Eve Online Privacy Policy

Protecting your privacy is important to Eve Financial, Inc (“Eve” or collectively “we” or “our” or “us”) and our employees. This Privacy Policy (“Policy”) has been adopted by Eve Financial to affirm our commitment to the Gramm-Leach-Bliley Act (GLBA) and Regulation P (Privacy), and other applicable privacy laws. Eve operates a financing waterfall/marketplace that helps consumers submit financing applications to third-party lenders through participating merchants; Eve does not issue credit, hold consumer deposit accounts, or service loans.

It is the policy of Eve to protect consumer and customer Personally Identifiable Information (PII), or any information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. Examples of PII could include, but are not limited to full name, social security number, passport number, bank account information, credit card number, or driver’s license number. Under GLBA, ‘nonpublic personal information’ (NPI) means personally identifiable financial information that is not publicly available. This Privacy Policy (“Policy”) explains how we may collect, use, and disclose information we obtain on the website, through the mobile app or in any other interactions with Eve (“Eve Service”).

“Nonpublic Personal Information” means information about you that we obtain in connection with providing financial products or services to you. For example, nonpublic personal information includes information you provide on a financing application, information from consumer reports, or information we receive from merchants and lender partners in connection with evaluating your eligibility for financing.

By opting into SMS from a web form or other medium, you are agreeing to receive SMS messages from Eve Financial. These messages may include SMS messages related to financing applications, status updates, disclosures, reminders, or other relevant communications related to your use of Eve Financial’s services. Message frequency may vary. Message and data rates may apply. You can opt out at any time by replying STOP. For assistance, text HELP or visit our website at www.eve.co. Reply STOP to any message to opt out. View our privacy policy at eve.co/legal/privacy and our Terms of Service at eve.co/legal/terms.

Information Collection, Use, and Sharing

See below for ways in which Eve may collect, use, and share information.

• Information Collection - Eve collects, retains, and uses information for the purpose of providing financial solutions and operating our financing marketplace and facilitating financing applications. We collect information from applications or other forms, which may include but is not limited to surveys and questionnaires. We may also collect information about transactions, information through cookies, and information we receive from consumer reporting agencies.
• Use of Information - Eve uses personal information in ways that align with the purposes for which it was originally requested and collected. For example, Eve uses information to process customer requests and transactions, provide additional information about products and services, or to evaluate financial needs. Eve collects and uses information to administer our business and deliver quality service. This may include advising consumers and customers about our products or services, those of our affiliates and our business partners, and other opportunities Eve believes may be of interest to our customers.
• Information Sharing - The primary federal regulation governing the collection, use and disclosure of customer information is Regulation P. As required by Regulation P, Eve provides the required Notice to consumers at or before establishing a customer relationship and when our practices materially change; annual notices are provided if required by law.
• Sharing with Eve's Third-Party Service Providers and Joint Marketers - Eve uses third-party service providers to assist with providing quality products and services to our customers. We may share the customer information we collect with third parties to facilitate the offering, administration, collection, and delivery of products and services under controlled circumstances designed to protect the privacy of our customers. We require third parties to comply with applicable laws and regulations as well as our requirements regarding security and confidentiality of such information.

There may also be occasions where we are legally required to disclose information about our customers, such as in response to a subpoena, to prevent fraud, or to comply with a legally permitted inquiry by a government agency or federal regulator.

Sharing with Eve Affiliates

• Fair Credit Reporting Act (FCRA) permits Eve to share customer transaction information (i.e., number of monthly deposits made) and experience information (such as account balance) as well as information obtained from our customers.
• Fair and Accurate Credit Transactions Act (FACTA) Section 214 provides consumers with the ability to limit the circumstances by which an affiliated institution may use certain information received from another affiliate to market to the consumer.

A customer can request that their information is not shared with the affiliates of Eve.

Information We Get from Others

We may also collect information from other sources. These sources include but are not limited to the following:

• Banks and Financial Institutions: To verify your identity or support a financing application, you may choose to link a bank account through a third-party provider (such as Plaid). When you link a bank account, we may receive certain information related to that account, such as account ownership details and recent transaction history, solely for verification and underwriting purposes.
  
