# Help Centre Welcome to the Help Centre of LFG for Business and Personal accounts.
Securely storing recovery wordsSecurely store recovery words for your walletHC security.png
Business account verificationWhat is business account verification?HC business cover.png
What are transaction charges?What are transaction charges?HC transactions.png
Checking my subscription?How do I check my subscription and fees on transactions?HC subscriptions.png
Getting in contact with usContact us or look for helpHC contact.png
Privacy and cookie policiesAgreementsHC cookie card.png
# How-to... # Setup an account # Back up your recovery codes What are Recovery Codes, and how do you securely back them up. # Securely store recovery words for your wallet When you create a new wallet directly on the LFG app, you will be required to see, and confirm, your **Secret Recovery Phrase**. This is a unique combination of 12 words of varying length that are easily usable in the future, should you need to recover your account. This of the phrase as a password to your wallet. 1. Create a new account using the LFG app, and give it any name you want such as *Daily spending*, *Investment and savings*, or anything else. 2. When adding the app will remind you to back up your phrase whereby you need to tap on **Reveal your words** to get started. 3. You can copy those words to your clipboard to paste elsewhere, such as your password manager but ensure they are very safely kept! 4. Once you have the order of the words you will be required to tap the words in the correct order to carry on using the wallet.
# Request account deletion You can request for your account to be closed, whereby we will delete as much information from our system as possible. To do so, follow these steps: 1. Once logged in to your account on the app, tap the profile picture of profile icon in the top left of the home screen. 2. Once there, you can tap on **Close account** where you are asked to confirm if you want to. We will start the automated internal process of wiping your data from our systems. Once this has been completed you can if you wish use the same email address again to create a new account. Important: when closing an account you are agreeing to the conditions as set out in the [Account Deletion](/p/agreements/account-deletion) agreement.
# Contact us or look for help If you have any questions, or need to search through Help Centre articles. ## Contacting us Whether you have a Personal customer account, or have a professional Business account, feel free to contact us either by emailing or sending us a message through our website here [getlfg.app/contact](https://getlfg.app/contact). ## Searching our Help Centre In the top left corner of this page you can type in some keywords to find an article to help you immediately. If you still can't find what you are looking for, of course get in contact with us. # Personal # What are transaction charges? Cryptocurrency transaction fees are small amounts paid to process a transaction, either for buying and selling crypto to currency, e.g. Ethereum-USD, or when swapping one crypto to another, e.g. Ethereum-Bitcoin. As a Business, you can also get charged a fee to charge one of your customers to purchase your products using crypto. ## LFG fee LFG charge a fee to ensure we are able to provide the best app possible and continue its development now and in the future. Furthermore, the fees charged by LFG also cover all the complex verifications and saftey checks we do on every single transaction, ensuring your funds are kept safe and clean at all times. ## Blockchain fee Depending on the crypto you are dealing with, and on which network, there are going to be fees applied by the network. **These are not fees charged by LFG**. Blockchain fees, that are not decided by LFG, can change mainly depending on: * Network congestion - more transactions waiting to be processed typically increase network fees as other blockchain users want their transactions processed faster. * Transaction complexity - transactions involving complex contracts or large amounts of data require more computational power and, thus, higher fees. This applies to LFG as we ensure that all transactions are from valid, verified sources. # How do I check my subscription and fees on transactions? You can check the fees you are charged for different operations by: 1. Tapping the *profile picture* or *profile icon* in the top left of the Home screen. 2. Tapping on *Subscription*. 3. Whereby you will be shown your current plan, and what is included.

In the above example, Payments are 1% + $0.75 per transaction. Crypto exchanges swaps are 0.5%.

# Business # What is business account verification? How can you get verified, and why we ask you to do it. ## Why get verified LFG prides itself on being a fully compliant payment platform for all types of business merchants, and personal users. To ensure all funds that are sent to you are from trusted, legally compliant users, we must also check businesses that use LFG to receive payments. Fortunately, getting verified is very easy as we work with our trusted partner, CoinMENA, to undertake checks. ## How to get verified As part of the onboarding process of your merchant account, **the app will guide you through the simple process and request a form of ID** from you as the business owner or representative. All verification is only done through the app. In most cases, the verification takes less than 1 minute to complete, but sometimes it can take a bit longer than that. However, you will be notified when the verification has been completed so you can start accepting crypto payments in your business. # Developers Accept stablecoin payments from your own app or storefront with the LFG Pay API. The **LFG Pay API** lets you take payments straight from your own website, app, or backend. Your server creates a payment link, you redirect the buyer to the hosted LFG checkout, and you receive a signed webhook the moment the payment settles. No card networks, no gas fees for your buyers — just USDC or USDT on Ethereum or Base. ### What you can build * A **"Pay with LFG"** button on your storefront or checkout. * Automated invoicing and order fulfilment driven by webhooks. * Any server-to-server flow that needs to charge a customer in stablecoins. ### Start here * [**Pay API integration guide**](/p/developers/pay-api-integration-guide) — everything you need to integrate, in one page: authentication, creating payment links, redirects, and verifying webhooks. Copy the whole page into your AI assistant (Claude, ChatGPT) and ask it to build the integration for your stack. * [**API reference**](/p/developers/api-reference) — the OpenAPI 3.1 spec ([openapi.yaml](https://github.com/LayerFlowGateway/openapi)) for every endpoint, schema, and error. Feed it to your client generator or SDK tooling. You'll need an API key first — create one in your dashboard under **Settings → API Keys**. # Pay API integration guide Integrate the LFG Pay API end to end — authentication, payment links, redirects, and signed webhooks. Everything in one page. This is a complete, self-contained guide to the LFG Pay API. It's written so you can read it top to bottom — or paste the whole page into an AI assistant (Claude, ChatGPT) and ask it to build the integration for your framework. > **Using an AI assistant?** Copy this entire page and prompt it with something like: *"Here are the LFG Pay API docs. Build a 'Pay with LFG' checkout in \: create a payment link on my server, redirect the buyer to the checkout URL, and verify the settlement webhook."* ## How it works The flow is three steps: 1. **Create a payment link** — your server calls the API with the amount and an order reference. You get back a `checkoutUrl`. 2. **Redirect the buyer** to that `checkoutUrl`. LFG hosts the checkout, handles the on-chain payment and compliance screening, and returns the buyer to your `successUrl` when they're done. 3. **Receive a webhook** — LFG POSTs a signed event to your server as the payment progresses, so you can fulfil the order automatically. * **Base URL:** `https://api.getlfg.app/pay/v1` * **Content type:** `application/json` * **Field casing:** all request and response fields are `camelCase`. Everything is scoped to the business your API key belongs to — you never send a business ID, and a leaked key can only ever touch its own business. ## Authentication Create an API key in your dashboard under **Settings → API Keys**. You'll get two secrets, **shown only once**: * the **API key** (`lfg_sk_live_…`) — used to authenticate requests. * the **webhook signing secret** — used to verify webhooks (see below). Store both in your server's secret manager. They're stored hashed on our side and cannot be retrieved again — if you lose one, revoke the key and create a new one. Send the API key as a bearer token on every request: ``` Authorization: Bearer lfg_sk_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx ``` {% hint style="danger" %} The API key is a **server-side secret**. Never put it in browser code, mobile apps, or any public repository. All API calls must come from your backend. {% endhint %} ### Authentication errors | HTTP | `code` | Meaning | | ---- | ------------------- | ----------------------------------------------------- | | 401 | `missing_api_key` | No `Authorization: Bearer …` header was sent. | | 401 | `invalid_api_key` | The key doesn't match any active key. | | 401 | `api_key_revoked` | You revoked this key. Create a new one. | | 403 | `api_key_disabled` | LFG disabled the key (see `reason`). Contact support. | | 403 | `business_disabled` | The business account is disabled. Contact support. | `401` means *your credential* is wrong — rotate it. `403` means LFG turned something off — a new key won't help; contact support. ## Rate limits **60 requests per 60 seconds, per API key.** The limit is per key, so your traffic is never affected by other merchants. Exceeding it returns `429`. ## Response format Successful responses are wrapped in an envelope: ```json { "data": { ... }, "meta": { "timestamp": "2026-01-01T12:00:00.000Z" } } ``` List endpoints add pagination fields (`page`, `limit`, `total`, `totalPages`) under `meta`. ## Create a payment link ``` POST /pay/v1/payment-links ``` ### Request body | Field | Type | Required | Notes | | --------------- | ------ | -------- | ------------------------------------------------------ | | `orderId` | string | yes | Your own order reference. Echoed back on webhooks. | | `fiatAmount` | number | yes | The amount to charge (positive). | | `token` | string | yes | `USDC` or `USDT`. | | `network` | string | yes | `base` or `ethereum`. | | `fiatCurrency` | string | no | Defaults to your business currency (e.g. `USD`). | | `expiryMinutes` | number | no | How long the checkout stays payable. | | `successUrl` | string | no | Where the buyer returns after paying. | | `cancelUrl` | string | no | Where the buyer returns on cancel/failure. | | `webhookUrl` | string | no | Overrides the key's default webhook URL for this link. | | `skuMetadata` | object | no | `{ "items": [ … ] }` line-item detail. | ### Example {% code title="cURL" %} ```bash curl -X POST https://api.getlfg.app/pay/v1/payment-links \ -H "Authorization: Bearer $LFG_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "orderId": "order_1042", "fiatAmount": 49.99, "fiatCurrency": "USD", "token": "USDC", "network": "base", "successUrl": "https://yourstore.com/thanks", "cancelUrl": "https://yourstore.com/cart" }' ``` {% endcode %} {% code title="Node.js" %} ```javascript const res = await fetch("https://api.getlfg.app/pay/v1/payment-links", { method: "POST", headers: { Authorization: `Bearer ${process.env.LFG_API_KEY}`, "Content-Type": "application/json", }, body: JSON.stringify({ orderId: "order_1042", fiatAmount: 49.99, fiatCurrency: "USD", token: "USDC", network: "base", successUrl: "https://yourstore.com/thanks", cancelUrl: "https://yourstore.com/cart", }), }); const { data } = await res.json(); // Redirect the buyer to data.checkoutUrl ``` {% endcode %} ### Response `201` ```json { "data": { "id": "…", "linkToken": "pay_yourbiz_ab12cd", "checkoutUrl": "https://pay.getlfg.app/pay/pay_yourbiz_ab12cd" }, "meta": { "timestamp": "…" } } ``` Redirect the buyer to `checkoutUrl`. LFG hosts the checkout, the on-chain payment, and compliance screening. {% hint style="warning" %} Always recompute the amount on your **server** from your own cart or order — never trust an amount sent from the browser. {% endhint %} ## List and fetch payment links ``` GET /pay/v1/payment-links?page=1&limit=15 ``` Returns your links, newest first, each with its current session, paginated. ``` GET /pay/v1/payment-links/{id} ``` Returns a single link (plus session), or `404` if it isn't yours. ## Returning the buyer to your store When the payment completes, the buyer sees an **Order Confirmed** screen on the LFG checkout. Closing it returns them to your `successUrl`, with these query parameters appended so you can reconcile the order: | Param | Description | | ------------ | ------------------------------ | | `order_id` | Your original `orderId`. | | `link_token` | The payment link token. | | `tx_hash` | The on-chain transaction hash. | | `status` | `success`. | On cancellation or a failed payment (wrong network/asset, underpaid, expired, screening failed), the buyer is returned to your `cancelUrl` with `status=cancelled` / `failed` / `expired`. {% hint style="info" %} Treat the **webhook** — not the redirect — as the source of truth for whether a payment succeeded. A buyer can close the tab before returning; the webhook still fires. {% endhint %} ## Webhooks If a payment link has a `webhookUrl` (either set per-request, or configured as the key's default), LFG sends a `POST` to it every time the payment session changes state — so you can fulfil orders without polling. ### Payload ```json { "event": "payment.state.changed", "orderId": "order_1042", "linkToken": "pay_yourbiz_ab12cd", "state": "approved", "previousState": "screening_in_progress", "txHash": "0x…", "sourceWallet": "0x…", "timestamp": "2026-01-01T12:00:00.000Z" } ``` Payment states progress roughly as: ``` created → opened → payment_pending → payment_detected → screening_in_progress → approved ``` Treat **`approved`** as "paid and cleared" — that's the state at which funds are confirmed and screened. Failure branches include `expired`, `underpaid`, `overpaid`, `wrong_asset`, `wrong_network`, and `screening_failed`. Delivery is retried up to 3 times with exponential backoff. Return any `2xx` status to acknowledge; a non-2xx triggers a retry. ### Verifying the signature Every webhook for an API-created link is signed. Each request carries: * `X-LFG-Timestamp` — unix seconds. * `X-LFG-Signature` — `HMAC-SHA256(secret, "{timestamp}.{rawBody}")`, hex-encoded. The `secret` is the **webhook signing secret** you received when creating the API key. Recompute the HMAC over `` `${timestamp}.${rawBody}` `` and compare in constant time. Reject anything with a timestamp older than a few minutes to prevent replays. {% code title="Node.js" %} ```javascript import { createHmac, timingSafeEqual } from "crypto"; function verifyWebhook(rawBody, headers, secret) { const timestamp = headers["x-lfg-timestamp"]; const signature = headers["x-lfg-signature"]; const expected = createHmac("sha256", secret) .update(`${timestamp}.${rawBody}`) .digest("hex"); const a = Buffer.from(signature); const b = Buffer.from(expected); const signatureOk = a.length === b.length && timingSafeEqual(a, b); const fresh = Math.abs(Date.now() / 1000 - Number(timestamp)) < 300; return signatureOk && fresh; } ``` {% endcode %} {% hint style="warning" %} Verify against the **raw request body**, exactly as received — before any JSON parsing or re-serialising. Re-encoding changes the bytes and breaks the signature. {% endhint %} ## Managing keys API keys are created, listed, and revoked by the business **owner** in **Settings → API Keys**. You can have up to **5 active keys** per business — rotate by creating a new key, then revoking the old one. Revoking takes effect immediately. ## Integration checklist 1. Create an API key in **Settings → API Keys**; store the key and webhook secret in your backend. 2. Add a server endpoint that creates a payment link and returns the `checkoutUrl`. 3. Redirect the buyer to `checkoutUrl`; set `successUrl` / `cancelUrl` back to your site. 4. Add a webhook endpoint that verifies the signature and marks the order paid on `approved`. 5. Go live — the API is production from day one; there is no separate test environment. # API reference Machine-readable OpenAPI 3.1 reference for the LFG Pay API — every endpoint, schema, error, and the signed webhook. The full LFG Pay API is described by an OpenAPI 3.1 spec: [**openapi.yaml**](https://github.com/LayerFlowGateway/openapi). Point your client generator, SDK tooling, or AI coding assistant at that file to get typed clients and request builders for free. For the narrative walkthrough — auth, redirects, webhook verification — read the [Pay API integration guide](/p/developers/pay-api-integration-guide). * **Base URL:** `https://api.getlfg.app/pay` * **Auth:** `Authorization: Bearer lfg_sk_live_…` (server-side only) * **Field casing:** `camelCase` everywhere ## Payment links {% openapi src="/files/LmiUpGph7sb74yuAhe15" path="/v1/payment-links" method="post" %} [openapi.yaml](https://751729885-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FreQD2uJtAxY2zZaB0y6M%2Fuploads%2Fgit-blob-75bf08d3799024c9c5f93403554a5ddeb236fa4e%2Fopenapi.yaml?alt=media) {% endopenapi %} {% openapi src="/files/LmiUpGph7sb74yuAhe15" path="/v1/payment-links" method="get" %} [openapi.yaml](https://751729885-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FreQD2uJtAxY2zZaB0y6M%2Fuploads%2Fgit-blob-75bf08d3799024c9c5f93403554a5ddeb236fa4e%2Fopenapi.yaml?alt=media) {% endopenapi %} {% openapi src="/files/LmiUpGph7sb74yuAhe15" path="/v1/payment-links/{id}" method="get" %} [openapi.yaml](https://751729885-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FreQD2uJtAxY2zZaB0y6M%2Fuploads%2Fgit-blob-75bf08d3799024c9c5f93403554a5ddeb236fa4e%2Fopenapi.yaml?alt=media) {% endopenapi %} ## Webhook The spec also documents the `payment.state.changed` webhook LFG sends to your `webhookUrl`, including the `X-LFG-Timestamp` / `X-LFG-Signature` headers. See [Verifying the signature](/p/developers/pay-api-integration-guide#verifying-the-signature) for a worked example. # WooCommerce plugin Accept USDC on Base in your WooCommerce store with the Layer Flow Gateway plugin — install, connect your API key, and orders update themselves. The **Layer Flow Gateway Payments for WooCommerce** plugin adds a **Pay by Layer Flow Gateway** option to your checkout. Buyers are sent to the Layer Flow Gateway hosted checkout, pay in USDC on Base, and come straight back to your store. The order is marked paid automatically — no code required. It's built on the [Pay API](/p/developers/pay-api-integration-guide), so everything in that guide applies under the hood. ## Requirements * WordPress 6.5+ and WooCommerce 8.3+ (PHP 7.4+). * A Layer Flow Gateway business account on a **monthly plan** — API keys aren't available on pay-as-you-go or the trial. Only the business **owner** can create keys. * Your store currency set to **US Dollar (USD)**. The payment method stays hidden for other currencies. ## 1. Install the plugin 1. Download the plugin: [layer-flow-gateway-woocommerce.zip](https://lfg-plugins.s3.eu-central-1.amazonaws.com/layer-flow-gateway-woocommerce.zip). Don't unzip it — WordPress installs the zip as-is. 2. In WordPress, go to **Plugins → Add New → Upload Plugin**, choose the zip, and click **Install Now**, then **Activate**. ## 2. Create an API key 1. In the Layer Flow Gateway dashboard, open **Settings → API Keys** and click **Create key**. Name it after your store (for example, "WooCommerce"). 