Privacy Policy — Across America Financial

PRE-PUBLICATION REVIEW NOTE — COMPLETE BEFORE PUBLISHING

This Privacy Policy is a working draft. Before publication, complete or confirm the following placeholders and details:

• [Legal Entity Name], the legal entity operating Across America Financial;
• [Registered Address];
• [Effective Date] and [Last Updated Date];
• the final list of third-party service providers and processors;
• the actual website, application, cookie, advertising, analytics, financial-product, and data-retention practices; and
• any bank, lender, payment, credit-reporting, or other regulated-product partners.

This document should be reviewed by a licensed Florida attorney and a qualified privacy professional before launch. It has not been attorney-reviewed and is not legal advice.

Effective Date: [Effective Date] Last Updated: [Last Updated Date]

1. Who We Are and What This Policy Covers

Across America Financial is an online cash flow management platform designed to help people understand and manage everyday money.

This Privacy Policy explains how [Legal Entity Name], doing business as Across America Financial (“Across America Financial,” “we,” “us,” or “our”) collects, uses, shares, protects, and retains personal information.

This Policy applies to personal information collected through:

• our website, including https://acrossamericafinancial.com;
• our mobile applications, when available;
• our online cash flow management platform;
• our customer support channels;
• our subscription and membership services;
• our spending tracking, bill reminder, and savings goal features; and
• our financial products and services, including Buy Now, Pay Later, Overdraft Protection, Credit Builder, and Earned Wage Access, when those products are available.

Some financial products may be provided by a bank, lender, employer, payment provider, credit reporting agency, or other third-party partner. Those partners may provide separate privacy notices that also apply to their collection and use of information.

2. Information We Collect

The information we collect depends on how you use our services, the features you select, and the products available to you.

2.1 Information You Give Us

We may collect information you provide directly, including:

• full name;
• email address;
• telephone number;
• mailing or billing address;
• date of birth;
• account username and password;
• account recovery information;
• household or family-member information;
• information about members added to a Family or Elevated plan;
• customer support messages and other communications;
• preferences, savings goals, bill information, and budgeting information;
• information you provide when applying for or using a financial product;
• employment or income information, where required for a product;
• government-issued identification information, where required for identity verification;
• information needed to comply with fraud-prevention, anti-money-laundering, or “know your customer” requirements; and
• information you provide in surveys, promotions, feedback forms, or other interactions with us.

Please do not provide information about another person unless you are authorized to do so. If you add another person to a household or Family plan, you represent that you have permission to provide their information and invite them to the service.

2.2 Information From Connected Bank and Card Accounts

If you choose to connect a bank, card, or other financial account, we may receive information through a third-party account-aggregation provider.

Depending on the account and the permissions you provide, this information may include:

• financial institution name;
• account type;
• account name or nickname;
• account balance;
• transaction history;
• transaction descriptions and merchant names;
• deposits and income information;
• bills and recurring payment information;
• account and routing information, where made available by the provider;
• account ownership information; and
• other information authorized through the connection.

The third-party aggregation provider may collect and process information under its own privacy policy and terms.

We use connected-account information to provide features such as spending tracking, cash-flow views, bill reminders, savings goals, product eligibility, fraud prevention, and other services you request.

We do not move money from your connected bank or card accounts merely because you connect them to our platform. We do not initiate transfers, withdrawals, or payments from a connected account unless you separately authorize that activity and the applicable product terms clearly explain it.

2.3 Payment and Subscription Information

If you purchase a Plus plan, Family/Elevated plan, or another paid service, payment information is processed by a third-party payment processor.

The payment processor may collect:

• payment card details;
• billing address;
• payment amount;
• payment history;
• subscription details; and
• information used to detect payment fraud.

We do not store full payment card numbers on our own systems unless this Policy is updated to say otherwise. We may receive limited payment information, such as the card type, last four digits, billing ZIP Code, payment status, and processor transaction identifier.

2.4 Information Collected for Financial Products

If you apply for or use Buy Now, Pay Later, Overdraft Protection, Credit Builder, Earned Wage Access, or another regulated product, we or the relevant product partner may collect additional information, including:

• identity and contact information;
• date of birth;
• Social Security number or other government identifier;
• income and employment information;
• bank-account information;
• transaction and account information;
• repayment or payment history;
• information from consumer reporting agencies, where legally permitted;
• information used to assess eligibility, prevent fraud, or manage risk;
• information needed to administer an employer-sponsored benefit;
• information required for disclosures, servicing, reporting, and compliance; and
• information required by applicable financial, consumer-credit, anti-money-laundering, or identity-verification laws.

