CONSUMERDIRECT, INC.
GLOBAL PRIVACY POLICY

INTRODUCTION

ConsumerDirect, Inc.^® ("ConsumerDirect" or "we" or "us") provides various products to enable consumers to educate themselves about and take control of their money, credit, and privacy. As a company focused on empowering consumers, we are dedicated to safeguarding your privacy and responsibly managing your personal information. This Global Privacy Policy outlines your privacy choices and rights and details how we collect, use, and disclose your personal information when you interact with one or more of our websites and mobile applications, including without limitation: SmartCredit^®, The Lending Score^®, and Hogo^®, and any products or services offered in connection therewith (each of the foregoing, a "Product" and collectively, the "Products").

By using any of our Products, you agree to our Terms of Use, any applicable Service Agreement, and to the terms of this Privacy Policy. Notwithstanding that the Product is provided by ConsumerDirect, you may have accessed the Product through the following third party, which has contracted with us for us to provide you with the Product: MyNovaeCredit operated by My Novae Credit (the "White Label Provider"). Although the Product may display the name of the White Label Provider, ConsumerDirect operates the Product and is responsible for the collection, use, and protection of personal information in connection with the Product as described in this Privacy Policy. To the extent that the White Label Provider receives your personal information from us or the Product, this Privacy Policy shall apply. However, please be aware that the White Label Provider may also independently collect your personal information through its own web pages or its own products or services that are not associated with our Product, and such personal information shall be governed by the White Label Provider's own privacy policies, and not this Privacy Policy. We are not responsible for the privacy practices of our partner with respect to any products or services they provide outside of our Products.

Below is a Table of Contents with a brief summary explaining the topics covered by each Section of this Privacy Policy. You may click on the links below to jump to any Section. You should read the entire Privacy Policy and should not rely on the following summaries. If you have any questions, please use our contact form by clicking on Contact Us in the Help Center on our website or in any of our Apps.

1. GENERAL APPLICABILITY OF PRIVACY POLICY

This Privacy Policy applies to (i) individuals who visit our website or download any of our Apps, even if they do not enroll in any Product, (ii) current and former users of our Products, and (iii) individuals acting on behalf of a business with which we interact.

This Privacy Policy applies only to your personal information (as defined in Section 3) that we collect and process. It does not apply to information collected by any third party. Some content linking to the Products, and some features accessible through the Products, are served by third parties, including advertisers, ad networks and servers, partners offering financial or other products or services, analytics companies, your device manufacturer, mobile or internet providers, and content and service providers. These third parties may use cookies alone or in conjunction with web beacons or other tracking technologies to collect your personal information in connection with your use of the Products. Without limiting the foregoing, such third parties may collect information, including personal information, about your online activities over time and across different websites and other online services. Such third parties may use this information to provide you with interest-based (cross-context behavioral) advertising or other targeted content. We do not control independent third-party tracking technologies or how they may collect or use your information. If you click on or otherwise interact with a third-party content, advertisement, or offer, the third party may assume that you meet its target criteria, and any information you share in connection with the advertisement or offer, and any information otherwise collected by such advertiser or partner in connection therewith, will be shared with or collected by such third party and will be governed by such third party's own privacy policy. You should consult with any such third party directly regarding their information collection and usage terms.

Third-party content may redirect you to another website or it may be displayed natively within the Product (e.g. through a widget or API). Third-party content can generally be identified by one or more of the following:

• It is provided under or in connection with a different company's branding;
• Links or interactions that redirect you to a website or service operated under a different domain or URL (website address);
• Embedded content or interactive features that are served from third-party systems or technologies;
• Disclosures, labels (such as "Sponsored" or "Advertisement"), or links to separate terms or privacy policies presented in connection with the content; or
• Requests for information that are not required to use our core Product.

2. PRODUCTS FOR ADULTS LOCATED IN THE UNITED STATES ONLY

The Products are not intended for persons under 18 years of age. We do not knowingly collect or process personal information of persons under the age of 18. If you are a parent or guardian and you believe we might have any personal information from or about your child, please contact us here.

Our Products are not intended for use or access by persons who are not located in the United States. You acknowledge that you may not be able to access the Products outside of the United States, and access thereto may not be legal in certain countries. If you access the Products from outside the United States in violation of this policy, you are responsible for compliance with local laws.

3. PERSONAL INFORMATION THAT WE COLLECT

Definition of Personal Information.

We collect and use information that identifies, relates to, describes, references, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household (" personal information "). Personal information does not include:

• Publicly available information, including from government records, through widely distributed media, or that the consumer made publicly available without restricting it to a specific audience.
• Lawfully obtained, truthful information that is a matter of public concern.
• Deidentified or aggregated consumer information.
• Personal information covered by certain sector-specific privacy laws, including without limitation the Fair Credit Reporting Act (FCRA), the Gramm-Leach-Bliley Act (GLBA), California Financial Information Privacy Act (FIPA), and the Driver's Privacy Protection Act.

Categories of Personal Information Collected.

