FLEX PRIVACY POLICY

This Privacy Policy describes how Flexbase Technologies, Inc., (“Flex,” “we,” or “us”) and its subsidiaries collect and use your personal information that you provide in connection with our products and services, including: (a) Flex financial services and credit products and tools made available through a mobile application, payment card, or otherwise; and (b) the websites we own or operate, including flex.one. 

In this Privacy Policy, the above are referred to collectively as the “Services.” This policy describes the choices available to you regarding our use of your personal information and how you can access and update this data. Services include software and services that we own and operate directly and software and services that we market or provide from or on behalf of third parties. 

If you have any questions regarding this Privacy Policy, please contact us at privacy@flex.one. By using any of the Services, you agree to be bound by this policy. If you do not agree to the terms of this Privacy Policy, please do not provide us with any personal information and do not use the Services. 

The Services are intended for a general audience. We do not knowingly collect personal information from children under the age of 13. We will delete any personal information collected that we later determine to be from a user younger than the age of 13. If you are a parent or guardian of a child under the age of 13 and you believe he or she has disclosed personal information to us, please contact Customer Service using the contact information below. 

The Services are provided to users from systems in the United States. If you are from outside the United States and use the Services, please be aware that the data protection laws in the United States may differ from those of the country where you are located, and your personal information may be subject to access requests from governments, courts, or law enforcement in the United States according to the laws of the United States. In addition, such data may be stored on servers located outside your resident jurisdiction and in jurisdictions that may have less stringent privacy practices than your own. By using the Services or providing us with any information, you consent to the transfer, processing, usage, sharing, and storage of your information, including personal information, in the United States as set forth in this Privacy Policy. 

If you are a California resident, you may have certain rights as provided in the California Consumer Privacy Act (“CCPA”). Section VI of this Notice, which describes our collection and use of information through our sites and Services, also serves as our Notice at Collection for California residents for CCPA purposes, which you can view by clicking here. For additional CCPA-specific provisions of this Privacy Policy, please see Section VI below.

If you are located outside of the United States, you may have certain rights under applicable privacy laws outside of the United States. Please see Section VIII below for more information.

I. Information Collected Via The Services

We may obtain various types of personal information about users of the Services and non-customer website visitors. This data may include: 

• Contact information (name, address, phone number, Social Security Number, work-related information, and email address); 
• Information about services ordered or provided; 
• Information collected through Internet-based and e-commerce activities such as information obtained from log files, cookies, clear gifs (i.e., web bugs), images, and scripts; 
• Customer service and demographic data such as gender, income level, and information about your prior experiences with our Services; 
• Information collected from our third-party service providers. We use unaffiliated third parties to gather data on customers and prospective customers from financial institutions, consumer reporting agencies, and other information service providers. By using the Services, you acknowledge that our unaffiliated, third-party providers will have the right, power, and authority to act on your behalf to access and transmit your personal and financial information from the relevant financial institution or consumer reporting agency, according to the terms of such third-party provider's privacy policy; and 
• Transaction-related data, including data sent to us from a credit card processor to process transactions if you make purchases, such as transaction amount, merchant details, and an anonymized value identifying your card for Lithic or Plaid, our payment processors. You may review their privacy policies at lithic.com/legal/privacy-policy or plaid.com/legal, respectively. 

When providing the Services we may also collect the following information about your devices, including: 

• Device information, such as the operating system version, processor type, memory space, and the like; 
• Information about software on your device, including the version of certain software programs and when they were installed and/or upgraded; 
• Browsing history, preferences, internet addresses, unique identifiers, device types, device location, and other similar information; and
• Information collected from logs, configuration files, and other system or software-level information. 

We will retain your personal information for as long as needed or permitted in light of the purposes for which it was obtained. The criteria used to determine our retention periods include: (i) for as long as we have an ongoing relationship with you; (ii) as required to comply with our legal obligations; or (iii) to enforce our legal interests.