The specific information collected, the party making an eligibility decision, and the applicable privacy notice may vary by product. Product-specific terms and notices will be provided before enrollment or use.

2.5 Identity Verification and Fraud Prevention Information

Where required by law, a product partner, or our risk controls, we may collect and use information to verify your identity or prevent fraud.

This may include:

• government identification;
• a photograph or video used for identity verification;
• facial or biometric information, where legally permitted and separately disclosed;
• device and account information;
• information from fraud-prevention databases;
• information from public or commercial records; and
• information about suspected fraud, misuse, or unauthorized activity.

We will use identity-verification and fraud-prevention information only for disclosed purposes, legal compliance, security, and related legitimate business purposes.

2.6 Device, Usage, Log, and Technical Information

When you use our website or services, we may automatically collect:

• Internet Protocol address;
• device type and model;
• operating system;
• browser type;
• application version;
• language and time-zone settings;
• approximate location derived from IP address;
• unique device or advertising identifiers;
• pages, screens, and features viewed;
• links or buttons selected;
• dates and times of access;
• referring and exit pages;
• crash reports and performance data;
• login and authentication information;
• security and audit logs; and
• information about how you interact with our communications.

2.7 Cookies and Similar Technologies

We and our service providers may use cookies, pixels, software development kits, local storage, tags, and similar technologies.

These technologies may collect information about your device, browsing activity, preferences, and use of our services. See Section 9, “Cookies and Tracking Technologies,” for more information.

3. How We Use Information

We may use personal information to:

3.1 Provide and Operate the Services

We use information to:

• create and maintain your account;
• authenticate you;
• provide the Free, Plus, and Family/Elevated plans;
• display income, bills, spending, balances, and cash-flow information;
• provide bill reminders;
• support savings goals;
• connect information from accounts you authorize;
• manage household or Family-plan access;
• process payments and subscriptions;
• provide customer support; and
• deliver features and services you request.

3.2 Support Financial Product Features

We may use information to:

• determine whether you may be eligible for a product or feature;
• administer Buy Now, Pay Later plans;
• administer Overdraft Protection;
• administer Credit Builder services;
• administer Earned Wage Access;
• calculate or display amounts, dates, balances, fees, or repayment information;
• provide disclosures and required notices;
• service accounts and payments;
• communicate with product partners;
• report information where legally required or permitted; and
• manage risk and prevent misuse.

Eligibility decisions may be made by us, a bank or lender partner, an employer, or another third party. Product-specific terms and notices will explain the relevant process.

3.3 Secure Accounts and Prevent Fraud

We use information to:

• verify identity;
• authenticate account access;
• detect and prevent fraud, unauthorized activity, abuse, and security incidents;
• investigate suspicious transactions or behavior;
• protect our users, employees, partners, and systems; and
• maintain the integrity of our services.

3.4 Comply With Legal and Regulatory Requirements

We may use information to comply with:

• federal, state, and local laws;
• court orders, subpoenas, and legal process;
• financial-services requirements;
• anti-money-laundering and customer-identification requirements;
• consumer-protection requirements;
• tax, accounting, and financial-recordkeeping obligations;
• licensing and regulatory obligations;
• reporting obligations; and
• requests from government authorities.

3.5 Communicate With You

We may use information to send:

• account and security notices;
• transaction and service messages;
• billing and subscription communications;
• product disclosures and legally required notices;
• responses to customer-support requests;
• information about changes to our services or policies; and
• marketing communications, where permitted by law and subject to your choices.

You may opt out of promotional marketing messages as described in Section 12.

3.6 Improve Our Products and Services

We may use information to:

• understand how people use our services;
• troubleshoot and improve performance;
• develop new features;
• test and personalize user experiences;
• conduct analytics and research;
• measure communications and campaigns;
• maintain business records; and
• create aggregated or de-identified information that cannot reasonably be used to identify you.

We will not attempt to re-identify properly de-identified information except as permitted by law.

4. How We Process Information and Applicable Privacy Rights

Privacy laws differ by state and may apply differently depending on the type of information we collect and the product you use.

Depending on where you live and whether a law applies to us, you may have rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA/CPRA”), and similar laws in Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and other states.

4.1 Our Privacy Processing Grounds

Where applicable, we process personal information based on one or more of the following:

• providing a service or performing a contract with you;
• your consent;
• complying with legal or regulatory obligations;
• protecting your account, our systems, and other people;
• preventing fraud and misuse;
• pursuing legitimate business purposes that are not overridden by your rights; and
• other grounds permitted by applicable law.

4.2 Categories of Information

The categories of personal information we may collect include:

We may disclose categories of information to service providers and other recipients as described in Section 7.