The particular personal information we collect about you will depend on your relationship with us and which Products, if any, you use, and how you otherwise interact with us if you do not use any of our Products. The general categories of personal information we may collect are as follows:

• Personal Identifiers: Your name, alias, unique personal identifier, online identifier, IP address, email address, physical address, telephone number, Social Security number, passport number, driver's license or state identification card number, date of birth (age), or other similar identifiers.
• Business Identifiers: If you interact with us on behalf of a business, we may collect the above Personal Identifiers in addition to the business name, job title, and other personal and business information.
• Account Information: Depending on the Product you use, we may collect account names and numbers of bank accounts, credit cards, debit cards, and other financial account information.
• Financial and Commercial Information: Depending on the Product you use, we may collect information about your creditors and accounts and the specific actions you take with regard to those accounts. In the course of providing any Products to you, we may also receive your personal information from your creditors, the financial institutions you are associated with, or the Credit Reporting Agencies, which may include records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.
• Billing Information: Credit or debit card information or other financial account information.
• Usage Information: Internet or other similar network activity, such as the site from which you accessed or were referred to our Product and information about your interaction with our Product.
• Location Information: Your approximate (as opposed to precise) geolocation data, such as physical location or movements.
• Demographic Information: Demographic information, credit, identity, and other personal profile data.
• Communications: Personal information contained in or related to any communications you have with us, which may include email address, physical address, telephone number, IP address, and the content of the communications.
• Social Media Information: If you interact with us on social media, we may collect personal information in connection therewith.
• Identity Verification: Some of our Products may involve an option for us to act as your authorized agent to make requests on your behalf. Before we act as your agent, you are required to provide information to us so that we may identify you. For example, our privacy features may require you to confirm your name, mailing address, email, and date of birth.
• Additional Information: From time to time, we may also collect or ask for additional personal information. Any personal information you provide to us is voluntary, and you can opt out of providing certain personal information requested by us. However, your refusal to provide certain personal information requested in connection with our Products may hinder or otherwise restrict your ability to use the Products.

Retention of Personal Information.

Except as otherwise expressly set forth in this Privacy Policy, we retain personal information for as long as necessary to fulfill the purposes for which it was collected, including to provide Products to our users, to comply with legal obligations, to resolve disputes, and to enforce our agreements. We retain account data for as long as the account is active, and thereafter for as long as we may deem appropriate in order to better serve our customers who reactivate their accounts, unless we receive a valid deletion request that is not subject to any exception. We retain contact information indefinitely for marketing and remarketing purposes, unless the consumer opts out of marketing.

Personal Information Not Collected.

We generally do not collect information regarding your: precise geolocation, racial or ethnic origin, citizenship or immigration status, religious or philosophical beliefs, union membership, genetic data, neural data, unique identifying biometric information, or sexual orientation.

4. HOW WE COLLECT YOUR PERSONAL INFORMATION

We collect personal information about you in the following ways:

• When you provide it directly to us.
• Automatically as you use the Products. Information collected automatically may include usage details, IP addresses, and information collected through cookies, web beacons, and other tracking technologies.
• From third parties, for example, our business partners, service providers, Credit Reporting Agencies, your creditors, and other sources of financial, credit, or other information, including without limitation third-party websites or data sources, whether private or generally accessible.

Information You Provide Directly to Us

We collect personal information that you provide directly to us on or through the Products, as follows:

• Information that you provide by filling in forms on or otherwise using or interacting with the Products. This includes information provided at the time of registering to use the Products and creating an account, verifying your identity, or verifying your connection to a creditor or financial institution.
• Records and copies of our correspondence with you (including email addresses).
• Your responses to surveys that we might ask you to complete for research purposes.
• Details of transactions you carry out through the Products and of your use of certain features of the Products. You may be required to provide personal or financial information to use certain features of the Products. For example, some of the Products' features involve us acting as your authorized agent to make requests on your behalf. Before we act as your agent, you are required to provide personal information to us so that we may identify you and request information from the relevant third parties.

We also collect personal information that you provide directly to us when you interact with us on behalf of a business.

Information We Collect Automatically

When you download, access, or use the Products, we may use technology to automatically collect:

• Usage Details. When you access and use the Products, we may automatically collect certain details of your access to and use of the Products, including traffic data, location data, logs, pages viewed, interaction with the Products or any features thereof, website or App preferences, and other communication data and the resources that you access and use on or through the Products.
• Device Information. We may collect information about your device and internet connection, including the device's unique device identifier, IP address, operating system, browser type, mobile network information, and the device's telephone number.
• Stored Information and Files. The App also may access metadata and other information associated with other files stored on your device.

We may also collect the foregoing information automatically when you communicate with us electronically, even if you do not use the Product.