2. Copy both values shown — the **API key** (`lfg_sk_live_…`) and the **webhook signing secret** (`whsec_…`). Each is shown **once**. You don't need to enter a webhook URL on the key: the plugin sends its own with every payment. ## 3. Connect WooCommerce Go to **WooCommerce → Settings → Payments → Layer Flow Gateway Payments** and fill in: | Setting | What to enter | | ---------------------- | -------------------------------------------------------------------------------------------------------------- | | Enable | Tick it. | | API key | The `lfg_sk_live_…` key. | | Webhook signing secret | The `whsec_…` secret. | | Test mode | Tick it to take test payments in USDC on Base Sepolia while you set up. Untick it to accept real USDC on Base. | | Checkout expiry | How long the buyer has to pay. Keep it at or below WooCommerce's **Hold stock** setting (default 60 minutes). | Click **Save changes**. The plugin checks the key with Layer Flow Gateway straight away and shows **"Layer Flow Gateway API key verified."** If the key is wrong or revoked, you'll see the reason instead. The payment method now appears on both the block-based checkout and the classic checkout. Payments are always **USDC on Base**. ## How orders update | What happened on Layer Flow Gateway | WooCommerce order | | ------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------- | | Payment confirmed | **Processing** (or **Completed** for virtual/downloadable products). The transaction hash is saved as the order's transaction ID. | | Underpaid, overpaid, wrong token or network, or manual review | **On hold**, with a note explaining why. | | Wallet screening failed | **Failed**. | | Checkout expired | A note only. A late payment still completes the order. | Every state change is added to the order notes, and the order page shows the payment link and transaction hash under the billing address. Buyers who click **Cancel payment** go back to the order's **Pay for order** page and can try again. If they retry within the expiry window, they get the same checkout — you aren't charged for a second payment link. ## Revoking a key Revoking the key in **Settings → API Keys** stops new checkouts immediately: buyers see **"Layer Flow Gateway is currently unavailable. Please try again or choose another payment method."** To resume, create a new key and paste it into the plugin settings. ## Troubleshooting **The payment method doesn't show at checkout.** Check that the store currency is USD (an admin notice appears if it isn't), the plugin is enabled, and an API key is saved. **Buyers see "Layer Flow Gateway is currently unavailable".** Re-save the plugin settings to see why, or open **WooCommerce → Status → Logs** and pick the `layer-flow-gateway` log. Common causes: | Log shows | Fix | | --------------------------------------- | ------------------------------------------------------------------------------ | | `HTTP 401` | The API key is wrong or was revoked. Create a new key and paste it again. | | `HTTP 403` with a plan or trial message | Your plan's payment-link allowance is used up. Check billing in the dashboard. | | `HTTP 403` otherwise | The key or business was disabled by Layer Flow Gateway. Contact support. | | `HTTP 429` | More than 60 checkouts started in a minute. Buyers can retry shortly. | **A buyer paid but the order is still Pending payment.** The webhook couldn't reach your site — a firewall, security plugin, or maintenance mode blocking `/wc-api/layer_flow_gateway/` is the usual cause. The order still updates when the buyer lands on the order-received page. Also check that the webhook signing secret matches the API key: a wrong secret is logged as "Rejected webhook". **Can I refund from WooCommerce?** Not yet — refund from the Layer Flow Gateway dashboard. # Agreements # Cookie policy **Effective date: 13th September 2026** This Policy explains cookies and comparable device technologies used by **Layer Flow Gateway, Inc.**, 131 Continental Dr, Suite 305, Newark, DE 19713, United States. Contact ****. Read it with our [Privacy Policy](https://help.getlfg.app/p/agreements/privacy-policy). ## 1. Our web applications LFG’s own web applications currently use one strictly necessary authentication cookie, **lfg\_access**. They do not currently run optional website analytics, advertising pixels or behavioural advertising cookies. | Item | Purpose | Provider | Duration | | ----------- | ------------------------------------------ | ---------------- | ---------------------------------------------------- | | lfg\_access | Maintain and validate authenticated access | LFG, first party | \[\[30 days; renewed when the user signs in again.]] | The authentication cookie is needed for the sign-in service you request. You can block or delete it through your browser, but authenticated features may stop working. We do not ask you to accept optional cookies where none are used. Essential server security logs are described separately in the Privacy Policy. LFG may use country, residence and account-eligibility information described in the Privacy Policy to apply the market and feature rules in the Global Availability Statement. This includes disabling USDT payments and swaps into USDT for EU/EEA customers. This is an access-control function, not advertising or behavioural profiling, and the cookie itself does not determine legal eligibility. A help page, embedded checkout or other page operated by a third party may have its own technologies and notice. We identify the provider when you enter its service. Where LFG controls the loading of non-essential technologies that require consent, we obtain it before loading them. A provider relationship does not remove that responsibility. ## 2. Mobile technologies | Tool | Function and information | Choice and retention | | --------- | -------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Sentry | App error and crash diagnostics; configured event information can include device/app details, error context and identifiers | Ordinary crash records are kept for up to 30 days. Optional diagnostic collection requiring consent is off until agreed and can be disabled in the app’s privacy controls. Necessary security processing is separately explained. | | OneSignal | Deliver enabled notifications, using push tokens, relevant app/device identifiers, preferences and delivery or interaction information | Notification permission can be changed in device settings. Separate optional data collection is controlled through the app’s privacy choices. Unnecessary identifiers are removed within 30 days of opt-out or closure, and unwanted sending stops promptly. | The fact that a tool reports crashes or delivers notifications does not make every use of that tool strictly necessary. We limit collection to the functions described and apply the relevant consent rules to optional device access or storage. An operating-system notification prompt does not authorise unrelated analytics or marketing. Wallet and sign-in integrations may also use local secure storage necessary for functions you request. Wallet recovery material is not an advertising identifier. Before deleting the app or its local storage, export and retain the recovery phrase or appropriate private key for every wallet. LFG cannot recover the wallets afterwards if the required access material has not been retained independently. ## 3. Refusing or changing choices You can refuse optional diagnostic or notification-related collection where offered and later change the choice in the app’s privacy settings. Where consent is required, refusing must be as straightforward as accepting. Withdrawing consent stops future optional collection; deletion of existing records follows the Privacy Policy and any applicable erasure right. Device notification settings control whether notifications can be delivered. The app’s privacy controls additionally govern any separate optional collection. Closing the account stops account notifications; unsubscribing from marketing does not prevent a necessary contractual or security notice sent through an appropriate channel. We do not use third-party behavioural advertising or sell device data to advertising brokers. If the tools or purposes change, we update this information and request any required new consent before the new processing begins. ## 4. Processing locations and contact Sentry’s EU ingestion configuration does not establish that all processing by every vendor occurs in the EU. The Privacy Policy explains international transfers, data rights and safeguards. Questions or requests can be sent to ****. *** # Privacy policy **Effective date: 12th Septemnber 2026** ## 1. Controller and scope **Layer Flow Gateway, Inc.**, Delaware File No. 10054149, is the controller for the personal data it processes to operate LFG accounts, its own onboarding, billing, security and support. Address: **131 Continental Dr, Suite 305, Newark, DE 19713, United States**. Contact: ****; support: ****. This Policy covers applicants, users, business representatives and beneficial owners, website visitors, support contacts and other people whose information we receive in connection with LFG. Privacy rights do not depend on successful onboarding or residence in an approved service country. Business records can contain personal data about individuals. **EEA representative:** \[\[EEA REPRESENTATIVE — NAME, POSTAL ADDRESS AND EMAIL]]. **UK representative:** \[\[UK REPRESENTATIVE — NAME, POSTAL ADDRESS AND EMAIL, IF REQUIRED]]. The representatives are privacy contacts; they are not LFG’s contracting company, a recovery custodian or a financial-services authorisation. You can contact LFG directly regardless of where you live. ## 2. Information we process and where it comes from | Information | Sources and use | | ------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Account and contact details | Information you provide, including name, contact details, age or date of birth, account settings and eligibility details. Used to set up and administer accounts and communicate with you. | | Verification information | Information submitted for Didit checks, including identity documents, relevant photographs or liveness material, business registration, representatives, beneficial ownership and screening results. We receive verification decisions and associated information through provider responses and dashboards. | | Verification and integration records | Provider session references, decision payloads, review outcomes, status changes and raw event notifications. Full responses can contain more than an approval status, including identity details or links to verification evidence. Access is restricted and the retention schedule below applies. | | Wallet and transaction information | Public addresses, network and token identifiers, amounts, transaction hashes, timestamps, payment requests and associated account labels or counterpart information. Obtained from you, your use of the interface, public networks and enabled providers. | | Encrypted wallet backup | Device-encrypted recovery material associated with the account. LFG cannot decrypt it independently. The active copy is deleted on account closure and cannot then be used by LFG to recover the wallet. | | Subscription information | Plan, invoices, payment and cancellation records, the LFG Vault address and signed EIP-3009 authorisations for LFG’s own fees. Signed payment authorisations are sensitive even though they are not the LFG Vault’s private key. | | Technical and security information | IP addresses, authentication and security events, app/device information, error reports and necessary service logs. Used for access, geographic controls, security and troubleshooting. | | Notification information | Push tokens, device/app identifiers, notification preferences and delivery or interaction information processed through the enabled OneSignal configuration. | | Telephone and messaging information | If SMS is enabled, telephone number, opt-in or opt-out record, message type, delivery status and interaction information. Used for requested authentication, account/security communications and separately authorised marketing where offered. | | Support and business contacts | Messages, attachments, complaint records and information needed to respond. Do not send wallet secrets or unnecessary identity evidence to support. | We do not require you to send a usable private key or recovery phrase to LFG support. The encrypted server backup must not be confused with readable key material. Device biometrics used locally by an operating system to unlock a device are also distinct from photographs, liveness checks or facial verification used in onboarding. Payment-card information entered in a provider’s own checkout is handled by that provider. LFG receives relevant status and transaction references; do not send full card information to LFG support. The exact information supplied to a provider is explained in that provider’s journey and privacy notice. ## 3. Purposes and lawful bases Where EU or UK GDPR applies, we use the following bases as appropriate to the particular information and purpose: | Purpose | Basis and explanation | | ------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Provide an individual’s requested account and service; support and administer their subscription | Performance of, or steps requested before, the contract, but only for processing objectively necessary for it. | | Administer a company’s account and communicate with its representatives | Legitimate interests in providing and administering the company’s requested service; contract where the individual is personally the contracting party. | | Verify eligibility and prevent fraud, account misuse and sanctions exposure | Legitimate interests following an assessment of necessity and the person’s rights; an applicable legal obligation only where a relevant law actually imposes it on LFG. Biometric identification requires the additional condition in section 4. | | Keep billing, tax and legally required records | The applicable legal obligation, or another valid basis where that obligation is not itself a GDPR legal-obligation basis, including assessed legitimate interests in accounting and legal compliance. | | Maintain necessary security and resolve incidents | Legitimate interests in protecting users and the service; a legal obligation where applicable. | | Optional diagnostic collection, notification uses or marketing requiring consent | Consent, requested separately with a way to refuse or withdraw. Necessary service communications and the assessment of device-storage consent are treated separately. | | Send requested SMS authentication and necessary account or security communications | Performance of the requested service or legitimate interests in account security, as applicable. Electronic-marketing rules and consent apply separately to marketing messages. | | Establish, exercise or defend legal claims; respond to lawful demands | Applicable legal obligations or assessed legitimate interests, with any additional condition required for sensitive information. | We do not assume that all customers’ identity files must be held under an AML law merely because LFG chooses to verify users. A third-party provider’s legal duty is not automatically LFG’s duty. Where a law requires particular information, or a service cannot be provided without necessary information, we explain that requirement and the consequence of not providing it. We do not sell personal data or share it for cross-context behavioural advertising. We do not use identity evidence or biometric material to train general models or enable optional provider training for LFG verification. We do not treat accepting the Terms as consent to an unrelated data use. ## 4. Identity checks, biometrics and review All LFG applicants must complete the relevant identity or business verification before activation. **Didit performs LFG’s verification checks. LFG determines whether the resulting eligibility requirements for its account have been met.** Authorised LFG administrators can view verification information, and LFG retains relevant provider responses. Read-only access is still access to personal data. Where facial matching or another biometric-identification method is offered on an explicit-consent basis, we request that consent separately before the check. You can choose the available non-biometric verification review through instead and can withdraw biometric consent. Identity verification remains necessary, but refusing optional biometric processing is not itself a reason to deny a suitable alternative. A different legal basis for biometric processing will be identified in a specific notice before that processing begins; ordinary contract wording or a generic fraud-prevention interest is not, by itself, a special-category condition. Verification uses checks on document validity, matching identity information, liveness where selected, and relevant fraud, eligibility or screening indicators. The result can determine whether activation or a feature is allowed. Automated checks can produce mistakes. Contact to contest a result, give additional information and request meaningful human review. Where the issue is a Didit result, we arrange review using its human-review process and reconsider LFG’s corresponding decision. We do not use a solely automated decision with a legal or similarly significant effect unless permitted by applicable law and with the required safeguards. Owl’s separate off-ramp onboarding, including its Sumsub verification, is governed by Owl’s privacy arrangements. LFG verification does not replace it. LFG account closure does not direct Owl to erase information it must independently retain. ## 5. Sharing and international processing We disclose information to providers as needed for the particular service: hosting and security providers; verification and screening providers; enabled wallet or blockchain infrastructure; notification and diagnostic providers; and a conversion provider you choose to use. We may also disclose relevant information to professional advisers, a lawful business successor, or authorities where lawfully required or justified. We assess the scope and legal basis of a request; this Policy is not blanket consent to release customer files to anyone claiming to be an authority. The [Integrated Service Providers](https://help.getlfg.app/p/agreements/integrated-service-providers) document explains the current integrations. Service processors act under applicable data-processing arrangements. Independent financial-service providers determine their own compliance processing under their notices. Calling a company a partner or sub-processor does not determine its legal role for every purpose. Our primary application storage is in **AWS eu-central-1, Frankfurt, Germany**, and Sentry uses an EU ingestion endpoint. That does not guarantee that every provider operation, support access or onward transfer occurs in the EEA. LFG is a US company and provider or personnel access can involve other countries. Where restricted international transfers occur, we use a mechanism valid for the particular recipient and transfer: an applicable adequacy decision within its scope, appropriate contractual safeguards with the required assessment and supplementary measures, or an applicable limited statutory exception. For relevant UK transfers this may include the UK Addendum or International Data Transfer Agreement. Encryption