4.3 Rights to Know and Access

You may have the right to request information about:

• the categories of personal information we collect;
• the specific pieces of personal information we maintain about you, subject to legal exceptions;
• the sources from which we collect information;
• our business or commercial purposes for collecting or using information; and
• the categories of third parties to whom we disclose information.

4.4 Right to Correct

You may have the right to request correction of inaccurate personal information.

You can also update certain account information directly through your account settings. We may ask for information needed to verify the requested correction.

4.5 Right to Delete

You may have the right to request deletion of personal information we collected from you.

Deletion is subject to legal exceptions. We may retain information when necessary to:

• complete a transaction;
• provide a service you requested;
• maintain security;
• detect or prevent fraud;
• comply with legal or regulatory obligations;
• complete financial or tax recordkeeping;
• exercise or defend legal claims;
• preserve evidence;
• comply with a legal request; or
• use information in a manner permitted by applicable law.

Deleting your information may limit or terminate your ability to use some services.

4.6 Right to Data Portability

You may have the right to receive certain personal information in a portable and usable format, or to request that it be transmitted to another entity where technically feasible and required by law.

4.7 Right to Opt Out of Sale or Sharing

We do not sell personal information for money.

We may use service providers and business partners to operate our services. We do not sell personal information in exchange for monetary payment.

Some privacy laws may define “sale” or “sharing” broadly. If any of our use of information is treated as a sale or sharing under an applicable law, you may have the right to opt out.

We may also use analytics or advertising technologies that could be considered “sharing” or targeted advertising under certain state laws. The final list of these technologies and our opt-out controls must be confirmed before publication.

4.8 Right to Opt Out of Targeted Advertising

Where required by applicable law, you may opt out of the use of personal information for targeted or cross-context behavioral advertising.

You may exercise this choice through:

• [Do Not Sell or Share My Personal Information] link;
• [Your Privacy Choices] link;
• cookie or privacy settings;
• account settings, where available;
• a request to support@acrossamericafinancial.com; or
• an applicable opt-out preference signal, such as Global Privacy Control.

4.9 Right to Limit Use of Sensitive Personal Information

California residents and residents of other states with similar rights may have the right to limit certain uses or disclosures of sensitive personal information.

We use sensitive information primarily for purposes such as:

• providing the service or product you request;
• identity verification;
• fraud prevention and security;
• legal and regulatory compliance;
• servicing financial products;
• processing transactions;
• maintaining accounts; and
• other purposes permitted by applicable law.

Where applicable, you may submit a request to limit the use or disclosure of sensitive personal information by contacting support@acrossamericafinancial.com or using [Limit the Use of My Sensitive Personal Information].

4.10 Right to Appeal

If we deny a privacy request where applicable law provides an appeal right, you may appeal by replying to our response or emailing support@acrossamericafinancial.com with the subject line “Privacy Appeal.”

Your appeal should include:

• your name;
• the email address associated with your account;
• the type of request;
• the date of our decision; and
• the reason you believe the decision should be reconsidered.

We will review the appeal and provide a written response within the time required by applicable law. If we deny an appeal, we will explain the reason where required and tell you how to contact the applicable state privacy regulator.

4.11 Right to Non-Discrimination

We will not unlawfully discriminate against you for exercising a privacy right.

Unless permitted by law, we will not:

• deny you goods or services;
• charge you a different price;
• provide you a different level or quality of service; or
• threaten or suggest that you will receive different treatment

because you exercised a privacy right.

Some services may not function if you ask us to delete information or disconnect an account that the service requires.

4.12 Financial Information and the Gramm-Leach-Bliley Act

Some financial information we collect may be subject to the Gramm-Leach-Bliley Act (“GLBA”) and other financial privacy laws.

To the extent information is governed by the GLBA or another sector-specific financial privacy law, it may be handled under the privacy notice and rights applicable to that law rather than under all provisions of a state comprehensive privacy law. State privacy laws may also contain exemptions for information collected, processed, sold, or disclosed under the GLBA.

This Policy does not replace any separate financial privacy notice required for a regulated financial product.

4.13 How to Submit a Privacy Request

To submit a request, email:

support@acrossamericafinancial.com

Please identify the type of request in the subject line, such as:

• Privacy Request — Access;
• Privacy Request — Correct;
• Privacy Request — Delete;
• Privacy Request — Opt Out;
• Privacy Request — Limit Sensitive Information; or
• Privacy Appeal.

We may also provide an online request form at [Privacy Request URL].

We will not require you to create an account solely to submit an opt-out request. We may ask you to provide information reasonably necessary to verify your identity and protect your information.