The technologies we use for this automatic data collection may include, without limitation:

• Cookies. When you use the Products, we may store some information on your computer's or device's hard drive. This information will be in the form of a "cookie." "Cookies" are information files which our Product may place on your computer or other device when you use our Products. We use cookies on our Products to enhance your customer experience. These cookies may capture data through different methods, including but not limited to behavioral metrics, heatmaps, and session replay. We may also work with third parties to serve ads on our Products. These ads may contain cookies and action tags (also known as single pixel gifs or web beacons) (which may include, but are not limited to, Meta Pixel) to measure advertising effectiveness and gather information that may be used in cross-context behavioral advertising. It may be possible to refuse to accept cookies by activating the appropriate setting on your browser or device or by opting out from nonessential cookies here. However, if you select this setting, you may be unable to access certain features of the Products.
• Web Beacons. Parts of the Products and our e-mails may contain small electronic files known as web beacons (also referred to as clear gifs, pixel tags, and single-pixel gifs) that permit us, for example, to count users who have visited certain webpages or opened an email and for other related statistics (for example, recording the popularity of certain content and verifying system and server integrity).

Information We Collect from Third Parties

We collect certain information about you from third parties, including:

• Credit and Account Information. Depending on the Product you use, we may collect information from Credit Reporting Agencies, financial institutions, creditors, and other third parties (including without limitation third-party websites or data sources, whether private or generally accessible), in order to provide you the applicable Product.
• Our Business Partners. We may collect information about you from our business and marketing partners.
• Identity and Account Verification. We may collect information from third parties to verify your identity or account information in connection with certain Products.
• Fraud Detection. We may collect information about you from third-party service providers and contractors to help us detect fraud and illegal activity.

5. HOW WE USE AND DISCLOSE YOUR INFORMATION

We may use and disclose your personal information for our business and commercial purposes. In particular, we may use your personal information to:

• enroll you in the Products;
• provide products and services that you request from us;
• enable contractors, service providers, and third parties we use to support our business to assist us with the operation of our business, provided the foregoing are bound by contractual obligations to keep personal information confidential and use it only for the purposes for which we disclose it to them. For example:
  • We may disclose your personal information to Credit Reporting Agencies and other sources of financial or credit information, in order to provide you with the Products and the features you use therein.
  • If you were referred to the Product by a third party and you have not opted out of allowing the third party to provide customer service, we may enable secure, tokenized access to the third-party (the " Customer Service Agent ") that referred you to the Product, for the purpose of allowing them to provide you with customer service.
    • Tokenization replaces your login credentials with a secure token that allows account access without sharing your actual username or password. Through this tokenized access, our partner may access information associated with your account and interact with the Product at your direction and on your behalf. Although tokenized access is designed to enhance security, it enables the Customer Service Agent to access your account and may include all information accessible therein, other than credit card and account numbers.
    • Under our agreements with our Customer Service Agents, they may only use your personal information to provide you with customer service for the Product. In furtherance of their customer support, if the Customer Service Agent has tokenized access, they may create and store notes in your account in connection with providing support or managing your account. These notes may contain information associated with your account, including communications and account activity. Notes may be visible only to the Customer Service Agent, or they may elect to share notes with you, creating a communication log that may be visible in your account. Any such notes may contain personal information and will be handled in accordance with this Privacy Policy.
    • Notwithstanding the foregoing, a Customer Service Agent may independently collect your personal information from you, including without limitation personal information that may be the same or similar to that they can obtain through tokenized access to the Product, and any independently collected personal information shall be governed by the Customer Service Agent's own privacy policy available on its website.
    • Although tokenized account access does not involve the sale or sharing of your personal information within the meaning of most state privacy laws, we do allow you to opt out of providing tokenized account access to the Customer Service Agent. To opt out of tokenized access, click here or close your account by clicking here. If you opt out, some features of the Product may be limited or unavailable.
• communicate with you including regarding any business relationship between us or in connection with the Products, including without limitation enrollment, membership messages such as billing notices, confirmation of actions taken within the Products, and the like;
• process instructions from you, which may involve, without limitation, the disclosure of your personal information to third parties as needed to process any Actions requested by you within any applicable Product. For example, if you request an Action within the Product, such request will constitute your direction to us to disclose your contact information and account information, along with your Action request and other relevant membership information to your creditor on your behalf;
• verify your identity;
• promote products and services to you, whether ours or third parties, via email, phone call, text message, and the like, unless you opt out as described below;
• process payment for any subscriptions or other purchases you make;
• carry out our obligations and enforce our rights arising from any contracts entered into between you and us, including for billing and collection;
• notify you when Product updates are available and of changes to any products or services we offer or provide through them;
• develop, monitor, improve, refine, and enhance our products and services, marketing, and customer relationships and user experience, including without limitation to store your preferences and customize the Products according to your individual interests, to speed up your searches, and to recognize you when you return to the Products;
• use for internal administrative purposes, including without limitation for troubleshooting, data analysis, testing, research, statistical, and survey purposes;
• process and analyze your personal information and other data using artificial intelligence (" AI ") tools, including, without limitation, to analyze your financial and credit health, to develop personalized educational materials, to display what we believe may be relevant advertisements or offers, and to develop, improve, and train AI or other tools or processes;
• exercise or defend our legal rights or otherwise protect our business and the interests and rights of our employees, affiliates, customers, partners, contractors, and agents;
• enforce our rights arising from any contracts entered into between you and us, including the Products, any services agreement or terms of use or the like, and for billing and collection;
• display advertisements or offers to you;
• protect against fraud and reduce credit risk;
• measure or understand the effectiveness of advertising we may serve to you, and to deliver relevant advertising to you;
• perform data analytics and benchmarking;
• administer and maintain our systems and operations, including for safety purposes;
• evaluate or engage in corporate transactions that may require or involve consumer records, such as mergers, acquisitions, divestitures, restructurings, bankruptcies, dissolutions, reorganizations, or sales of assets, in which case we may sell or transfer all personal information as part of any such transaction(s);
• respond to law enforcement requests;
• comply with any court order, law, or legal process, including to respond to any government or regulatory request;
• fulfill any other purpose for which you provide it, or with your consent.