alone is not a substitute for a required transfer mechanism. Contact for information about the applicable safeguards and a copy subject to necessary redactions. ## 6. Retention and deletion The following are our standard maximum operational periods, subject to earlier deletion where information is no longer needed and a lawful exception where retention is required. A justified archive contains only relevant information and is not used as an active marketing, verification-training or recovery database. | Record category | Standard retention and starting point | | ----------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Active profile, preferences and ordinary account records | While needed for the account; delete from active systems within 30 days after closure, except the limited records below. | | Encrypted wallet backup associated with the account | Remove the active copy when the account is closed. Residual disaster-recovery copies follow the backup rule below and are not an available wallet-recovery service. | | Minimum verification and eligibility audit | While the account is active, then up to 12 months after closure. Keep only the identity link, provider reference, relevant result/date and review evidence needed for the stated purpose, except a subset required in a lawful longer archive. | | Ordinary identity-document copies and verification media | Avoid unnecessary duplication; delete no later than 30 days after the final verification decision or completion of a timely review, unless specific evidence must lawfully be retained. Biometric samples/templates are deleted when their specific purpose ends; this may require earlier deletion. | | Abandoned applications | Delete unnecessary application information within 30 days of abandonment. | | Refused applications | Retain the minimum decision and review record for up to 90 days after refusal for a review request; the shorter rules for biometric material and unnecessary media still apply. A live appeal or documented fraud matter is considered separately. | | Raw provider event notifications and duplicate webhook payloads | Up to seven days after receipt for necessary troubleshooting; extract needed records into their appropriate category and remove the raw copy. | | Ordinary crash diagnostics | Up to 30 days after the event. | | Necessary application security logs | Up to 90 days after the event, unless relevant evidence is needed for a documented incident. | | Push identifiers and notification profiles | While needed for the enabled notification service; stop sending promptly after opt-out or closure and remove unnecessary identifiers within 30 days. Keep only a minimal suppression record where needed to honour the choice. | | SMS delivery and consent records, if SMS is enabled | Message content and ordinary delivery metadata are kept only as long as needed for the communication, security or support purpose. A minimal opt-in, opt-out or suppression record may be kept for as long as needed to demonstrate and honour the choice or comply with law. | | Routine support tickets | Up to 12 months after resolution; relevant billing or formal dispute evidence follows its separate justified period. | | LFG invoices, fee calculations, receipts, refunds and necessary related transaction/identity evidence | Normally seven years after the relevant financial year ends for accounting and claims purposes, subject to the actual tax and other applicable recordkeeping rules. This is not a statement that every country requires seven years. | | Other off-chain wallet/payment history | While needed to provide the account’s history, then delete within 30 days after closure, except identified records needed for accounting, a specific legal duty or a documented claim. Blockchain publication does not justify keeping every identity-linked copy indefinitely. | | Subscription authorisations | On cancellation, immediately mark the subscription cancelled and block the active billing-submission service from accessing or submitting unused authorisations. Remove the executable signed payloads from active systems, or irreversibly render them inaccessible to the submission service, without undue delay after cancellation, use or expiry. Retain only non-executable evidence of consent, amounts, validity periods and outcomes where needed for billing, a dispute or law. | | Disaster-recovery copies of deleted information | Put beyond ordinary use and purge or overwrite within 90 days of deletion. Reapply deletion if a backup is restored. These copies are not promised to be available for customer recovery. | Where a specific AML recordkeeping obligation applies to LFG, the relevant evidence is kept for that obligation’s required period and starting event, which may be five years or another period. We do not apply a five-year blanket rule to every selfie, webhook or backup simply because a provider conducts KYC. Records of transactions falling within applicable US sanctions recordkeeping rules may require at least ten years from the relevant transaction; records of blocked property have a separate retention trigger. These rules apply to the relevant records, not automatically to every data category. Other mandatory obligations can require different periods. A specific legal hold, investigation or dispute may extend retention of relevant information. We restrict access, document the reason and review the hold, deleting information when the applicable purpose and obligations end. We do not keep everything indefinitely in case an authority might ask for it later. We apply deletion instructions to processors where we control the processing. Independent providers may retain their own records under their notices and legal obligations. A request to close LFG does not automatically close every provider account. Public blockchain entries are not erased by deleting LFG’s off-chain records. ## 7. Security and recovery information We use measures appropriate to the risks, including access controls, encryption where appropriate, restricted administration and incident procedures. No system can guarantee that a breach will never occur. Security incidents are assessed and notified where required by law. You must secure your device and export and retain the recovery phrase or appropriate private key for every wallet before closing the account, deleting the app or deleting required device data. LFG cannot independently decrypt the server backup or recover a wallet afterwards. Identity verification, an email code or a new LFG account cannot recreate the missing keys. Planned social recovery is not part of the current service. If a new recovery feature is introduced, we will explain its separate processing and obtain any required consent before using it; it will not operate retrospectively to recover access already lost under the present system. ## 8. Your rights and choices Depending on applicable law, you can request access, correction, erasure, restriction, portability and information about our processing; object to processing based on legitimate interests; withdraw consent; and contest relevant automated decisions. Direct-marketing objections are respected. Withdrawal does not invalidate processing lawfully carried out beforehand. Some records may need to be retained under a lawful exception, which we explain where permitted. Send requests to ****. We use proportionate verification and do not require a wallet secret to handle a privacy request. For GDPR requests, we respond without undue delay and ordinarily within one month. If the law permits an extension, we explain the reason within the initial period. Other applicable statutory deadlines and appeal rights apply where relevant. US residents may have additional state-law rights, including rights concerning sensitive information, correction, deletion, portability, an authorised agent, appeals and freedom from unlawful discrimination. Applicable opt-out preference signals are respected where they apply. The categories, purposes and retention practices above also serve as our information about collection; any additional required notice is provided when relevant information is collected. You can complain directly to your local data-protection authority. EEA residents may contact the authority where they live, work or consider an infringement occurred; UK residents may contact the ICO. You do not have to complain to LFG first. Other statutory remedies remain available. ## 9. Children and policy changes LFG accounts are for adults aged 18 or older. If we learn that an ineligible child supplied information, we take appropriate steps to restrict the account and remove unnecessary information, subject to a lawful retention need. This does not remove that person’s privacy rights. We publish material updates with a new effective date and notify affected users where appropriate. A new use requiring consent does not become authorised merely because we publish an updated policy or a user continues using the service. *** # Regulatory position statement **Effective date: 13th September 2026** ## 1. Operator and service **Layer Flow Gateway, Inc.**, a Delaware corporation, provides LFG’s software to eligible personal and business users. Company incorporation is not a financial-services licence. Our registered address is 131 Continental Dr, Suite 305, Newark, DE 19713, United States. Regulatory enquiries: ****. LFG provides software for users to manage their own wallets, create payment requests, approve blockchain transactions and access enabled integrations. It earns software subscription fees from business users and the disclosed referral commission from Owl. Personal LFG accounts are currently free, although external transaction costs may apply. ## 2. Customer control and backups Users control the keys for their wallets and sign their ordinary transfers and every swap through their devices. Neither LFG nor Web3Auth can sign alone. Web3Auth wallet infrastructure handles the signing flow and broadcast without giving LFG independent signing authority. LFG does not hold assets for customers, possess or reconstruct their private keys, alter transaction instructions or have usable customer keys allowing it to sign independently. The current architecture includes device-encrypted server backup material that LFG cannot independently decrypt. A backup of encrypted information is not the same as an ability to control the underlying wallet. Customers must export and preserve the recovery phrase or appropriate private key for every wallet before account closure, app deletion or loss of required device data. Under the current service, LFG cannot recover the wallet afterwards: its encrypted server backup cannot be independently decrypted by LFG, and identity verification or an email code cannot reconstruct the keys. No future social-recovery design is represented as deployed or capable of recovering access already lost under the present system. ## 3. Swaps and ordinary payments For the present **1inch Classic Swap Aggregation API v6.0** integration, 1inch returns the route and transaction data directly to the user. The user reviews and signs every swap, and Web3Auth wallet infrastructure handles the broadcast. LFG does not receive or transmit the order, select the route, sign or broadcast a swap, operate Fusion, provide limit-order execution or exercise discretionary portfolio management. LFG’s swap fee is disabled and LFG receives no transaction-based compensation from swaps or payments. Ordinary payments are customer-controlled transactions in supported USDC or USDT. For customers in the European Union or European Economic Area, USDT payments and swaps into USDT are disabled and payments are USDC-only. In all other eligible countries, payments may use USDC or USDT where enabled. LFG does not take a mandate to execute a customer’s third-party recurring bill payments. The customer remains responsible for the underlying commercial transaction and the instructions they authorise, subject to LFG’s responsibility for its own software and representations. ## 4. Collection of LFG’s fees Each business user has an **LFG Vault**, a non-custodial wallet for receiving business payments and paying LFG subscription fees. The user alone controls its private keys and is responsible for maintaining enough supported USDC in it on each billing date. The first and later subscription payments are collected from the LFG Vault. Paid business subscriptions use **EIP-3009 subscription payment authorisations** for LFG’s own fees. When the user confirms a subscription, the user signs the first payment and the stated later billing cycles. The wallet infrastructure may broadcast a valid, user-signed authorisation for an agreed subscription collection. LFG cannot independently sign or broadcast it, change its amount or recipient, or use it to pay anyone other than LFG. This arrangement is not a bank direct debit and does not give LFG control of the wallet. The current programme covers up to six signed billing cycles as disclosed in the subscription flow, with amounts, recipients and validity windows fixed by the relevant signatures. There is no general authority to change signed amounts or spend for other purposes. Cancellation and retries are governed by the Terms. The deployed arrangement is not Coinbase Spend Permissions. ## 5. Conversion providers and verification Enabled fiat-to-crypto purchases are supplied by Coinbase, Transak or MoonPay through their applicable legal entities. Enabled crypto-to-fiat off-ramps are supplied by Owl/Harbor and its applicable counterparties. A user enters the relevant provider’s service on its terms, and the provider applies its own eligibility and verification requirements. The provider’s permission must cover the actual product, customer type and territory; a global brand does not establish universal coverage. LFG performs its own account eligibility process using Didit. Owl independently performs its own off-ramp checks, including business verification through Sumsub. These are different processing relationships. LFG remains responsible for the duties applying to its own onboarding, data use, interface, marketing and commercial conduct. Owl currently excludes EU-citizen individual senders and EU-incorporated business senders from Harbor onboarding. Payouts to EU destinations can still be supported for an otherwise eligible sender. LFG does not represent payout destination coverage as permission to onboard a sender. Owl’s current customer off-ramp fee is 0.50% of the off-ramped amount. LFG receives a referral commission from Owl out of that fee. The commission does not increase the 0.50% customer fee. ## 6. Regulatory basis and limits LFG’s operating position for the described product is that it supplies non-custodial software rather than customer custody, discretionary execution or an exchange service undertaken by LFG. This describes the actual functions on which that position depends. It is not a declaration that every non-custodial product is exempt everywhere or that an integrated provider’s licence transfers to LFG. Regulatory duties depend on the activities actually performed, the relevant country’s rules and their territorial reach. The [Global Availability Statement](https://help.getlfg.app/p/global-availability-statement) classifies LFG software markets as eligible or excluded and currently lists **92 eligible countries and territories**, including all 50 United States and Washington, DC. Provider-specific feature availability is stated separately and does not make the underlying LFG software account unavailable. **Cryptoassets are not local legal tender.** LFG does not represent USDC, USDT or any other supported cryptoasset as government-issued currency or legal tender in any market. In the EU/EEA, this statement does not claim that LFG holds a MiCA authorisation or that software access has been approved by a regulator. A change that brings an LFG activity within a regulated service category requires a new assessment and any applicable permission before that activity is offered. A GDPR representative is a privacy requirement, not a MiCA licence. The United Kingdom is an eligible LFG software market, while UK-facing communications and onboarding remain subject to applicable financial-promotion requirements. LFG does not rely on an “API wrapper passport” or a provider’s registration as automatic permission for its own communications. All 50 United States and Washington, DC are eligible for the described non-custodial software model; Delaware incorporation does not replace any separate tax, privacy, corporate-registration or other obligation arising from LFG’s activities in a state. There is no blanket UAE permission simply because a customer is incorporated in a free zone. ## 7. Risk controls and information LFG uses account verification, risk information and geographic controls to protect its software service. It may restrict software access and respond to lawful demands within applicable requirements. It cannot itself reverse a customer’s confirmed blockchain transfer or freeze the customer’s independently controlled assets through account suspension. Risk signals are indicative and can be inaccurate. They are not legal, tax or investment advice and do not establish that a transaction is safe or compliant. LFG does not promise a universally licensed or insured service, deposit protection, a token’s value, or an independent provider’s future availability. These explanations do not exclude responsibilities imposed on LFG by law. *** # Account deletion **Effective date: 13th September 2026** This Policy applies to accounts with **Layer Flow Gateway, Inc.** Read it before closing an account, uninstalling the app or removing the device data used for your wallets. ## 1. Before you close your account **Closing your LFG account or deleting the app does not move your crypto. LFG cannot recover your wallets afterwards. Before either action, you must export and securely retain the recovery phrase or private key for every wallet you need. Without it, you will lose access to any funds that remain in that wallet.** Before proceeding: 1. **Back up every wallet.** Save the complete recovery material provided for each ordinary wallet and your LFG Vault, such as its recovery phrase or exported private key, with the information needed to restore it. A public wallet address is not a backup. Do not assume one private key covers every account. 2. **Check that the backup is usable**, or move assets to a wallet you already control independently. Keep recovery material securely outside the app. Do not send it to LFG support or anyone offering to help recover funds. 3. **Export records you need**, including payment history, invoices, receipts, wallet addresses, transaction references and business records. LFG holds off-chain account and transaction information; some of it may no longer be available through your account after closure. 4. **Review pending transactions and connected providers.