Data Stewardship Policy

1.1 User Ownership. You, as the Data Creator or Primary Data Subject, retain full, exclusive ownership and control of all underlying data, documents, and media that you create, upload, or originate via the Sourcery Connect Platform.

1.2 Sourcery’s Recognition. As set out in Section 7.2 of the Membership and User Agreement:

“Our Data Stewardship Policy recognises and imparts full ownership and control of Customer Data / Trade Data to the primary Data Creator / Data Subject. We treat such data as your asset, not ours.”

1.3 Scope of Data. This ownership applies to all forms of data captured, including but not limited to receipts, invoices, shipping documents, photographs, video, messages, packing slips, farm-level metrics, and related commercial, social, or environmental impact data.

2.1 Distinction of IP. While you own the content (the data points and documents), you acknowledge that the method of collection is the proprietary intellectual property of Sourcery Group, Inc., operated by Sourcery Partners, LLC under licence.

2.2 Ownership of IP Rights. Any commercial, transactional, and impact data captured and aggregated via Sourcery is collected using a unique and novel data collection process and methodology that is the proprietary intellectual property of Sourcery Group, Inc., operated by Sourcery Partners, LLC under licence, and is protected by intellectual property laws in the United States and other jurisdictions. You agree not to reverse-engineer, copy, or replicate this data collection methodology.

To operationalize your data ownership and control, Sourcery employs Self-Sovereign Identity (SSID) technology and a Zero-Knowledge architecture:

3.1 Sourcery Identity. Your access to data is secured by your Sourcery ID, a unique digital identity that links your verified existence to your data.

3.2 Partner Data Vault (PDV). All data you create is encrypted and stored in your Partner Data Vault (PDV).

• Zero-Knowledge Architecture: Your PDV is a zero-knowledge system. This means that by default, Sourcery cannot see, access, or decrypt the raw data stored inside your PDV.
• Encryption Keys: You hold the private digital keys to your PDV. You are the only party that can grant access to the data stored within.

4.1 Purpose of Stewardship. The Sourcery Data Stewardship Policy is designed to protect the integrity and privacy of your data specifically to preserve the lifetime royalty value for all Partners.

4.2 BlueBox. When you choose to monetize your data, it is aggregated and anonymized into non-fungible digital assets called BlueBox.

• Licensing: You license the data from your PDV to create the BlueBox.
• Royalties: When BlueBox are sold on the Sourcery Exchange, royalties are paid directly to your wallet in BluePoints (convertible to fiat currency).
• Control: Data is never sold without your permission (manifested through your acceptance of the User Agreement and participation in the Exchange).

To protect the value of the data marketplace and maintain security:

5.1 Restriction. Data captured by the Connect Platform may not be used by any Partner or shared with other Commercial Partners or third parties outside of the Connect Platform ecosystem without explicit written consent from both:

• Sourcery; and
• The Data Subject/Owner (You).

5.2 Exception for Trade Disputes (Trust Line). While Sourcery cannot access your data by default, you may grant “View Only” access to specific Sourcery Engagement team members for the sole purpose of resolving trade disputes. This permission must be explicitly granted by you following a formal request via the Trust Line and is revoked immediately upon resolution.

6.1 Immutable Record. To ensure trust and verify provenance, data hashes (fingerprints of your data) are recorded on a distributed ledger (blockchain).

6.2 No Deletion of History. While you own your data, you acknowledge that blockchain records are immutable. Once written, they cannot be altered or deleted.

6.3 Effect of Deactivation. If you leave Sourcery:

• We sever the link between your personal identity and the blockchain record (pseudonymization).
• The historic ledger entry remains to prove the validity of past trades, but it can no longer be associated with you personally or accessed for new commercial purposes.

7.1 Auditing. To validate your data for BlueBox creation, you may grant temporary access to approved Impact Partners (auditors/verifiers) who will have access to the data only via Sourcery Impact Partner portal.

7.2 Limited Scope. These partners are granted access only to verify specific data points. They do not acquire ownership of your data, and their access is revoked once the verification is complete, subject to audit record retention laws in the country where the data is originated and stored.

8.1 Strict Prohibition on Reuse. Any third-party partners connecting via API or other integration methods are strictly forbidden from using any data transmitted into their systems for marketing, resale, data mining, or any commercial purpose other than the specific service functionality authorized by you.

8.2 DPA and Monitoring. Prior to connecting any third-party system, Sourcery executes a specific Data Processing Addendum (DPA) with the partner. We actively monitor the use of data by these partners through metadata analysis, digital signature verification, system tracking, and manual observation by our Data Integrity Teams.

8.3 Liability and Restitution. Third-party partners remain legally liable for any unauthorized use, leakage, or commercialization of your data.

• Penalties: Partners are required to pay fees and damages for verified unauthorized use.
• Distribution to Owners: These fees are enforced and collected by Sourcery and distributed to the affected Data Owners (You), less any reasonable legal and administration costs incurred by Sourcery to enforce the claim.

9.1 Encryption. All data stored in your PDV is secured using AES-256 bit encryption (Advanced Encryption Standard) at rest and in transit. Data transmitted between your device, the Platform, and our APIs is protected via TLS 1.3 (Transport Layer Security) protocols to ensure integrity and confidentiality during transit.

9.2 Access Control. Access to your PDV and sensitive functionality requires strong authentication linked to your Sourcery ID identity, utilizing cryptographic signatures and, where supported, biometric verification on your trusted device. Sourcery itself cannot access the data in your PDV.

9.3 Standards Alignment. The Sourcery Connect Platform infrastructure is designed in alignment with ISO/IEC 27001 information security standards and NIST cybersecurity frameworks to ensure the highest level of protection for your digital assets.

If you have any questions about this Data Stewardship Policy (DSA), You can contact us:

• By email: legal@thesourcery.io
• By visiting this page on our website: https://www.thesourcery.io/contact