We may disclose your personal information to the following categories of persons:

• Service providers and contractors. We share personal information with service providers and contractors who assist us in operating our business and providing our Products. These providers help us with functions including marketing, sales, data storage, web management, communications, software maintenance and support, analytics, social media, market research, auditing, security, user verification, localization, payment processing, customer service and support, and account management. Without limiting the foregoing, our White Label Provider My Novae Credit is a service provider to which we disclose your personal information.
• Advertisers. We share personal information with advertisers who may present you with advertising and offers that you may be interested, whether through cross-context behavioral advertising, direct marketing (e.g. to your email), or through one or more of our Products.
• Credit Reporting Agencies. We may share your personal information with one or more Credit Reporting Agencies to pull your credit information in connection with one or more Products or otherwise at your direction.
• Creditors or financial institutions. We may share your personal information with your creditors or financial institutions, e.g. when you request us to take an Action on your behalf.
• Third parties in possession of your personal information. We may share your personal information with other third parties that are or may be in possession of your personal information, in order to exercise any rights on your behalf, at your direction, e.g. exercising your right to request deletion of your personal information.

6. YOUR RIGHTS AND CHOICES

You have rights and choices regarding marketing communications and the sale and sharing of your personal information. In particular:

• You can opt-out of (i) receiving marketing communications sent by us or on our behalf, and (ii) the sale and sharing of your personal information with third parties (including targeted advertisements) by contacting us here.

• You may also opt-out of email marketing, by following the opt-out instructions included in every commercial email we send. You may also opt out by updating your alert settings here. Please note that we may continue to communicate with you regarding your membership and your use of the Products, including any Actions you take.

• You may opt-out of receiving promotional telephone calls from us by asking the operator to place you on our do not call list or by contacting us here.

• You may opt-out of receiving promotional text messages (SMS) from us by texting "STOP" or by updating your alert settings here.

For App Users Only

If you access any of our Products through an App, you can choose whether to allow the App to collect and use real-time information about your device's location through your device's privacy settings. If you block the use of location information, the App may become inaccessible or not function properly.

Correcting Credit Information

If provided in the applicable Product, credit information is provided by one or more of the three major Credit Reporting Agencies. If you believe there are errors or inaccuracies in your credit report, contact the applicable Credit Reporting Agency directly, or you may contact the furnisher of the information directly. The Consumer Financial Protection Bureau provides information on how to dispute credit information, which as of the date of this Privacy Policy is accessible at the following link:https://www.consumerfinance.gov/ask-cfpb/how-do-i-dispute-an-error-on-my-credit-report-en-314/.

7. UPDATING OR CORRECTING PERSONAL INFORMATION

You can review your personal information by logging into the applicable Product or by contacting us. You may request that we update, modify, or correct any personal information that we have collected about you through the applicable Product or by contacting us here. Please note, we are not able to update, modify, or correct, personal information about you that we do not control. We may not accommodate a request to update, modify, or correct information if we believe the change would violate any contractual, regulatory, or legal requirement, cause the information to be incorrect, or for any other reason except as prohibited by applicable law.

8. DATA SECURITY

We have developed a formal data security program to safeguard personal information that we collect and process. Our security program includes reasonable technical, physical and administrative safeguards in accordance with PCI DSS Level One and SOC 2 Type 2 standards. For example, we restrict access to your information only to those employees who need to know that information to provide products or services to you.

We also take special steps to protect your information via transmission over the Internet by using a secure web server, which allows web browser programs (e.g. Mozilla/Firefox, Netscape, or Microsoft Internet Explorer) to interact with the web server via an encrypted session. We employ a Secure Sockets Layer (SSL) connection that provides an encrypted connection between your computer and our Products and systems. The encrypted connection scrambles ordinary text or data into cyphertext to safeguard sensitive information during its journey across the Internet. The information is decrypted, or put back into a readable format, when it reaches its intended destination. Depending on which browser you use, you will know you are in secured area by "https" or a lock appearing on your screen.

Any payment transactions are processed by our third-party payment processor and will be encrypted using SSL technology.

The safety and security of your information also depends on you. Where we have given you (or where you have chosen) a password for access to certain parts of our Products, you are responsible for keeping this password confidential. We ask you not to share your password with anyone.

Unfortunately, the transmission of information via the Internet and mobile platforms is not completely secure. Although we do our best to protect your personal information, we cannot guarantee the security of your personal information transmitted through our Products or systems. Any transmission of personal information is at your own risk. We are not responsible for circumvention of any privacy settings or security measures we provide.

