Privacy Policy

Effective as of December 03, 2025

This Privacy Policy describes how Prime Financial Technologies, Inc. (“we” or “us”) handles personal information that we collect through this website, platform, and any other sites or services that link to this Privacy Policy (collectively, the “Services”).

Personal information we collect

Information users submit to us:

  • Contact and account information, such as your first and last name, phone number, mailing address, email address, username, and password.
  • Commercial loan application information, including your social security number, credit and employment information, financial account information, transaction history, and information about your business.
  • Feedback or correspondence, such as information you provide when you contact us with questions, feedback, or otherwise correspond with us online.
  • Usage information, such as information about how you use the Services and interact with us, including information associated with any content you upload to the Services or otherwise submit, and information you provide when you use any interactive features of the Services.
  • Marketing information, such as your preferences for receiving communications about our Services, and details about how you engage with our communications.
  • Other information that we may collect, which is not specifically listed here, but which we will use in accordance with this Privacy Policy or as otherwise disclosed at the time of collection.

Information we obtain from third parties:

  • Social media information.
    • We may maintain pages on social media platforms, such as Facebook, LinkedIn, and other third-party platforms. When you visit or interact with our pages on those platforms, the platform provider’s privacy policy will apply to your interactions and their collection, use and processing of your personal information.
  • Other sources.
    • We may obtain your personal information from other third parties, such as marketing partners, background check providers, credit reporting agencies, financial institutions, publicly-available sources, and data providers.

Automatic data collection

We and our service providers may automatically log information about you, your computer or mobile device, and your interactions over time with our Services, our communications and other online services, including:

  • Device data: such as your computer’s or mobile device’s operating system type and version, manufacturer and model, browser type, screen resolution, RAM and disk size, CPU usage, device type (e.g., phone, tablet), IP address, unique identifiers, language settings, mobile device carrier, radio/network information (e.g., WiFi, LTE, 4G), and general location information such as city, state or geographic area.
  • Online activity data: such as pages or screens you viewed, how long you spent on a page or screen, browsing history, navigation paths between pages or screens, information about your activity on a page or screen, access times, duration of access, and whether you have opened our marketing emails or clicked links within them.

We use the following tools for automatic data collection:

  • Cookies, which are text files that websites store on a visitor’s device to uniquely identify the visitor’s browser or to store information or settings in the browser for the purpose of helping you navigate between pages efficiently, remembering your preferences, enabling functionality, and helping us understand user activity and patterns.
  • Local storage technologies, like HTML5, that provide cookie-equivalent functionality but can store larger amounts of data, including on your device outside of your browser in connection with specific applications.
  • Web beacons, also known as pixel tags or clear GIFs, which are used to demonstrate that a webpage or email was accessed or opened, or that certain content was viewed or clicked.

How we use your personal information

To operate our Services:

  • Provide, operate, maintain, secure and improve our Services.
  • Provide our users with customer service.
  • Communicate with you about our Services, including by sending you announcements, updates, security alerts, and support and administrative messages.
  • Understand your needs and interests, and personalize your experience with our Services and our communications.
  • Respond to your requests, questions and feedback.

For research and development:

We may use your personal information for research and development purposes, including to analyze and improve our Services and our business. As part of these activities, we may create aggregated, de-identified, or other anonymous data from personal information we collect. We make personal information into anonymous data by removing information that makes the data personally identifiable to you. We may use this anonymous data and share it with third parties for our lawful business purposes, including to analyze and improve our Services and promote our business.

Direct marketing:

We may from time-to-time send you direct marketing communications as permitted by law, including, but not limited to, notifying you of special promotions, offers and events via email and in-app notifications. You may opt out of our marketing communications as described in the “Opt out of marketing communications” section below.

Compliance and protection:

We may use personal information to:

  • Comply with applicable laws, lawful requests, and legal process, such as to respond to subpoenas or requests from government authorities.
  • Protect our, your or others’ rights, privacy, safety or property (including by making and defending legal claims).
  • Audit our internal processes for compliance with legal and contractual requirements and internal policies.
  • Enforce the terms and conditions that govern our Services.
  • Prevent, identify, investigate and deter fraudulent, harmful, unauthorized, unethical or illegal activity, including cyberattacks and identity theft.

How we share your personal information

Service providers:

We may share your personal information with third party companies and individuals that provide services on our behalf or help us operate our Services (such as lawyers, bankers, auditors, insurers, customer support, hosting, analytics, email delivery, marketing, and database management). These third parties also include entities that assist us in the administration, processing, servicing, and sale of your loan, such as fraud detection services, underwriting services, title companies, and financial institutions. All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

Authorities and others:

We may disclose your personal information to law enforcement, government authorities, and private parties, that we believe in good faith to be necessary or appropriate for the compliance and protection purposes described above.

