MoonPay College Privacy Notice

Effective Date: Sep 2, 2026

Introduction

This Privacy Notice explains how MoonPay USA LLC (“MoonPay,” “we,” “us,” or “our”) collects, uses, shares, and protects your personal information when you interact with the MoonPay College program, including the MoonPay College landing page at moonpay.com/college, the Campus Leader application, the notification signup form, and related communications (together, the “Program”).

This Notice applies only to the MoonPay College program. It does not cover MoonPay’s financial products, cryptocurrency services, or other services, which are governed by the MoonPay Global Privacy Policy available at moonpay.com/legal/privacy_policy.

We encourage you to read this Notice carefully. If you have questions about this policy, you can reach out to our Data Protection Officer at [email protected].

Who We Are (Data Controller)

The data controller for personal information collected through the MoonPay College program is:

MoonPay USA LLC

8 The Green, Suite B
Dover, DE 19901

MoonPay USA LLC decides how and why your personal information is processed in connection with the Program. If you have questions about how your data is handled, or if you wish to exercise any of your privacy rights, contact our Data Protection Officer at [email protected].

What This Notice Covers (Scope)

This Notice applies to:

• The MoonPay College landing page (moonpay.com/college)
• The Campus Leader application form
• The notification/email signup form
• Communications sent to you in connection with the Program (both service notifications and optional marketing communications)
• The internal review and administration of submitted applications

This Notice applies to individuals located in the United States who are 18 years of age or older. Access to the Program is restricted to individuals located in the United States. If you are located outside the United States, you should not submit personal information through the Program.

Personal Data We Collect

We collect personal information directly from you when you interact with the Program. The specific data elements we may collect include:

Campus Leader Application

• Full name
• Educational email address (.edu)
• University name
• Major (optional)
• Graduation year
• Social media handles (Instagram, TikTok, YouTube, and/or LinkedIn)
• Campus involvement
• Consent and eligibility flags:
  • Age confirmation (18+)
  • Current enrollment confirmation
  • Social media review agreement
  • Marketing communications opt-in (optional)
• Marketing attribution data (UTM source, medium, and campaign parameters)

Notification/Email Signup

• Email address
• Source identifier
• Marketing attribution data (UTM source, medium, and campaign parameters)

Information Collected Automatically

• IP address (used for geographic access restriction and security)
• Device and browser information
• Page interaction data (page views, scroll depth, button clicks)
• hCaptcha challenge data (used to prevent automated/bot submissions)

We do not collect financial information, government-issued identification, Social Security numbers, or any data typically associated with cryptocurrency transactions as part of the application process. If you are selected as a Campus Leader and enter into a paid content creation engagement, additional personal information necessary for that engagement (such as payment and tax information) will be collected under the terms of a separate agreement provided to you at that time.

Important note about the campus involvement field: The free-text “campus involvement” field is provided so you can describe your extracurricular activities and interests. Please do not include sensitive personal information in this field, such as information about your racial or ethnic origin, political opinions, religious beliefs, health conditions, or sexual orientation. We do not request or require this type of information, and we ask that you avoid volunteering it.

How and Why We Use Your Personal Data

We process your personal information for the following purposes:

Communications

There are two distinct categories of communications you may receive through the Program:

1. Required Service Communications

If you submit a Campus Leader application, you will receive communications directly related to your application and participation in the Program. These include:

• Application confirmation emails
• Status updates (e.g., application received, under review, accepted, or not selected)
• Program logistics and participation details (for accepted Campus Leaders)
• Direct outreach from our team regarding your application

Receipt of these communications is a necessary part of participating in the Program. You cannot opt out of service communications while your application is active or while you are participating as a Campus Leader.

2. Optional Marketing Communications

Separately, you may choose to receive marketing emails about MoonPay products, news, events, and promotional content. This requires a separate, affirmative opt-in via a clearly labeled checkbox on the application form.

Important:

• The marketing opt-in checkbox is separate from the age/enrollment attestations and the social media review agreement.
• Declining the marketing opt-in does not affect your application in any way.
• If you opt in to marketing communications, your email address will also be added to our notification signup list.
• You may unsubscribe from marketing emails at any time by clicking the “unsubscribe” link in any marketing email. Unsubscribing from marketing emails does not affect service communications related to your application or participation in the Program.