** A transfer already submitted to the blockchain may still complete. Closure does not cancel an independent provider account or an unrelated external token approval. We do not require a wallet to have a zero balance before closure. The current closure process does not establish that every associated wallet has been checked for assets. No warning about a particular balance should be taken as proof that the wallet is empty. ## 2. What closure does When you confirm the authenticated **Close account** action, LFG first records the subscription as cancelled in its server-side billing state, disables scheduled submissions and queued retries, and blocks the active submission service from accessing or submitting any unused subscription authorisation held by LFG. These operational steps do not require an additional wallet signature and do not themselves revoke an authorisation on-chain. Only after that step succeeds does account closure continue. If cancellation fails, closure does not complete and you are directed to support. When the closure process is completed: * Your LFG account and access to its ordinary account functions end. * Your subscription has been cancelled and future fee submissions and queued retries that were not already submitted to the blockchain have been stopped. * The active account-linked encrypted wallet backup is deleted. LFG cannot reactivate the account, reconstruct its wallets or retrieve their keys afterwards. * Unnecessary personal information is deleted under the Privacy Policy. Limited billing, verification, sanctions, legal-claim and other records may be retained only for their applicable purposes and periods. * Required deletion instructions are applied to relevant processors. Independent providers retain responsibility for their own accounts and lawful retention. Account closure does **not** transfer, liquidate, refund, confiscate or delete your blockchain assets. It does not erase public blockchain entries. A new LFG account does not automatically recreate the deleted account, restore its encrypted backup or recover missing wallet secrets. ## 3. No LFG recovery after account closure or app deletion LFG’s current service can retain a device-encrypted backup while the account and required device data remain available, but LFG cannot decrypt that backup independently. **Once you close your LFG account, or delete the app or its required device data, LFG cannot reactivate the account, reconstruct the wallet, retrieve its keys or recover access for you.** Passing KYC again, proving your identity, receiving an email code or opening a new LFG account will not change this. Only you can recover a wallet, using the complete recovery phrase or the appropriate private key that you exported **before** closing the account or deleting the app or required device data. If you did not export and securely retain the necessary recovery material beforehand, access to the wallet and any assets remaining in it will be permanently lost. LFG has no master key, override or support process capable of reversing that result. Export and preserve the recovery material for **every** wallet you need, including each ordinary wallet and the LFG Vault. One private key may recover only its corresponding wallet or address and must not be assumed to restore every wallet derived from a recovery phrase. Test that your backup works with compatible independent wallet software before closing or deleting LFG. Any future social-recovery feature would apply only in accordance with its own terms after it is introduced. It cannot recover an account or wallet whose required access material was lost or deleted before that feature became available. ## 4. Uninstalling is different Uninstalling LFG **does not close your account or cancel your subscription**. However, deleting the app or its required device data can remove the information needed to access the wallets, and LFG cannot recover that access for you. Do not rely on reinstalling the app, a phone backup, KYC or support to restore it. Export and test the recovery material for every wallet first. A device reset, loss or replacement can create the same risk. If you only want to stop billing, cancel the subscription through LFG rather than assuming removal of the app will stop it. ## 5. Billing, authorisations and records The first and later business subscription payments are collected in USDC from your non-custodial LFG Vault under EIP-3009 subscription payment authorisations. This is not an app-store subscription, Coinbase Spend Permissions or a bank direct debit. You are responsible for keeping enough supported USDC in the LFG Vault on each billing date. The final **Close account** action must first cancel the subscription in LFG's billing system, disable future submissions and queued retries, and block unused signed payment payloads held by LFG from its active submission service. LFG does not require another wallet signature to stop its own submission process, and it must not delete the account if that operational cancellation step fails. A transaction submitted before cancellation may still complete. Tell support promptly about a disputed charge; an erroneous post-cancellation collection will be corrected or refunded as required. Stopping LFG's submission process is not the same as invalidating an authorisation on-chain. Unless and until an unused authorisation is used, expires at its stated `validBefore` time, or is cancelled on-chain using a valid cancellation instruction signed by the wallet owner where the token contract supports it, the authorisation may remain technically valid. LFG cannot create that cancellation signature for you. Closing LFG is therefore not a promise that every signature has been invalidated on-chain, but LFG must stop accessing and using it for further collection. Independent provider arrangements and external approvals require separate attention. Closure ends app access immediately. Fees already earned are subject to the Terms’ refund provisions and applicable law; closure does not waive a refund claim or consumer right. Public blockchain history may remain accessible, but it is not a complete replacement for LFG invoices or business records. ## 6. Confirmation and responsibility The closure screen asks you to acknowledge the backup and access consequences. You may decide to proceed without independently retained recovery material, but you must understand that LFG cannot recover the wallet and you will permanently lose access to it and any remaining funds unless you already control it independently. That choice does not transfer responsibility for LFG’s own breach to you. You are responsible, to the extent permitted by applicable law, for loss caused solely by your failure to retain or secure a usable backup or your informed decision to proceed despite the warning. Nothing here excludes LFG’s liability for its own actionable fault or any right that cannot lawfully be waived. You do not have to waive a complaint or legal claim to close an account. If you need help finding the export or closure controls, contact ** before proceeding**. We can explain where the available controls are, but we cannot reconstruct, retrieve or recreate wallet keys after account closure or deletion of the app or required device data. Privacy requests: ****. *** # Terms of service **Effective date: 13th September 2026** ## 1. Who we are and this agreement 1.1 These Terms govern the website, applications and software services provided by **Layer Flow Gateway, Inc.**, a Delaware corporation, Delaware File No. 10054149, incorporated on 2 January 2025 (LFG, we, us). Our registered office is **131 Continental Dr, Suite 305, Newark, DE 19713, United States**. Legal enquiries: ****. Support: ****. 1.2 You accept these Terms when you create an account or otherwise expressly accept them. A person opening a business account must have authority to bind that business. A consumer is a person acting outside their trade, business or profession; selecting an account label does not remove mandatory consumer rights. 1.3 Our [Global Availability Statement](https://help.getlfg.app/p/global-availability-statement) and [Account Deletion Policy](https://help.getlfg.app/p/agreements/account-deletion) supplement these Terms. Our [Privacy Policy](https://help.getlfg.app/p/agreements/privacy-policy), [Cookie Policy](https://help.getlfg.app/p/agreements/cookie-policy), [Regulatory Position Statement](https://help.getlfg.app/p/agreements/regulatory-position-statement) and [Integrated Service Providers](https://help.getlfg.app/p/agreements/integrated-service-providers) explain the service and its dependencies. Accepting these Terms does not constitute consent to optional tracking or biometric processing. 1.4 A signed business order or service agreement prevails over these Terms to the extent of a specific conflict. It cannot remove rights that the applicable law makes mandatory. For other inconsistencies, these Terms govern contractual matters, the Availability Statement governs eligibility, and the Privacy Policy governs our description of personal-data processing. ## 2. What LFG provides 2.1 LFG supplies software for eligible individuals and businesses to manage user-controlled wallets, create payment requests, send and receive supported digital assets, access enabled third-party integrations and use available business and risk-screening tools. Personal accounts are currently free. Business features require the relevant paid subscription. 2.2 Customer wallets are non-custodial. LFG does not hold customer assets for safekeeping and does not possess customer wallet keys in a form that allows LFG to use them independently. For wallets using the current backup feature, LFG stores a device-encrypted backup that it cannot decrypt independently. The backup and recovery limitations in section 4 apply. 2.3 Customers approve and sign their ordinary wallet transactions through their devices. Web3Auth wallet infrastructure handles the signing flow and broadcast without giving LFG independent signing authority. For enabled swaps, 1inch returns the route and transaction data directly to the customer; the customer reviews and signs every swap. LFG does not select an execution route, receive or transmit a customer order, sign or broadcast the customer’s swap, or operate discretionary trading for the customer. 2.4 There is one separate collection arrangement: a business customer can pre-authorise scheduled payments of **LFG’s own software subscription fees** under section 6. The wallet infrastructure may broadcast a valid, user-signed authorisation for the agreed fee. LFG cannot sign, change the amount or recipient, or use it to make the customer’s payments to other people. LFG does not presently offer recurring payments of customers’ third-party bills. 2.5 LFG is not a bank, deposit account, investment adviser, token issuer or insurer of customer assets. Software usage allowances have no cash value and cannot be transferred, redeemed or exchanged. Receiving LFG’s own earned subscription fees is distinct from holding assets for customers. 2.6 Features shown for development, preview or future release are not included in the current service unless expressly enabled and described to you. In particular, there is no promise that future social recovery will become available or recover a wallet whose access has already been lost. ## 3. Eligibility and account access 3.1 You must be at least 18, have capacity to contract, and satisfy the country and customer-type requirements in the Availability Statement. An eligible company must be represented by an authorised adult. Personal accounts must not be used to bypass business verification or subscription requirements. 3.2 LFG requires identity verification for individuals and business verification for businesses before activation. We use Didit for this process. We may require information about the business, its representatives and beneficial owners, and may perform subsequent eligibility and risk checks. A paid business account also requires successful subscription payment. Verification is not a guarantee that a user or their transactions are safe, lawful or creditworthy. 3.3 A third-party provider may require its own verification and may refuse an otherwise eligible LFG customer. Passing LFG verification does not confer a right to a provider account, fiat purchase, off-ramp or bank payout. 3.4 Give accurate information and promptly update material changes to your residence, business registration, principal operations, authorised representatives and beneficial ownership. Use accounts and funds you own or are lawfully authorised to use for the verified business. Do not misrepresent the customer, location or purpose of a transaction. 3.5 Do not evade geographic, sanctions, verification, feature or customer-type restrictions, including by using a VPN or proxy to conceal ineligibility. Restrictions may depend on more than an IP address. A nationality-based provider restriction applies where specifically stated; it is not a general rule that every holder of a nationality is excluded from all LFG software. 3.6 Keep login credentials secure and tell us promptly about suspected account misuse. Your responsibility for activity depends on your authorisation, conduct and applicable law; you are not automatically responsible for a security failure caused by LFG. 3.7 The Global Availability Statement records the countries, customer types and feature conditions that LFG supports when that Statement is published or updated. Eligibility is a continuing condition of using the Services, not a permanent or grandfathered right. Laws, sanctions, regulatory requirements, provider coverage, security risks and LFG’s supported operations can change after an account is opened. 3.8 If LFG discovers a material error in its published availability information, it will correct the Statement promptly and deal fairly with affected users under section 12. An eligibility statement does not override applicable law or make an otherwise prohibited service lawful. 3.9 LFG is available to eligible personal and business users in the countries and territories listed in the Global Availability Statement, currently covering **92 markets**, including all 50 United States and Washington, DC. A market is listed as eligible or excluded; provider-specific feature availability does not change the underlying software-account classification. 3.10 **Cryptoassets are not local legal tender.** LFG does not represent USDC, USDT or any other supported cryptoasset as government-issued currency or legal tender in any market. ## 4. Wallet backups, recovery and loss of access 4.1 **Keep a secure, usable backup for every wallet before relying on it to hold assets.** This includes an ordinary wallet and the **LFG Vault** used for business subscriptions. Save the complete recovery material offered for that wallet, such as its recovery phrase or exported private key, together with any account or network information needed to restore it. One exported private key should not be assumed to recover every other wallet or address. 4.2 Protect your backup from loss and unauthorised access. Anyone who obtains usable recovery material may be able to control the associated assets. LFG support will never ask you to send a recovery phrase or private key by email, chat, a support ticket or a verification upload. 4.3 A login, identity-verification record or encrypted server backup is **not a substitute for your independent backup**. LFG cannot independently decrypt the server backup or reconstruct your wallet from your email address, KYC record or proof of identity. Passing KYC again, receiving an email code or opening a new account does not give LFG a wallet-recovery capability. 4.4 If the device, app or required local data is lost, damaged, reset or removed and you have not independently retained the complete recovery phrase or appropriate private key, LFG cannot recover the wallet for you. Your access to the associated wallet and its funds will be permanently lost unless you already control that wallet independently. Funds can remain on the blockchain while being inaccessible to you. 4.5 Before uninstalling or deleting the app, removing its local data, replacing or resetting your device, or closing your account, export and test the necessary recovery material for **each** relevant wallet, or transfer the assets to a wallet you already control independently. This includes every ordinary wallet and the LFG Vault. Simply copying a wallet address does not back up its private key. 4.6 Account closure permanently removes access to the LFG account and deletes its active account-linked encrypted backup. LFG cannot then reactivate that account, reconstruct its wallets or retrieve their keys. Closure does not automatically transfer assets, close a blockchain address or reverse transactions. The service may permit closure while a wallet still has a balance; the absence of a balance warning does not mean a wallet is empty. Uninstalling alone does not close the LFG account or cancel a subscription, but deleting the app or required device data can permanently remove wallet access. 4.7 You bear loss caused solely by your failure to preserve or secure a usable backup, or your informed decision to remove access despite the warnings, to the extent permitted by applicable law. This allocation does not exclude LFG’s responsibility for its own breach, misleading recovery information, defective functionality for which it is responsible, or liability that cannot lawfully be excluded. Section 14 applies. ## 5. Transfers, supported assets and blockchain risks 5.1 The Services can support payment requests and user-directed transfers between eligible LFG users and, where enabled, external self-hosted wallets that you own or are authorised to use. Availability is subject to verification, risk checks, limits, network support, provider rules and applicable law. 5.2 You initiate and sign ordinary transfers from wallets you control. Web3Auth wallet infrastructure handles the signing flow and broadcast. LFG does not hold, receive, transmit, broadcast or settle customer assets on your behalf and cannot independently sign from your wallet. The user-signed authorisations for LFG’s own business-subscription fees are described separately in section 6 and are not authority to make other transfers. 5.3 Payments through LFG may use **USDC or USDT** on the networks enabled in the app, subject to the following launch restriction: for customers in the **European Union or European Economic Area, USDT payments and swaps into USDT are disabled**, so payments there are USDC-only. In all other eligible countries, payments may be made in either USDC or USDT where the relevant asset and network are enabled. Bridged USDbC is not supported for payments. Feature and provider availability may be narrower. 5.4 The app’s supported asset and network list governs the interface. LFG does not presently support adding custom token addresses. A similarly named token, a token on another network or an externally visible balance is not necessarily supported. Token availability does not constitute an investment recommendation or confirmation of unrestricted use under local law. 5.5 Review the recipient, amount, asset, network, provider quote, fees, any memo or reference and any displayed minimum receipt before signing. You are responsible for entering and checking transaction instructions, except to the extent an error is caused by LFG or another responsible party. Network fees may require a separate network asset. Do not assume that a USDC balance alone is sufficient to send every transaction. 5.6 Blockchain transactions, approvals and signatures can have irreversible consequences. A pending transaction may fail, remain pending or be replaced, and a confirmed transfer may be irreversible. LFG cannot undo a confirmed transfer or guarantee recovery of a transfer sent to an incorrect or incompatible destination. A provider’s refund obligation, or LFG’s responsibility for its own error, is not removed merely because a blockchain transfer is irreversible. 5.7 Public-blockchain and token risks include transaction failure or delay, congestion, front-running or maximal-extractable-value effects, forks, chain reorganisations, protocol changes, malicious approvals, smart-contract defects or exploits, changing network fees and slippage. Stablecoins and other tokens can lose their expected value, become illiquid, or be restricted, frozen or affected by issuer, protocol or regulatory action. LFG does not guarantee redemption, a fixed value, deposit protection or compensation for token losses. 