3. Categories of Personal Information We Collect

Depending on how you interact with us, we may collect the following categories of personal information.

A. Identifiers and Contact Information

We may collect:

• full name

• email address

• phone number

• mailing address

• date of birth

• username and account credentials

• government-issued identification numbers, where legally permitted or required

• tax identification number, Social Security number, or similar identifiers, where applicable and legally permitted

B. Financial and Account Information

We may collect:

• bank account details

• payment card details

• transaction history

• account balances and financial activity

• billing and payment records

• information relating to assets, liabilities, income, and financial goals

• information needed to provide lending, payment, investment, insurance, advisory, or other financial services

C. Identity Verification / KYC Information

To comply with legal and regulatory obligations, we may collect and/or verify:

• government-issued ID details

• copies or images of identification documents

• proof of address

• selfie or biometric comparison data, if used through an identity verification provider and permitted by law

• sanctions, politically exposed person (PEP), watchlist, and adverse media screening results

• beneficial ownership or control information for business accounts

D. Commercial and Service Usage Information

We may collect:

• products or services you have viewed, requested, or used

• account preferences and settings

• communications regarding applications, transactions, or customer support

• survey responses and feedback

• records of your interactions with us

E. Device, Internet, and Technical Information

When you use our Services, we may automatically collect:

• IP address

• browser type and version

• device type and operating system

• mobile device identifiers

• approximate geolocation derived from IP address

• pages viewed, clicks, session activity, referring URLs, and timestamps

• log files, crash reports, and performance diagnostics

F. Communications and Support Information

If you contact us, we may collect:

• the content of emails, chats, support tickets, and phone call notes

• call recordings, where permitted by law and with any required notice

• attachments and documents you provide to us

G. Marketing and Preference Information

We may collect:

• your marketing preferences

• subscription preferences

• responses to promotional campaigns

• information about how you engage with our emails, advertisements, or website content

H. Sensitive Personal Information

Depending on the nature of our services and applicable law, we may collect sensitive personal information, such as:

• Social Security number or government ID number

• financial account credentials or access information

• precise identity verification data

• information required for fraud prevention, legal compliance, or underwriting

We only use sensitive personal information as reasonably necessary to provide services, comply with law, protect against fraud and security threats, or for other purposes permitted by applicable law.

4. Sources of Personal Information

We collect personal information from the following sources:

A. Directly From You

We collect information you provide when you:

• fill out forms on our website

• create an account

• apply for financial products or services

• connect bank accounts or payment methods

• upload identity or verification documents

• communicate with us or customer support

• participate in surveys, promotions, or events

B. Automatically Through Your Use of the Services

We collect information automatically through cookies, pixels, SDKs, server logs, analytics tools, and similar technologies when you browse or use our Services.

C. From Financial Institutions and Payment Networks

Where relevant to the services we offer, we may receive information from:

• banks and financial institutions

• payment processors

• card networks

• account aggregation providers

• custodians, brokerages, lenders, or insurance partners

D. From Identity, Fraud, and Compliance Providers

We may obtain information from service providers and databases used for:

• identity verification

• fraud prevention

• anti-money laundering screening

• sanctions screening

• authentication and risk scoring

E. From Business Partners and Service Providers

We may receive information from vendors and partners that support our operations, including:

• CRM and marketing platforms

• analytics providers

• customer support vendors

• hosting and cloud providers

• document processing vendors

F. From Publicly Available Sources and Other Third Parties

We may receive information from public databases, public registries, social media or professional platforms (where relevant), credit bureaus, and other third parties as permitted by law.

5. How We Use Personal Information

We may use personal information for the following purposes:

A. To Provide and Operate the Services

We use information to:

• create and manage your account

• process applications, transactions, and payments

• provide financial products and services

• verify your identity and eligibility

• deliver account-related communications

• maintain customer records and preferences

B. To Perform Identity Verification, Fraud Prevention, and Security Monitoring

We use information to:

• verify your identity

• detect and prevent fraud, money laundering, account takeover, and other suspicious activity

• authenticate logins and transactions

• secure our systems, users, and infrastructure

• investigate incidents and enforce our policies

C. To Comply With Legal, Regulatory, and Compliance Obligations

We use information to:

• comply with financial, tax, anti-money laundering, know-your-customer, sanctions, and consumer protection laws

• respond to lawful requests from courts, regulators, law enforcement, or government agencies

• maintain records required by law

• conduct audits and regulatory reporting

D. To Improve and Personalize the Services

We use information to:

• analyze user behavior and service usage

• improve website functionality and user experience

• develop new features, products, and services

• personalize content, recommendations, and service offerings

E. To Communicate With You

We use information to:

• respond to inquiries and support requests

• send service notices, confirmations, alerts, and updates

• notify you about changes to our terms, services, or policies

• provide educational content, product updates, and marketing communications where permitted by law

F. For Internal Business Operations

We use information to:

• administer and manage our business

• perform accounting, reconciliation, forecasting, and reporting

• maintain quality assurance and training

• support dispute resolution and legal defense

G. For Corporate Transactions

We may use and disclose personal information as part of an actual or proposed merger, acquisition, financing, reorganization, bankruptcy, sale of company assets, or similar corporate transaction.

