD), the Superintendencia del Sistema Financiero (SSF), and the Banco Central de Reserva de El Salvador (BCR). We comply with all applicable data protection, AML/CFT, and financial services laws and regulations.

This Privacy Policy has been developed for Lunar Rails. It is reviewed at least annually, or earlier if a change in applicable law requires an earlier update. The Chief Information Security Officer / Data Protection Officer (CISO/DPO) is responsible for maintaining, developing, implementing, and updating this Policy and ensuring compliance with all applicable laws and regulations. The Board of Directors is responsible for approving and monitoring its implementation.

This Privacy Policy is intended to help you make informed decisions when using our Platform and to explain how your personal information may be collected and processed by us. "Personal Data" means any data or information relating to you which, by itself or in combination with other information, is capable of identifying you.

By visiting, accessing, or using the Lunar Rails platform including the website at https://lunarrails.io (the "Platform"), you confirm that you are at least eighteen (18) years old and agree to be bound by the terms described in this Privacy Policy. Read this Policy together with any other notices we provide when collecting or processing Personal Data about you. This Policy supplements those notices and does not override them.

If you do not accept this Privacy Policy, you must not access or use our Platform. Continued use of the Platform after any update to this Policy constitutes acceptance of the revised terms.

Scope

This Privacy Policy describes how Lunar Rails collects, uses, discloses, and protects the personal information of:

Every person who visits our website
Every person who creates an account with us
Every person who uses our services
Every person who applies for a role at Lunar Rails
Every person whose personal information we process as a result of providing services to third parties
Representatives of third-party service providers who interact with us to fulfil their contractual obligations

Information Collection

Information we process	Purpose	Lawful basis	Mode of collection
Personal identifiers Identity data: first name, last name, username, ID document number. Contact data: email address, telephone number, address. Profile data: username and password.	Register you for our services. Fulfil your requests. Allow participation in interactive features of our Platform.	Performance of a contract. Compliance with a legal obligation.	Direct interactions, email correspondence, registration forms.
Sensitive Personal Data Criminal records and sanctions data collected as part of due diligence.	Due diligence on users and third-party representatives. Fraud and security checks where required by applicable law.	Performance of a contract. Compliance with a legal obligation.	Registration and onboarding forms, direct interactions, email correspondence.
Legal proceedings data Details of legal proceedings, criminal convictions, or judicial/security procedures.	Ensuring service provision complies with applicable laws.	Performance of a contract. Compliance with a legal obligation.	Public registers and records. Third-party database providers.
Marketing data Name, position, business details, communication and marketing preferences.	Promote and market our services. Provide personalised offers. Distribute newsletters and communications.	Consent. Performance of a contract.	Registration forms, direct interactions, email correspondence.
Technical data IP address, login data, browser and device type, time zone, location data, Platform usage data (pages visited, visit duration, language preferences).	Monitor Platform performance. Ensure content is presented effectively. Tailor content to your preferences. Keep our Platform and IT systems secure.	Consent. Performance of a contract.	Automatically collected via browser operation, cookies, and similar technologies as you interact with the Platform.
Email interaction data Information contained in our correspondence with you.	Fulfil your requests. Measure effectiveness of email communications. Plan marketing campaigns. Segment our database.	Performance of a contract.	Our correspondence with you.
Banking and payment data Bank account number, card information (where applicable).	Perform agreements with you and manage our relationship.	Consent. Performance of a contract.	Registration forms, order forms, correspondence.
Transaction history Transaction history with Lunar Rails, including virtual asset purchase, sale, exchange, and transfer transactions.	Fulfil your requests. Comply with applicable laws and regulations.	Consent. Performance of a contract.	Platform interaction, order forms, correspondence.

Use of Personal Information

We may use the personal information we collect for the following purposes:

To provide services: To operate, maintain, and provide our services, including facilitating transactions and account management.
To verify your identity: On an ongoing basis, in compliance with applicable regulatory requirements including AML/CFT obligations.
To enable third-party performance: We may share your information with third-party partners or service providers, subject to confidentiality obligations consistent with this Policy and on the condition that they use your information only on our behalf and pursuant to our instructions.
To communicate: To respond to your enquiries and provide customer support.
To improve services: To analyse usage trends, conduct research, and improve our Platform, while creating a better, more personalised experience for you.
To comply with legal obligations: Including KYC, AML, and CFT requirements and any other applicable regulation.
Recruitment: To assess your suitability for any role you apply for at Lunar Rails, whether submitted online, via email, in hard copy, or in person.
Aggregation: We may create, process, collect, use, and share aggregated, anonymised, or de-identified data for any purpose permitted under applicable laws, including improving and customising the Platform and complying with legal or regulatory obligations. Such data will no longer identify you as an individual.

Disclosure of Personal Information

We may disclose your personal information to third parties in the following circumstances. Where we share your details with any other party, we require them to keep your Personal Data secure and to use it only for the intended purpose.

Employees and affiliates: Our employees, affiliates, and their employees, where necessary to provide our services or where affiliates provide support services to Lunar Rails.
Service providers: Third parties engaged to perform functions and provide services to us, who are bound by confidentiality obligations and authorised to use your information only as directed by us.
Auditors: Auditors, contractors, and advisers assisting with or advising on our business purposes.
Analytics providers: Analytics and search engine providers who assist in improving and optimising our Platform.
Legal compliance: Any party where disclosure is required to enforce our terms and conditions or other agreements, respond to a legal request (subpoena, court order, or government demand), report illegal activity, or enforce or defend claims.
Business transfers: In connection with a merger, acquisition, or sale of all or part of our assets, your personal information may be transferred to the acquiring entity.