II. Information Usage

You agree that we may use the personal information you submit in order to: 

• Accomplish our business purposes, including to deliver, determine your eligibility for or provide the Services, establish or maintain customer and business relationships, obtain, upon your authorization, a credit report, references, and other information from credit bureaus or other third parties in connection with your potential use of the Services, verify your identity, detect and guard against potential fraud and identity theft, detect security incidents and protect against malicious, deceptive, fraudulent or illegal activity, improve the Services, provide access to Internet-based and e-commerce activities, perform accounting functions, and conduct other activities as necessary or appropriate in connection with the Services.
• Market our products and services to you, and the products and services of our third-party partners that we may promote or market on their behalf, including to send you information about products, services, or promotions.
• Opt-out: You may opt out of these promotional communications by following the instructions in each message, or by contacting us at privacy@flex.one.
• Send you service updates, announcements, and alerts related to the Services, including notices of security incidents, downtime, or planned maintenance. You may not opt-out of these service communications. If you do not wish to receive them, you have the option of deactivating your account and ceasing your use of the Services. 

In addition, we may transfer or disclose personal information to our service providers as needed for such service providers to perform services on our behalf as required to fulfill our obligations to you. Service providers and business partners that are provided information under this section will not use personal information for any other purposes. If we have actual knowledge that a business partner or service provider is processing your personal information in a way that is contrary to this Privacy Policy, we will take reasonable steps to prevent or stop such processing. 

We may transfer or disclose personal information, including your contact information, to our affiliates, licensees, partners, and other third parties only in accordance with the terms of written agreements and as necessary to offer and improve our Services, effectuate your transactions and assist us in advertising regarding our Services. 

We will, in our sole discretion, disclose your personal information to third parties in certain additional limited cases: (1) when we have reason to believe that disclosing this information is necessary to identify, contact, or bring legal action against someone who may be causing injury to or interference with our rights or the rights of our customers and vendors; (2) when we believe in good faith that the law requires us to do so; (3) to a subsequent owner, co-owner, or operator of a website or service or in connection with a merger, consolidation, dissolution, or restructuring, or the sale of substantially all of our interests and/or assets (which may include the sale of personal information to one or more parties), or other corporate change, including during the course of any due diligence process; and (4) in situations involving threats to the physical safety of any person. 

We do not collect, use, or sell personal information for the purpose of training large language models.

SMS/text messaging opt-in data and consent information will not be shared with third parties for marketing or promotional purposes. We may share such data with service providers who assist us in delivering messages on our behalf, subject to contractual restrictions on further use. 

III. Information Security 

Your data is of the utmost importance to us. We use transmission technologies to encrypt your personal information so it cannot be read in transit. In addition, we use secure technology, privacy protection controls, and restrictions on employee access to safeguard your personal information in storage. 

Please note, however, that although we employ industry-standard security measures to safeguard the security of your personal information, no transmissions made on or through the Internet are guaranteed to be secure. Therefore, we cannot ensure the absolute security of any information you transmit to us, and you use our Services and provide us with your information at your own risk.

IV. Tracking Technologies  

To the extent allowed by applicable law, we may use technologies such as cookies, beacons, and other tracking technologies which may be operated by our third party services providers who assist us in collecting information about usage of the Services, serving ads, or providing other services to you, such as: enabling features that are necessary for providing you the Services, identifying you as being signed in, tracking content views, remembering your preferences, and the number of times you have been shown an advertisement; allowing us to understand how our Services are being used, track site performance, and make improvements; and delivering tailored advertising based on your preferences or interests across services and devices, and measuring the effectiveness of advertisements. 

Statements regarding our practices do not apply to the methods for collecting information used by these third parties or the use of the information that such third parties collect. We do, however, work with third parties to make efforts to have you provided with information on their practices and any available opportunity to exercise choice. We make no representations regarding the policies or practices of such third parties. We do not respond to browser ‘Do Not Track’ signals because no industry standard for responding to such signals has been established.

Please contact us for information on third parties to whom we have sold or may sell your personal information.

V. Other Services  

If you click on a link to a third-party site, you will leave the site you are visiting and be redirected to the site you selected. Because we cannot control the activities of third parties, we do not accept responsibility for any use of your personal information by such third parties, and we do not guarantee that they will adhere to the same privacy policies as described in this Privacy Policy. We encourage you to review the privacy policies of any other service provider from whom you request services. If you visit a third-party site that is linked to a Service, you should read that third-party site’s privacy statement before providing any personal information. 