4.14 Verification of Requests

For certain requests, we must verify that you are the person about whom we collected information.

Verification may involve:

• confirming information associated with your account;
• signing in to your account;
• confirming an email address or telephone number;
• responding to questions about recent account activity; or
• providing additional information reasonably necessary to prevent fraud.

We will not request highly sensitive information unless reasonably necessary for verification. If we cannot verify your identity, we may be unable to complete the request.

4.15 Authorized Agents

Where permitted by law, you may designate an authorized agent to submit a privacy request on your behalf.

We may require:

• written permission signed by you;
• proof of the agent’s identity;
• proof that the agent is authorized to act for you;
• confirmation directly from you; or
• other information required by applicable law.

A request made through a recognized opt-out preference signal may be treated as a request directly from the consumer where required by law.

5. Sharing and Disclosure of Information

We may disclose personal information for the purposes described in this Policy.

5.1 Service Providers and Processors

We may disclose information to companies that provide services for us, including:

• bank-account aggregation providers;
• cloud hosting and infrastructure providers;
• payment and subscription processors;
• identity-verification providers;
• fraud-prevention and security providers;
• analytics providers;
• customer-support platforms;
• communications and email providers;
• software and technology providers;
• data storage and backup providers;
• accounting, audit, and professional advisers; and
• other vendors necessary to operate the services.

These providers may use information only as permitted by our agreements and applicable law.

The final list of third-party processors must be completed before publication and may be available at [Third-Party Providers Page].

5.2 Banks, Lenders, Employers, and Financial Partners

Where a regulated product is delivered through a bank, lender, employer, payment provider, credit reporting agency, or other partner, we may disclose information necessary to:

• evaluate eligibility;
• provide or administer the product;
• process or service transactions;
• verify identity;
• prevent fraud;
• comply with legal obligations;
• provide customer support;
• report or receive information as permitted by law; and
• enforce applicable product terms.

The relevant partner may provide its own privacy policy and legally required financial privacy notices.

5.3 Your Direction or Consent

We may disclose information when you direct us to do so or consent to the disclosure, including when you:

• connect an account;
• authorize an account aggregator;
• request a product or service;
• add a household member;
• share information through a feature; or
• authorize a third-party integration.

5.4 Legal and Regulatory Disclosures

We may disclose information when reasonably necessary to:

• comply with law, regulation, legal process, subpoena, or court order;
• respond to government or regulatory requests;
• enforce our agreements;
• investigate suspected violations;
• protect the rights, property, safety, or security of Across America Financial, our users, or others; or
• detect, prevent, or investigate fraud, security incidents, or other unlawful activity.

5.5 Corporate Transactions

We may disclose information in connection with:

• a merger;
• acquisition;
• financing;
• reorganization;
• bankruptcy;
• sale of assets;
• change in ownership; or
• negotiation of any of these transactions.

We will handle personal information in accordance with applicable law and will provide required notices about material changes in ownership or use.

5.6 Aggregated and De-Identified Information

We may share information that has been aggregated or de-identified so that it cannot reasonably be used to identify you.

We may use this information for analytics, research, reporting, product improvement, and other lawful business purposes.

5.7 No Sale of Personal Information

We do not sell your personal information for money.

We do not provide your personal information to third parties to sell it as a standalone data asset. If our practices change, we will update this Policy and provide any notices and choices required by law.

6. Information About Financial Products

Across America Financial currently markets or may offer the following product lines:

• Buy Now, Pay Later;
• Overdraft Protection;
• Credit Builder; and
• Earned Wage Access.

These products may involve additional data collection, eligibility requirements, disclosures, underwriting, credit reporting, repayment, servicing, licensing, and regulatory obligations.

The availability, terms, fees, eligibility criteria, and provider for each product may vary by state and customer. A product may be provided by Across America Financial or by a third-party partner.

Before you enroll in a regulated product, we will provide applicable terms, disclosures, consent requests, and product-specific privacy information.

7. Cookies and Tracking Technologies

7.1 Types of Technologies We May Use

We may use the following categories of cookies and similar technologies:

Strictly necessary technologies: These support account login, security, fraud prevention, navigation, accessibility, and core site functions. They generally cannot be disabled through ordinary cookie settings without affecting the service.

Functional technologies: These remember preferences, settings, language, and other choices to improve your experience.

Analytics technologies: These help us understand usage, performance, traffic, errors, and feature effectiveness.

Advertising technologies: These may be used, if implemented, to measure campaigns, display relevant advertising, or understand activity across websites or services. The final advertising technologies must be confirmed before publication.