Security of Personal Information

We have established adequate information security policies, rules, and technical measures to protect the information we collect from unauthorised access, improper use, alteration, or unlawful destruction. We use SSL certificates to secure our website.

Where you have been allocated a profile to interact with the Platform, it is protected by your username and password, which you must not share with anyone else.

Communications over the internet, including email, are not inherently secure unless encrypted. No transmission over the internet or method of electronic storage can be guaranteed to be 100% secure. We cannot accept responsibility for any unauthorised access or loss of Personal Data that is beyond our control.

In the event of a personal data breach that poses a risk to your financial or personal security, we will promptly notify you of the nature of the breach, its likely consequences, and the measures we have taken to address it and mitigate its adverse effects. We will also notify the relevant supervisory authority in accordance with applicable data protection law.

Cookies

What is a cookie?

A cookie is a small piece of encrypted text saved on your browser or device when you visit a website. Cookies allow us to recognise you and make your subsequent visits easier and more useful. Cookies can be stored for varying lengths of time.

We use both session cookies (which expire when you close your browser) and persistent cookies (which remain on your device until deleted).

How we use cookies

When you use and access our Platform, we may place cookie files on your device. We use cookies to enable Platform functions, provide analytics, prevent fraudulent activity, store your preferences, and enable advertising delivery. We may also use third-party cookies to report usage statistics and deliver advertisements through our Platform.

Types of cookies we use

Essential cookies: Required to let you move around the Platform and use its features. Used to authenticate users and prevent fraudulent use of accounts.
Performance cookies: Collect anonymous information about how you use the Platform, such as which pages you visit most often, to help us improve performance. No personally identifiable information is collected.
Functionality cookies: Remember the choices you make, such as username, login details, and language preferences, to provide enhanced personalised features.
Advertising and targeting cookies: Collect information about your visit and browsing habits to deliver more relevant advertisements and measure campaign effectiveness.

If you delete or refuse cookies, some features of the Platform may not function correctly, and some pages may not display properly. Lunar Rails is not responsible for any loss resulting from your decision or inability to use cookies.

Retention of Personal Information

We will retain your personal information for as long as necessary to fulfil the purposes described in this Policy and to meet any legal, accounting, reporting, regulatory, or law enforcement requirements. All Personal Data records will be securely retained for a minimum of five (5) years, calculated from the date your professional relationship with us closes, unless a longer retention period is required by law.

Your Rights

Under applicable data protection law, you have the following rights regarding your Personal Data:

Access and correction: You have the right to access and correct your personal information. You may update your account information or contact us to request access or correction.
Withdrawal of consent: You may withdraw any consent provided for the processing of your personal information. Withdrawal of consent may affect your ability to use certain services and will not affect processing carried out before the withdrawal.
Right to erasure: You may request deletion of your personal information in certain circumstances, such as where we no longer need it or where you withdraw your consent. Where we have shared your information with third parties, we will notify them of the erasure request where possible and required by law.
Right to lodge a complaint: You may report concerns about our privacy practices to the relevant data protection supervisory authority in your jurisdiction.
Right to object: You may object to the processing of your Personal Data in certain circumstances, including for direct marketing purposes. We may demonstrate compelling legitimate grounds to continue processing that override your rights and freedoms.
Right to restrict processing: You may request that we suspend the processing of your Personal Data in specific scenarios: where you contest its accuracy; where our use is unlawful but you do not wish erasure; where you require it for legal claims; or where you have objected and we are verifying our legitimate grounds.
Right to data portability: You may request that we transfer your Personal Data to you or a nominated third party in a structured, commonly used, machine-readable format, where technically feasible and where applicable under applicable data protection law.

Some of these rights may be limited where we have an overriding legal obligation to continue processing, or where data is exempt from disclosure under applicable law.

Children

Lunar Rails does not offer services to persons under the age of 18. We do not knowingly collect personal information from minors. If we learn that we have inadvertently collected personal information from a minor, we will deactivate the relevant account and take reasonable measures to delete the information promptly.

You confirm that all Personal Data you provide to us is true, complete, and accurate, and you must notify us of any changes.

International Data Transfers

Your personal information may be transferred to and processed in countries other than the country in which you reside, including countries where our service providers or servers are located. We will take appropriate measures to ensure such transfers comply with applicable data protection law.

We transfer Personal Data internationally only where: (i) the recipient country provides an adequate level of protection for personal data; or (ii) we have implemented appropriate safeguards, such as contractual clauses or binding corporate rules. Where neither applies, we transfer data only with your express consent, where necessary for the performance of a contract with you, or where required by applicable law.

If you wish to obtain information about specific safeguards applied to the transfer of your Personal Data, please contact us using the details below.

Amendment

We may update this Policy from time to time by posting a revised version on our website. The revised version will be effective from the date we post it. We encourage you to review this Policy periodically. Continued use of our Platform following any update constitutes your acceptance of the revised Policy. If you do not agree to any update, you must cease using our Platform and notify us.

Record Keeping

Lunar Rails will retain all records relating to compliance investigations, disciplinary actions, and associated notifications for a minimum period of eight (8) years.

Contact Us

If you have questions about this Privacy Policy or our privacy practices, please contact our Data Protection Officer at compliance@lunarrails.io.

By using our services, you consent to the collection, use, and disclosure of your personal information as described in this Privacy Policy.