Business transfers:

We may sell, transfer or otherwise share some or all of our business or assets, including your personal information, in connection with a business transaction (or potential business transaction) such as a corporate divestiture, merger, consolidation, acquisition, reorganization or sale of assets, or in the event of bankruptcy or dissolution. In such a case, we will make reasonable efforts to require the recipient to honor this Privacy Policy.

Your choices

Access or update your information:

You may update your personal information in your account by logging in and editing your information or contact us at [email protected] or [email protected].

Opt out of marketing communications:

You may opt out of marketing-related emails by following the opt-out or unsubscribe instructions at the bottom of the email. However, you may continue to receive service-related and other non-marketing emails.

Online tracking opt-out:

There are a number of ways to limit online tracking, we have summarized some of the options below:

  • Blocking cookies in your browser. Most browsers let you remove or reject cookies. To do this, follow the instructions in your browser settings. Many browsers accept cookies by default until you change your settings. For more information about cookies, including how to see what cookies have been set on your device and how to manage and delete them, visit www.allaboutcookies.org.
  • Using privacy plug-ins or browsers. You can block our websites from setting cookies by using a browser with privacy features, like Brave, or installing browser plugins like Privacy Badger, Ghostery, or uBlock Origin, and configuring them to block third party cookies/trackers. You can also opt out of Google Analytics by downloading and installing the browser available at: https://tools.google.com/dlpage/gaoptout.

Note that because these opt-out mechanisms are specific to the device or browser on which they are exercised, you will need to opt out on every browser and device that you use.

Do Not Track:

Some Internet browsers may be configured to send “Do Not Track” signals to the online services that you visit. We currently do not respond to “Do Not Track” or similar signals. To find out more about “Do Not Track,” please visit https://www.allaboutdnt.com.

Other sites, mobile applications and services:

Our Services may contain links to other websites, mobile applications, and other online services operated by third parties. These links are not an endorsement of, or representation that we are affiliated with, any third party. In addition, our content may be included on web pages or in mobile applications or online services that are not associated with us. We do not control third party websites, mobile applications or online services, and we are not responsible for their actions. Other websites and services follow different rules regarding the collection, use and sharing of your personal information. We encourage you to read the privacy policies of the other websites and mobile applications and online services you use.

Security:

We employ a number of technical, organizational, and physical safeguards designed to protect the personal information we collect. However, no security measures are failsafe and we cannot guarantee the security of your personal information.

Changes to this Privacy Policy:

We reserve the right to modify this Privacy Policy at any time. If we make material changes to this Privacy Policy, we will notify you by updating the date of this Privacy Policy and posting it on the website.

How to contact us:

Please direct any questions or comments about this Policy or our privacy practices to [email protected]

Appendix A: Your Privacy Rights

Rev. August 1, 2024

Introduction

Welcome to Lead Bank!

We work hard to protect your personal information and ensure your information is kept private and secure. The following privacy policy outlines the types of personal information that Lead Bank ("Lead Bank") collects through our websites and services. It also explains why we collect your information and how we use it.

Privacy is important to Lead Bank. We will never rent or sell your information to anyone. If you have any questions or if you believe that Lead Bank has not adhered to this privacy policy, please send us a note at [email protected]. We reserve the right to amend this privacy policy at our discretion and at any time.

Table of Contents

U.S. Consumer Privacy Notice

  1. What does Lead Bank do with your personal information?
  2. How does Lead Bank use and share your personal information?
  3. Who we are
  4. What we do
  5. Definitions
  6. Other important information

U.S. State Mandated Privacy Notice at Collection

  1. Your Privacy Choices and Rights
  2. Exercising Your Privacy Choices and Rights
  3. Non-Discrimination
  4. California Specific Notices
  5. Changes to Our U.S. State Mandated Privacy Notice at Collection
  6. Contact Information

U.S. Consumer Privacy Notice

What does Lead Bank do with your personal information?

Why?

Financial companies choose how they share your personal information. Federal law gives consumers the right to limit some but not all sharing. Federal law also requires us to tell you how we collect, share, and protect your personal information. Please read this notice carefully to understand what we do.

What?

The types of personal information we collect and share depend on the product or service you have with us. This information can include:

  • Social Security number and account transactions
  • Checking account information and credit history
  • Payment history and account balances

When you are no longer our customer, we continue to share your information as described in this notice.

How?

All financial companies need to share customers' personal information to run their everyday business. In the section below, we list the reasons financial companies can share their customers' personal information; the reasons Lead Bank chooses to share; and whether you can limit this sharing.