Third-Party Recipients

We may share your personal information with the following categories of third-party service providers who process data on our behalf and under our instructions:

• Cloud infrastructure and database hosting providers (for secure data storage)
• Email delivery service providers (for sending application confirmations, status updates, and marketing communications)
• Bot/spam prevention services (hCaptcha, to verify form submissions are from real people)
• Web hosting and deployment providers (for serving the Program landing page)
• Analytics providers (receiving only non-identifying, aggregated data — no personal information such as names or email addresses is shared with analytics tools)
• Application logging and monitoring services (subject to PII redaction controls)

We do not sell or share your personal information for cross-context behavioral advertising. We do not share applicant personal data with sponsor partners, event partners, or other third parties for their own marketing purposes.

How We Protect Your Data

We implement appropriate technical and organizational measures to protect your personal information, including:

• Encryption at rest for stored data
• Network restrictions and least-privilege access controls on our database
• Authenticated, access-controlled internal admin panel (restricted to authorized personnel only — not accessible to all MoonPay staff)
• Input sanitization and length limits on form submissions
• hCaptcha on all public-facing forms to prevent automated abuse
• PII redaction from application logs and analytics systems

No method of transmission over the internet or electronic storage is 100% secure. While we take reasonable measures to protect your information, we cannot guarantee absolute security.

How Long We Keep Your Data

We retain your personal information only for as long as necessary to fulfill the purposes for which it was collected. Retention periods vary based on your relationship with the Program:

Notwithstanding the above, we may retain personal information for longer periods where reasonably necessary to comply with applicable legal or regulatory obligations, to establish, exercise, or defend legal claims, or to resolve disputes. In such cases, we will retain only the information necessary for the applicable purpose and will delete it when that purpose has been fulfilled.

When we delete your data, we remove it from our primary database. We also take steps to ensure that personal information is removed from application logs and any backup systems within a reasonable timeframe as required by applicable data protection laws.

Your Privacy Rights

Depending on where you are located, you may have certain rights regarding your personal information. Such rights may include:

• Right to Know: You have the right to request that we disclose what personal information we have collected about you, the categories of sources, the purposes of collection, and the categories of third parties with whom we have shared it.
• Right to Access: You may request a copy of the specific personal information we have collected about you.
• Right to Correction: You have the right to request correction of inaccurate personal information.
• Right to Deletion: You have the right to request that we delete personal information we have collected from you, subject to certain exceptions permitted by law.
• Right to Opt-Out of Sale/Sharing: We do not sell your personal information or share it for cross-context behavioral advertising. If this practice changes, we will update this Notice and provide an opt-out mechanism.
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights. Exercising your rights will not affect your application status or program participation.

How to Exercise Your Rights

To submit a privacy rights request, please contact our Data Protection Officer directly at [email protected].

In accordance with applicable data protection laws, we will verify your identity before processing your request. We will respond to all privacy rights requests within the time period required by applicable laws. If we need additional time, we will notify you of the extension and the reason for it as required.

Children’s Privacy

The MoonPay College program is intended exclusively for individuals who are 18 years of age or older. We do not knowingly collect personal information from anyone under the age of 18.

Participation requires an affirmative attestation that you are 18 years of age or older. If we learn that we have collected personal information from someone under 18, we will take steps to delete that information as quickly as reasonably possible.

Sensitive Personal Information

We do not intentionally collect sensitive personal information (as defined under applicable law) through the MoonPay College program (e.g., references to religious organizations, political groups, or health-related activities). We do not request this type of information, and we ask that you do not submit it to us. If sensitive personal information is incidentally submitted, it will be treated with the same protections as all other personal information collected through the Program and will not be used for any purpose beyond the purposes described in this notice.

Cross-Border Transfers

The Program is currently offered only in the United States, and personal information collected through the Program is stored and processed using cloud infrastructure which may store data across several locations, including the United States, UK, and EEA. Any cross-border transfers that may occur are done so with proper transfer mechanisms as required by applicable law, and may include binding corporate rules, intercompany agreements, standard contractual clauses, or adequacy decisions where appropriate.

Changes to This Notice

We may update this Privacy Notice from time to time to reflect changes in our practices, the Program, or applicable law. When we make material changes, we will:

• Post the updated Notice on the Program landing page
• Update the “Last Updated” date at the top of this Notice
• Where required by law or where changes are significant, provide notice through email or a prominent notification on the landing page

We encourage you to review this Notice periodically. Your continued participation in the Program after changes are posted constitutes your acknowledgment of the updated Notice.

How to Contact Us

If you have questions about this Privacy Notice, want to exercise your privacy rights, or have concerns about how your personal information is handled, you may contact our Data Protection Officer at [email protected].

For general MoonPay privacy matters unrelated to the MoonPay College program, please refer to the MoonPay Global Privacy Policy at moonpay.com/legal/privacy_policy.