  To authenticate accounts, we’ve integrated with Plaid, a San Francisco-based financial technology (“fintech”) company that builds connections with thousands of financial institutions. They’re a trusted partner to companies ranging from popular fintech applications to Fortune 500 companies and major banks. These relationships require the company to have strong security controls in place, and its platform is regularly audited and tested to ensure its controls meet industry standards. For example, Plaid ensures sensitive data (both inmotion and at-rest) is encrypted, and regularly completes SOC-2 Type 2 compliance, ISO27001 (Security) and ISO27701 (Privacy) audits. When you enter your online banking credentials, Plaid establishes an encrypted connection with your bank. This flow was designed with security in mind, as an easy alternative to entering static account and routing numbers. Once this connection is established, our application receives a token. This token enables us to get the data we need to provide our service without direct access to your bank account or credentials. Plaid’s use of your personal information is governed by Plaid’s Privacy Policy.
• Service Providers and Linked Account Data: We use third-party providers to verify identity, support underwriting, and prevent fraud. We do not debit your bank account.
• Credit Reference Agencies: We use these services that may provide information related to your credit file, such as your credit score, credit inquiries, and payment history.
• Social Media: When you interact with our Services through social media networks, we may receive information about you that you permit the social media network to share. The data we receive is dependent upon your privacy settings within the social media network.
• Job Applicant-related Third Parties: we may receive personal information from job applicant-related third parties, such as job application platforms, your current employer, references, background check providers and recruiters.
• Publicly Available Sources: We may also collect personal information from publicly available sources to, for example, contact you if we are otherwise unable to reach you, or, to send advertising or promotional materials or to personalize our Services.

Information Automatically Collected

Some information is automatically collected. This includes but may not be limited to the following:

• Information about you and your computer or mobile device such as your hardware model, operating system info, unique device identifier, mobile network information, device performance information, and information about the device's interaction with our Services. Note that the Eve App may periodically collect or refresh this information in order to stay up to date. You can review and change permissions for some information the Eve App has access to in your device privacy settings.
• Transaction data, when you use our Services, including if you give us access to collect your financial data from your other accounts, for example payments into and out of such accounts including the date, time, amount, merchant or beneficiary details, or ATMs associated with the transaction.
• Usage data, including the electronic path you take to our Services, through our Services and when exiting our Services, as well as your activity information on our services.
• Location information. We use your information to protect against fraud. If you have location services in the Eve App enabled, we may track your geolocation and your IP address. You can withdraw your consent at any time by disabling location permission for the Eve App within your device settings. We may use third-party providers to help provide location-based services through mobile systems and we may make information available to such providers to enable them to provide their location-based services, provided that such third-party providers may use the information only in accordance with this Privacy Policy.

Sharing Personal Information

We may share personal information with our affiliates, subsidiaries, or entities that share a common ownership in Eve, partners, other Eve App customers designated by you for the purposes of customer referrals or managing shared pockets, and to third-party service providers for purposes such as risk detection and prevention, customer service, email delivery and other similar services.

If we are involved in a merger, acquisition, or sale of assets, we will require the successor entity to honor this Privacy Policy or provide you with notice of material changes. We may also be required to share personal information in the event of a corporate restructuring (e.g., merger, sale, joint venture, or other disposition) or when we deem it necessary or appropriate to:

• Comply with applicable laws, including disclosing information to fraud prevention agencies
• Comply with lawful requests and legal process, including to respond to requests from public and government authorities to meet national security or law enforcement requirements
• Enforce our Privacy Policy
• Protect the rights, privacy, safety, or property of you, Eve, or others

We may also share anonymized or de-identified aggregate information (this means information that is no longer personal information because it is no longer attributable to a specific individual) with third parties to help deliver products, services, and content that are tailored to the users of the Eve App and for other purposes. We may also disclose personal information about an individual to certain other third parties or publicly with their consent or direction.

