cred.ai privacy policy

last updated: July 21, 2021

agreements

PLEASE READ THIS PRIVACY POLICY CAREFULLY. BY ACCESSING THE WEBSITE WWW.cred.ai, OR THE cred.ai MOBILE APP, YOU AGREE TO BE BOUND BY THE PRIVACY POLICY BELOW. IF YOU DO NOT AGREE TO THE PRIVACY POLICY BELOW, DO NOT ACCESS THE cred.ai WEBSITE OR THE MOBILE APP. We will also use and share any financial information that we collect from or about you in accordance with our Privacy Notice (located at www.cred.ai/privacy).

The cred.ai Deposit Account is issued by Wilmington Savings Fund Society, FSB (“WSFS Bank”) and serviced by Robo Cred One, LLC (“cred.ai,” “we,” “us,” and “our”). This Privacy Policy describes how cred.ai collects, uses, and shares your personal information with regard to the cred.ai Deposit Account. This Privacy Policy applies to the online collection, use, and sharing of personal and other information through the cred.ai website (www.cred.ai) and the cred.ai mobile app (the “Platform Services”), and does not apply to any other product or service that you may obtain from WSFS Bank.

In connection with the cred.ai Deposit Account, cred.ai shares your personal information with WSFS Bank. In addition, when you provide your personal information to cred.ai to apply for and/or open the cred.ai Deposit Account, you are also providing that information to WSFS Bank. Information about WSFS Bank’s privacy practices regarding your financial information is available here: https://www.wsfsbank.com/privacy-policy.

information collection

We collect information about you (“personal information”) and your use of our Platform Services, some of which may not be personally identifiable. We collect any information that you provide to us through our Platform Services or through your access to or use of our Platform Services. This includes, but is not limited to, your personal information such as:

• Real name, alias, unique personal identifier, online identifier, Internet Protocol address, account name, driver’s license number, passport number, or other similar identifiers;

• Signature, state identification card number, employment, employment history, credit card number, or any other financial information, such as bank deposit account balances;

• Characteristics of protected classifications under California or federal law (sex, race, religion, color, national origin, age, handicaps);

• Commercial information, including records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies;

• Biometric information;

• Internet or other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding a consumer’s interaction with an Internet website, application, or advertisement; July 2021 Page 2

• Audio, electronic, visual, or similar information; • Professional (or employment) related information;

• Inferences drawn from any of the information identified in this subdivision to create a profile about a consumer reflecting the consumer’s preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes; and

• Any other information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. Personal information includes, but is not limited to, the following if it identifies, relates to, describes, is capable of being associated with, or could be reasonably linked, directly or indirectly, with a particular consumer or household.

We also collect technical information about your use of our Platform Services, which may include information about your device, web browser, and location. When you use our Platform Services, your IP address (the Internet address of your device) is recorded so that we may know how you are using our Platform Services. Your browser may also automatically provide us with information regarding the type of computing device and operating system you are using. This information is used by cred.ai to monitor and improve our Platform Services. This information is not linked back to you as an individual user.

Our website uses cookies to record user-specific information about the pages you access or actions you take during your visit on our website. These cookies do not store or collect any personally identifiable data. Please see the section below on Tracking Technologies for more information.

cred.ai uses Plaid Inc. (“Plaid”), during the application process and in service of your account, to gather your personal and financial data (for example, account balances) from your third-party bank. By applying for or using our products or services, you grant Plaid the right, power, and authority to act on your behalf to access and transmit your personal and financial information from your third-party bank. You agree to your personal and financial information being transferred, stored, and processed by Plaid in accordance with the Plaid Privacy Policy, which is available here: https://plaid.com/legal. Plaid never shares your third-party bank credentials with cred.ai.

information uses

We may use the information that we collect from you to:

• Provide you with the services or products that we offer through our Platform Services;

• Respond to your inquiries, requests, or other service-related purposes;

• Communicate with you to administer the Platform Services, including notifying you about any updates, changes, or additions to this Privacy Policy;

