Privacy Policy

This Policy describes how Lithic, Inc., doing business as Privacy.com, protects and manages your personal data, including:

• What data we collect when you sign-up for, use, or engage with any of our applications, products, services or websites (collectively, "Services")
• How we manage data from the beginning of your engagement forward
• The choices you have regarding how data is managed

This Policy applies to information we collect in connection with your access and use of our Services. Please read this Policy carefully. By continuing to use or access our Services, you are consenting to the practices described in this Policy.

Our Commitment to User Privacy

We collect and use the minimum amount of your data necessary in order to stay in compliance with bank and payment card industry requirements, and to ensure the best possible experience with our Services. We do not sell user information for advertising or marketing purposes.

We Limit Use of Your Personal Data to:

• Verifying your identity
• Protecting the legal rights, property and safety of our Services and users
• Providing, maintaining and improving our Services
• Sharing personal data with a merchant with whom you open a Payment Dispute for a transaction

We Collect and Use Data:

• Provided by you to verify your identity and eligibility:
  • Your name, email address, phone number, birth date
  • Government-issued identification number
  • Payment card and bank information
  • Other information you may be asked to provide when signing-up for an account, providing identity verification, or engaging in a transaction
• For anti-fraud and payment protection purposes:
  • Transaction Data: when, where and how a transaction takes place including, but not limited to, the devices and payment methods used
  • Device Data: hardware model, operating system, unique device identifiers, mobile network data, browser type, and Internet Protocol (”IP”) address

• To improve your experience with our Services:
  • Cookies: small data files we may store on your computer or mobile device memory to help us manage your engagement with our Services (discussed below)
• Collected from third-party sources to help us verify your identity, prevent fraud or assess risk. We collect (and/or have collected during at least the 12-month period preceding the effective date of this Policy) information about you from the following categories of sources:
  • Third-party identity verification services and publicly available sources, including your government-issued identification number.
  • Third-party sources related to any investigation, eligibility, identity or account verification process, fraud detection process, or collection procedure, or as may otherwise be required by applicable law. This includes, without limitation, the receipt and exchange of account or transaction-related information with any consumer reporting agency.

We Share Personal Information Under Controlled Circumstances Only:

• With third parties who may access data about you to provide you with the Services
• With third parties who may access data about you to perform functions on our behalf
• With financial institutions, processors, payment card associations and other entities that are involved in the payment process
• With government and law enforcement where reasonably necessary to protect user or public safety or comply with applicable law, regulation, legal process, governmental request
• With others where reasonably necessary to protect the security or integrity of our Services or user safety
• In connection with, or during the negotiation of, any merger, sale of company stock or assets, financing, acquisition, divestiture or dissolution of all or a portion of our business, or
• With your consent

We may share aggregated and anonymized information that does not specifically identify you or any individual user of our Services.

Security

We are committed to protecting your personal data from loss, theft, misuse, unauthorized access, disclosure, alteration and destruction. We undergo annual certifications to ensure our systems and operating processes are PCI (Payment Card Industry) and SOC 2 (Service Organization Control) compliant.

Our procedures prevent unauthorized access to your data by anyone, including our staff. We use leading technologies such as (but not limited to) data encryption, firewalls, and server authentication to protect the security of your data. We require multi-factor authentication for all users. Our staff, and third parties whenever we hire them to provide support services, are required to observe our privacy standards.

You Have Choices:

• Personal Data: You can change or correct data about yourself through your Privacy.com account at any time or by emailing us at support@privacy.com.
• Email and Text Communications: You can opt-out of email or text messages by following unsubscribe instructions in these messages. If you opt-out, we may still send you messages regarding transactions and services related to our ongoing business relationship.
• Notifications: Our Services may ask you for permission to send notifications to your device. Our services will still work if you do not grant us permission to send you notifications.
• Do Not Track: Some browsers support a “Do Not Track” feature, which is intended to be a signal to websites that you do not wish to be tracked across different websites you visit. Our Services do not currently change the way they operate based upon detection of a Do Not Track or similar signal.

Cookies

We and our partners use cookies or similar technologies to offer an enhanced experience and Services to users who wish to allow them. These technologies help us analyze trends, administer the website, track traffic, and gather information about users. For information on how to block cookies, see below.

We use cookies to track preferences and settings (e.g., so we can remember your preferences, like whether you’ve selected a “do not display banners” option), for sign in and authentication (e.g., so you don’t have to sign in each time you return to the site, or sign in again whenever you move to a new webpage), and for analytics purposes (e.g., to count page visitors or obtain statistics about our Services’ operations that help us improve our website and Services). We may use cookies from third-party providers.

How to Control Cookies

Some users wish to block cookies. Certain features of Privacy’s Services depend on cookies, so your experience may be negatively affected if cookies are disabled. Additionally, if you choose to delete cookies, settings and preferences controlled by those cookies, including advertising preferences, will be deleted and may need to be recreated.

However, we completely understand if you want to block cookies. At a high-level, here’s how you can:

• You can block cookies in your web browser. Your browser can also be set to alert you when cookies are placed on your device. Typically, browser cookie settings can be found in a browser’s settings. To find out how to specifically disable cookies in your browser, search for instructions in your browser’s help documentation.
• If you use Privacy’s Services on a mobile device, you can manage your device’s settings to limit the use of information shared for the purposes of advertising. Look in your device’s settings for “Limit Ad Tracking” (for iOS), “Opt out of Interest-Based Ads” (for Android), or similar controls.

To find out more about cookies, including how to see what cookies have been set and how to manage and delete them, visit www.aboutcookies.org or www.allaboutcookies.org.

Third-Party Websites

The Services contain hyperlinks to other websites or locations that we do not control and are operated and controlled by third parties (“Third-Party Websites”). Our Privacy Policy does not apply to these Third-Party Websites and we make no representations regarding the policies or business practices of any such Third-Party Websites.

We Retain Personal Data as Required by Law

When you close your account, financial regulations require us to retain certain information for at least a minimum time period that varies based on the information involved:

• Identity verification data: 5 years from the date of account closure
• Payment card data: 5 years from the date of account closure
• Funding bank account information: 6 years from the date of account closure
• Audit logs: 3 years from date of creation
• ACH transactions: 6 years from the date of an ACH entry

Changes to this Policy

• We can change this Policy. When the changes impact how we use your data in important ways, we’ll tell you first by email (if you’ve given us your email address).
• We may amend this Policy from time to time by posting a revised version and updating the “Effective Date” above. The revised version will be effective on the “Effective Date” listed. We will provide you with reasonable prior notice of material changes in how we use your information, including by email, if you have provided one. If you disagree with these changes, you may cancel your account at any time. If you keep using our Services, you consent to any amendment of this Policy.

Last updated: December 15, 2023