Our Services may include social media features, such as a “Share This” or similar button that allows you to like us on Facebook or share our content on Twitter. These features may collect your IP address and information regarding your use of the Services. Social media features are either hosted by a third party or hosted directly on our systems. Your interactions with these features are governed by the privacy statement of the applicable company. 

VI. California Consumer Privacy Act (CCPA)

This section serves as Flex’s Notice at Collection and contains California privacy disclosures pursuant to the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CPRA).

A. Categories of Personal Information We Collect 

The following table describes the categories of personal information we collect and our purposes for collecting each category.

‍

For information on how long we retain each category of personal information listed above, please refer to the retention criteria described in Section I of this privacy policy, which apply to all categories of personal information we collect.

B. Sources of Personal Information 

We collect personal information directly from information you provide to us; indirectly from our affiliates, service providers, and other vendors; and indirectly through your interactions with websites or advertisements.

C. Disclosures of Personal Information for Business Purposes 

We disclose the categories of personal information described above to the following categories of service providers and contractors for business purposes:

• Payment processing and banking partners: Identifiers, financial information, commercial information, and sensitive personal information, as necessary to process transactions, settle payments, and maintain accounts through our bank partners.
• Cloud infrastructure and hosting providers: All categories listed above, as necessary to host and operate our platform and maintain data security.
• Identity verification and fraud prevention providers: Identifiers, financial information, sensitive personal information, and geolocation data, as necessary to verify customer identity, prevent fraud, and comply with KYC/AML requirements.
• Analytics and performance monitoring providers: Internet/network activity and inferences, as necessary to monitor platform performance and improve our services.
• Customer support platforms: Identifiers, commercial information, and feedback/customer service data, as necessary to respond to customer inquiries and resolve issues.
• Credit reporting agencies: Identifiers, financial information, and professional/employment information, as necessary for credit underwriting and regulatory reporting.

All service providers and contractors are contractually required to use personal information only for the business purposes specified in their agreements with Flex and are prohibited from selling or sharing your personal information.

D. Sale and Sharing of Personal Information

Flex does not sell personal information for monetary consideration. However, certain digital analytics and advertising activities may constitute a “sale” or “sharing” of personal information as those terms are defined under applicable privacy laws. Flex may sell and/or share identifiers (other than phone numbers), commercial information, and Internet/Network Activity (including device identifiers, cookies, and browsing activity) with advertising partners for cross-context behavioral advertising and advertising measurement. To opt out of selling or sharing, click Your Privacy Choices. We also honor Global Privacy Control (GPC) signals as valid opt-out requests.

E. Use of Sensitive Personal Information

Flex uses and discloses sensitive personal information only as necessary to provide the services you have requested and for purposes authorized under applicable law.

F. CCPA/CPRA Rights Disclosure

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), grants you certain rights regarding your personal information. These rights include the right to:

• Know and Access: Be informed about the categories of personal information we collect, disclose, or share about you and the categories of sources from which such information is collected.
• Purpose & Third Parties: Be informed about the business or commercial purpose for collecting, selling, or sharing personal information and the categories of third parties with whom we share or disclose personal information.
• Specific Data Request: Receive the specific pieces of personal information we have collected about you.
• Correct Information: Correct inaccurate personal information that we maintain about you.
• Delete Information: Delete personal information we have about you, subject to certain legal exceptions.
• Opt-Out of Sale or Sharing: Opt out of the sale or sharing of your personal information, including for cross-context behavioral advertising.
  

To make a CCPA/CPRA request, please contact us at privacy@flex.one, call (833) 353-9267, or mail us at Flexbase Technologies, Inc., 390 NE 191st St #8019, Miami, FL 33179.

To verify your identity when you submit a request to know, delete, or correct, we will ask you to confirm information associated with your account, such as your email address and the last four digits of your Social Security number. If we cannot verify your identity to a reasonable degree of certainty, we may request additional documentation. For requests to access specific pieces of personal information, we will apply a higher degree of verification, which may include matching at least three data points you provide against our records.

You may designate an authorized agent to submit a request on your behalf. To do so, you must provide the authorized agent with written permission signed by you, and we may require the agent to submit proof of that authorization when making the request. We may also require you to verify your own identity directly with us, even when using an authorized agent, unless the agent provides a valid power of attorney.