• Enhance your experience with us, such as tailoring the content displayed through our Platform Services to your preferences or developing new products or services based on your interactions with our Platform Services;

• Send you information about products or services that we think may be of interest to you;

• Establish your identity when you apply for and/or access your account in order to protect you and cred.ai from fraud and/or identity theft in accordance with any applicable federal or state laws, regulations, and best practices;

• Carry out any specific purposes for which we have obtained your prior consent; and

• Conduct any other legitimate business activities not otherwise prohibited by law. We may also use your information for business purposes such as:

• Auditing related to a current interaction with you and concurrent transactions, including, but not limited to, counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards;

• Detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, and prosecuting those responsible for that activity;

• Debugging to identify and repair errors that impair existing intended functionality;

• Short-term, transient use, provided that the personal information is not disclosed to another third party and is not used to build a profile about you or otherwise alter your experience outside the current interaction, including, but not limited to, the contextual customization of ads shown as part of the same interaction;

• Performing services, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing advertising or marketing services, providing analytic services, or providing similar services;

• Undertaking internal research for technological development and demonstration;

• Undertaking activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by us, and to improve, upgrade, or enhance the service or device that is owned, manufactured, manufactured for, or controlled by us; and

• Any commercial purposes, as permitted by law, including any purpose to advance your commercial or economic interests, such as by inducing you to buy, rent, lease, join, subscribe to, provide, or exchange products, goods, property, information, or services, or enabling or effecting, directly or indirectly, a commercial transaction.

information sharing

We may share information about you with relevant and appropriate third parties in the following situations:

• To our service providers that perform functions on our behalf;

• To protect or enforce our rights or property, to protect your safety or the safety of others, or to investigate, prevent, or take action against fraud or other illegal activities;

• In response to legal process or as otherwise required by law;

• In the event that cred.ai goes through a business transition or corporate transaction requiring due diligence, such as a merger, capital investment, acquisition by another company, or sale of all or a portion of its assets; or

• To conduct any other legitimate business activities not otherwise prohibited by law.

Notwithstanding anything else in the Privacy Policy, we may share aggregate or non-personally identifying information about the users of our Platform Services with third parties for marketing, advertising, research, or other business purposes.

We do not sell personal information.

information security

We follow generally accepted industry standards to protect the personal information submitted to us, both during transmission and once we receive it. No method of transmission over the Internet, or method of electronic storage, is 100% secure, however. Therefore, while we strive to use commercially reasonable means to protect your personal information, we cannot guarantee its absolute security.

To protect the security of your information, we may require you to authenticate your identity (i.e., prove that you are who you say you are) to conduct certain transactions through our Platform Services. It is a good idea to protect your security by always closing your web browser after leaving the website or closing mobile apps when not in use. If you believe that information that you have submitted through our Platform Services has been used without your permission to engage in any unauthorized activity, you must tell us immediately. The best way of keeping your possible losses to a minimum is to call us at (877) 244-0933. If you fail to notify us, you may be liable for all unauthorized activity on your account.

third party links

Our Platform Services may display links to third-party websites. By including a link to third- party websites, cred.ai does not endorse or recommend any products or services offered or information contained at the third-party websites. cred.ai disclaims liability for any privacy practices of the third-party websites linked through our Platform Services, which may have a privacy policy different from that of cred.ai. If you decide to visit a third-party website via a link displayed on our Platform Services, you do so at your risk.

tracking technologies

In addition to the information you provide, cred.ai may also collect information during your use of our Platform Services through our online tracking technologies, which include Web beacons, cookies, device identification, geolocation, embedded Web links, and other information- gathering tools. These tools collect certain traffic information that your browser automatically sends, such as your browser type and language, access times, and the address of the website from which you arrived. They may also collect information about your Internet Protocol (“IP”) address, click stream behavior (e.g., the pages you view, the links you click, and other actions you take in connection with the websites or “powered by” websites) and product information. When you browse or use one of our Platform Services, we may store certain information on your device, in the form of a small text file or “cookie,” which can help us to tailor our Platform Services to your individual preferences and save you time if you use the Platform Services again. For more information about cookies, please visit https://www.allaboutcookies.org.