9. CHANGES TO OUR PRIVACY POLICY

We may amend this Privacy Policy from time to time. If we make changes to the Privacy Policy, we will post the new Privacy Policy on this page with an updated "Last Revised" date, and we may also notify you by emailing you, by sending an in-App alert (when applicable), posting a notice on our website, or by any other means we reasonably determine to give you notice. You are responsible for ensuring we have an up-to-date active and deliverable email address for you. Your continued use of the Products after any such amendment will constitute your agreement to this Privacy Policy as amended.

If you do not agree to any amendment, you may not continue to use the Products, and you must deactivate any account or membership you have with us and delete our Apps (if applicable) from your device(s).

10. FOR USERS OUTSIDE OF THE UNITED STATES

Our Products are exclusively hosted in the United States. If you access the Products from the European Union, Australia, Asia, or any other region with laws or regulations governing personal data collection, use, and disclosure, that differ from United States laws, please note that you are transferring your personal data to the United States, which does not have the same data protection laws as such other regions. User information (including Personal Information or "personal data" as may be defined by foreign laws) collected through the Products may be stored and processed in the United States, and by using the Products, you consent to any such transfer of information outside of your home country. You are also consenting to the application of United States laws in all matters concerning the Products.

11. STATE PRIVACY RIGHTS

State consumer privacy laws may provide their residents with additional rights regarding our collection and use of their personal information.

Residents of certain U.S. states now (or in the future) have certain rights under their state privacy laws. These may include the right to:

1. Confirm whether we process your personal information.
2. Access and delete certain personal information we hold about you.
3. Correct inaccuracies in your personal information.
4. Receive a portable copy of your personal information (data portability).
5. Opt out of certain uses of personal information, including:
   • Targeted advertising
   • The sale of personal information
   • Profiling in furtherance of decisions that produce legal or similarly significant effects
6. Limit or require consent for the processing of sensitive personal information.
7. The right to appeal decisions we make about your privacy requests.

The availability and scope of these rights vary depending on your state of residence. To exercise any of your privacy rights under any state law, please click here or by contacting us here.

The following disclosures and notices are given under the California Consumer Privacy Act (as amended, the " CCPA "):

Personal Information Categories Chart

The chart below identifies, for the past 12 months, which categories of personal information we collected from our consumers and the expected retention period.

Retention of Personal Information Generally.

Except as otherwise set forth in the chart above, we retain personal information for as long as necessary to fulfill the purposes for which it was collected, including to provide services to our customers, to comply with legal obligations, to resolve disputes, and to enforce our agreements. We retain account data for as long as the account is active, and thereafter for as long as we may deem appropriate in order to better serve our customers who reactivate their accounts, unless we receive a valid deletion request that is not subject to any exception. We retain contact information indefinitely for marketing and remarketing purposes, unless the consumer opts out of marketing.

Sensitive Personal Information Categories Chart

For purposes of the CCPA, sensitive personal information is a subtype of personal information consisting of the specific information categories listed in the chart below. While we collect some information that falls within the sensitive personal information categories listed in the table below, the CCPA does not treat this personal information as sensitive because we do not collect or use it to infer characteristics about a person.

Additional Personal Information Categories or Other Use Purposes

We will not collect additional categories of personal information or use the personal information we collected for materially different, unrelated, or incompatible purposes without providing you notice. If required by law, we will also seek your consent before using your personal information for a new or unrelated purpose.

We may collect, process, and disclose non-personal information, including aggregated or deidentified consumer information, for any purpose, without restriction. When we collect, process, or disclose aggregated or deidentified consumer information, we will maintain and use it in deidentified form and will not to attempt to reidentify the information, except to determine whether our deidentification processes satisfies any applicable legal requirements

The chart below identifies the categories of entities to whom we have disclosed personal information for a business purpose over the preceding 12 months, along with the personal information categories disclosed and the disclosure's business purposes.

Sale and Sharing of Your Personal Information

We may sell your personal information to third parties and have sold it in the preceding 12 months. We may share your personal information with third parties for cross-context behavioral advertising purposes and have shared your personal information in the preceding 12 months.

The chart below identifies the categories of third parties to whom the Company has sold consumers' personal information or shared consumers' personal information for cross-context behavioral advertising purposes over the preceding 12 months, along with the personal information categories sold or shared and the business or commercial purposes for selling or sharing that information.

CCPA Consumer Rights

Under the CCPA, California residents have the following rights:

RIGHT TO BE FREE FROM DISCRIMINATION

You have the right not to be discriminated or retaliated against for exercising any your rights under the CCPA. If you choose to exercise any of your CCPA rights, we will not:

• Deny you goods or services;
• Charge you a different price or rate for goods or services, including through granting discounts or other benefits, or imposing penalties;
• Provide you a different level or quality of good or services; or
• Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.

RIGHT TO OPT-OUT OF THE SALE AND SHARING OF PERSONAL INFORMATION

You have the right to direct us not to sell or share your personal information ("opt-out request") at any time. We cannot sell or share your personal information after we receive your opt-out request unless you later consent to the sale or sharing of your personal information. If you would like to exercise your opt-out right, visit our page. You may also opt out of the sale or sharing of personal information through an opt-out preference signal or by clicking here .

