Privacy Policy

This privacy policy (this "Privacy Policy") describes how Finvest collects, secures, uses, retains, discloses, and otherwise processes your personal information when you access and use our website and mobile app and when you otherwise engage with us (for example, by applying for our services or contacting our customer service team) (collectively, our "Services"). This Privacy Policy also describes the choices you can make with respect to the personal information we collect and process about you. In this Privacy Policy, we use "customer" and "you" to refer to anyone who accesses and uses our Services.

Personal Information We Collect

The personal information we collect depends on how you interact with us, the Services you sign-up for or use, and the choices you make. We collect information about you from different sources and in various ways when you use our Services, including information you provide directly, information collected automatically, information from third-party data sources, and data we infer or generate from other data.

When you are asked to provide personal information, you may decline to do so. You may also use web browser or operating system controls to prevent certain types of automatic data collection. However, if you choose not to provide or allow information that is necessary for our Services, then the Services or particular features may not be available or fully functional to you.

Personal Information You Provide to Us

We collect personal information you may provide to us, such as:

• Basic Customer Information: Name, Email Address, Address, Date of birth, Nationality, Country of residence, Phone number, Government ID
• Investment Profile: Such as tax status, investment goals, and investing experience.
• Employment Information: Such as employment status, job title, employer information, and salary information.
• Financial Account Information: Such as bank account number, brokerage account number, routing numbers, and credit or debit card information.
• Transactions Information: When you submit or complete a transaction using our Services, we collect information about that transaction, such as the notional value, the asset you are buying or selling, and time and date of the transaction.
• Audio or Electronic Information: Records of your communications with us (for example, we keep copies of the contents of your correspondence with us on our website, app, chat features, and other channels).
• Communications and Content Information: Such as your survey responses, information you provide to us during contests and other promotional events, and correspondence with our customer service team.
• Sensitive Personal Information:
  • Government ID: Such as government-issued identifiers like your driver's license, passport number, and social security number.
  • Sensitive Demographic Information: Such as citizenship and visa information, some of which may be protected classifications.
  • Account Access Information: Such as a username or account number in combination with a password.
  • Biometric Information: Such as facial images from your identification card or selfie photographs.
  • Certain Services require us to perform a "know your customer" check by law. To perform this check, we collect personal information, including sensitive personal information, such as your full name, date of birth, home address, and government-issued identification with photo.

Personal Information We Collect Automatically When You Use Our Services

As is typical of many online platforms, we may automatically collect personal information based on your Internet or other electronic network activity when you use our Services. For example:

• Usage Information: Information about your engagement with our Services, like the pages you view, the features or buttons you use, the notifications you see, the dates and times of your visits, and other similar information. We also use tools to record and analyze your interaction with our Services to help us improve your experience.
• Location Information: We may infer your general geographic location (such as city, state, and country) by using your internet protocol (IP) address.
• Device Information: We receive information about the device and software you use to access our Services, such as IP address, web browser type, operating system version, phone carrier and manufacturer, application installations, device identifiers, mobile advertising identifiers, and push notification tokens.
• Personal Information We Create or Generate: We may infer new information from other data we collect, including using automated means to generate information about your likely preferences or other characteristics ("inferences"). For example, we may infer your general geographic location (such as city, state, and country) based on your IP address.

Personal Information We Receive from Other Sources

We may receive information about you from other sources, such as:

• Data Brokers: Data brokers and aggregators from which we obtain information to supplement the data we collect.
• Marketing Partners: Partners with which we engage in joint-marketing activities or co-sponsor events.
• Third-Party Partners: We obtain information about you from third-parties that we work with to operate and maintain the Services. For example, we receive information about you from our identity verification and fraud prevention partners in order to verify your identity, prevent fraud, comply with our legal obligations (such as anti-money laundering laws) and protect the safety and security of our Services, business, and customers.
• Service Providers: Service providers that collect or provide information in connection with work they do on our behalf, for example companies that determine your device's location based on its IP address.

Financial-Account Linking and Payment Processing

We partner with third parties, like Plaid, Inc. ("Plaid") to link your account to our Services and process payments. In order to confirm identity and provide their services, companies like Plaid may provide us with data about you from your banking institutions. By using our Services, you acknowledge and agree that the privacy policies of the third parties used for financial-account linking and payment processing will govern the use of any information collected for this purpose. We encourage you to review any such companies' privacy policies. You can view Plaid's privacy policy on their website.

