Privacy Policy.
Engineered for digital and physical sovereignty.

This Privacy Policy governs the collection, processing, storage, and protection of personal data by Clover Technologies, operating as a trading division of Power Global Limited, a company registered in the United Kingdom ("Clover", "Power Global", "we", "us", or "our"). Clover Technologies forms part of the wider Power Global clean-energy and smart-infrastructure ecosystem alongside power.green.

This Policy applies whenever you access or interact with:

• Our official web properties, including www.clover.energy and all associated pages, digital configurators ("Atelier"), and interactive OS demonstrations (collectively, the "Website");
• Our Clover Raven Genesis reservation and statutory escrow workflows (/buynow.html), whether settled in Pounds Sterling (GBP) via Stripe or on-chain via ENERG smart-contract escrow;
• Our ENERG thermodynamic utility allocation portal (/energ.html) and associated ecosystem wallet-linking services; and
• Direct institutional, media, White Paper, or customer concierge correspondence with our team.

For the purposes of the United Kingdom General Data Protection Regulation ("UK GDPR"), the UK Data Protection Act 2018 ("DPA 2018"), the Privacy and Electronic Communications Regulations 2003 ("PECR"), and, where applicable to residents of the European Economic Area, the European Union General Data Protection Regulation (Regulation (EU) 2016/679, "EU GDPR"), Power Global Limited (trading as Clover Technologies) is the Data Controller of the personal data described in this Policy.

We practise strict data minimisation: we collect only the information reasonably necessary to deliver the specific service or interaction you initiate. Depending on how you engage with Clover, we may collect and process the following categories of data:

Because Clover engineers intelligent hydrogen-electric vehicles equipped with cabin sensors and Vehicle-to-Grid (V2G) hardware, we maintain a strict architectural separation between Website Personal Data (governed by this Policy today) and Production Vehicle Telemetry (governed by our Three-Zone Hardware Privacy Architecture upon vehicle delivery):

• Zone 01 — Air-Gapped Local Silicon Enclave: Inside production Clover Raven vehicles, cabin acoustics, occupant posture, biometric comfort adaptation, and local Muse (Meta AI) prompts execute exclusively inside volatile memory across onboard Terafab AI5/AI6, AMD Versal, or NVIDIA DRIVE Thor silicon inside the vehicle's hardware-encrypted enclave. Zero bytes of raw cabin audio, video, or biometric inference leave the vehicle unless an owner explicitly initiates an external share.
• Zone 02 — Blind-Routed Edge Synthesis: Where external spatial navigation, weather corridor forecasting, or frontier model queries traverse the AWS AI Quantum Gateway, hardware middleware strips Vehicle Identification Numbers (VINs), owner account tokens, and origin/destination GPS coordinates prior to encrypted relay.
• Zone 03 — Zero-Knowledge Energy Settlement (ZK-PoT): When a Raven exports clean power via 22 kW V2G or exchanges canisters at a 700-Bar HCS lounge, 50-millisecond inverter telemetry is aggregated locally into a succinct Zero-Knowledge Proof of Transfer (π_ZK-PoT), verifying kilowatt-hour integrity on-chain without exposing when or where an owner parks their vehicle.

Note that interactive AI prompts, V2G dials, and HCS swap scrubbers displayed on clover.energy today run purely as client-side browser demonstrations and do not record biometric data or connect to physical grid inverters.

Under Article 6(1) of the UK GDPR and EU GDPR, we process personal data only where a valid lawful basis applies. Below is our transparent mapping of processing activities and corresponding legal bases:

When you place a £3,000.00 GBP reservation deposit for a Clover Raven or purchase an ENERG allocation in fiat currency, payment processing is handled by Stripe Payments UK, Ltd. and/or Stripe, Inc. ("Stripe") on behalf of Power Global Limited as Merchant of Record.

• Zero Raw Card Handling: Payment inputs are rendered inside Stripe's isolated, PCI-DSS Level 1 certified iframe/checkout environment. Clover never receives, views, logs, or stores your full 16-digit card number, expiration date, CVV/CVC code, or Apple Pay / Google Pay cryptographic cryptograms.
• Metadata Attached to Payment Records: To ensure unambiguous traceability of your segregated refundable deposit, we transmit structured reservation metadata to Stripe (including your name, email address, phone number, selected Raven trim, delivery region, and provisional Genesis ENERG bonus reference).
• Client-Side PDF Certificate Generation: When you download your official Escrow Certificate after reservation verification, the PDF document is assembled directly inside your browser using verified session parameters so you retain an immediate offline cryptographic receipt.

For full details on how Stripe processes payment data and conducts statutory anti-fraud screening, please consult Stripe's Privacy Policy at stripe.com/gb/privacy.

Interacting with Web3 wallets and decentralized physical infrastructure networks (DePIN) involves unique technical data properties that differ from traditional web databases:

6.1 Client-Side Non-Custodial Wallet Generation

If you choose the "Create a New ENERG Wallet" option during an ENERG allocation flow on /energ.html, cryptographic keypairs and 12-word BIP-39 mnemonic recovery phrases are generated locally in your device's volatile memory using standard client-side cryptography (ethers.js / Web Crypto API). Only your public wallet address (0x...) is transmitted to our API to credit your ENERG allocation. Your private key and recovery phrase are never sent to, logged by, or recoverable by Clover Technologies or Power Global Limited.