6. Legal Bases for Processing (If Applicable)

If you are located in a jurisdiction that requires a legal basis for processing personal information, such as the European Economic Area, United Kingdom, or similar jurisdictions, we may process your personal information based on one or more of the following legal bases:

• Performance of a contract: to provide the Services you request, maintain your account, and fulfill our obligations to you.

• Legal obligation: to comply with applicable financial, tax, anti-money laundering, fraud prevention, and other legal obligations.

• Legitimate interests: to secure our Services, improve our products, prevent fraud, administer our business, and communicate with users, provided those interests are not overridden by your rights.

• Consent: where required by law, including for certain marketing communications or certain cookies/tracking technologies.

• Establishment, exercise, or defense of legal claims: where necessary to protect legal rights.

7. Cookies and Tracking Technologies

We and our service providers may use cookies, web beacons, pixels, local storage, SDKs, and similar technologies to collect information about your use of the Services.

A. Types of Cookies and Technologies We Use

These may include:

• Strictly necessary cookies used for authentication, security, and core website functionality

• Performance and analytics cookies used to understand how users interact with the Services

• Functional cookies used to remember settings and preferences

• Advertising or targeting cookies used to measure campaigns or deliver more relevant ads, if applicable

B. Purposes of Cookies

We may use cookies and similar technologies to:

• keep you signed in

• remember preferences

• detect fraud and security incidents

• understand traffic and usage patterns

• improve performance and usability

• measure marketing effectiveness

• support personalization

C. Your Choices

Depending on your location, you may be able to manage cookies through:

• our cookie banner or preference center

• your browser settings

• device-level settings

• opt-out mechanisms offered by analytics or advertising providers

Please note that disabling certain cookies may affect the functionality of the Services.

8. How We Disclose Personal Information

We may disclose personal information to the following categories of recipients, subject to applicable law and contractual restrictions:

A. Service Providers and Vendors

We may disclose information to vendors who perform services on our behalf, such as:

• cloud hosting and infrastructure providers

• payment processors

• identity verification providers

• fraud prevention and security vendors

• CRM, marketing, and communications vendors

• analytics and product performance providers

• customer support providers

• document storage and e-signature vendors

• professional advisors, auditors, and consultants

These providers are generally authorized to use personal information only as necessary to provide services to us or as otherwise permitted by law.

B. Financial Institutions and Financial Ecosystem Partners

Where relevant to the Services, we may disclose information to:

• banks and custodians

• lenders

• payment processors and card networks

• broker-dealers, investment platforms, or insurance partners

• account aggregation or open banking providers

• settlement, clearing, and compliance counterparties

C. Affiliates and Corporate Family

We may share information with our parents, subsidiaries, and affiliates for purposes consistent with this Privacy Policy, including business operations, compliance, fraud prevention, and service delivery.

D. Government, Regulators, Law Enforcement, and Legal Process

We may disclose information where we believe it is necessary to:

• comply with law, regulation, subpoena, court order, or lawful request;

• respond to regulators, supervisory authorities, tax authorities, or law enforcement;

• enforce our terms, agreements, or policies;

• protect the rights, safety, property, or security of our Company, users, or others.

E. Corporate Transactions

We may disclose information in connection with an actual or proposed merger, acquisition, financing, due diligence process, reorganization, receivership, sale of assets, or bankruptcy proceeding.

F. With Your Consent or at Your Direction

We may disclose personal information to third parties when you instruct us to do so or otherwise consent.

9. “Sale,” “Sharing,” and Targeted Advertising Disclosures

Depending on applicable law, certain disclosures of personal information for advertising, analytics, or cross-context behavioral advertising may be considered a “sale,” “sharing,” or targeted advertising.

If we engage in these practices, we will provide any legally required notices and rights, including any required “Do Not Sell or Share My Personal Information” or targeted advertising opt-out mechanisms.