For requests to opt-out, we will also notify our service providers, contractors, and certain other downstream recipients of your request to opt-out and instruct them to comply with your request and to forward the request to their own downstream recipients, if applicable.

We may deny opt-out requests if we have a good-faith, reasonable, and documented belief that the request is fraudulent and will clearly explain our denial decision to the requestor.

You can confirm that we processed your request to opt-out by contacting us here.

Once you make a request to opt-out, we will wait at least 12 months before asking you to reauthorize personal information sales or sharing. However, you may change your mind and opt back in at any time by contacting us here.

RIGHT S WITH RESPECT TO AUTOMATED DECISION-MAKING TECHNOLOGY (ADMT)

When a business uses automated decision-making technology (" ADMT ") to make significant decisions about you, you may have rights to:

• Obtain certain information about how the business uses ADMT, that is specific to you (the "ADMT access right").

• Opt-out of the ADMT use (the "ADMT opt-out right") unless the business provides you with a method to appeal the decision to a human reviewer with the authority to overturn the decision (the "ADMT appeal right") or another exception applies.

ADMTs are technologies that process personal information and use computation to execute a decision and either replace or substantially replace human decision-making, resulting in decisions made without human involvement. Decisions are significant when they result in the provision or denial of financial or lending services, housing, education enrollment or opportunities, employment or independent contracting opportunities or compensation, or healthcare services. Advertising is not a significant decision.

Although we may us AI technology as described above, we do not currently use ADMT to make significant decisions about consumers, so we do not provide ADMT access, opt-out, or appeal rights.

RIGHT TO LIMIT SENSITIVE PERSONAL INFORMATION USE AND DISCLOSURE

You have a right to ask businesses that use or disclose your sensitive personal information to limit the use and disclosure of sensitive personal information to certain statutorily approved reasons (the "right to limit"). However, while we collect information that California law defines as sensitive personal information (such as Social Security numbers and government issued identification numbers), we do not collect or use such information to infer characteristics about a person. We use this information only as necessary to provide our Products, help keep accounts secure, comply with legal obligations, and prevent fraud.

RIGHT TO KNOW AND DATA PORTABILITY

You have the right to request, up to two times in any 12-month period, a disclosure about our collection and use of your personal information (the "right to know"), including the specific pieces of personal information we have collected about you (a "data portability request"). Our response will cover the 12-month period preceding the request, although we will honor requests to cover a longer period that does not extend past January 1, 2022, unless doing so would be impossible or involves disproportionate effort. Upon submission of a verifiable consumer request, we will provide you with the following information:

(1) The categories of personal information we have collected about you.

(2) The categories of sources from which we collected the personal information.

(3) The business or commercial purpose for collecting, selling, or sharing your personal information.

(4) The categories of persons, including third parties, to whom we disclosed your personal information, including separate disclosures identifying the categories of your personal information that we (a) disclosed for a business purpose to each category of persons and (b) sole or shared to each category of third parties.

(5) When your right to know submission includes a data portability request, a copy of your personal information subject to any permitted redactions.

If we provide this information to you electronically, the information will be in a portable format. To the extent that it is technically feasible, we will provide you the information in a readily useable format that you can easily transfer to another entity.

If you intend to exercise your right to know or submit a data portability request, please visit the Personal Data section located in the settings tab of your App or click here.

RIGHT TO DELETE

You have the right to request that we delete any of your personal information that we collected from you and retained, subject to certain exceptions and limitations (the " right to delete"). Once we receive your request and confirm your identity, we will delete your personal information from our systems unless an exception allows us to retain it. We will also notify our service providers, contractors, and other recipients to take appropriate action. Please note we are unable to delete your personal data if you currently have an active account, as the retention of your personal information is required to continue servicing your membership. If you would like to exercise your right to delete, please deactivate your account first. Please note that even after account deactivation, we may be unable to delete some personal information under certain legal exceptions and limitations.

If you intend to exercise your right to delete, click here

RIGHT TO CORRECT

You have the right to request correction of any personal information that we maintain about you that you believe is incomplete or inaccurate. We may require you to provide documentation to confirm your identity and support your claim that the information is incomplete or inaccurate. Unless an exception applies, we will correct personal information that our review determines is incomplete or inaccurate and notify our service providers, contractors, and other recipients to take appropriate action.

If you intend to exercise your right to correct, click here.

EXERCISING CCPA RIGHTS GENERALLY

Only you, or someone legally authorized to act on your behalf, may make a request to know, delete, or correct, or a data portability request, related to your personal information. To designate an authorized agent, please click here. We may request specific information from you or your authorized representative to confirm your or their identity before we can process your right to know, delete, or correct your personal information or to process a data portability request.

We cannot respond to your request to know, delete, correct, or for data portability, if we cannot verify your identity or authority to make the request and confirm the personal information relating to you. We will only use personal information provided in the request to verify the requestor's identity or authority to make the request.

We consider requests made through your password-protected account with us sufficiently verified when the request relates to personal information associated with that specific account. However, you do not need to create an account with us to submit a request to know, correct, or delete or for data portability.