5.8 Prices, rates, estimated fees, risk information and network data shown in the Services are informational or indicative until the applicable transaction is confirmed. They can come from public networks or Third-Party Providers and can be delayed, incomplete or different from final execution. This does not excuse an inaccurate fee or representation for which LFG is legally responsible. ## 6. Business subscriptions and cancellation 6.1 Each business account has an **LFG Vault**, a non-custodial wallet for receiving business payments and paying LFG subscription fees. You alone control the private keys for your LFG Vault. LFG does not hold or control its balance. Before subscription confirmation, we disclose the selected plan, monthly USDC fee, applicable taxes, first collection, next billing date and the scope of the requested payment authorisations. Personal accounts currently have no LFG subscription fee; third-party and network charges can still apply. 6.2 The first and all later business subscription payments are collected in USDC from your LFG Vault. When you confirm the subscription, you authorise the first payment and establish the automatic subscription payment arrangement described below. The first payment is collected at confirmation. Later payments are collected monthly on the billing dates shown in the app. 6.3 The automatic subscription payment arrangement uses EIP-3009 user-signed payment authorisations; it is not a bank direct debit or Coinbase Spend Permissions. The current arrangement uses up to six pre-authorised billing cycles, as shown when you confirm. Each authorisation specifies the LFG Vault as the source wallet and fixes the amount, recipient and validity window for one billing cycle. The wallet infrastructure may broadcast a valid authorisation for the corresponding subscription fee without asking for a fresh signature at that collection time. LFG cannot independently sign or broadcast it, take a different amount, pay a different recipient or collect outside its validity window. 6.4 You are responsible for keeping enough supported USDC in your LFG Vault on each billing date. You may fund the LFG Vault by receiving eligible business payments through LFG or by transferring supported USDC to it through an available lawful route. LFG does not automatically purchase USDC or move funds from another wallet to cover the fee. A plan change, additional charge or billing cycle beyond the signed authorisations requires a suitable fresh authorisation. We will tell you when a new authorisation is required to continue the subscription. 6.5 Monthly subscriptions continue subject to cancellation, an available valid authorisation and payment. The app shows the next billing date. You can cancel in your account at any time before the next collection is submitted. If account access is unavailable, contact ; we will use proportionate identity checks and record the time of your cancellation request. 6.6 **Cancellation stops future subscription collections and queued retries that have not already been broadcast to the blockchain.** Account closure also cancels the LFG subscription. We stop the billing process from requesting broadcast of remaining authorisations. Cancellation does not reverse an already-broadcast transaction. A charge broadcast in error after a timely cancellation will be corrected or refunded; statutory remedies remain available. 6.7 Cancellation of the subscription and cancellation of a cryptographic authorisation are different. The current LFG service does not provide or promise an independent, external signature-revocation facility. A previously signed authorisation may remain technically valid until used, expired or effectively cancelled on-chain where the relevant contract supports that. This does not permit LFG to keep collecting after cancellation. Protect signed authorisation data as sensitive information. 6.8 Following cancellation, paid features normally remain available until the end of the period already paid for. If you also close the account, account access ends on closure. Amounts lawfully due for services already supplied remain payable, but cancellation does not permit further automatic retries under the cancelled subscription. 6.9 If a scheduled renewal fails because of insufficient funds, LFG may retry during the **three calendar days following that renewal’s due time**. The **14-calendar-day grace period runs from the same unpaid renewal due time**, not from the end of the retry period. If payment remains outstanding at the end of that grace period, paid access may be suspended. A later renewal requires valid payment arrangements. We will not collect twice for the same period or retry after cancellation. Removing the app does not stop this schedule. 6.10 The subscription price, third-party purchase price, network fees and any provider charges are separate. We disclose LFG taxes and charges before confirmation and handle taxes we must collect. You are responsible for your own transaction and business taxes. The Terms do not transfer LFG’s tax obligations to you. 6.11 We give at least 30 days’ advance notice of an increase in LFG’s recurring fee. It applies no earlier than an appropriately notified renewal and, where needed, a fresh payment authorisation. You may cancel before it takes effect. Plan changes and any prorated charge are shown for agreement before they apply. 6.12 Business fees already earned for a supplied billing period are normally non-refundable if you simply change your mind. This does not exclude refunds for an erroneous charge, a service failure giving a right to refund, termination by LFG for its own convenience, or any mandatory legal right. Provider refunds are governed by the relevant provider’s terms and applicable law. 6.13 There are currently no paid personal subscriptions. Before introducing them, we will provide the applicable consumer price, renewal, cancellation and withdrawal disclosures and any required consent for immediate performance. No general acceptance of these Terms waives a consumer cooling-off period or other statutory remedy. 6.14 **Your taxes:** you are responsible for determining, reporting and paying taxes, duties and similar public charges arising from your own virtual-asset activity and, for a business user, its underlying sales, payroll, income, gains and business operations. This can include keeping invoices and applying any withholding or indirect-tax rules that apply to you. You are not made responsible for a tax that the law imposes on LFG. 6.15 **LFG taxes and price disclosure:** LFG remains responsible for taxes imposed on LFG and for collecting, reporting or remitting any tax that applicable law requires LFG to handle in connection with its own supply. Any tax added to an LFG charge will be identified before you confirm where required. 6.16 **No tax or professional advice:** LFG does not act as your tax agent, accountant, lawyer, financial adviser or fiduciary. Information in the Services is general operational information and is not advice for your circumstances. Obtain professional advice where needed. 6.17 **Records and third-party data:** transaction histories, CSV files, invoices and dashboard summaries are provided for convenience and may use information from public networks or Third-Party Providers. You must check them against your own records and the relevant network or provider evidence. LFG does not promise that a particular export satisfies every accounting, tax or regulatory filing rule, but remains responsible for correcting its own records where required by law or these Terms. 6.18 For business users only, a third-party claim, fine or penalty caused by the business’s material breach of its own tax obligations may fall within the limited indemnity in section 14.4, but only to the extent recovery is lawful. This does not make a consumer indemnify LFG, cover LFG’s taxes or fault, or prevent a user from challenging an incorrect assessment. ## 7. Swaps, on-ramps and off-ramps 7.1 The current integrations are 1inch for enabled user-operated swaps; Coinbase, Transak and MoonPay for enabled on-ramps; and OwlPay/Harbor for enabled off-ramps. A brand name does not identify a single legal entity or one worldwide permission. The applicable entity, product terms and eligibility are identified in the relevant provider journey. 7.2 A provider’s service is subject to its own agreement with you, verification, restrictions, quote and fees. You choose whether to use it. LFG does not promise acceptance, availability of a payment method, a particular exchange rate or delivery to every bank. We remain responsible for our own contractual obligations and for our own interface and representations where required by law. 7.3 **Swaps:** the current integration uses the 1inch Classic Swap Aggregation API. It does not use Fusion or limit-order execution. 1inch returns the route and transaction data directly to you; you review and sign every swap using your wallet, and Web3Auth wallet infrastructure handles the broadcast. LFG does not receive or transmit the order, select the route, sign or broadcast the swap. LFG’s swap fee is currently disabled and LFG receives no transaction-based compensation from swaps or payments. Network costs and any applicable third-party costs or price effects may still apply. A future LFG swap fee would require advance disclosure and any necessary eligibility changes before use. 7.4 **On-ramps:** buying USDC through Coinbase, Transak or MoonPay is separate from acquiring LFG software. Each provider decides whether it supports your location, customer type, chosen asset, network and payment method. A provider’s acceptance of personal purchases does not establish acceptance of company funds or a business customer. Apple Pay or Google Pay, if offered by a provider, is a payment method within that provider’s purchase flow, not the present mechanism for LFG’s recurring billing. 7.5 **Off-ramps:** Owl/Harbor performs its own onboarding and compliance checks. Business verification in that process uses Sumsub under Owl’s arrangements. You transfer from your own wallet to the destination provided by Owl. Owl and its relevant counterparties provide the conversion and bank payout under their terms. LFG is not the sender purchasing that service on your behalf. 7.6 **Owl fee and LFG commission:** Owl’s current customer off-ramp fee is **0.50% of the off-ramped amount**, as shown before you confirm the transaction. LFG receives a referral commission from Owl out of that fee. The commission does not increase the 0.50% fee charged to you. Any separate network, bank, foreign-exchange or other cost will be shown in the applicable transaction quotation. Our commercial relationship with Owl may influence our decision to make its service available through LFG. 7.7 Owl has told LFG that Harbor currently cannot onboard **EU-citizen individual senders or EU-incorporated business senders**. Its ability to send a payout to an EU bank account through SEPA or SEPA Instant does not change that sender restriction. Other sender categories, including EEA and residence/citizenship combinations, require provider confirmation before the feature is offered. 7.8 Availability of an external provider outside LFG does not establish availability of its LFG integration. You must not use a false personal or business classification, an intermediary account or a different person’s verification to bypass a restriction. LFG’s software restrictions do not authorise a transaction otherwise prohibited by law. 7.9 **United Kingdom communications:** the United Kingdom is an eligible LFG software market. UK-facing communications and onboarding remain subject to applicable financial-promotion requirements. An API link, a provider’s FCA registration or a provider’s separate promotion does not by itself approve LFG’s own communication. ## 8. Verification, monitoring, Travel Rule and legal compliance 8.1 LFG applies proportionate identity, business, wallet and transaction-risk controls to administer accounts, protect the Services and help prevent fraud, money laundering, terrorist financing, sanctions breaches and other misuse. Controls may be automated or reviewed by authorised personnel and providers. Their use does not state that LFG is a bank, money transmitter, CASP or VASP, or that every control is imposed on LFG by an AML law. 8.2 Controls can include KYC or KYB, sanctions and adverse-risk screening, public-blockchain analytics, account-security monitoring and checks requested by an enabled provider. LFG may make further enquiries about a user, wallet, source or purpose of funds, recipient, transaction or business activity where reasonably necessary for these purposes. 8.3 We may suspend, limit or terminate an affected feature or account where a user fails a required check, a credible risk or prohibited use is detected, a regulated counterparty or provider rejects or flags the activity, or law or a competent authority requires action. Section 12 governs proportionality, notice and review. An LFG restriction affects access to LFG software; because LFG has no customer keys, it does not itself freeze or confiscate assets in a user-controlled wallet. A provider, token issuer or authority may have separate powers. 8.4 Scores and alerts can be incomplete or wrong. They are not a determination that a person committed an offence or that a transaction is lawful. Do not use an LFG-verified status as a guarantee or regulatory approval. If a verification or risk decision prevents access, you can request an explanation and review through . Where a Didit result needs reconsideration, we arrange review through its available human-review process and reconsider the associated LFG restriction as appropriate. We may withhold particular information where disclosure is lawfully restricted. 8.5 **Travel Rule information:** when an enabled regulated provider or counterparty requires originator, beneficiary or self-hosted-wallet information for a transaction you choose, you authorise LFG to request the minimum information needed and transmit it securely to that provider or counterparty as a technical pass-through. Where the integration returns corresponding compliance information to LFG, LFG may receive and pass it for the same purpose. The applicable provider decides whether its requirements are met. 8.6 Section 8.5 is conditional on the applicable integration. LFG does not promise a universal Travel Rule service, apply one worldwide threshold, or represent that it is the ordering, intermediary or beneficiary VASP merely because its interface transmits information. If required information cannot be obtained or validated, LFG may prevent use of the relevant integration or restrict the affected transaction or account. 8.7 We assess legal demands and may preserve or disclose relevant records where lawfully required or otherwise lawfully justified. We may report suspected illegal, sanctioned or fraudulent activity where required or permitted by applicable law and cooperate with competent authorities and regulated counterparties. We may be legally prohibited from telling you about a report, investigation or restriction. Nothing in these Terms gives a private party authority to demand customer records without a valid basis. 8.8 You must provide accurate compliance information and must not use the Services to evade applicable AML/CFT, sanctions, tax, reporting or licensing rules. You remain responsible for the legality of your own activity. LFG remains responsible for the controls, disclosures and reports that applicable law places on LFG. ## 9. Acceptable use and business responsibilities 9.1 Do not use LFG for fraud, money laundering, terrorist financing, sanctions evasion, unauthorised access, illegal goods or services, unlicensed regulated activity, or deception about the identity or authority of a payer, payee or merchant. Do not introduce malicious code, attack the service, circumvent security controls or infringe another person’s rights. 9.2 Business users remain responsible for their underlying goods and services, customer disclosures, invoices, taxes, refunds, authorisations and local trading requirements. LFG is not a party to a sale between a business and its customer. A dispute about that sale does not authorise either party to interfere with LFG systems. 9.3 Use screening and analytics for their stated operational purpose. Do not use them to harass, dox, defame or present an unverified allegation as fact. You may provide relevant information confidentially to professional advisers, competent authorities, counterparties where necessary and lawful, or as required by law. Nothing prohibits protected reporting, obtaining legal advice or exercising a legal right. ## 10. Data, content and software rights 10.1 You retain ownership of content you supply. You grant LFG the limited rights needed to host, process and display it to operate, secure and support the service, using providers where necessary. This does not authorise unrelated advertising, sale of personal data or use of identity images for model training. Personal-data processing remains subject to the Privacy Policy and applicable law. 10.2 Provide third-party information only when you have the necessary authority and lawful basis. Tell business representatives, beneficial owners and other relevant individuals about the applicable privacy information. Where a particular business feature makes LFG a processor of your customers’ personal data, the applicable data-processing agreement must be in place; these Terms alone do not replace it. 10.3 LFG and its licensors retain their rights in the software and branding. Subject to these Terms, you may use the software for your permitted personal or business activities. Do not reproduce, resell or reverse engineer it except with permission or to the extent the law grants a right that cannot be excluded. Separate open-source licences continue to apply to the relevant components. 10.4 We use a business’s name or logo in customer marketing only with permission. Feedback may be used to improve the service, but this does not grant permission to disclose personal or confidential information. ## 11. Disclaimers, service standards, changes and events beyond control 11.1 Subject to the express commitments in these Terms and rights that cannot lawfully be excluded, the Services are supplied on an **as-available** basis. LFG will provide its services with reasonable care and skill and honour applicable mandatory requirements. We cannot promise uninterrupted or error-free operation or control of public networks and independent providers. We will take reasonable steps to address failures for which we are responsible. 11.2 Information, screening scores and compliance analytics in the Services are indicative and probabilistic. They can be incomplete, delayed or wrong and do not constitute legal, tax, accounting or investment advice, a credit assessment or a guarantee that a person or transaction is lawful. Do not rely on them as the sole basis for a consequential decision or report. This does not exclude LFG’s responsibility for an inaccurate representation or defective service where applicable law makes LFG responsible. 