If we do not sell or share personal information in a manner defined by applicable law, insert the following instead:

We do not sell your personal information for monetary consideration. We may disclose certain information to service providers, analytics providers, or partners as described in this Privacy Policy. Where required by law, we will honor applicable opt-out rights relating to targeted advertising or similar disclosures.

10. Data Retention

We retain personal information for as long as reasonably necessary for the purposes described in this Privacy Policy, including to:

• provide the Services;

• maintain your account;

• comply with legal, tax, accounting, audit, and regulatory obligations;

• investigate disputes or incidents;

• enforce our agreements; and

• protect our legitimate business interests.

Retention periods may vary depending on the type of information and legal requirements. For example, financial services providers may be required to retain certain records for several years under applicable banking, payments, securities, anti-money laundering, or tax laws.

When personal information is no longer needed, we will delete, anonymize, or securely dispose of it in accordance with applicable law and our retention policies.

11. Data Security

We implement administrative, technical, and physical safeguards designed to protect personal information from unauthorized access, loss, misuse, alteration, or disclosure. These measures may include, as appropriate:

• encryption in transit and at rest

• access controls and authentication safeguards

• logging and monitoring

• network and endpoint protections

• vendor due diligence and contractual safeguards

• employee training and confidentiality obligations

• incident response procedures

However, no method of transmission over the internet or method of storage is completely secure, and we cannot guarantee absolute security.

12. Children’s Privacy

Our Services are not directed to children under the age of 13, and we do not knowingly collect personal information from children under 13 through the Services unless expressly permitted by law and clearly disclosed for a specific product or service.

If you believe a child has provided personal information to us in violation of this section, please contact us so we can investigate and take appropriate action.

If your services are not intended for anyone under 18, you may add:

Our Services are intended only for individuals who are at least 18 years old, unless otherwise expressly stated in connection with a specific product or service.

13. Your Privacy Rights

Depending on your location and applicable law, you may have certain rights regarding your personal information. These may include the right to:

• know whether we process your personal information;

• access or obtain a copy of your personal information;

• correct inaccurate personal information;

• delete certain personal information, subject to legal exceptions;

• object to or restrict certain processing;

• withdraw consent where processing is based on consent;

• opt out of targeted advertising, profiling, or certain sharing activities;

• request data portability, where applicable;

• appeal a denial of a privacy request, where required by law.

A. Exercising Your Rights

To exercise your privacy rights, please contact us using the contact details below or submit a request through [privacy request portal URL].

We may need to verify your identity before processing your request. We may also deny or limit requests where permitted by law, including where an exemption applies or where we are required to retain information for legal, security, fraud prevention, or compliance purposes.

B. Authorized Agents

If permitted by law, you may designate an authorized agent to make certain requests on your behalf. We may require proof of the agent’s authority and may still need to verify your identity directly.

C. Non-Discrimination

We will not discriminate against you for exercising privacy rights afforded to you under applicable law, subject to lawful limitations.

14. California Privacy Notice

This section applies to California residents to the extent required by the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA”).

A. Categories of Personal Information Collected

In the preceding 12 months, we may have collected the following categories of personal information:

• identifiers

• personal information described in Cal. Civ. Code § 1798.80

• commercial information

• internet or other electronic network activity information

• geolocation data

• audio, electronic, visual, or similar information

• professional or employment-related information, if relevant

• inferences drawn from personal information

• sensitive personal information, including financial account information and government identifiers, where applicable

B. Categories of Sources

We collect personal information from:

• you directly

• your devices and interactions with our Services

• service providers and vendors

• financial institutions and transaction counterparties

• fraud, identity verification, and compliance providers

• public or governmental sources

• marketing and business partners

C. Business or Commercial Purposes

We collect and use personal information for the purposes described in this Privacy Policy, including:

• providing and improving Services

• account administration

• fraud prevention and security

• regulatory compliance

• customer support

• analytics and internal operations

• marketing and communications, where permitted by law

D. Categories of Personal Information Disclosed

We may disclose the categories of personal information listed above to the categories of recipients described in Section 8 of this Privacy Policy.

E. Sensitive Personal Information

We use sensitive personal information only for purposes permitted by applicable law, including providing requested services, verifying identity, fraud prevention, security, legal compliance, and other operational purposes authorized by law.

F. California Rights

California residents may have the right to:

• know the categories and specific pieces of personal information we collect, use, disclose, sell, or share;

• request deletion of personal information;

• request correction of inaccurate personal information;

• limit the use of sensitive personal information, where applicable;

• opt out of sale or sharing of personal information, where applicable.