How We Use Your Personal Information

Personal Information We Disclose

We do not sell personal information. We disclose personal information as necessary to complete your transactions, provide the Services, or with your consent (where required by applicable law). In addition, we disclose personal information described in this Privacy Policy to the categories of recipients described below, for the business purposes detailed below:

• Service providers: We provide personal information to vendors or agents working on our behalf for the purposes described in this Privacy Policy. For example, data cloud providers, information technology, customer support, marketing, and website analytics. We use an identification verification service provider to determine whether a selfie you take matches the photo in your government-issued identification.
• Financial service companies & payment processors: When you provide payment data, for example to make a purchase, we will disclose payment and transactional data to banks and other entities as necessary for payment processing, fraud prevention, credit risk reduction, analytics, or other related financial services.
• Substantial corporate transactions: We may share information about you in connection with a substantial corporate transaction, a merger, consolidation, reorganization, financing, change in control or acquisition of all or a portion of our business by a third party, or in the unlikely event of a bankruptcy or similar proceeding.
• Affiliates: We enable access to certain personal information across our affiliates, for example, where we share common data systems or where access helps us to provide our Services and operate our business.
• Legal and law enforcement: We will access, disclose, and preserve personal information when we believe that doing so is necessary to comply with applicable law or respond to valid legal process, including from law enforcement or other government agencies.
• Third parties as necessary for security, safety, and protecting rights: We will disclose personal information if we believe it is necessary to:
  • protect our customers and others, for example to prevent spam or attempts to commit fraud, or to help prevent the loss of life or serious injury of anyone;
  • Operate and maintain the security of our Services, including to prevent or stop an attack on our computer systems or networks; or
  • Protect the rights or property of ourselves or others, including enforcing our agreements, terms, and policies.
• Analytics and Advertising Providers: Analytics and advertising companies also collect personal information through our website and app, including identifiers and device information (such as cookie IDs, device IDs, and IP address), geolocation data, usage data, and inferences based on and associated with that data. In some cases, these providers may combine this data across multiple sites to improve analytics for their own purpose and others. For example, we use Google Analytics on our website to help us understand how users interact with our website; you can learn how Google collects and uses information at www.google.com/policies/privacy/partners.
• Please note that some of our Services also include integrations, references, or links to services provided by third parties whose privacy practices differ from ours. If you provide personal information to any of those third parties, or allow us to disclose personal information to them, then such data is governed by their privacy statements.
• With your consent: We share information about you for any other purposes disclosed to you with your consent.

Cookie Policy

This Cookie Policy explains how Finvest use cookies and similar technologies when you visit our websites, when you use the Finvest mobile app or Finvest application programming interface ("API") or third party applications relying on such APIs and/or when you interact with Finvest online advertisements or marketing emails (the Sites, Apps and associated services are collectively referred to as the "Services"). It explains what these technologies are and why we use them, as well as your rights to control our use of them.

In some cases, we may use cookies and similar technologies to collect personal information, or information that becomes personal information if we combine it with other information. In such cases, the Finvest Privacy Policy will apply in addition to this Cookie Policy.

You can review your cookie preferences and update your choices by visiting our Cookie Preferences Manager. This is in addition to any other controls that may be available to you.

What are cookies?

Browser cookies are text files with small pieces of data downloaded onto your computer or mobile device. Browser cookies and other similar technologies (collectively called "Cookies" in this Cookies Policy) enable websites and apps to store information or facilitate access to information stored on your device to enable certain features and distinguish you from other visitors. These technologies are used by most website and app providers to let users navigate between pages efficiently, ensure security of the webpage or application, understand how their websites are used, remember user preferences and generally improve the user experience. More information on cookies and their use can be found at www.aboutcookies.org or www.allaboutcookies.org.

Cookies set by the website operator are called "first party cookies" and cookies set by parties other than the website operator are called "third party cookies". You should check the third-party's website for more information on how they use cookies.

What do we use cookies for?

When you access our Sites and Services, we, or companies we work with, may place cookies and similar technologies (such as web beacons, software development kits ("SDKs"), pixels, APIs, mobile advertising identifiers, tags and local storage) on your computer or other device.