11.3 Features can depend on public blockchains, smart contracts, wallet and node infrastructure, cloud hosting, identity and screening services, notification and diagnostic providers, and independent on-ramp, off-ramp and swap providers. LFG does not control those independent services and is not responsible for their independent acts or omissions merely because an integration exists. LFG remains responsible for its own selection, integration, instructions, security, statements and contractual performance to the extent required by law. 11.4 A beta, preview or experimental feature will be identified as such. It may change, be interrupted or be withdrawn and may have additional terms shown before use. Labelling a feature as beta does not exclude a mandatory duty or remedy. 11.5 We may make changes for security, law, compatibility, maintenance or service improvement. For a material adverse change to a paid service, we give reasonable advance notice, normally at least 30 days where feasible, and explain the available cancellation and refund rights. Urgent legal or security changes may take effect sooner, with notice when lawful and practicable. 11.6 An event beyond LFG’s reasonable control can include a material outage or failure of an independent provider or upstream internet, DNS, cloud, banking or telecommunications infrastructure; public-blockchain congestion, fork, reorganisation, attack or protocol change; a major external cyberattack or supply-chain event; war, terrorism, civil unrest, natural disaster, pandemic or labour disruption; or an unforeseeable legal, sanctions, regulatory or app-distribution action. This applies only to the extent the event actually prevents or delays performance despite reasonable precautions. 11.7 During such an event, LFG will take reasonable steps to limit disruption, protect users and resume the affected service. The event does not excuse payment already properly due, a failure caused by LFG’s lack of reasonable care, or any remedy the law does not allow us to exclude. Loss or compromise of your own keys or recovery material is governed by section 4 and is not automatically an event excusing either party. 11.8 Contact support if you need help accessing the service or its information. Applicable accessibility duties remain LFG’s responsibility. This agreement does not assert an independently verified technical accessibility certification. ## 12. Suspension, termination and account closure 12.1 We may suspend, restrict or terminate all or part of the Services proportionately if: you materially breach these Terms or an applicable business agreement; an initial or ongoing KYC, KYB, eligibility or security check is not completed or passed; a subscription is unpaid; your activity presents a credible legal, sanctions, financial-crime, fraud or security risk; a competent authority lawfully requires action; or an integrated provider suspends the relevant service or flags the account or activity as non-compliant. 12.2 Action may be immediate where delay or advance notice would create a material risk, frustrate a lawful investigation or breach a legal restriction. Otherwise, we give reasonable notice where practical. We give a reason and a meaningful review route where lawful, and limit the restriction to what is reasonably necessary. We may be prohibited from disclosing particular information. 12.3 An account restriction affects access to LFG software and integrations. LFG does not hold customer assets or usable customer keys and therefore cannot itself freeze, confiscate or reverse assets held in a user-controlled wallet. You can use a valid independent backup to control that wallet outside LFG, subject to the blockchain, token issuer and any other applicable restrictions. 12.4 If LFG terminates a paid service for its own convenience, we normally give at least 30 days’ notice and refund prepaid fees for the unused period. We do not retain payment for an unprovided service merely because its provider is unavailable. Different remedies may apply to a termination caused by your material breach, subject to law. 12.5 You may cancel a subscription or close the account through the available account controls, or contact support when access is unavailable. Read the Account Deletion Policy and preserve wallet backups and required records first. Closing the account is not conditional on emptying a wallet or waiving a legal claim. 12.6 When you confirm **Close account**, LFG first records cancellation of the LFG subscription and prevents the billing process from requesting broadcast of unused subscription authorisations or queued retries. Only after that cancellation step succeeds does the closure process deactivate the account and delete active account-linked recovery material. If the cancellation step fails, account closure does not complete and you are directed to support. A transaction already broadcast to the blockchain before cancellation may still complete. 12.7 Closure ends account access and applies the Privacy Policy’s deletion and justified-retention rules. LFG will provide a reasonable opportunity to export available records and recovery material before a planned termination where lawful and feasible. Keep an independent wallet backup in any event. Required retention does not preserve the account as an active wallet-recovery service or permit LFG to keep using a cancelled payment authorisation. 12.8 **Change in country, customer-type or feature availability:** LFG may withdraw an account type, feature or the Services from a country or customer category where reasonably required by a change in law, sanctions, regulatory or court action, provider coverage, a material security or financial-crime risk, or a decision to discontinue the relevant operation. No user is entitled to continue an unsupported or unlawful service merely because it was available when the account was opened. 12.9 Where lawful and practicable, LFG will notify an affected user on a durable medium reasonably before the restriction takes effect, identify the affected service and effective date, and explain the available export, cancellation and refund arrangements. For a planned commercial discontinuation, notice will normally be at least 30 days. LFG may act immediately where advance notice would breach law, sanctions or a lawful direction, create a material security or financial-crime risk, or be legally prohibited. In that case, LFG will provide notice and an explanation as soon as legally permitted and practicable. 12.10 If an availability change ends a paid LFG service, **LFG—not the user—will cancel the affected subscription**, prevent the billing process from requesting broadcast of unused EIP-3009 authorisations and queued retries, and stop future subscription collections. The user does not have to suspend the payments separately. A blockchain transaction validly broadcast before cancellation may still settle and cannot necessarily be reversed on-chain. Unless termination results from the user’s material breach, LFG will refund any LFG subscription fee collected for a period after access ends, including the relevant unused part of a prepaid period, subject to mandatory law. 12.11 Before planned access ends, LFG will provide a reasonable opportunity, where lawful and technically feasible, to export available account records and the recovery material made available for each wallet, or to transfer assets using the user-controlled wallet. Because an immediate legal or security restriction may prevent an additional export period, users must keep independent wallet backups at all times. After LFG access ends, a user who has retained the complete recovery phrase or appropriate private keys can control the wallet through compatible independent software and transact elsewhere where legally permitted. LFG cannot recover the wallet or keys for the user after closure or deletion as explained in section 4 and the Account Deletion Policy. ## 13. Consumer rights and disputes 13.1 Contact for service assistance or for a complaint. We aim to acknowledge complaints within five business days and respond substantively within 30 days. If more time is needed, we explain why and provide an update. Shorter statutory deadlines prevail. You do not have to complete this process before using a right to complain to a regulator or bring a claim. 13.2 Delaware law governs this agreement, subject to mandatory law. For a consumer, this choice does not remove the protections of the country whose mandatory consumer law applies. Consumer rights are not lost merely because eligibility is disputed, the account is free or the user is located in a restricted country. 13.3 Business disputes are subject to the competent state or federal courts in Delaware, except where mandatory law requires otherwise or a signed agreement validly specifies a different forum. Consumers may use the courts available to them under mandatory law, including their home courts where that right applies. There is no mandatory consumer arbitration or class-action waiver in these Terms. ## 14. Responsibility and limits of liability 14.1 Nothing excludes or limits liability that cannot lawfully be excluded or limited, including liability for fraud, fraudulent misrepresentation, wilful misconduct or death or personal injury caused by negligence where applicable. Statutory data-protection and consumer remedies remain available. 14.2 **Consumers:** LFG is responsible for losses for which applicable law makes it responsible, including reasonably foreseeable loss caused by its breach or failure to use the required care and skill. No general monetary cap or blanket exclusion of digital-asset loss is imposed on consumers by these Terms. LFG is not responsible for a loss caused solely by a risk properly allocated to the user, such as loss of a usable backup despite clear warnings, where LFG has not caused or contributed to that loss through a breach or other actionable fault. 14.3 **Businesses:** subject to section 14.1 and any applicable mandatory restriction, LFG is not liable for indirect or consequential losses, or loss of anticipated profits or business opportunities. Its aggregate contractual liability for claims arising in a 12-month period is capped at the greater of the LFG subscription fees paid in the six months preceding the first event giving rise to the relevant claim and USD 500. This cap does not restrict an obligation to return an unauthorised charge or pay an agreed refund. LFG’s own responsibility must still be determined on the actual facts. 14.4 A business must reimburse LFG for reasonable loss from a third-party claim to the extent caused by that business’s unlawful use, infringement of rights or material breach. This obligation does not cover LFG’s own fault. LFG must give reasonable notice, cooperate and allow appropriate participation in the defence; it cannot agree a settlement imposing an obligation on the business without its consent. This indemnity does not apply to consumers. ## 15. Changes and general provisions 15.1 We may update these Terms for a stated legal, security, operational or product reason. We will explain material changes and normally give at least 30 days’ advance notice, except where an urgent legal or security need requires a shorter period. Changes do not retrospectively remove accrued rights. Where express consent is legally required, continued use is not a substitute for it. 15.2 You may reject a material adverse change by ending the affected service before it takes effect, with any refund required by these Terms or law. Required notice of a price change also remains subject to section 6. 15.3 If a provision is unenforceable, the remainder continues where legally possible. Delay in enforcing a right is not a waiver. Neither party may transfer this agreement in a way that unlawfully reduces the other’s protections. A permitted business successor must honour the applicable obligations. 15.4 These Terms and any properly incorporated or signed documents form the agreement for the service. They do not exclude liability for misleading statements, erase enforceable pre-contract information or prevent reliance on mandatory rights. Provisions concerning accrued payment obligations, confidentiality, lawful retention, liability and disputes survive closure where their nature requires it. 15.5 No person other than you and LFG may enforce these Terms, except a lawful successor or a person expressly identified in a signed agreement as an intended beneficiary. This does not limit an independent Third-Party Provider’s rights under its own agreement with you. ## 16. Definitions 16.1 In these Terms: * **Business User** means a company, partnership, sole trader or other person using the Services mainly for trade, business or professional purposes. * **Consumer** means an individual using the Services wholly or mainly outside their trade, business or profession. * **EIP-3009 authorisation** means the signed, limited token-transfer authorisation described in section 6; it is not a wallet private key or bank direct-debit mandate. * **Blockchain Compliance Provider** means a Third-Party Provider used for public-wallet or transaction-risk analytics. Its alerts are subject to sections 8 and 11. * **Identity Verification Provider** means a Third-Party Provider used to perform or support identity, business, fraud or screening checks for a stated onboarding or compliance purpose. * **Integrated Service Providers** means LFG’s current public directory of providers used for particular functions, as updated from time to time. * **LFG Vault** means the non-custodial wallet associated with a business account for receiving eligible business payments and paying LFG subscription fees. The user controls its keys. * **LFG-verified user** means a user whose applicable LFG account-verification requirements have been completed. It does not mean that LFG or a regulator guarantees the user or every transaction. * **Merchant** means a Business User that uses available LFG tools to request or receive payment for its own goods or services. * **On-ramp or off-ramp provider** means an independent provider that offers an enabled fiat-to-crypto or crypto-to-fiat service under its own agreement and eligibility rules. * **Self-hosted wallet** means a wallet for which the user or another non-provider person controls the means of access, rather than a wallet held in an account with a custodial provider. * **Services** means the LFG website, applications and software features made available under these Terms, subject to the Global Availability Statement. * **Third-Party Provider** means a person other than LFG that supplies an integration, infrastructure or other service used by or accessible through the Services. * **Travel Rule** means applicable requirements placed on certain regulated transfer-service providers to obtain, verify, hold or transmit specified originator and beneficiary information. Section 8 describes LFG’s limited technical role where an enabled integration requires such information. 16.2 References to the **Global Availability Statement**, **Privacy Policy**, **Cookie Policy**, **Regulatory Position Statement**, **Integrated Service Providers** and **Account Deletion Policy** mean the current documents linked in section 1.3. ## 17. Electronic communications, push notifications and SMS 17.1 We may send account, security, authentication, billing, legal and service messages by email, in-app message, push notification or, if configured for your account, SMS. Some messages are necessary to operate or secure an account and are not marketing. 17.2 Marketing messages are sent only where permitted by law and, where required, after separate consent. Marketing consent is not a condition of opening an account. You can withdraw it using the message instructions, account settings or . We will honour the request promptly, although a short processing period and a legally permitted confirmation message may apply. 17.3 If you opt into SMS, message frequency varies with your account activity and choices. Standard carrier message and data rates may apply. Where replies are supported, reply **STOP** to opt out of optional SMS and **HELP** for assistance; you may also contact . Opting out of marketing does not stop a transaction-specific authentication code you separately request or a legally required notice, but we will use another available channel where appropriate. 17.4 Mobile carriers are not responsible for delayed or undelivered messages. Delivery is not guaranteed, so do not rely on SMS or push notifications as your only method of monitoring a wallet, billing date or security issue. 17.5 The Privacy Policy explains how contact details, consent and delivery information are processed. We do not sell telephone numbers or SMS consent records, or share them with third parties for their own marketing. Communications providers may process them only to provide the applicable service or as otherwise lawfully explained. *** # Integrated service providers **Effective date: 13th September 2026** This document explains the current provider roles in the service supplied by **Layer Flow Gateway, Inc.