6.2 Power Global Ecosystem Synchronization

When you complete an ENERG allocation, our backend records your normalized email address, public wallet address, allocation tier, ENERG quantity, and Stripe Payment Intent reference in our encrypted database infrastructure so your clean-energy balance can be recognised seamlessly across Clover and the Power Global platform (power.green). If an existing Power profile matches your email address and has no wallet linked yet, we automatically associate your public wallet address with your profile for unified access.

6.3 Public Blockchain Immutability Notice

If you interact directly with public smart contracts (such as locking or refunding 20,000 ENERG in CloverReservationEscrow.sol or transferring tokens on an EVM/ENERG network), your public wallet address, transaction value, block timestamp, and smart-contract call parameters are permanently broadcast to decentralized validator nodes worldwide. Because public blockchains are append-only and cryptographically immutable by design, neither Clover nor any third party can edit, redact, or erase historical on-chain records. Accordingly, exercising erasure rights under data protection law applies only to off-chain records held within Clover and Power Global databases, and cannot alter public ledger state.

Clover maintains an intentionally clean, low-footprint browser environment. We do not deploy third-party advertising trackers, behavioral retargeting pixels, social-media tracking beacons, or cross-site fingerprinting scripts.

We use strictly necessary cookies and HTML5 browser storage solely where essential to deliver secure site functionality:

• Payment Security & Fraud Prevention Cookies (Strictly Necessary): When you open the reservation checkout or ENERG payment modal, Stripe sets essential security cookies (such as __stripe_mid and __stripe_sid) to detect fraudulent card testing, enforce Strong Customer Authentication (3D Secure), and maintain checkout session continuity.
• Ephemeral Browser Session State: Temporary UI selections (such as your selected Clover Raven specification in URL query parameters or active checkout verification state) may be held transiently in browser memory or session storage so your configuration is preserved if 3D Secure redirects you back to /buynow.html.
• Web Typography Delivery: Our pages load open-source typefaces (Outfit, Plus Jakarta Sans, Inter, and Roboto Mono) via Google Fonts (fonts.googleapis.com and fonts.gstatic.com), which receives standard HTTP font-fetch headers without setting tracking cookies.

You can configure your web browser at any time to block or clear cookies and local storage; however, blocking strictly necessary Stripe security cookies may prevent fiat payment transactions from completing.

We disclose personal data only to vetted corporate affiliates and infrastructure sub-processors bound by written data processing agreements, confidentiality obligations, and strict security standards:

• Power Global Limited (Corporate Group): As Clover Technologies trades under Power Global Limited, administrative, treasury, statutory escrow custody, customer concierge, and ecosystem wallet synchronization functions are operated jointly with Power Global Limited.
• Stripe (Payment Infrastructure): Processes GBP reservation deposits, ENERG fiat allocations, 3D Secure verification, and instant card refunds.
• Supabase, Inc. (Encrypted Database Infrastructure): Hosts encrypted relational tables storing ENERG allocation records and ecosystem profile wallet links, protected by row-level security and server-side service-role isolation.
• Vercel Inc. (Cloud Edge & Serverless Hosting): Delivers static web assets over HTTPS/TLS and executes stateless API functions for checkout session creation and verification.
• Professional Advisers, Auditors & Authorities: Shared strictly where necessary with legal counsel, statutory auditors, banking custodians, HM Revenue & Customs (HMRC), law enforcement, or judicial authorities to comply with applicable UK or international law, enforce our Terms and Conditions, or protect the safety and rights of reservation holders.
• Corporate Restructuring: In connection with any corporate financing, merger, spin-out of Clover Technologies into a standalone subsidiary, or reorganisation within the Power Global group, subject to equivalent privacy protections and notice where required by law.

Power Global Limited is headquartered in the United Kingdom, while certain cloud infrastructure and payment sub-processors (including Vercel, Supabase, and Stripe) may process or replicate encrypted data across data centres located in the United Kingdom, the European Economic Area (EEA), and the United States.

Whenever personal data is transferred outside the United Kingdom or the EEA to a jurisdiction not covered by a full adequacy decision, we ensure appropriate statutory safeguards are in place prior to transfer, including:

• Reliance on UK Adequacy Regulations, including the UK Extension to the EU–US Data Privacy Framework (UK–US Data Bridge) for certified US recipients;
• Execution of the UK Information Commissioner's International Data Transfer Agreement (IDTA) or the UK International Data Transfer Addendum to the European Commission's Standard Contractual Clauses (SCCs); and
• Supplementary technical safeguards, including TLS 1.3 encryption in transit, AES-256 encryption at rest, and strict least-privilege credential scoping.