Information from these tracking technologies allow us to measure activity through our Platform Services and to create ideas for improving our Platform Services, which may include the time and length of your visit, pages viewed, previously visited websites, and your Internet service. We, or our third-party providers, may collect personal information about your online activities over time and across different websites when you use our Platform Services. For example, we use Google Analytics to generate statistical and other information about the use of our website by means of cookies. To learn more about Google’s privacy policy, please visit: http://www.google.com/policies/privacy/. You can also learn more about how to opt out of the collection and processing of such information by Google by visiting this website: https://tools.google.com/dlpage/gaoptout.

You have the ability to accept or decline cookies using your web browser settings. If you choose to not accept cookies from our Platform Services, you may not be able to take full advantage of our features or to receive some of the services that our Platform Services provides.

The cred.ai website does not respond to browser “Do Not Track” signals.

age restrictions

Our Platform Services are not intended for use by children or minors. We do not knowingly solicit information from children, and we do not knowingly market to children. We recognize that protecting children’s identities and privacy online is important and that the responsibility to do so rests with both the online industry and with parents. Please notify us immediately if you believe that we may have collected personal information from a child, so that we can delete such information.

We do not sell the personal information of California consumers that are less than 16 years of age, unless the consumer (in the case of consumers between 13 and 16 years of age) or the consumer’s parent or guardian (in the case of consumers who are less than 13 years of age) has affirmatively authorized the sale of the consumer’s personal information.

california privacy rights

Under the California Consumer Privacy Act, California residents have the right to:

• Request that a business delete any personal information about the consumer which the business has collected from the consumer.

• Request that a business that collects personal information about the consumer disclose to the consumer, free of charge, the following:

• The categories of personal information that it has collected about that consumer.
• The categories of sources from which the personal information is collected.
• The business or commercial purpose for collecting or selling personal information.
• The categories of third parties with whom the business shares personal information.
• The specific pieces of personal information it has collected about that consumer.

• Request that a business that sells the consumer’s personal information, or that discloses it for a business purpose disclose, free of charge, to the consumer:

• The categories of personal information that the business collected about the consumer.
• The categories of personal information that the business sold about the consumer and the categories of third parties to whom the personal was sold, by category or categories of personal information for each third party to whom the personal information was sold.
• The categories of personal information that the business disclosed about the consumer for a business purpose.

• Direct a business that sells personal information about the consumer to third parties not to sell the consumer’s personal information.

You may submit a request under the California Consumer Privacy Act through the following methods:

• You may call us toll-free at (877) 244-0933.
• You may write to us at: cred.ai, CCPA Request, PO Box 63688, Philadelphia, PA 19147.

To submit a request, we are required to verify your identity. If you call us, please be prepared to provide us with your name, contact information, and other personal information that you had previously provided on your application. If you write to us, please provide only your telephone number at which you may be reached so that we may call you to request that you provide this same information in order to verify your identity. We will match the personal information that you provide to us with personal information that we already maintain about you in order to verify your identity.

You may also designate an authorized agent to make such requests on your behalf by calling us at (877) 244-0933.

We may not be able to honor each request that we receive, but if we are unable to do so, we will respond to let you know our reasons. We will not discriminate against you if you choose to exercise any of your rights as described in this section.

We reserve the right to change this Privacy Policy at any time. We will notify you of any changes to this Privacy Policy by posting such changes to the cred.ai mobile app and the cred.ai website. Unless otherwise stated, any modifications to this Privacy Policy will go into immediate effect after they have been posted, as indicated by the “Last Updated” date located at the beginning of this Privacy Policy. Your continued use of our Platform Services indicates your consent to the Privacy Policy posted at the time of use.

If you have any questions about this Privacy Policy, please contact us at (877) 244-0933.