We use cookies for the following purposes:

Strictly Necessary purposes

Strictly Necessary Cookies are essential for our Services to function and therefore cannot be switched off. They are usually only set in response to actions made by you which amount to a request for services, such as setting your privacy preferences, logging in, or filling in forms. These also include cookies we may rely on for security purposes, such as to prevent unauthorized access attempts. You can set your browser to block or alert you about these cookies at any time, but some features of our Services may not work.

Performance purposes

We use these Cookies to count visits and traffic sources so we can measure and improve the performance of our Services. They help us to know which pages are the most and least popular and see how visitors move around the Sites and Apps, and to resolve any errors that occur on the Services quickly to provide you with a better experience.

Functional purposes

We use these Cookies to remember the choices you make (e.g. country or language selection) and to tailor our Services to your preferences.

Targeting purposes

Finvest uses first party and third party cookies for advertising and measurement purposes. These advertising cookies are used to serve personalized advertising on our Services or to serve advertising on other third party sites that may be relevant to you or your interests. This means that after you have been to our Services, you may see advertisements about our Services elsewhere on the Internet.

These cookies are also used to help measure the effectiveness of advertising campaigns. The information collected through this process does not enable these third party service providers to identify your name, contact details or other personal information that directly identifies you.

Our third-party service providers may place cookies on your browser or device to help us keep our Services safe and secure, promote our Services on other apps and websites, and enable us, our advertisers and measurement partners to measure the effectiveness of advertising campaigns.

How long will these cookies stay on my browsing device?

The length of time a cookie will stay on your browsing device depends on whether it is a "persistent" or "session" cookie. Session cookies will only stay on your device until you close your browser. Persistent cookies are set to automatically expire after a defined duration (for example, a few days, weeks or months).

How to manage cookies?

You have the right to decide whether to accept or reject cookies (except strictly necessary cookies). You can enable or disable categories of cookies by visiting our Cookie Preferences Manager. This includes both first party and third party cookies. You can use the browser with which you are viewing this website to enable, disable or delete cookies. To do this, follow the instructions provided by your browser (usually located within the "Help", "Tools" or "Edit" settings). However, please note, if you set your browser to disable cookies, you may not be able to access secure areas of our Services. Also, if you disable cookies, other parts of our Services may not function properly.

How We Protect Personal Information

We take reasonable and appropriate steps to help protect personal information from unauthorized access, use, disclosure, alteration, and destruction. To help us protect your personal information, please use a strong password and never share your password with anyone or use the same password with other sites or accounts.

Your Personal Information Choices

We provide a variety of ways for you to manage the personal information we hold about you, including choices about how we use that data. In some jurisdictions, these controls and choices may be enforceable as rights under applicable law.

Account controls: Your Profile. You can edit your name, username, bio, email, and phone number by visiting the setting page on the mobile app

Cookie controls: Many web browsers are set to accept cookies and similar tracking technologies by default. If you prefer, you can set your browser to delete or reject these technologies. If you choose to delete or reject these technologies, this could affect certain features of our Services. If you use a different device, change browsers, or delete the opt-out cookies that contain your preferences, you may need to perform the opt-out task again.

Close Your Account. You can close your account by emailing us at support@getfinvest.com

How We Retain Personal Information

We retain personal information for as long as necessary to provide our Services and fulfill the transactions you have requested, comply with our legal obligations, resolve disputes, enforce our agreements, and for other legitimate and lawful business purposes. Because these needs can vary for different data types in the context of different services, actual retention periods can differ significantly based on criteria such as customer expectations or consent, the sensitivity of the data, the availability of automated controls that enable customers to delete data, and our legal, regulatory or contractual obligations.

Children's Privacy

We do not knowingly collect, maintain, or use personal information from children under 18 years of age, and no part of our Services are directed to children.

Location of Personal Information

The personal information we collect will be stored and processed in the US. Currently, our cloud provider, AWS, uses data centers in the United States. The storage location(s) are chosen to operate efficiently and improve performance. We take steps with the intent of processing and protecting personal information as described in this Privacy Policy wherever the personal information is located.

California Privacy Rights

If you are a California resident and the processing of personal information about you is subject to the California Consumer Privacy Act ("CCPA"), then you have certain rights with respect to that information.