Reasons we can share your personal informationDoes Lead Bank share?Can you limit this sharing?

For our everyday business purposes–

such as to process your transactions, maintain your account(s), respond to court orders and legal investigations, or report to credit bureaus

YesNo

For our marketing purposes–

to offer our products and services to you

YesNo

For joint marketing with other financial companies

YesNo

For our affiliates' everyday business purposes–

information about your transactions and experiences

NoWe don't share

For our affiliates' everyday business purposes–

information about your creditworthiness

NoWe don't share

For affiliates to market to you

NoWe don't share

For nonaffiliates to market to you

NoWe don't share

For questions? Call 866-845-9545, go to www.lead.bank or email [email protected]

Who we are

Who is providing this notice?

Lead Bank

What we do
How does Lead Bank protect my personal information?To protect your personal information from unauthorized access and use, we use security measures that comply with federal law. These measures include computer safeguards and secured files and buildings. We authorize our employees to get your information only when they need it to do their work, and we require companies that work for us to protect your information.
How does Lead Bank collect my personal information?

We collect your personal information, for example, when you

  • Apply for a loan or open an account
  • Show your government-issued ID or use your credit or debit card
  • Provide employment information

We also collect your personal information from others, such as credit bureaus, affiliates, or other companies. See below for more information on your rights under state law.

Why can't I limit all sharing?

Federal law gives you the right to limit only

  • Sharing for affiliates' everyday business purposes – information about your creditworthiness
  • Affiliates from using your information to market to you
  • Sharing for nonaffiliates to market to you

You should be aware that Lead Bank does not collect or share information for these purposes.

State laws and individual companies may give you additional rights to limit sharing. See below for more information on your rights under state law.

Definitions
Affiliates

Companies related by common ownership or control. They can be financial and nonfinancial companies.

  • Our affiliates include others, such as Luna Parent, Inc.
Nonaffiliates

Companies not related by common ownership or control. They can be financial and nonfinancial companies.

  • Lead Bank does not share with non-affiliates so they can market to you.
Joint marketing

A formal agreement between non-affiliated financial companies that together market financial products or services to you.

  • Our joint marketing partners include Third Party Financial Service platforms for credit cards, loans, and other banking services

Other important information

Lead Bank is chartered under the laws of the State of Missouri and is subject to regulatory oversight by the FDIC. Any consumer wishing to file a complaint against Lead Bank should contact the FDIC through one of the following means: In person, by U.S. Mail: 1100 Walnut Street; Suite 2100; Kansas City, MO 64106, by Telephone (800) 209-7459, or Online at: https://ask.fdic.gov/FDICCustomerAssistanceForm

Several U.S. states, including California, have enacted or will soon enact consumer privacy laws that grant their residents certain rights and require additional disclosures. If you are a resident of California or one of these states, you may have rights granted under the applicable state law. Learn more about your privacy rights.

VT: Accounts with a Vermont mailing address are automatically treated as if they have limited the sharing as described above. For joint marketing, we will only disclose your name, contact information and information about your transactions.

NV: We are providing you this notice pursuant to Nevada law. For more information, contact us at 866-845-9545, or email [email protected], with "Nevada Annual Notice" in the subject line. You may also contact the Nevada Attorney General's office: Bureau of Consumer Protection, Office of the Nevada Attorney General, 555 E. Washington St., Suite 3900, Las Vegas, NV 89101; telephone number: 1–702–486–3132; email [email protected].

CA: Accounts with a California mailing address are automatically treated as if they have limited the sharing with nonaffiliates as described above. If you are a California resident and would like to exercise additional choices over your data, please review the California Consumer Privacy Act of 2018 and California Privacy Rights Acts in the next section.

U.S. State Mandated Privacy Notice at Collection

Several U.S. states, including California, have enacted or will soon enact consumer privacy laws that grant their residents certain rights and require additional disclosures (collectively, "State Privacy Laws"). If you are a resident of one of these states, this section applies to you and supplements the information contained in Lead Bank's Privacy Policy.

As explained in our Privacy Policy, both federal and state laws require us to tell you how we collect, use, share, and protect your personal information. As a result, our data collection practices are generally governed by federal law, including the Gramm-Leach-Bliley Act ("GLBA"). However, certain information collected may be out of scope of federal laws and instead covered by State Privacy Laws. Under the California Consumer Privacy Act of 2018 ("CCPA"), as amended by the California Privacy Rights Act ("CPRA") of 2020 and other California laws (collectively, the "CCPA"), this may also include information about employees and employee applicants as well as enterprise data (such as business-to-business).