Additional Information

• You may only make such requests twice within a twelve-month period.
• Requests are generally free, but we may charge a reasonable fee or deny your request if it is manifestly unfounded, excessive, or repetitive.
• We do not discriminate against consumers for exercising their rights under the CCPA/CPRA. However, certain features or services may require the use of personal information, and limitations on data processing may affect service availability.
• Please note that certain information may be exempt from such requests under California law. For example, we need certain information in order to provide the Services to you. 

If you would like further information regarding your legal rights under California law, please contact us at privacy@flex.one.

G. California Direct Marketing Information Requests

If you are a California resident, California Civil Code Section 1798.83 allows you to request, once per year and free of charge, information about whether we disclosed personal information to third parties for their direct marketing purposes in the preceding 12 months. If applicable, this information will include a list of categories of personal information shared and the names and addresses of third parties who received it.

To make such a request, please submit your written request to privacy@flex.one or Flexbase Technologies, Inc., 390 NE 191st St #8019, Miami, FL 33179. 

VII. Privacy Rights Under Other State Laws

Depending on your state of residence, you may have certain rights regarding your personal information, such as the right to access, delete, correct, or opt out of certain data processing activities. We will honor these rights as required by applicable law, and you may contact us using the information in the “Miscellaneous” section to exercise them. Only you or, as permitted by law, a person that you authorize to act on your behalf, may make a request related to your personal information. For certain requests, we must verify your request before we can fulfill it. Verifying your request will require you to provide sufficient information for us to reasonably confirm that you are the person about whom we collected personal information or that the requestor is authorized to act on your behalf. We will not discriminate against you for exercising your privacy rights.

Specific privacy rights you may have, subject to certain exceptions, include as follows:

• Right to Access. You may have the right to request that we disclose what personal information we collect, use, disclose, and sell about you.
• Right to Correction. You may have the right to request correction of personal information that we maintain about you if you find that the personal information is inaccurate.
• Right to Deletion. You may have the right to request that we delete personal information that we have collected from you.
• Data Portability. You may have the right to request a copy of your personal information in a portable and, to the extent technically feasible, readily usable format.
• Right to Withdraw Consent. You may have the right to withdraw your consent to the processing of your personal information.
• Right to Opt-Out. You may have the right to opt-out of certain uses of your personal information such as for (i) targeted advertising, (ii) “sale” or “sharing” for cross-context behavioral advertising, or (iii) profiling or automated decision-making activities that can result in a legal or similarly significant effect on you. You can opt-out of uses (i) and (ii) by adjusting your cookies settings to reject analytics and advertising cookies, noting that these adjustments may be specific to the Flex site on which you make them. Additionally, if you visit our sites with the GPC preference signal enabled, if required by law, that signal will be treated as a request to opt-out of “sale,” “sharing,” or targeted advertising. Please note your request may apply only to the browser or device from which you submit the request. 
• Right to a List of Third Parties. You may have the right to obtain a list of third parties to which we have disclosed personal information.
• Right to Appeal. In some circumstances, we may deny your request to exercise one of your privacy rights described in this privacy policy (e.g., if we cannot verify your identity). In such a case, we will communicate this in writing and explain the reasons for the denial. You may appeal our decision by responding to our denial email or submitting a request to privacy@flex.one. We will notify you of our decision regarding your appeal in writing. If we deny your appeal, you may have the right to contact your state Attorney General to file a complaint.
• Right to Information on Profiling.  Should your personal information be processed for the purposes of profiling in furtherance of any automated decision that produced any legal or similarly significant effect concerning you, and if feasible, you may have the right to (i) question the result of such profiling, (ii) be informed of the reason that such profiling resulted in such decision, and (iii) review your personal information that was processed for the purposes of such profiling.

VIII. Notice for Individuals Located Outside of the United States

This section applies to individuals located outside of the United States whose personal information is processed by Flex. Flex is a United States-based company and you understand that when you provide your personal information to Flex, Flex will process that information in the United States in accordance with United States data protection laws.