We implement layered technical and organisational security measures proportionate to the sensitivity of the operations we support:

• End-to-End Transport Security: All Website traffic and API payloads are enforced over HTTPS using modern TLS 1.2/1.3 cipher suites.
• Serverless Secret Isolation: Stripe secret keys and database administrative credentials reside exclusively inside encrypted server-side environment variables and are never exposed in client-side JavaScript bundles.
• Segregated Payment Tokenization: Financial credentials are isolated within Stripe's PCI-DSS Level 1 certified vault.
• Access Governance: Production administrative dashboards require multi-factor authentication (MFA) and role-based access restricted to authorised Power Global / Clover personnel with a demonstrable operational need.

While no internet transmission can be guaranteed to be 100% immune to sophisticated cyber threats, we maintain incident-response procedures to investigate, mitigate, and—where required under Articles 33 and 34 of the UK/EU GDPR—notify the UK Information Commissioner's Office (within 72 hours) and affected individuals of any qualifying personal data breach.

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including satisfying statutory financial, accounting, tax, or legal reporting requirements:

• Clover Raven Reservation & Escrow Records: Retained throughout the life of your active Genesis reservation until final vehicle delivery or deposit refund, plus seven (7) years thereafter in accordance with UK statutory corporate accounting and HMRC tax record-keeping mandates (Companies Act 2006).
• ENERG Allocation & Wallet-Linking Records: Retained for so long as your ecosystem profile or wallet allocation remains active across Clover / Power Global, plus statutory financial retention periods (typically 6–7 years from transaction date) for fiat payment auditability.
• White Paper Requests & Concierge Correspondence: Retained for up to twenty-four (24) months following resolution of your inquiry, unless linked to an active reservation or institutional partnership.
• Edge Server & API Security Logs: Automatically rotated and purged within thirty (30) to ninety (90) days unless flagged for an active security or fraud investigation.

Under the UK GDPR, EU GDPR, and comparable global privacy statutes, you enjoy comprehensive rights over your personal data:

• Right of Access (Subject Access Request): Obtain confirmation of whether we process your personal data and receive a structured copy of that data.
• Right to Rectification: Request prompt correction of inaccurate or incomplete personal data (for example, updating the contact email or phone number tied to your Genesis build slot).
• Right to Erasure ("Right to be Forgotten"): Request deletion of your off-chain personal data where it is no longer needed for its original purpose, subject to mandatory statutory accounting/tax retention obligations and the technical immutability of public blockchains noted in Clause 6.3.
• Right to Restrict Processing: Ask us to suspend processing of your data while accuracy or lawful grounds are verified.
• Right to Data Portability: Receive personal data you provided to us in a structured, commonly used, machine-readable format (such as JSON or CSV) and transmit it to another controller where technically feasible.
• Right to Object: Object at any time to processing conducted under our legitimate interests (Art. 6(1)(f)) or to any direct marketing communications.
• Right to Withdraw Consent: Where processing relies on consent, withdraw that consent at any time without affecting the lawfulness of prior processing.
• Human Review of Automated Decisions: Clover does not subject Website visitors to solely automated profiling or decision-making that produces legal or similarly significant effects under Article 22 UK/EU GDPR.

How to Exercise Your Rights: Submit your request to privacy@clover.energy or contact@clover.energy. You will not pay a fee to access your personal data unless a request is manifestly unfounded or repetitive. To protect reservation and wallet holders against social engineering, we may request reasonable verification of your identity (such as confirming control of the registered email address or Payment Intent reference) before fulfilling a request. We respond to all verified requests within one (1) calendar month.

13.1 Children's Privacy (18+ Only)

Our Website, Clover Raven vehicle reservations, and ENERG allocations are designed strictly for adults aged 18 years and older. We do not knowingly solicit or collect personal data from anyone under the age of 18. If we learn that personal data from a minor has been inadvertently submitted, we will promptly delete such information and reverse any unauthorised deposit.

13.2 External Websites & Exit Notifications

Our Website contains links to external platforms, including our parent brand site (www.power.green), third-party Web3 wallet extensions, and payment processors. Where appropriate (such as clicking "Team" in our footer), we display an explicit exit modal informing you before you leave clover.energy. External websites operate under their own privacy policies, which we encourage you to review.

13.3 Changes to This Privacy Policy

We may revise this Privacy Policy periodically to reflect new vehicle connectivity features, ENERG mainnet milestones, or legislative updates. Whenever we publish changes, we will update the "Effective Date" and version number at the top of this page. Where changes materially affect how we handle data of active Genesis reservation holders, we will provide prominent notice via email or on the Website.

If you have any questions, concerns, or requests regarding this Privacy Policy, our data governance practices, or your statutory escrow records, please contact our Data Governance team directly:

Right to Lodge a Complaint: While we welcome the opportunity to resolve any privacy concern directly and swiftly with you first, you have the statutory right at any time to lodge a complaint with the United Kingdom's supervisory authority for data protection—the Information Commissioner's Office (ICO) at www.ico.org.uk (Telephone: +44 (0)303 123 1113)—or, if you reside in the EEA, with the data protection supervisory authority in the Member State of your habitual residence or place of work.