** It is a service directory, not a statement that every named technology vendor is regulated or that every integration is available worldwide. Our Privacy Policy explains processing purposes, recipients, international transfers and rights. ## 1. Verification, software and infrastructure | Provider | Role in LFG | Responsibility and limits | | ------------------- | ------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Didit | LFG’s own applicant KYC/KYB, verification results and review support | LFG is responsible for its account admission process and data use. Didit performs checks under the applicable arrangements; authorised LFG administrators can view results and associated information. | | 1inch | Classic Swap Aggregation API v6.0 for user-directed quotes and transaction data | 1inch returns the route and transaction data directly to the user. The user reviews and signs every swap. LFG does not receive or transmit the order, select the route, sign or broadcast the swap, and its swap fee is currently disabled. For EU/EEA customers, swaps into USDT are disabled. | | Web3Auth | Non-custodial wallet, authentication, signing-flow and transaction-broadcast infrastructure | Neither Web3Auth nor LFG can sign alone. LFG cannot possess or reconstruct the private key, change transaction instructions or broadcast independently. Web3Auth is not an LFG recovery service; users must export and retain the recovery material for every wallet because LFG cannot recover it after closure or loss of required device data. | | Amazon Web Services | Primary LFG application hosting and storage | Main reported application region: eu-central-1, Frankfurt, Germany. This does not determine every personnel or sub-processor access location. | | Sentry | Mobile error and crash diagnostics | EU ingestion is configured. Actual collection and retention are limited as described in the Privacy and Cookie Policies. | | OneSignal | Mobile notification delivery and associated device/notification records | Notification permissions, any separate data-collection consent and deletion are managed separately as described in the Privacy and Cookie Policies. | LFG may use additional necessary blockchain-node, screening, communications or support infrastructure within the recipient categories in its Privacy Policy. Its current contractual processor record must identify the actual providers used. A planned integration does not become operational merely because it appeared in an earlier list. ## 2. Financial-service integrations | Provider brand | Enabled type of service | Important limit | | --------------------------------- | --------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Coinbase | On-ramping to supported USDC | Only the appropriate provider entity, country, customer type, network and funding method. Coinbase Spend Permissions is not LFG’s current subscription billing mechanism. | | Transak | On-ramping to supported USDC | Personal and business coverage must be established separately for the relevant product. | | MoonPay | On-ramping to supported USDC | Personal and business coverage must be established separately for the relevant product. | | OwlPay / Harbor | Off-ramping from supported USDC and bank payouts for eligible senders | EU-citizen individual senders and EU-incorporated business senders cannot currently onboard. EU payout destinations do not remove the sender restriction. | | Sumsub, through Owl’s arrangement | Owl’s separate business verification for its off-ramp | This is not the same process as LFG’s Didit onboarding. Owl’s terms and privacy arrangements govern that provider relationship. | The specific legal entity supplying a financial service, its customer agreement, any relevant permission and the applicable fees are identified in its onboarding or checkout. LFG must only enable a route supported by that entity’s actual product coverage. Listing a provider is not a financial-services passport for LFG or a promise that the provider accepts all users of its brand worldwide. No Ramp Network integration is included in this current directory. The listed providers’ unintegrated products are not LFG features. ## 3. Fees, outages and responsibilities Owl’s current customer off-ramp fee is 0.50% of the off-ramped amount. LFG receives a referral commission from Owl out of that fee; it does not increase the 0.50% customer charge. The confidential commission percentage is not part of this customer document. Separate costs, if any, are shown in the applicable quote. LFG’s current 1inch swap fee is zero, and LFG receives no transaction-based compensation from swaps or payments; network and applicable provider costs remain separate. Each provider is responsible for its own service under its agreement and applicable law. LFG remains responsible for its own duties, including the accuracy of its representations and any applicable obligation concerning the integration or selection of a provider. A provider failure does not automatically exclude all LFG liability. Provider complaints should be addressed to the provider supplying the disputed service. LFG support can help identify the appropriate provider and address the LFG part of a complaint. Closing LFG does not automatically close a provider account, revoke an external wallet approval or erase records an independent provider lawfully retains. ## 4. Changes and enquiries We update this directory when an integration materially changes. We obtain any additional consent required for a new processing purpose and honour any contractual processor-change procedure that applies. Contact **** for privacy or contractual questions and **** for a service problem. *** # Merchant details & trading name (DBA) policy ### **LFG Merchant Details & Trading Name (DBA) Policy** ### 1 Objective Layer Flow Gateway (LFG) is dedicated to facilitating trusted, secure, and transparent crypto-to-fiat commerce. This policy outlines the mandatory requirements for the names and addresses merchants use when processing payments through our infrastructure. Our goal is to ensure clarity for LFG, our liquidity providers, regulatory bodies, and the end consumers. ### 2 Business Details Definition During the onboarding process, all business customers must provide two distinct sets of information: Incorporated Details: The legal entity name and registered office address as officially listed on government-issued incorporation documents. Trading Details (DBA): The ‘Doing Business As’ name and physical operating address that consumers recognize and will see on their digital receipts or payment interfaces. ### 3 Acceptable Use of Trading Names (DBA) LFG recognizes that in many legitimate global business models (e.g., authorized dealerships in the UAE or franchises in the EU), a merchant’s trading name may differ significantly from their incorporated identity. We support the use of DBAs provided that: Ownership: The name is legitimate and belongs to the merchant or their parent company. IP Compliance: The name does not violate third-party trademarks or intellectual property rights. Authorization: In the case of authorized dealerships or franchise agreements (e.g., Al Nabooda trading as Porsche Centre Dubai), the merchant must be able to provide proof of authorization to trade under that brand name immediately upon request. ### 4 Prohibited Uses ("The Brand Hijacking Rule") Merchants are strictly prohibited from using trading names or addresses that: Mislead Consumers: You may not claim to be, or impersonate, a well-known brand (e.g., Nike, Apple, Coca-Cola, etc.) if your business is unrelated or unauthorized. Facilitate Fraud: Any attempt to use a trading name to obscure the nature of goods sold or to deceive the sender of funds is prohibited. Are Offensive: Names that are politically, socially, or ethically offensive will be rejected. ### 5 Operational Addresses If your physical place of business differs from your registered office, you must provide the operational address. This must be a verified physical location used by the business; P.O. Boxes or mail-forwarding virtual offices are not permitted for operational address entries. ### 6 Disclaimer: LFG Verification & Liability By submitting trading details that differ from your incorporated data, you acknowledge the following: #### 6.1 No Initial Verification: LFG (Layer Flow Gateway) provides the technical infrastructure and does not verify the initial accuracy, trademark ownership, or legitimacy of the trading details you submit. #### 6.2 Merchant Responsibility: You are solely responsible for ensuring you have the legal right to use your chosen trading name (DBA). ### 7 Account Suspension & Legal Recourse LFG maintains a zero-tolerance policy for brand hijacking and identity fraud. If a merchant is found to be in breach of these guidelines: #### 7.1 Termination of Access: LFG will immediately terminate or suspend your account and API access without prior notice. As a non-custodial provider, this action will permanently disable your ability to process new payments or access integrated off-ramping/settlement services through our partners. #### 7.2 Reporting to Authorities: LFG reserves the right to report suspected fraudulent activity, brand hijacking, or identity theft to the relevant financial and law enforcement authorities in the merchant’s country of incorporation and the regions in which they operate. #### 7.3 Indemnification & Legal Costs: The merchant agrees to indemnify LFG against any third-party claims arising from a breach of this policy. LFG reserves the right to pursue the merchant for all legal costs, regulatory fines, or damages incurred by LFG as a result of the merchant’s unauthorized or fraudulent use of trading names. #### 7.4 Jurisdictional Compliance: LFG will cooperate fully with any legal actions or information requests required by the laws of the merchant’s country of incorporation. # Global availability statement **Effective date: 13 September 2026** **Last updated: 9 October 2026** ## 1 What availability means Layer Flow Gateway, Inc. supplies non-custodial software to eligible individuals and businesses. Customers control their own wallets. LFG does not hold customer assets or have access to private keys that would allow it to control a customer's wallet or independently authorise a transaction. Our role and the wallet architecture are explained in our [Regulatory Position Statement](https://help.getlfg.app/p/agreements/regulatory-position-statement) and [Terms of Service](https://help.getlfg.app/p/agreements/terms-of-service). When a customer uses an enabled MoonPay, Coinbase or Transak on-ramp, the purchase takes place directly between that customer and the applicable provider entity. The provider processes the purchase and delivers the purchased cryptoassets to the customer's designated wallet. LFG does not receive or hold the purchase funds, act as the buyer or seller, or execute or settle the conversion on the customer's behalf. LFG provides access to the provider's service through its software and remains responsible for its own onboarding, interface and applicable obligations. LFG takes no transaction fee or commission on MoonPay, Coinbase or Transak on-ramp purchases. Provider and network charges may apply. LFG's business software subscription fees are separate. Any Owl/Harbor off-ramp referral commission is disclosed separately in our Terms and [Integrated Service Providers statement](https://help.getlfg.app/p/agreements/integrated-service-providers). Individuals must complete identity verification, and businesses must complete business verification, through Didit before LFG account activation. LFG applies account, country, customer-type and feature restrictions. The provider then applies its own verification, sanctions screening and product eligibility requirements, including KYC or KYB as applicable. There are separate eligibility decisions: opening an LFG account, buying crypto through an on-ramp, using Owl/Harbor as an off-ramp sender, and requesting a payout to a destination. Passing one assessment does not establish eligibility for the others. Sanctions and other applicable legal restrictions override every entry in the availability schedule. Personal accounts are free. Business accounts require the relevant subscription and an eligible funding method. Being a business does not automatically qualify a customer for a provider's business, professional or institutional services. Cryptoassets are not government-issued money or local legal tender. ## 2 Account availability LFG software accounts are available to Both personal and business customers in the following countries and territories, subject to verification and the conditions shown. Account availability does not mean every provider service is available. Provider services are listed separately in section 4. | Country or territory | Availability | Customers | Conditions | | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------ | --------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Austria; Belgium; Bulgaria; Croatia; Cyprus; Czechia; Denmark; Estonia; Finland; France; Germany; Greece; Hungary; Ireland; Italy; Latvia; Lithuania; Luxembourg; Malta; Netherlands; Poland; Portugal; Romania; Slovakia; Slovenia; Spain; Sweden | Available | Both | USDC-only payments; USDT payments and swaps into USDT are disabled. Applicable local consumer and privacy requirements. Owl cannot onboard EU-citizen individual senders or EU-incorporated business senders. On-ramp coverage is separate. | | Iceland; Liechtenstein; Norway | Available | Both | USDC-only payments; USDT payments and swaps into USDT are disabled. Applicable local requirements. Owl off-ramping is unavailable unless sender eligibility is specifically confirmed and is not inferred from SEPA coverage. | | Switzerland | Available | Both | Provider, customer-type and funding eligibility remain separate. | | Canada | Available | Both | User-controlled software flow; no LFG mandate to pay the customer’s third-party invoices. Provider eligibility remains separate. | | Peru | Available | Both | The remote software offering described in the Terms; provider and customer-type eligibility remain separate. | | Japan; Philippines; South Korea | Available | Both | Non-custodial software only. LFG does not possess private keys, sign or execute transactions, control assets, select swap routes or receive transaction-based compensation for direct wallet payments, on-ramp purchases or swaps. Provider and funding eligibility remain separate. | | Argentina; Brazil; Chile; Colombia; Costa Rica; Mexico; Panama; Dominican Republic; El Salvador; Guatemala; Jamaica; Trinidad & Tobago; Anguilla; Barbados; Montserrat; Turks and Caicos Islands | Available | Both | Non-custodial software only. Cryptoassets are not local legal tender. LFG does not possess private keys, sign or execute transactions, control assets, select swap routes or receive transaction-based compensation for direct wallet payments, on-ramp purchases or swaps. Provider and funding eligibility remain separate. | | United Kingdom | Available | Both | Non-custodial software only. UK-facing communications and onboarding must comply with applicable financial-promotion requirements. Provider, funding and on-ramp/off-ramp eligibility remain separate. | | United States — all 50 states and Washington, DC | Available | Both | Non-custodial software only. LFG does not accept or transmit customer value, possess private keys, sign or execute transactions, control assets or receive transaction-based compensation for direct wallet payments, on-ramp purchases or swaps. State provider availability and other applicable state requirements remain separate. Delaware incorporation does not replace any registration, tax, privacy or other obligation arising from LFG's activities in a state. | | Mauritius; Gibraltar; Guernsey; Bermuda; Cayman Islands; British Virgin Islands; Bahamas | Available | Both | Non-custodial software only. Provider, business-verification, subscription-funding and on-ramp/off-ramp availability remain separate and may limit particular features. | | Andorra; Monaco; San Marino; Vatican City; Isle of Man; Jersey; Bahrain; Oman; Qatar; South Africa; Benin; Botswana; Burkina Faso; Cameroon; Cape Verde; Côte d’Ivoire; Ghana; Kenya; Madagascar; Malawi; Mozambique; Namibia; Senegal; Sierra Leone; Togo; Uganda; Zambia; Australia; Hong Kong; New Zealand; Singapore | Available | Both | Non-custodial software only. Cryptoassets are not local legal tender. Provider, verification, funding and on-ramp/off-ramp availability remain separate and may limit particular features. | LFG is a Delaware software company. Incorporation in Delaware does not replace local requirements. A local office or a change in the services offered may affect account availability. ## 3 Sanctions and excluded markets ### 3.1 Sanctions always override availability LFG does not provide an account, feature or transaction where doing so would breach applicable sanctions or export-control law. This applies regardless of whether a country otherwise appears eligible. LFG will reject or restrict: * a person or entity designated on an applicable sanctions list; * an entity owned or controlled by a designated person where the applicable rules treat it as restricted; * blocked property, a prohibited wallet, or a transaction involving a prohibited person, sector, activity or territory; and * attempted circumvention, including use of another person, entity, wallet, location or account to evade a restriction. As a Delaware company, LFG applies applicable United States sanctions, including the current [OFAC sanctions programmes and lists](https://ofac.treasury.gov/sanctions-programs-and-country-information). It also applies relevant [United Kingdom](https://www.gov.uk/government/publications/the-uk-sanctions-list), [European Union](https://data.europa.eu/data/datasets/consolidated-list-of-persons-groups-and-entities-subject-to-eu-financial-sanctions?locale=en) and [United Nations](https://main.un.org/securitycouncil/en/content/un-sc-consolidated-list) restrictions where they apply to LFG, the user, the service or an integrated provider. These sources change, so the current legal lists prevail over this summary. ### 3.2 Countries and territories excluded under LFG policy LFG does not offer any account type to persons resident in, or businesses incorporated in or primarily operating from, the following countries and territories: | Country or territory | Availability | Customers | Details | | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------- | --------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Belarus; Cuba; Iran; North Korea; Russia; Syria** | Not available | Both | Entire LFG account service excluded because of LFG’s sanctions-exposure, provider and risk policy. This is a categorical LFG eligibility rule; it does not claim that every resident or company is individually designated under every sanctions regime. | | **Crimea and any non-government-controlled or occupied area of Ukraine covered by applicable sanctions**, including relevant areas of Donetsk, Luhansk, Kherson and Zaporizhzhia | Not available | Both | Entire LFG account service excluded. The applicable legal description of a restricted territory prevails over informal geographic labels. | ### 3.3 Other excluded markets LFG also does not presently offer account services to persons resident in, or businesses incorporated in or primarily operating from, the following markets. Relevant restrictions also apply to use from a location where access is not permitted. This is an operational exclusion list; it does not assert that every excluded country criminalises private crypto possession or is subject to identical sanctions. | Country or territory | Availability | Customers | Details | | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------- | --------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Tanzania | Not available | Both | Excluded from the present service. The Bank of Tanzania states that cryptocurrency trading and use are not authorised under its foreign-exchange framework. | | Turkey | Not available | Both | Excluded from the whole service. The current product uses cryptoasset payments, which conflict with the identified Turkish payment restrictions. Removing swaps alone does not resolve that issue. | | Ecuador | Not available | Both | Excluded from the present USDC payment launch. | | Rwanda | Not available | Both | Excluded from the present direct USDC payment launch without the required specific authorisation. | | United Arab Emirates | Not available | Both | No general mainland or free-zone launch under this Statement. A named financial-zone or other specific route must be separately established before it is offered. Free-zone incorporation or a counterparty on LFG’s global list is not sufficient by itself. | | Saudi Arabia | Not available | Both | Excluded as LFG’s launch policy pending a verified route. This is not presented as a finding that all private wallet use is unlawful. | | Afghanistan; Algeria; Bangladesh; Bolivia; mainland China; Egypt; India; Indonesia; Iraq; Libya; Malaysia; Morocco; Myanmar; Nepal; Nigeria; Pakistan; Sudan; Thailand; Venezuela; Vietnam; Yemen | Not available | Both | Existing LFG exclusions retained. Different legal, provider, sanctions-risk and operational reasons may apply. | Sanctions screening can restrict an otherwise listed market’s particular person, entity, beneficial owner, wallet or transaction. Conversely, citizenship is not automatically the general software exclusion test; any provider-specific citizenship restriction is identified separately, including Owl’s EU rule. Countries not included in an eligible scope are not offered merely because they are absent from the excluded list. A new route requires an updated eligibility decision and implementation. ## 4 On-ramp and off-ramp coverage ### 4.1 Services and customer types An on-ramp lets a customer buy USDC using money from a card or bank account. An off-ramp lets an eligible customer convert USDC and receive money in a bank account. Each purchase or conversion takes place directly with the provider. We use three customer descriptions: * **Personal:** an individual using the service for themselves. * **Business:** a company or other business using the service through an authorised representative. * **Both:** personal and business customers. Each service is available only in the countries and to the customers listed below. Owl/Harbor's separate limits are in