Third-Party Online Advertising & Cookies

• Advertising - We participate in interest-based advertising and use third party advertising companies to serve you targeted advertisements based on your browsing history. We permit third party online advertising networks, social media companies and other third-party services, to collect information about your use of our online services over time so that they may play or display ads on our Services, on other websites or services you may use, and on other devices you may use. Typically, though not always, the information used for interest-based advertising is collected through tracking technologies, such as cookies, web beacons, embedded scripts, location-identifying technologies, and similar technology, which recognize the device you are using and collect information, including clickstream information, browser type, time and date you visited the Eve App, AdID, precise geolocation and other information. We may share a common account identifier (such as a hashed email address or user ID) with our third-party advertising partners to help identify you across devices. We and our third-party partners use this information to make the advertisements you see online more relevant to your interests, as well as to provide advertising-related services such as reporting, attribution, analytics and market research. We may also use services provided by third parties (such as social media platforms) to serve targeted ads to you and others on such platforms. We may do this by providing a hashed version of your email address or other information to the platform provider.
• Social Media Widgets and Advertising - Eve may use social media platforms like Instagram, Facebook, Twitter, and LinkedIn. We may display targeted advertising to you through these social media platforms. These companies have interest-based advertising programs that allow us to direct advertisements while those users are on the social media platform. We may share a unique identifier, such as a user ID or hashed email address, with these platform providers or they may collect information from our website visitors through a first-party pixel. These activities are governed by the privacy policies of those social media companies that provide them.
• Third Party Partners - We may use third-party analytics on our Services. For example, we use Google Analytics to better understand how you interact with our Services. The information we obtain through our Services may be disclosed to or collected directly by these third parties. To learn more, see Google Analytics.
• Cookies - We and our third-party partners may also use cookies and tracking technologies for advertising purposes. Eve uses various technologies to collect information, and this may include sending cookies to your computer or mobile device. "Cookies" are small text files that are stored on your device or hardware by a website. Cookies can be stored on your computer for different periods of time. Some cookies expire after a certain amount of time, or upon logging out (session cookies), others survive after your browser is closed until a defined expiration date set in the cookie (as determined by the third party placing it), and help recognize your computer when you open your browser and browse the Internet again (persistent cookies). For more details on cookies please visit All About Cookies (https://www.allaboutcookies.org/).

On most web browsers, you will find a “help” section on the toolbar. Please refer to this section for information on how to receive a notification when you are receiving a new cookie and how to turn cookies off. Please refer to this section for guidance on how to modify your web browser’s settings. Please note that if you limit the ability of websites to set cookies, you may be unable to access certain parts of the Site and you may not be able to benefit from the full functionality of the Site.

Advertising networks may use cookies to collect Personal Information. Most advertising networks offer you a way to opt out of targeted advertising. If you would like to find out more information, please visit the Network Advertising Initiative’s online resources at http://www.networkadvertising.org and follow the opt-out instructions there.

If you access the Site on your mobile device, you may not be able to control tracking technologies through the settings.

• Email Pixels - We use pixels in our email campaigns that allow us to collect your email and IP address as well as the date and time you open an email or click on any links in the email.
• Analytics - We may also use analytics tools such as Google Analytics to collect information regarding visitor behavior and visitor demographics on our Site and develop website content. This data is not tied to any Personal Information. For more information on how Google uses this data, go to www.google.com/policies/privacy/partners/. You can opt out of Google's collection and Processing of data generated by your use of the Site by going to https://tools.google.com/dlpage/gaoptout.
• Online Tracking and "Do Not Track" Signals - We and our third party service providers, including Facebook, may use cookies, pixels, or other tracking technologies to collect information about your browsing activities over time and across different websites following your use of the Site and use that information to send targeted advertisements. We honor Global Privacy Control (GPC) signals where required by law. Activating GPC in your browser will be treated as a request to opt out of 'sale'/'sharing' for that device or browser.

Control Over Your Information

You always have the ability to control the way your information is used. Below are some ways to manage your information with Eve.