To the extent that any laws outside of the United States govern our processing of your personal information, we provide the following notice to you. You may have additional rights in your country of residence and Flex is committed to honoring those rights and complying with applicable laws.

For the purposes of complying with those laws, Flex commits to the following:

1. Accountability

Flexbase Technologies, Inc., 390 NE 191st St #8019, Miami, FL 33179, USA, acts as the controller of all personal information collected from individuals outside of the United States. We have designated individuals responsible for overseeing our compliance with applicable privacy laws. 

2. Collection, Use, and Disclosure

For a description of the types of personal information we hold, our purposes for collection, and the categories of third parties with whom we share personal information (including affiliates and subsidiaries), please refer to Sections I and II of this privacy policy.

3. Consent

If we are required to rely on your consent to collect, use, and disclose your personal information in your country of jurisdiction, we will provide you notice and ask for your consent, which may be express or implied depending on the sensitivity of the information and the laws of the jurisdiction where you reside. You may withdraw your consent at any time by contacting us at privacy@flex.one. Withdrawal of your consent may affect our ability to provide certain Services. We will explain any impact at the time of your request.

4. Your Rights

Subject to applicable law and certain exceptions, you may have the right to: (a) access the personal information we hold about you and obtain a copy; (b) request correction or rectification of inaccurate or incomplete personal information; (c) request deletion, erasure, or anonymization of your personal information; (d) request restriction of processing of your personal information; (e) request data portability, including to receive your personal information in a structured, commonly used, and machine-readable format; (f) withdraw consent to the processing of your personal information; (g) object to certain processing of your personal information, including processing based on legitimate interests or for direct marketing purposes; (h) object to, or not be subject to, decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects; and (i) request de-indexation of hyperlinks associated with your name where dissemination of the personal information causes serious harm to your privacy or reputation or contravenes applicable law. To exercise any of these rights, contact us at privacy@flex.one. We may need to verify your identity before processing your request.

5. Retention and Security

We retain personal information in accordance with the criteria described in Section I of this privacy policy. When personal information is no longer necessary to fulfill the purposes for which it was collected, or as required by law, we will securely destroy, erase, or anonymize it. We protect personal information using the safeguards described in Section III.

6. Legal Bases for Processing

We process your personal information on the following legal bases: (a) Contract – where processing is necessary to perform or enter into a contract with you for our Services; (b) Legal obligation – where processing is necessary to comply with applicable laws; (c) Legitimate interests – where processing is necessary for our legitimate interests (such as fraud prevention, improving our Services, and direct marketing), provided those interests are not overridden by your rights; and (d) Consent – where you have given specific consent for a particular processing activity, such as receiving promotional communications. You may withdraw consent at any time by contacting us at privacy@flex.one without affecting the lawfulness of processing carried out before withdrawal. The provision of your personal information is a contractual requirement necessary to enter into and use the Services; if you do not provide the required personal information, we may be unable to provide the Services to you.

7. International Transfers

Your personal information will be transferred to and processed in the United States. Where required by law, we rely on appropriate safeguards for such transfers, such as, where applicable, Standard Contractual Clauses approved by the European Commission and/or the UK International Data Transfer Agreement. You may obtain a copy of the relevant safeguards by contacting us at privacy@flex.one.

8. Questions and Complaints

If you have privacy-related inquiries, complaints, requests, or to obtain additional information about our privacy practices or the handling of your personal information, please contact us at privacy@flex.one. If you are not satisfied with our response, you may contact the supervisory authority in the jurisdiction where you reside.

IX. Bank Partners

Flex may offer through one or more bank partners different services or products. Please see below for bank-specific privacy policy and terms.

Lead Bank:

https://www.lead.bank/privacy-and-terms

X. Miscellaneous

You can access, update or correct your information, or otherwise ask us questions about this Privacy Policy by contacting us as follows: 

Email: privacy@flex.one

Mail: Flexbase Technologies, Inc. 

390 NE 191st St #8019 

Miami, FL 33179 

Phone: (833) 353-9267

We may update this Privacy Policy from time to time to reflect changes to our information practices. When we make changes to this Privacy Policy, we will revise the “Effective Date” at the beginning of the policy. Your continued use of our Services after the Effective Date of any such changes constitutes your acceptance of the updated Privacy Policy.