section 4.5. | Service | Availability | Customers | | ------------------------------------------------ | ------------- | --------- | | LFG account and wallet | Available | Both | | Coinbase USDC purchases | Available | Personal | | Transak USDC purchases | Available | Personal | | MoonPay USDC purchases | Available | Personal | | Business purchases through these three providers | Not available | Business | | Owl/Harbor USDC conversion and bank payout | Available | Both | A service listed for Personal customers does not cover purchases made for a business or using business funds. Business customers can use only services listed for Business or Both. A service being available in a country does not guarantee that every customer or payment will be accepted. The customer must pass the provider's checks, use an accepted payment method and request a USDC purchase or conversion that the provider offers through LFG. These entries cover the services integrated into LFG. A provider's separate business platform or other product is not included simply because that provider offers it elsewhere. The relevant customer terms are available from [Coinbase](https://docs.cdp.coinbase.com/onramp/coinbase-hosted-onramp/countries-%26-currencies), [Transak](https://transak.com/terms-of-service) and [MoonPay](https://www.moonpay.com/legal/terms). ### 4.2 Availability by country and customer type The table uses two availability labels: * **Available:** the service is offered to the customer type shown, subject to verification and the conditions in this statement. * **Not available:** the service is not offered through LFG, including where provider approval for that country and customer type has not been confirmed. For personal customers, the country is where they live. For business customers, the provider must approve the business and its relevant countries. Personal availability does not establish business availability. All countries below are eligible for LFG software accounts under section 2, for Both personal and business customers. The provider columns refer to buying USDC. State and province restrictions are explained in section 4.3. | Country or territory | Coinbase | Transak | MoonPay | | ------------------------ | -------------------- | -------------------- | -------------------- | | Andorra | Not available | Not available | Available (Personal) | | Anguilla | Not available | Not available | Available (Personal) | | Argentina | Not available | Not available | Available (Personal) | | Australia | Not available | Available (Personal) | Available (Personal) | | Austria | Available (Personal) | Not available | Available (Personal) | | Bahamas | Not available | Not available | Available (Personal) | | Bahrain | Not available | Not available | Available (Personal) | | Barbados | Not available | Not available | Not available | | Belgium | Available (Personal) | Not available | Available (Personal) | | Benin | Not available | Not available | Available (Personal) | | Bermuda | Not available | Available (Personal) | Available (Personal) | | Botswana | Not available | Not available | Available (Personal) | | Brazil | Not available | Not available | Available (Personal) | | British Virgin Islands | Not available | Not available | Available (Personal) | | Bulgaria | Available (Personal) | Not available | Available (Personal) | | Burkina Faso | Not available | Not available | Not available | | Cameroon | Not available | Not available | Available (Personal) | | Canada | Available (Personal) | Available (Personal) | Available (Personal) | | Cape Verde | Not available | Not available | Available (Personal) | | Cayman Islands | Not available | Not available | Available (Personal) | | Chile | Not available | Not available | Available (Personal) | | Colombia | Not available | Not available | Available (Personal) | | Costa Rica | Not available | Not available | Available (Personal) | | Croatia | Available (Personal) | Not available | Available (Personal) | | Cyprus | Available (Personal) | Not available | Available (Personal) | | Czechia | Available (Personal) | Not available | Available (Personal) | | Côte d’Ivoire | Not available | Not available | Not available | | Denmark | Available (Personal) | Not available | Available (Personal) | | Dominican Republic | Not available | Not available | Available (Personal) | | El Salvador | Not available | Not available | Available (Personal) | | Estonia | Available (Personal) | Not available | Available (Personal) | | Finland | Available (Personal) | Not available | Available (Personal) | | France | Available (Personal) | Not available | Available (Personal) | | Germany | Available (Personal) | Not available | Available (Personal) | | Ghana | Not available | Not available | Available (Personal) | | Gibraltar | Not available | Not available | Available (Personal) | | Greece | Available (Personal) | Not available | Available (Personal) | | Guatemala | Not available | Not available | Available (Personal) | | Guernsey | Not available | Not available | Available (Personal) | | Hong Kong | Not available | Available (Personal) | Available (Personal) | | Hungary | Available (Personal) | Not available | Available (Personal) | | Iceland | Available (Personal) | Not available | Available (Personal) | | Ireland | Available (Personal) | Not available | Available (Personal) | | Isle of Man | Not available | Not available | Available (Personal) | | Italy | Available (Personal) | Not available | Available (Personal) | | Jamaica | Not available | Not available | Not available | | Japan | Not available | Not available | Not available | | Jersey | Not available | Not available | Available (Personal) | | Kenya | Not available | Not available | Available (Personal) | | Latvia | Available (Personal) | Not available | Available (Personal) | | Liechtenstein | Available (Personal) | Not available | Available (Personal) | | Lithuania | Available (Personal) | Not available | Available (Personal) | | Luxembourg | Available (Personal) | Not available | Available (Personal) | | Madagascar | Not available | Not available | Not available | | Malawi | Not available | Not available | Available (Personal) | | Malta | Available (Personal) | Not available | Available (Personal) | | Mauritius | Not available | Not available | Available (Personal) | | Mexico | Not available | Available (Personal) | Available (Personal) | | Monaco | Not available | Not available | Available (Personal) | | Montserrat | Not available | Not available | Available (Personal) | | Mozambique | Not available | Not available | Available (Personal) | | Namibia | Not available | Not available | Available (Personal) | | Netherlands | Available (Personal) | Not available | Available (Personal) | | New Zealand | Not available | Available (Personal) | Available (Personal) | | Norway | Available (Personal) | Not available | Available (Personal) | | Oman | Not available | Not available | Available (Personal) | | Panama | Not available | Not available | Available (Personal) | | Peru | Not available | Not available | Available (Personal) | | Philippines | Not available | Available (Personal) | Available (Personal) | | Poland | Available (Personal) | Not available | Available (Personal) | | Portugal | Available (Personal) | Not available | Available (Personal) | | Qatar | Not available | Not available | Available (Personal) | | Romania | Available (Personal) | Not available | Available (Personal) | | San Marino | Not available | Not available | Available (Personal) | | Senegal | Not available | Not available | Not available | | Sierra Leone | Not available | Not available | Available (Personal) | | Singapore | Not available | Not available | Available (Personal) | | Slovakia | Available (Personal) | Not available | Available (Personal) | | Slovenia | Available (Personal) | Not available | Available (Personal) | | South Africa | Not available | Not available | Available (Personal) | | South Korea | Not available | Not available | Available (Personal) | | Spain | Available (Personal) | Not available | Available (Personal) | | Sweden | Available (Personal) | Not available | Available (Personal) | | Switzerland | Not available | Not available | Available (Personal) | | Togo | Not available | Not available | Available (Personal) | | Trinidad & Tobago | Not available | Not available | Available (Personal) | | Turks and Caicos Islands | Not available | Not available | Available (Personal) | | Uganda | Not available | Not available | Not available | | United Kingdom | Available (Personal) | Available (Personal) | Available (Personal) | | United States | Available (Personal) | Available (Personal) | Available (Personal) | | Vatican City | Not available | Not available | Available (Personal) | | Zambia | Not available | Not available | Available (Personal) | Country information comes from [Coinbase's payment-method coverage](https://docs.cdp.coinbase.com/onramp/additional-resources/payment-methods) and [EEA country information](https://help.coinbase.com/en/coinbase/other-topics/other/mica-cblu), [Transak's country coverage](https://transak.com/global-coverage) and [country list](https://api.transak.com/api/v2/countries), and [MoonPay's country list](https://api.moonpay.com/v3/countries). The provider's checks and LFG's restrictions still apply. ### 4.3 State and province restrictions LFG software accounts are available in all 50 US states and Washington, DC. The providers have their own restrictions: | Provider | US availability for Personal customers | | -------- | ------------------------------------------------------------------------------------------------------------------- | | Coinbase | Available only in states where Coinbase offers the requested USDC purchase and payment method through LFG. | | Transak | Available in 45 states and Washington, DC. Not available in Alaska, Louisiana, Minnesota, New York or North Dakota. | | MoonPay | Available in all 50 states and Washington, DC, subject to customer checks and the requested USDC purchase. | In Canada, Transak is Available in 12 provinces and territories and Not available in Nunavut. MoonPay is Available in all 13 provinces and territories. Coinbase's country and local restrictions still apply. A provider offering a service in a US territory does not automatically make that territory available for LFG accounts. ### 4.4 Provider entities and published regulatory information The entity shown in the provider's customer agreement or purchase flow must supply the service. The information below identifies relevant published permissions. It does not claim that a home-country registration gives the provider, or LFG, universal permission to operate in every other market. | Provider | Market or customer agreement | Entity and published evidence | | -------- | ---------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Coinbase | United States | Coinbase, Inc. Its [Licences and Disclosures](https://www.coinbase.com/legal/licenses) list state permissions, including New York virtual-currency and money-transmitter licences. | | Coinbase | EEA | Coinbase Luxembourg S.A. is listed as a MiCA crypto-asset service provider, CSSF number N00000004. Coinbase Ireland Limited is separately listed as an electronic money institution, C188493. See [European licences](https://www.coinbase.com/legal/licenses/europe) and the [MiCA service migration](https://help.coinbase.com/en/coinbase/other-topics/other/mica-cblu). | | Coinbase | United Kingdom | The [European licences page](https://www.coinbase.com/legal/licenses/europe) identifies CB Payments, Ltd. as an electronic money institution and registered for specified cryptoasset activities, reference 900635. The actual customer agreement determines the entity and functions supplied. | | Coinbase | Other eligible LFG markets | The relevant Coinbase entity and product permission must be established from the customer's provider agreement and the enabled route. The US or EEA licence pages are not presented as worldwide on-ramp permission. | | Transak | United States | Transak USA LLC. Its [Compliance page](https://transak.com/compliance) lists FinCEN registration and state money-transmitter permissions. The [US Terms](https://transak.com/terms-of-service-us) identify the contracting entity. FinCEN registration is distinct from state licensing. | | Transak | Canada | Transak Canada Limited, listed on the [Compliance page](https://transak.com/compliance) as a FINTRAC-registered MSB, C100000155. | | Transak | Australia | Transak Australia Pty Limited, listed on the [Compliance page](https://transak.com/compliance) as an AUSTRAC-registered digital currency exchange provider, 100865469. | | Transak | UK and other countries under its Rest of World Terms | Transak Limited. Section 5.1 of the [Rest of World Terms](https://transak.com/terms-of-service) identifies the applicable non-US/Canada/Australia entity and FCA cryptoasset registration, FRN 928910. Eligibility outside the UK requires the actual supported route and applicable local basis. | | MoonPay | United States | MoonPay USA LLC, with FinCEN registration and state licences published on its [Licences page](https://www.moonpay.com/legal/licenses), including a New York virtual-currency licence. | | MoonPay | EEA | MoonPay Europe B.V., identified as an AFM-authorised MiCA crypto-asset service provider in its [European Terms](https://www.moonpay.com/legal/terms_of_use_europe). The [Licences page](https://www.moonpay.com/legal/licenses) lists AFM reference 41000002. | | MoonPay | United Kingdom | MoonPay (UK) Limited, identified in its [UK Terms](https://www.moonpay.com/legal/terms_of_use_uk) and [Licences page](https://www.moonpay.com/legal/licenses) as FCA-registered. The current register should govern the registration details. | | MoonPay | Canada | The [Canadian Terms](https://www.moonpay.com/legal/terms_of_use_canada) identify MoonPay Canada Inc. The permission relied on must match the entity actually supplying the enabled route. | | MoonPay | Australia | MoonPay AUS Pty Ltd. The [Licences page](https://www.moonpay.com/legal/licenses) lists AUSTRAC digital currency exchange registration DCE100858195-001. | | MoonPay | Other supported jurisdictions under its Rails terms | MoonPay Jersey Ltd. Its [Jersey Terms](https://www.moonpay.com/legal/terms_of_use_jersey) identify JFSC registration; the [Licences page](https://www.moonpay.com/legal/licenses) lists SCH-14176. Product-specific terms govern where another MoonPay service uses a different entity. | Provider licences and registrations do not transfer to LFG. LFG remains responsible for duties applying to its own activities, onboarding, data use, interface and communications. ### 4.5 Owl and Harbor off-ramping Owl/Harbor provides the USDC conversion and bank payout service under its own terms and verification process. It is separate from Coinbase, Transak and MoonPay purchases. | Sender | Customers | Availability | | --------------------------------------------------------------------------- | --------- | ------------- | | EU citizen, including an EU citizen living outside the EU | Personal | Not available | | Business incorporated in the EU | Business | Not available | | Other customer approved by Owl/Harbor for the requested country and service | Both | Available | Other customers must receive Owl/Harbor approval for their country, customer type and requested service. This statement does not list all non-EU countries as available for off-ramping. An approved sender may be able to receive a payout to an EU bank account using SEPA or SEPA Instant. An EU bank being available for payouts does not make an EU citizen or EU-incorporated business eligible to send through Owl/Harbor. For EEA customers, the provider's nationality, residence and business-country restrictions must be checked separately. The current off-ramp fee is 0.50% of the amount converted. LFG receives a referral commission from this fee, as disclosed in section 7 of our [Terms](https://help.getlfg.app/p/agreements/terms-of-service). This commission does not increase the customer's 0.50% fee. Any extra network or bank charges are shown in the quote. ### 4.6 Restrictions and changes A service is available only when the customer meets LFG's account rules, the provider's country and customer requirements, and applicable legal and sanctions requirements. If any requirement is not met, that service is not available. Completing LFG verification or choosing an approved bank destination does not override these restrictions. Restrictions apply to the affected account and feature, including relevant app and API access. Customers must give accurate residence, company, representative and beneficial-owner information and report material changes. They must not use a VPN, proxy, another person's account or an incorrect customer classification to bypass restrictions. Coverage may change. The provider's current terms and product checks apply at the time of a transaction, subject to applicable law and LFG's own obligations. A provider may decline a customer or purchase even where its country is listed. Where LFG withdraws existing access, the notice, cancellation and export provisions in the Terms continue to apply. ## 5 Assets, restrictions and changes For customers in the **European Union or European Economic Area**, USDT payments and swaps into USDT are disabled, and payments are USDC-only. In every other eligible country, payments may use either USDC or USDT where the relevant asset and network are enabled in the app. Bridged USDbC payments remain disabled. Holding or swapping other displayed assets is a separate feature and may be restricted by country, customer type, network or provider. There is no assertion that privately holding USDT is prohibited. Restrictions apply to the affected account and feature, including relevant app and API access. Do not conceal your location or customer type to evade them. Tell LFG about material eligibility changes. Where access is restricted, preserve independent wallet access and follow any available lawful export procedure; an LFG restriction does not itself move or confiscate assets. This Statement records LFG’s current supported countries, customer types and feature conditions on its effective date and whenever it is updated. LFG intends it to accurately describe the scope then offered, but it is not a promise that a country, customer type, provider or feature will remain supported indefinitely. If we identify a material error, we will correct it promptly. The fact that a provider allows a transaction or that a feature is technically visible does not override a legal restriction. Coverage can change because of law, sanctions, regulatory action, provider coverage, material security or financial-crime risk, or discontinuation of the relevant operation. Where an existing customer becomes unsupported, LFG will apply sections 12.8–12.11 of the Terms: give advance notice where lawful and practicable; cancel the affected subscription in LFG's billing system; disable its scheduled submissions and retries without requiring another wallet signature from the customer; address any unused prepaid period; and provide a reasonable opportunity to export records and wallet recovery material before planned loss of access. Stopping LFG's submission process does not itself revoke a signed EIP-3009 authorisation on-chain. Immediate restrictions may be required without advance notice, so users must keep their recovery phrase or appropriate private keys independently at all times. Those keys allow the user to control the wallet through compatible independent software and transact elsewhere where legally permitted; LFG cannot recover them after closure or deletion. Questions: or .