We will confirm receipt of your request to know, delete, or correct or for data portability within ten business days. If you do not receive confirmation within the ten-day timeframe, please contact us here.

We endeavor to substantively respond to a verifiable request within 45 days of its receipt. If we require more time (up to another 45 days), we will inform you of the reason and extension period in writing. We will deliver our written response to your verified email address or your password-protected user account. Our substantive response will tell you whether we have complied with your request. If we cannot comply with your request in whole or in part, we will explain the reason, subject to any legal or regulatory restrictions. Applicable law may allow or require us to refuse to provide you with access to some or all of the personal information that we hold about you, or we may have destroyed, deleted, or made your personal information anonymous in compliance with our record retention policies and obligations.

We do not charge a fee to process or respond to your verifiable request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

12. DISPUTES; APPLICABILITY OF TERMS OF USE AND SERVICE AGREEMENT ; ARBITRATION AGREEMENT

Please carefully read our Terms of Use, and any Service Agreement applicable to the Product, which govern your use of the Products and any disputes arising out of or relating to the Products or this Privacy Policy.

Additionally, in the event of any dispute arising out of or related to this Privacy Policy, the following

ARBITRATION AGREEMENT .

12.1 MOST CONSUMER CONCERNS CAN BE RESOLVED QUICKLY AND TO THE CONSUMER'S SATISFACTION BY CONTACTING US HERE. If we are unable to resolve your complaint informally, you and ConsumerDirect hereby agree that any dispute arising out of or related to this Privacy Policy, or the relationship between you and us (all of the foregoing, collectively, "Arbitrable Matters"), will be exclusively resolved through final and binding arbitration or small claims court instead of in courts of general jurisdiction, to the fullest extent permitted by law. DO NOT ENROLL IN OR OTHERWISE USE ANY OF OUR PRODUCTS IN ANY WAY IF YOU DO NOT AGREE TO THIS ARBITRATION AGREEMENT (the "Arbitration Agreement"). For purposes of this Arbitration Agreement, references to ConsumerDirect shall include, as applicable, ConsumerDirect and our affiliates, subsidiaries, service providers, business partners, White Label Providers, and Customer Service Agents, and our and their respective agents, employees, predecessors in interest, successors, and assigns.

12.2 ARBITRATION IS MORE INFORMAL THAN A LAWSUIT IN COURT. ARBITRATION USES A NEUTRAL ARBITRATOR INSTEAD OF A JUDGE OR JURY, ALLOWS FOR MORE LIMITED DISCOVERY THAN IN COURT, AND IS SUBJECT TO VERY LIMITED REVIEW BY COURTS. ARBITRATORS CAN AWARD THE SAME DAMAGES AND RELIEF THAT A COURT CAN AWARD. YOU AGREE THAT, BY USING ANY PRODUCT, YOU ARE AGREEING TO THIS ARBITRATION AGREEMENT, AND YOU AND CONSUMERDIRECT ARE EACH FOREVER WAIVING THE RIGHT TO A TRIAL BY JURY OR TO PARTICIPATE IN A CLASS ACTION.

12.3 YOU AGREE AND UNDERSTAND THAT ANY DISPUTE OR CLAIM YOU MAY HAVE AGAINST US MUST BE RESOLVED EITHER THROUGH BINDING ARBITRATION OR, WHERE PERMITTED, IN SMALL CLAIMS COURT AS PROVIDED IN SECTION 12.4. YOU FURTHER AGREE THAT ARBITRATION WILL BE THE EXCLUSIVE FORUM FOR ALL DISPUTES AND CLAIMS BETWEEN US THAT ARE NOT ELIGIBLE FOR RESOLUTION IN SMALL CLAIMS COURT. THIS AGREEMENT TO ARBITRATE IS INTENDED TO BE BROADLY INTERPRETED. IT INCLUDES, BUT IS NOT LIMITED TO:

• claims arising out of or relating to any aspect of the relationship between you and us, whether based in contract, tort, statute, fraud, misrepresentation or any other legal theory;
• claims that arose before your agreement to this Privacy Policy or any prior privacy policy (including, but not limited to, claims relating to advertising);
• claims that are currently the subject of purported class action litigation in which you are not a member of a certified class;
• claims that may arise after any termination of this Privacy Policy; and
• disputes over the interpretation, applicability, enforceability, or formation of this Privacy Policy, including this Arbitration Agreement.

12.4 Notwithstanding anything to the contrary in this Arbitration Agreement, either party may bring an individual action in small claims court, to the extent such claim is brought in a California small claims court of competent jurisdiction.

12.5 This Arbitration Agreement does not preclude you from bringing issues to the attention of federal, state, or local agencies, including, for example, the Federal Trade Commission. Such agencies can, if the law allows, seek relief against us on your behalf.

12.6 Unless a different procedure is required by applicable law, the arbitration will be conducted before a single arbitrator administered by the American Arbitration Association ("AAA") in accordance with their rules, including the AAA's Supplementary Procedures for Consumer-Related Disputes.