7.2 Managing Cookies

You may manage cookies through:

• your browser settings;
• device settings;
• our cookie preference tool, when available;
• advertising-industry controls; or
• links and controls provided by third-party providers.

Disabling cookies may affect the availability or functionality of certain features.

7.3 Global Privacy Control and Opt-Out Signals

Where required by applicable law, we will honor valid opt-out preference signals, including Global Privacy Control (“GPC”), as a request to opt out of the sale or sharing of personal information or targeted advertising.

The effect of an opt-out signal may depend on the applicable law, the browser or device sending the signal, and whether the signal is associated with a recognized account.

7.4 Cookie Banner

A cookie consent banner and preference-management tool will be implemented before launch. The final banner will describe the technologies used and provide controls required by applicable law.

8. Data Security

We use administrative, technical, and physical safeguards designed to protect personal information.

These safeguards may include:

• encryption in transit;
• encryption at rest;
• access controls;
• authentication and authorization procedures;
• monitoring and logging;
• security testing;
• vendor risk management;
• employee training;
• incident-response procedures; and
• backup and recovery controls.

We describe our security as “bank-level” only to the extent that our actual controls support that statement and the claim has been reviewed before publication.

No method of transmitting or storing information is completely secure. We cannot guarantee that personal information will never be accessed, disclosed, altered, or destroyed through a security incident.

If we discover a legally reportable security incident, we will provide notices required by applicable law.

9. Data Retention

We retain personal information for as long as reasonably necessary for the purposes described in this Policy.

Retention periods depend on:

• the type and sensitivity of the information;
• the reason it was collected;
• whether you maintain an account;
• whether you use a financial product;
• legal, regulatory, accounting, tax, and audit requirements;
• fraud-prevention and security needs;
• dispute resolution and legal claims; and
• our legitimate business needs.

When you close your account or request deletion, we may delete, de-identify, or restrict access to personal information, subject to applicable exceptions.

We may retain information for longer periods when required or permitted for:

• financial and transaction records;
• anti-money-laundering and identity-verification requirements;
• consumer-credit, payment, tax, or regulatory records;
• fraud prevention;
• security logs;
• legal holds;
• disputes and litigation;
• enforcement of agreements; or
• backup and disaster-recovery systems.

Information retained for legal or regulatory purposes will be protected and used only for the applicable purpose, unless otherwise permitted by law.

10. Children’s Privacy

Our services are intended for adults and are not directed to anyone under 18.

We do not knowingly collect personal information from children under 18. If you believe that a child has provided personal information to us, contact us at support@acrossamericafinancial.com.

If we learn that we collected personal information from a child under 13 without legally required parental consent, we will take reasonable steps to delete it.

11. Your Choices

11.1 Marketing Communications

You may opt out of promotional emails by using the unsubscribe link in the message or contacting support@acrossamericafinancial.com.

Even if you opt out of marketing communications, we may continue to send non-promotional messages about:

• your account;
• security;
• billing;
• transactions;
• product servicing;
• legal notices; and
• changes to our services or policies.

11.2 Closing Your Account

You may request to close your account by contacting support@acrossamericafinancial.com or using the account-closure option available in the service.

Closing your account may not immediately delete all information. We may retain information as described in Section 9.

11.3 Disconnecting a Linked Account

You may disconnect a linked bank or card account through the platform, where available, or by contacting support.

Disconnecting an account may stop future data access but may not delete information previously collected. Information already collected may be retained for service, legal, security, fraud-prevention, or financial-recordkeeping purposes.

You may also need to revoke access directly with the third-party account-aggregation provider or financial institution.

11.4 Deleting Information

To request deletion of your personal information, contact support@acrossamericafinancial.com with the subject line “Privacy Request — Delete.”

We may need to verify your identity before processing the request. Some information may be retained as required or permitted by law.

12. Third-Party Links and Services

Our website, application, emails, or services may contain links to third-party websites, applications, products, or services.

Those third parties may have their own privacy policies and practices. We are not responsible for their content, security, or privacy practices.

Review the privacy policy of any third party before providing information or connecting an account.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time.

If we make a material change, we will provide notice required by applicable law. Notice may be provided by:

• posting the updated Policy on our website;
• updating the “Last Updated” date;
• displaying a notice in the application;
• sending an email or account message; or
• using another legally permitted method.

Your continued use of the services after the effective date of an updated Policy means that the updated Policy applies to your use of the services, except where applicable law requires your consent.

14. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices, contact us at:

Across America Financial Legal Entity: [Legal Entity Name] Registered Address: [Registered Address] Email: support@acrossamericafinancial.com Privacy Request URL: [Privacy Request URL]

We will respond to privacy requests within the time required by applicable law.