In general, the CCPA broadly protects personal information that businesses collect from California consumers. However, as described in the "U.S. exemptions" section below, the personal information you provide to us may be governed by the Gramm Leach Bliley Act ("GLBA") or the California Financial Information Privacy Act and not the CCPA.

Notice at Collection: At or before the time of collection, you have a right to receive notice of our practices, including the categories of personal information and sensitive personal information to be collected, the purposes for which such information is collected or used, whether such information is sold or shared, and how long such information is retained.

Right to Know: You have a right to request that we disclose to you the personal information we have collected about you. You also have a right to request additional information about our collection, use, disclosure, or sale of such personal information.

Rights to Request Correction or Deletion: You also have rights to request that we correct inaccurate personal information and that we delete personal information under certain circumstances, subject to a number of exceptions.

Right to Limit Use and Disclosure of Sensitive Personal Information. You have a right to limit our use of sensitive personal information for any purposes other than to provide the services you request or as otherwise permitted by law. Note that we do not use or disclose sensitive personal information for any such additional purposes.

Non-discrimination: Finally, you have a right to not be discriminated against for exercising these rights set out in the CCPA.

Please be aware that we do not disclose personal information to any third parties for their direct marketing purposes as defined by this law.

California Customers may request further information about our compliance with this law by emailing support@getfinvest.com. Please note that businesses are required to respond to one request per California Customer each year and may not be required to respond to requests made by means other than through the designated email address.

Privacy Rights Under Other U.S. State Laws (Excluding California)

If you are a U.S. resident, you may have certain rights with respect to your personal information under applicable state privacy laws (e.g. Colorado, Connecticut, Utah (effective December 31, 2023) and Virginia). Such rights may include (in each case subject to applicable law):

• Right to confirm we are processing personal information about you and request access to such personal information
• Right to correct inaccurate information
• Right to delete personal information provided by or obtained about you
• Right to obtain a copy of personal information provided by you in a portable (and to the extent technically feasible) format
• To opt out of the processing of the personal information for purposes of (i) targeted advertising, (ii) the sale of personal information, or (iii) profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer, in each case as further detailed by the underlying U.S. state law
• Right to appeal a decision we make with respect to your privacy rights by submitting your request to support@getfinvest.com

To exercise your rights, please follow the directions in the "Exercising your rights over your data" section below.

Exercising Your Rights Over Your Data

In order to process your request, we will need to verify or authenticate your identity to the degree of certainty required by law. We will verify your request by asking you to send it from the email address associated with your account or requiring you to provide other information necessary to verify your account.

Except for the automated controls described in the "Your Personal Information Choices" section above, if you send us a request to exercise your rights, then to the extent permitted by applicable law, we may charge a fee or decline requests in certain cases.

For example, we may decline requests where granting the request would be prohibited by law, could adversely affect the privacy or other rights of another person, would reveal a trade secret or other confidential information, or would interfere with a legal, regulatory or business obligation that requires retention or use of the data.

We may decline a request where we are unable to authenticate you as the person to whom the data relates, the request is unreasonable or excessive, or where otherwise permitted by applicable law.

Where permitted by applicable law, you may also designate, in writing or through a power of attorney, an authorized agent to make requests on your behalf to exercise your rights. Before accepting such a request from an agent, we will require the agent to provide proof you have authorized it to act on your behalf, and we may need you to verify your identity directly with us.

Where permitted by applicable law, if you receive a response from us informing you that we have declined your request, in whole or in part, you may appeal that decision by submitting your appeal using the contact method described at the bottom of this Privacy Policy.

Links to Third-Party Websites and Services

Our Services may contain links to other websites, products or services that we do not own or operate. We are not responsible for the privacy practices of these non-affiliated third parties. Please be aware that this Privacy Policy does not apply to your activities on these third-party services or any information you disclose to these third parties. We encourage you to read their privacy policies before providing any information to them.

Changes to this Privacy Policy

This Privacy Policy will be updated from time to time when necessary to reflect changes in our Services, how we collect, use, or otherwise process personal information, or the applicable law. When we publish such changes, we will revise the "Effective Date" above. To stay informed of our privacy practices, we recommend you review this Privacy Policy on a regular basis as you continue to use our Services. If we make material changes to the Privacy Policy, we will provide additional notice and/or obtain consent regarding such changes where required by law.