• Updating your Information - Once you have registered for an Account, you may be able to update or correct your profile information details and preferences by accessing your account settings through the Eve App, or by contacting us at support@evefinancial.com or write to us at: Eve, 776 E Technology Ave #F13-13, Orem, Utah 84097.
• Deactivating your Account - We do not delete information about you upon deactivation of your Account. Although your deactivated status is reflected promptly in our user databases, we may retain the information you submit for a variety of purposes, including legal compliance, backups and archiving, prevention of fraud and abuse, and analytics. Upon deactivation, you will no longer receive communications from Eve and any active financing applications or linked services will be terminated. If you have a financing request pending at the time you deactivate your account, we will still transmit the request to the relevant lender or merchant as required, but you will not be able to initiate new applications through Eve.
• Correcting Credit Reports - Information related to your creditworthiness is maintained by the credit bureaus. If you find that there is an error or you want to dispute the information found in your credit report, please contact the credit reporting bureaus: Experian, TransUnion, and Equifax.
• Opting-Out of Certain Online Ads - To learn more about interest-based advertising and how you may be able to opt-out of some of this advertising, you can visit the Digital Advertising Alliance (DAA) and/or the Network Advertising Initiative's (NAI) at http://www.aboutads.info/choices or http://www.networkadvertising.org/choices/. You may also be able to limit interest-based advertising through the settings menu on your mobile device by selecting "limit ad tracking" (iOS) or "opt-out of interest-based ads" (Android). You may also be able to opt-out of some — but not all — interest-based advertising served by mobile ad networks by visiting http://youradchoices.com/appchoices and downloading the mobile AppChoices app. Please note: When you opt out of receiving interest-based advertisements, this does not mean you will no longer see advertisements from us. It means that the online ads that you see from DAA program participants should not be based on your interests. We are not responsible for the effectiveness of, or compliance with, any third-parties' opt-out options or programs or the accuracy of their statements. In addition, third parties may still use cookies to collect information about your use of our online services, including for analytics and fraud prevention as well as any other purpose permitted under the DAA's Principles.
• Data Retention - We retain personal information only as long as necessary to fulfill the purposes described in this policy, including to process financing applications, comply with legal obligations, resolve disputes, and enforce agreements. We apply documented retention schedules and securely dispose of data when no longer required.
• GLBA-Covered Data - Our GLBA Privacy Notice provides information about how you can limit your sharing options for our financial services and GLBA-covered data.

Applicable State Laws

U.S. State Privacy Rights

Certain state laws (including the California Consumer Privacy Act as amended by the California Privacy Rights Act (collectively, “CCPA/CPRA”), the Colorado Privacy Act, the Connecticut Data Privacy Act, the Virginia Consumer Data Protection Act, and the Utah Consumer Privacy Act) grant residents additional rights regarding their personal information collected outside of GLBA-covered activities, such as marketing, website analytics, and job applicant data. Depending on your state of residence, these rights may include the right to:

• Know the categories and specific pieces of personal information we have collected about you;
• Access, correct, or delete certain personal information;
• Obtain a portable copy of personal information you provided to us;
• Opt out of the "sale" or "sharing" of personal information for cross-context behavioral advertising; and
• Opt out of targeted advertising or certain profiling.

We do not use GLBA-covered application data for interest-based advertising. For non-GLBA site and app data, you may opt out of “sale” or “sharing” for cross-context behavioral advertising by using our “Do Not Sell or Share My Personal Information” link or by enabling Global Privacy Control (GPC) in your browser. Where required, we honor GPC signals as a valid opt-out request.

To exercise your state privacy rights or submit an appeal if your request is denied, you may:

• Submit a request at www.evefinancial.com/privacy-requests; or
• Email us at privacy@evefinancial.com.

We will respond consistent with applicable state law.

Applicable state laws must be taken into consideration when marketing to customers via a third party. For example, Vermont and California state laws prohibit financial institutions from sharing customer PII unless the customer takes affirmative action authorizing the institution to do so. Therefore, customers with Vermont or California addresses must be removed from campaigns that involve information sharing with unaffiliated third parties under the Regulation P joint marketing agreement exception.

• California Consumer Privacy Act (CCPA) covers California residents about whom Eve has collected personal information (PI) from and is applicable to any business that collects and stores PII of California residents, regardless of if the business is located in California. For purposes of this section the term “personal information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular California consumer/resident or household. Personal information does not include information that has been de-identified or that does not fall within the above definition of personal information.
  