This notice is intended to provide information required under State Privacy Laws, including the CCPA. This notice applies to the data collection and processing practices of Lead Bank (collectively, "Lead Bank" or "we").

We do not and will not sell consumer personal information in the traditional and colloquial sense of the word sale. We do not use advertising technology on our website, which under some State Privacy Laws may be considered a "sale" or "share" of your information. In the preceding twelve (12) months, we have not "sold" or "shared" consumers' personal information, as defined under State Privacy Laws. We do not engage in targeted advertising.

We also do not offer financial incentives, preferential service agreements, or any other differences in our prices or services in exchange for your data.

Your Privacy Choices and Rights

Under the State Privacy Laws, you may have the following rights, including the right to (1) request to know more about the categories and specific pieces of personal information we collect, use, and disclose and access your personal information, including receive the information in a portable format, (2) request deletion of your personal information, (3) request correction of inaccurate personal information, (4) request to limit the use and disclosure of sensitive personal information, and (5) not be discriminated against for exercising these rights ("Data Subject Requests").

This section describes consumers' rights under the State Privacy Laws and explains how you can exercise those rights with Lead Bank.

Right to Delete

Under certain State Privacy Laws, you have the right to request that we delete any of your personal information that we collected from you and retained, subject to certain exceptions. Once we receive and verify your Data Subject Requests, we will delete your personal information from our records (and direct our service providers to delete your personal information from their records), unless an exception applies.

Certain personal information that we collect and use to provide you with financial services, and which Lead Bank is obligated by federal law and/or regulations to retain, cannot be deleted upon request.

We also may deny your Data Subject Requests to delete if retaining the information is necessary for us or our service providers to:

  • Detect security incidents;
  • Protect against malicious, deceptive, fraudulent, or illegal activity;
  • Assist law enforcement in prosecuting those responsible for such activities; or
  • Comply with a legal obligation.

Right to Correction

Under certain State Privacy Laws, you have the right to request that we correct any inaccuracies about your personal information. If we provide you with financial services, you can do so through our application.

Right to Know/Right to Access and Data Portability Rights

Under certain State Privacy Laws, you have the right to request that we disclose certain information to you about our collection and use of your personal information over the past 12 months. Once we confirm your Data Subject Request, we will disclose to you, upon specific request:

  • The categories of personal information we collected about you.
  • The categories of sources for the personal information we collected about you.
  • Our business or commercial purpose for collecting, disclosing, or sharing that personal information.
  • The categories of third parties with whom we disclose that personal information.
  • The categories of personal information we disclosed or sold to each category of third party.
  • The specific pieces of personal information we collected about you.

Right to Limit Use and Disclosure of Sensitive Personal Information

You have the right to request that we limit the use and disclosure of sensitive personal information to the services we provide to you. Lead Bank's current practice is to use the sensitive personal information it collects only for the purpose of providing you with the financial services we offer.

Exercising Your Privacy Choices and Rights

If you are a resident of a state that provides the above rights under State Privacy Laws, you may exercise the rights above by:

  • By email: [email protected]
  • By phone: (800) 209-7459

Each Data Subject Request must:

  • Provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information or an authorized representative. We will make every effort to verify your identity using your email address, but we may request additional information. If an authorized representative is making the request on your behalf, we require documentation showing that the representative has such authority.
  • Describe your Data Subject Request with sufficient detail that allows us to properly evaluate and respond to it.

We cannot respond to your Data Subject Request or provide you with personal information if we are unable to verify your identity, or unable to verify the authority for the person making the request as your agent. We will use personal information provided in a verifiable consumer Data Subject Request to verify your identity or authority to make the Data Subject Request, and not for any other purpose.

You may only make a verifiable Data Subject Request for access or data portability twice within a 12-month period.

Response Timing and Format

We will acknowledge your Data Subject Request within 10 days. We attempt to respond to every Data Subject Request within 45 days. If we require more time, we will inform you of the reason and how much additional time we require (up to 90 days in total). Any disclosures we provide may only cover the 12-month period preceding the Data Subject Request's receipt. If we are unable to satisfy your Data Subject Request, or a part of your Data Subject Request, we will explain why.

We do not charge a fee to process or respond to Data Subject Requests.

Authorized Agent

Only you, or a person you have designated in writing as your authorized agent, or who is registered with the applicable Secretary of State to act on your behalf, or to whom you have provided power of attorney pursuant to applicable laws, ("Authorized Agent"), may make a verifiable consumer request to access, port, correct, or delete your personal information. You may also make a verifiable consumer request on behalf of your minor child.

