PRIVACY POLICY

Introduction

Because FuteurCredX helps you apply for financial products, we handle sensitive financial and identity information. We are committed to protecting it and to being transparent about how it is used. This Policy applies to information we collect through the Platform; it does not govern the separate privacy practices of the Lending Partners or other third parties to whom we transmit your application.

Information We Collect

Information you provide

• 2.1Business information — legal name, EIN/tax ID, address, entity type, industry, time in business, and stated revenue;
• 2.2Owner / applicant information — legal name, date of birth, Social Security Number, ownership percentage, residential address, email, and phone;
• 2.3Financing request — amount requested, purpose of funds, and timing;
• 2.4Financial documents — business bank statements and other financial documents you connect or upload;
• 2.5Account and communications — credentials via our identity providers, support messages, and preferences.

Information we obtain from others

• 2.1Credit and business data from consumer and commercial credit bureaus (such as Experian, Dun & Bradstreet, Equifax, and TransUnion), including scores, tradelines, and risk indicators;
• 2.2Verification and results from Lending Partners and service providers, including application status and offers;
• 2.3Bank and document data derived from the statements you upload, extracted and analyzed by automated and third-party AI systems.

Information collected automatically

• 2.1Device, browser, IP address, and usage/analytics data collected through cookies and similar technologies to operate, secure, and improve the Platform.

How We Use Your Information

We use your information to:

• 3.1Create and manage your account and verify your and your business’s identity;
• 3.2Where expressly disclosed, run soft-inquiry prequalification and estimate the products you may qualify for;
• 3.3Obtain and evaluate business and personal credit reports under your authorization (see our Terms §6);
• 3.4Extract and analyze your bank statements to assess cash flow and match you to appropriate products;
• 3.5Prepare, submit, and service your application with our Lending Partners;
• 3.6Communicate with you about your application, offers, and account;
• 3.7Detect and prevent fraud, secure the Platform, and comply with legal and regulatory obligations;
• 3.8Operate, analyze, and improve our products using aggregated and de-identified data.

Credit Reporting and FCRA

How We Share Your Information

We disclose information for the purposes described below and as otherwise permitted or required by law:

• 5.1Lending Partners — we transmit your application, credit data, and supporting documents to one or more banks/lenders (and, through our integration provider Lendflow, to their network) so they can underwrite and, if approved, fund you. They use your information under their own privacy policies;
• 5.2Service providers — identity/authentication, credit bureaus, bank-data and document-processing providers, artificial-intelligence services that analyze statements, hosting, payments, analytics, and communications vendors, acting on our behalf under contract;
• 5.3Legal and safety — to comply with law, respond to lawful requests, enforce our Terms, and prevent fraud or harm;
• 5.4Business transfers — in connection with a merger, acquisition, or sale of assets, subject to this Policy.
• 5.5Bank-connection provider (Plaid) — when you choose to link a bank account, we use Plaid Inc. to securely access your account information on your behalf. You authorize us and Plaid to access and use that information as described here and in Plaid’s End User Privacy Policy, and Plaid handles it under that policy.

Data Retention & Deletion

We keep your information only as long as necessary for the purposes described in this Policy. While your account is active, we retain it to provide the Service. After your account closes, we keep certain records to meet legal, regulatory, tax, audit, anti-fraud, and recordkeeping obligations. For financial-services records this is generally up to seven (7) years, and longer only where the law requires. Bank-account information accessed through Plaid is retained only as long as needed to provide the Service you requested, then deleted or de-identified.

• 6.1Account & profile data — retained for the life of your account, then deleted or de-identified after closure unless a longer period is legally required;
• 6.2Application & underwriting records (including SSN, date of birth, bank statements, and credit-bureau data) — retained for the period required by GLBA, FCRA, and applicable financial recordkeeping law, generally up to seven (7) years;
• 6.3Bank-connection data via Plaid — retained only while needed to deliver the Service you requested, then promptly deleted or de-identified;
• 6.4Marketing & analytics data — retained no longer than needed for the purpose collected, and removed when you withdraw consent or object;
• 6.5Backups — retained on a rolling schedule and overwritten in the ordinary course of our secure backup cycle.

You may request access to, correction of, a copy of, or deletion of your personal information at any time by emailing data@futeurcredx.com. We verify your identity and respond within the time required by applicable law (generally within 45 days). We delete or de-identify your information unless we are legally required to keep it, in which case we delete it once that obligation ends. When we dispose of data, we use secure methods designed to render it unrecoverable.

Data Security

We maintain administrative, technical, and organizational safeguards designed to protect your information, applied according to its sensitivity. Our controls include, among others:

• 7.1Encryption — information is encrypted in transit using TLS and encrypted at rest; sensitive identifiers such as Social Security number and date of birth are additionally encrypted at the field level using AES-256-GCM;
• 7.2Access control & least privilege — role-based access limits personnel to only the data required for their role;
• 7.3Authentication — multi-factor authentication is required for administrative access to systems that store or process financial data;
• 7.4Logging & monitoring — access to sensitive data is logged, including a recorded business reason for each access;
• 7.5Key management — encryption keys are managed securely and kept separate from the data they protect;
• 7.6Vendor review — we assess the security of the third parties we rely on, such as Plaid, our cloud infrastructure, and the credit bureaus;
• 7.7Secure development — we follow secure software-development practices and remediate identified vulnerabilities.

No method of transmission over the internet or of electronic storage is completely secure, so while we work hard to protect your information we cannot guarantee its absolute security. If we become aware of a breach affecting your personal information, we will notify you and the relevant authorities as required by law.

Cookies and Analytics

We use cookies and similar technologies for authentication, security, preferences, and analytics to understand and improve how the Platform is used. You can control cookies through your browser settings; disabling some cookies may affect functionality.

Your Privacy Rights

Depending on where you live and subject to applicable exceptions, you may have the right to access, correct, delete, or receive a portable copy of personal information, opt out of certain processing, withdraw consent where processing relies on consent, and be free from unlawful discrimination for exercising a right. Financial information governed by the GLBA or FCRA may be subject to separate rules or exemptions. To submit a request, contact data@futeurcredx.com. We may verify your identity and authority before responding.

Financial Privacy (GLBA)

Where the Gramm-Leach-Bliley Act and its implementing rules apply to a service, relationship, or category of information, we handle nonpublic personal information in accordance with applicable financial-privacy requirements. Our separate Financial Privacy & GLBA Notice explains those practices without claiming that every product or record is governed by GLBA.

International Data Transfers

The Platform is intended for U.S. businesses, and your information is processed in the United States. If you access the Platform from outside the United States, you consent to processing in the United States, where privacy laws may differ from those of your location.

Children’s Privacy

The Platform is for business owners aged 18 and over and is not directed to children. We do not knowingly collect personal information from anyone under 18. If we learn we have done so, we will delete it.

Third-Party Links and Services

The Platform may link to or integrate with third-party sites and services, including Lending Partners. Their privacy practices are governed by their own policies, and we are not responsible for them. We encourage you to review the privacy policy of any Lending Partner before accepting an offer.

Changes to This Policy

We may update this Policy to reflect changes in our services, vendors, practices, or legal obligations. We will revise the “Last Updated” date and provide additional notice when required by applicable law.

Contact and Data Controller

FuteurCredX Inc. is responsible for the practices described in this Policy. For privacy questions or rights requests, contact data@futeurcredx.com or write to 17 State Street, FL 40, New York, NY 10004, United States.