  As a consumer financial services company, Eve has developed and implemented privacy and security controls to protect your personal information and comply with United States federal law, including but not limited to the Gramm-Leach-Bliley Act and the Fair Credit Reporting Act. As such, most of the personal information about you that we may collect and use is exempt from the CCPA.
  
  California Privacy Rights
  Under the California Consumer Privacy Act, California residents, subject to certain limitations and exceptions, have the right to:
  • Right to Know - The right to request the following information from us about our use of your personal information:
    • The specific pieces of personal information we have collected about you
    • The categories of personal information that we have collected about you
    • The categories of sources from which your personal information was collected
    • The business or commercial purpose for collecting or selling your personal information
    • The categories of third parties with whom we may share personal information
  • Right to Delete - You have the right to request the deletion of your personal information that is collected or maintained by us.
  • Right to Opt-Out of Sale - You have the right to opt-out of the sale of your personal information by us. We do not sell personal information.
  • Right to Non-Discrimination - You have the right to not receive discriminatory treatment by us for the exercise of the privacy rights described above.
  
  In some instances, we may not be able to honor your request. For example, we will not honor your request if we cannot verify your identity or if we cannot verify that you have the authority to make a request on behalf of another individual. Additionally, we will not honor your request where an exception applies, such as where the disclosure of personal information would adversely affect the rights and freedoms of another consumer or where the personal information that we maintain about you is not subject to your rights under the CCPA.
  
  We will advise you in our response if we are unable to honor your request. Additionally, if you request access to the specific pieces of personal information we have collected about you, we will not provide social security numbers, driver’s license numbers or government issued identification numbers, financial account numbers, account passwords or security questions and answers, or any other specific pieces of information if the disclosure presents the possibility of unauthorized access that could result in identity theft, fraud, or unreasonable risk to data, systems, and network security.
  
  How to Exercise Your Rights under the CCPA
  If you are a California resident, you may make a request to exercise your rights under the CCPA by either of the following methods:
  • Submitting a request via email to support@evefinancial.com



• Children Online Privacy Protection Act (COPPA) is a federal law that imposes specific requirements on operators of websites and online services to protect the privacy of children under 13. It is Eve's policy NOT to (i) sell any customer or consumer PII to third parties, and (ii) collect PII from individuals under the age of 13, as defined by COPPA (Children Online Privacy Protection Act), and under the age of 16 (per the CCPA). The Eve App is not directed to, and we do not intend to, or knowingly, collect or solicit personal information from children under the age of 13. If you believe that a child under age 13 may have provided us with personal information without parental consent, please contact us.
• Vermont State Law - For Vermont residents, we do not share nonpublic personal financial information with affiliates or nonaffiliates, except as permitted by law (such as to process financing applications or prevent fraud). We will not disclose creditworthiness information to affiliates without your consent.
• Privacy and Opt-Out Notice - Our customers provide private information to Eve during daily business, and we are committed to treating such information responsibly. Our customers expect privacy and security for the financial information they share with us during the financing application process. To that end, we provide the Privacy and Opt-Out Notice (Notice) to all consumers at account opening, enrollment for a new service, if there are changes to our privacy practices, and annually thereafter, if required by law.

Reporting Unauthorized Disclosure of Personal Information

The trust of our customers is Eve’s most valuable asset. If an unauthorized disclosure of personal information occurs, Eve will investigate promptly, take steps to mitigate harm, and notify affected individuals and regulators as required by law.

The negative impact of an information breach can create reputational risk and cause noncompliance with laws and regulations. Incidents may include any situation in which customer personal, financial or health information or records (whether in paper, electronic, or other form that is maintained by or on behalf of Eve) may potentially be lost, misdirected, or in any way accessed by unauthorized individuals or parties. Any incidents or suspected incidents involving data security and disclosure of customer information should be reported immediately to the IT Department and/or Senior Management in accordance with the Information Security Policy’s standards and associated procedures. Eve’s unaffiliated third-party service providers are instructed to report all unauthorized access to, and disclosure of, any customer information.

Gramm Leach Bliley Act (GLBA) Privacy Notice