If you wish to have an Authorized Agent make a request on your behalf, they will need to provide us with sufficient written proof that you have designated them as your Authorized Agent, and we will still require you to provide sufficient information to allow us to reasonably verify that you are the person about whom we collected personal information.

Non-Discrimination

We will not discriminate against you for exercising any of your rights. Unless permitted by the State Privacy Laws, we will not:

  • Deny you services.
  • Charge you different prices for our services, including through granting discounts or other benefits, or imposing penalties.
  • Provide you a different level or quality of service.

California Specific Notices

If you are a California resident, California Civil Code Section 1798.83 permits you to request a list of all third parties to which we, during the immediately preceding calendar year, have disclosed certain personally identifiable information for direct marketing purposes. In the preceding calendar year, we have not disclosed personally identifiable information for direct marketing purposes.

We are only required to respond to a customer request for this list once during any calendar year. To make such a request, please see above under the section "Exercising Your Privacy Choices and Rights." Please be aware that not all information sharing is covered by the California privacy rights requirements and only information sharing that is covered will be included in our response.

During the last twelve (12) months, we have collected personal information in the following categories from consumers and disclosed personal information with the following categories of recipients. Although the list contains examples of information collected, we do not collect every specific piece of personal information for every consumer:

Category of Personal InformationExamples of Personal Information CollectedCategories of Recipients
IdentifiersName, address, email address, phone number, account identifiers, online identifiers, IP address, Social Security number, or other similar identifiers.Our affiliates, service providers, third parties to whom you or your agents authorize us to disclose your personal information in connection with products or services we provide to you.
California customer records or similar information in states with applicable privacy lawsName, signature, Social Security number, address, telephone number, driver's license or state identification card number, employment, employment history, bank account number, and other financial information.
This category may overlap with other categories.
Our affiliates, service providers, third parties to whom you or your agents authorize us to disclose your personal information in connection with products or services we provide to you.
Characteristics of protected classifications under state or federal lawAge, marital status, or gender.Our affiliates, service providers, third parties to whom you or your agents authorize us to disclose your personal information in connection with products or services we provide to you.
Commercial informationPurchasing or consuming histories or tendencies.Our affiliates, service providers, third parties to whom you or your agents authorize us to disclose your personal information in connection with products or services we provide to you.
Internet or other similar network activityInformation on a consumer's interaction with our website, applications, or advertisements.Our affiliates, service providers, third parties to whom you or your agents authorize us to disclose your personal information in connection with products or services we provide to you.
Professional or employment-related informationCurrent occupation.Our affiliates, service providers, third parties to whom you or your agents authorize us to disclose your personal information in connection with products or services we provide to you.
InferencesInferences drawn from any of the information listed above to create a profile about you, such as a profile that reflects your preferences, characteristics, behavior, and attitudes.Our affiliates, service providers, third parties to whom you or your agents authorize us to disclose your personal information in connection with products or services we provide to you.
Sensitive Personal InformationGovernment-issued identifiers (such as Social Security number and driver's license), financial account numbers in combination with login credentials, and facial images used for identification.Our affiliates, service providers, third parties to whom you or your agents authorize us to disclose your personal information in connection with products or services we provide to you.

We collect personal information for the business and commercial purposes and uses described in the Privacy Policy section titled "What does Lead Bank do with your personal information?"

In addition to the sources described above, we collect personal information from the following categories of sources:

  • Directly from our clients or their agents,
  • Indirectly from our clients or their agents, in the course of the services that we provide,
  • Directly and indirectly from activity on our website, and
  • Other third-party sources, including government sources.
  • From third parties that interact with us in connection with the services we perform.

The retention periods for data elements within each category listed above vary depending on the nature of the data element and the purposes for which it is collected and used. Our retention period for the data elements within each category is set based on the following criteria: (1) the length of time that the data is needed for the purposes for which it was created or collected, (2) the length of time the data is needed for other operational or record retention purposes, (3) the length of time the data is needed in connection with our legal, compliance and regulatory requirements, for legal defense purposes and to comply with legal holds, (4) how the data is stored, (5) whether the data is needed for security purposes and fraud prevention, and (6) whether the data is needed to ensure the continuity of our products and services.

Changes to Our U.S. State Mandated Privacy Notice at Collection

We reserve the right to amend this privacy notice at our discretion and at any time. When we make material changes to this privacy notice, we will notify you by email, by notice on this site, or by other acceptable means.

Contact Information

If you have any questions or comments about this notice, our Privacy Statement, the ways in which we collect and use your personal information, your choices and rights regarding such use, or wish to exercise your rights under State Privacy Laws, please do not hesitate to contact us.

By email: [email protected]

By phone: 866-845-9545