To exercise these rights, contact us at [privacy email] or use [request portal URL].

15. State Privacy Disclosures for Other U.S. Residents

Residents of certain U.S. states may have privacy rights under applicable state law, including rights to access, correct, delete, obtain copies of personal data, or opt out of certain processing such as targeted advertising, profiling, or sale of personal data.

To exercise applicable rights, please contact us at [privacy email] or use [request portal URL].

If you are denied a request, and your state law provides an appeal right, you may submit an appeal by contacting us at [appeals email or privacy email] with the subject line: “Privacy Rights Appeal.”

16. International Transfers

If you access our Services from outside the country where our servers or operations are located, your personal information may be transferred to, stored in, and processed in countries other than your own, which may have different data protection laws.

Where required by law, we will implement appropriate safeguards for cross-border transfers of personal information, such as contractual protections or other lawful transfer mechanisms.

17. Third-Party Websites and Services

Our Services may contain links to third-party websites, applications, or services. This Privacy Policy does not apply to the privacy practices of third parties that we do not own or control. We encourage you to review the privacy policies of those third parties before providing them with personal information.

18. Email and Marketing Communications

If you opt in to receive marketing emails, newsletters, or promotional communications from us, we may use your contact information to send those communications. 

We do not share mobile contact information with third parties or affiliates for marketing or promotional purposes. Information may be shared with subcontractors in support services, such as customer service. All other categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

You may opt out of marketing emails by using the unsubscribe link in the email or contacting us. You may opt out of SMS messages by replying “STOP” where applicable. Even if you opt out of marketing messages, we may still send you transactional or service-related communications, such as account notices, security alerts, and updates related to your use of the Services.

19. Notice Regarding Financial Privacy / GLBA

If we are subject to the Gramm-Leach-Bliley Act (“GLBA”) or similar financial privacy laws, certain personal information we collect in connection with providing financial products or services may be treated as nonpublic personal information and may be subject to separate privacy notices or disclosures required by applicable financial laws.

If applicable, our GLBA privacy notice, customer financial privacy notice, or other sector-specific disclosures may supplement this Privacy Policy.

20. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our business practices, legal requirements, technologies, or services. When we do, we will update the “Last Updated” date at the top of this Privacy Policy and take any additional steps required by law.

Your continued use of the Services after an updated Privacy Policy becomes effective means that the updated policy will apply to your interactions with us, to the extent permitted by law.

21. Contact Us

If you have questions about this Privacy Policy or our privacy practices, or if you would like to exercise your privacy rights, please contact us at:

[Company Legal Name]
Attn: Privacy Team / Data Protection Officer
Email: [privacy@yourcompany.com]
Mailing Address: [Company Address]
Phone: [Phone Number]
Privacy Request Portal: [URL]

If applicable, you may also include:

EU/UK Representative or Data Protection Contact:
[Representative Name / Contact Information]

Optional Add-On: Short Website Summary

If you want a shorter summary for use in a footer or account onboarding flow, you can add:

We collect personal information to provide our financial services, verify identity, prevent fraud, process transactions, comply with law, improve our platform, and communicate with you. We may share information with service providers, financial partners, compliance vendors, and authorities as required by law. Depending on your location, you may have rights to access, correct, delete, or opt out of certain data practices. Please review this Privacy Policy for full details.

Company-Specific Fields to Fill In Before Publishing

Before using this policy, replace the placeholders and confirm the following:

1. Company legal name and contact information

2. Website URL and privacy request contact

3. Type of financial service offered
   Examples: lending, payments, fintech SaaS, investing, insurance, bookkeeping, tax support, credit repair, personal finance tools, etc.

4. Jurisdictions served
   U.S. only, California residents, EU/UK users, Canada, etc.

5. Whether you are subject to GLBA, state lending laws, money transmitter rules, SEC/FINRA rules, insurance privacy rules, etc.

6. Whether you collect:

    

    

   • SSNs / tax IDs

   • driver’s licenses / passports

   • bank account credentials

   • transaction histories

   • biometric/selfie verification data

7. Your third-party vendors / categories of vendors

    

    

   • payment processor

   • cloud host

   • CRM/email provider

   • analytics tools

   • fraud / KYC vendors

   • customer support tools

8. Cookie / advertising practices

    

    

   • Google Analytics

   • Meta Pixel

   • retargeting / ad platforms

   • cookie banner / preference manager

9. Retention periods

10. User rights workflow

• privacy request email

• online request form

• appeals process if needed

1. Whether you need a separate financial privacy notice under GLBA or other sector-specific law