12.7 A demand for arbitration under this Arbitration Agreement may be made either before or after a lawsuit or other legal proceeding begins. However, any demand for arbitration that is made after a lawsuit or other legal proceeding has begun must be made within 90 days following the service of a complaint, third-party complaint, cross-claim or counterclaim or any answer thereto or any amendment to any of the above.

12.8 You understand and agree that before you take a dispute to arbitration under this Arbitration Agreement, you must first contact our customer account representatives and give us an opportunity to resolve this dispute. Information about the arbitration process and the AAA's arbitration rules and its fees are available from the AAA at http://www.adr.org.

12.9 The cost of any arbitration proceeding shall be split between you and us. However, at your request, we will promptly reimburse you for your portion of the payment of your arbitration filing fee. The filing fee currently is $225 for consumer claims initiated by an individual but is subject to change by the arbitration provider. If you are unable to pay this fee, we will pay it directly after receiving a written request.

12.10 The arbitration will be based only on the written submissions of the parties and the documents submitted to the AAA relating to the dispute, unless either party requests that the arbitration be conducted using the AAA's telephonic, online, or in-person procedures (additional charges may apply for these procedures).

12.11 The arbitrator may award declaratory or injunctive relief only in favor of the individual party seeking relief and only to the extent necessary to provide relief warranted by that party's individual claim.

12.12 Notwithstanding any provision in the Privacy Policy or this Arbitration Agreement to the contrary, the prevailing party in any arbitration or litigation involving any dispute arising out of or related to any Arbitrable Matter, as determined by the arbitrator or by a court of competent jurisdiction, shall be entitled to recover his, her, or its reasonable attorneys' fees and costs and expenses incurred in connection with such arbitration or litigation.

12.13 ANY ARBITRATION UNDER THIS ARBITRATION AGREEMENT WILL TAKE PLACE ONLY ON AN INDIVIDUAL BASIS; CLASS ARBITRATIONS AND CLASS ACTIONS ARE NOT PERMITTED. YOU UNDERSTAND AND AGREE THAT NO CLAIM, DISPUTE OR CONTROVERSY MAY BE CONSOLIDATED WITH A DISPUTE OF ANY OTHER PERSON IN ARBITRATION, OR RESOLVED ON A CLASS-WIDE BASIS BY A CLASS ACTION OR OTHER PROCEEDING AND YOU HEREBY WAIVE YOUR RIGHT TO COMMENCE OR PARTICIPATE IN ANY SUCH COLLECTIVE OR REPRESENTATIVE PROCEEDING. YOU AGREE THAT YOU MAY BRING CLAIMS ONLY IN YOUR INDIVIDUAL CAPACITY, AND NOT AS A PLAINTIFF OR CLASS MEMBER IN ANY PURPORTED CLASS OR REPRESENTATIVE PROCEEDING. You agree that the arbitrator may not consolidate more than one person's claims and may not otherwise preside over any form of a representative or class proceeding. Any claim that all or any part of this Section 12.13 is invalid, unenforceable, unconscionable, or void may be determined only by a court and not by the arbitrator. Notwithstanding any provision in this Arbitration Agreement to the contrary, if any part of this Section 12.13 is deemed invalid, unenforceable, unconscionable, or void, then the entirety of this Arbitration Agreement shall be null and void and neither party shall be entitled to arbitration hereunder.

12.14 The parties to this Arbitration Agreement acknowledge that this Arbitration Agreement is made pursuant to a transaction involving interstate commerce, and shall be governed by the Federal Arbitration Act, 9 U.S.C. § 1 et seq. ("FAA"). Judgment upon any arbitration award may be entered in any court having jurisdiction. The arbitrator shall follow substantive law to the extent consistent with the FAA and shall honor any claims or privileges recognized by law.

12.15 Any disputes or claims you may have which relate to your credit report, or any claims arising out of or relating to the Fair Credit Reporting Act ("FCRA") and/or the FCRA's state law equivalent(s), are not subject to or governed by this Arbitration Agreement.

12.16 This Arbitration Agreement shall survive any termination of this Privacy Policy.

12.17 Notwithstanding anything to the contrary in this Arbitration Agreement, if AAA is unavailable or declines to administer an arbitration regarding any Arbitrable Matter consistent with its Consumer Arbitration Rules, the parties will select another nationally recognized arbitration provider that will administer the arbitration of the Arbitrable Matter under comparable consumer rules. If the parties cannot agree, either party may petition a court of competent jurisdiction to appoint an arbitrator under 9 U.S.C. § 5 to conduct the arbitration.

12.18 Limitation of Time to File Claims . To the fullest extent permitted by law, ANY CAUSE OF ACTION OR CLAIM YOU MAY HAVE ARISING OUT OF OR RELATING TO THIS PRIVACY POLICY MUST BE COMMENCED WITHIN ONE (1) YEAR AFTER THE CAUSE OF ACTION ACCRUES. IF NOT, SUCH CAUSE OF ACTION OR CLAIM IS PERMANENTLY BARRED. This limitation does not apply to any claim with a legally mandated longer statute of limitations that cannot be shortened by contract.

13. CONTACT US

If you have any questions about this Privacy Policy, please contact us here.

All Rights Reserved.