Privacy Policy

This Privacy Policy ("Policy") describes how Vestr Financial, Inc. ("Vestr," "we," "us," or "our") collects, uses, discloses, and safeguards information when you visit our website vestr.finance, use our platform, mobile applications, or engage with our services (collectively, the "Services").

This Policy applies to all users, including consumers, business applicants, lending partners ("Vendors"), independent brokers, and visitors. By accessing our Services, you acknowledge that you have read and understood this Policy.

Vestr operates in both the United States and Canada. This Policy addresses compliance with applicable laws in both jurisdictions, including the Gramm-Leach-Bliley Act (GLBA), the Telephone Consumer Protection Act (TCPA), the Federal Trade Commission Act (FTC Act), the CAN-SPAM Act, the California Consumer Privacy Act (CCPA), and Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).

Vestr Financial, Inc. is a financial technology company that connects businesses seeking capital with lending institutions, family offices, private equity firms, and tax credit recovery partners. We act as a marketplace intermediary. we facilitate introductions, pre-screen applications, and manage document flows, but we are not a bank, lender, or credit provider.

For GLBA purposes, Vestr may be considered a "financial institution" to the extent we are significantly engaged in financial activities, including acting as a finder or loan broker. We treat all nonpublic personal information (NPI) with the protections required under GLBA and Regulation P.

A. Personal Identification Information

• Full legal name, date of birth, Social Security Number (SSN) or Employer Identification Number (EIN)
• Email address, phone number, mailing address
• Government-issued identification documents

B. Financial Information

• Bank account details (via Plaid or manual entry), account balances, transaction history
• Revenue figures, payroll data, import/export records
• Tax returns, financial statements, accounts receivable aging reports
• CBP Form 7501 entries, ACE Portal export data, customs brokerage records

C. Business Information

• Business name, entity type, industry, NAICS code
• Years in operation, employee count, annual revenue
• Business licenses, articles of incorporation

D. Technical & Usage Data

• IP address, browser type, device identifiers
• Pages visited, time on site, click patterns, referral URLs
• Cookies, pixel tags, and similar tracking technologies

E. Communication Records

• Phone call recordings (where permitted and disclosed), SMS/text message logs
• Email correspondence, support chat transcripts
• Consent records and opt-in timestamps

• Directly from you. when you submit applications, create accounts, upload documents, or contact us
• Through Plaid. with your express authorization, we retrieve bank account, transaction, and identity data via Plaid Inc.'s secure API. Use of Plaid is subject to the Plaid End User Privacy Policy
• From third-party sources. credit bureaus, business databases, public records, referral partners
• Automatically. through cookies, web beacons, analytics tools (e.g., Google Analytics), and server logs
• From our partners. brokers, vendors, or lenders who refer you to or receive referrals from our platform

We use personal information for the following purposes:

• Application Processing: Evaluating eligibility, pre-screening applications, matching applicants with appropriate lending or tax credit recovery partners
• Service Delivery: Operating the platform, facilitating document exchange, managing user accounts
• Underwriting Support: AI-assisted document analysis, risk assessment, and compliance verification
• Communications: Sending application updates, transactional emails, and. with your consent. marketing messages
• Legal Compliance: Fulfilling regulatory requirements, responding to legal processes, preventing fraud
• Analytics & Improvement: Understanding usage patterns to improve our Services
• Commission Management: Calculating and processing broker/partner commissions

We never sell your personal information. We may share your information with:

A. Lending Partners & Vendors

When you submit an application, relevant information is shared with matched lending institutions, family offices, or tax credit specialists for the purpose of evaluating your request. Only information within the scope of the applied product is shared.

B. Service Providers

We engage trusted third-party service providers who process data on our behalf, including:

• Plaid Inc.. bank account verification and data aggregation
• Cloud hosting providers (encrypted, SOC 2-compliant infrastructure)
• Analytics providers (in anonymized or aggregated form where possible)
• Email and communication platforms

C. Legal & Regulatory

We may disclose information when required by law, subpoena, court order, or regulatory request, or to protect the rights, safety, or property of Vestr, our users, or the public.

D. Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of the transaction. We will notify affected users before information becomes subject to a different privacy policy.

E. With Your Consent

We may share your information for purposes not described here with your express, prior consent.

Vestr fully complies with the Telephone Consumer Protection Act (47 U.S.C. § 227) and its implementing regulations (47 C.F.R. § 64.1200).

Consent for Communications

• Express Written Consent: Before sending any autodialed calls, pre-recorded voice messages, or automated text messages for marketing purposes, we obtain your prior express written consent as defined by the TCPA and the FCC's 2024 one-to-one consent rule.
• Transactional Messages: We may contact you without marketing consent for transactional or informational purposes directly related to your application, account, or an existing business relationship (e.g., application status updates, document requests).
• Revocation of Consent: You may revoke consent at any time by replying STOP to any text message, calling us at the number below, or emailing inquire@vestr.finance. We will process opt-out requests within 10 business days.

Do-Not-Call Compliance

• We maintain an internal Do-Not-Call (DNC) list and honor it within 30 days of receiving a request
• We scrub outbound calling lists against the National Do Not Call Registry
• All telemarketing calls are made only between 8:00 AM and 9:00 PM in the called party's local time zone

Caller Identification

All calls from Vestr transmit accurate Caller ID information, including our name and a valid callback number.

Record Retention

We retain consent records. including the specific language consented to, timestamp, and method of consent. for a minimum of five (5) years, as recommended by FCC enforcement guidance.

Vestr complies with Section 5 of the Federal Trade Commission Act (15 U.S.C. § 45), which prohibits unfair or deceptive acts or practices in commerce.

• Truthful Representations: All marketing materials, product descriptions, and communications accurately represent our Services. We do not make misleading claims about funding amounts, approval rates, or timelines.
• Clear Disclosures: Material terms, fees, and conditions are disclosed clearly and conspicuously before you commit to any service.
• Data Security Standards: We follow FTC guidance on reasonable data security practices, including the FTC Safeguards Rule (16 C.F.R. Part 314), which requires financial institutions to develop, implement, and maintain a comprehensive information security program.
• Endorsements & Testimonials: Any testimonials or endorsements on our platform comply with the FTC's Endorsement Guides (16 C.F.R. Part 255), with material connections clearly disclosed.

Under the CAN-SPAM Act (15 U.S.C. § 7701 et seq.), we commit to the following:

• All commercial emails clearly identify the message as an advertisement where required
• Subject lines accurately reflect the content of the message
• Every commercial email includes our valid physical postal address
• Every commercial email includes a clear, conspicuous, and functional unsubscribe mechanism
• Opt-out requests are honored within 10 business days
• We do not use deceptive header information, misleading subject lines, or harvested email addresses
• We monitor third parties who send emails on our behalf to ensure compliance

For users in Canada, we comply with the Personal Information Protection and Electronic Documents Act (PIPEDA) (S.C. 2000, c. 5) and applicable provincial privacy legislation. PIPEDA is built on ten fair information principles:

Cross-Border Transfers

Your personal information may be transferred to and processed in the United States where our primary servers and service providers are located. We ensure that any cross-border transfer of personal information is protected by contractual safeguards that provide a comparable level of protection.

Breach Notification

In accordance with PIPEDA's mandatory breach notification requirements, we will report any breach of security safeguards involving personal information that creates a real risk of significant harm to the Office of the Privacy Commissioner of Canada and to affected individuals as soon as feasible.

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) / California Privacy Rights Act (CPRA), as amended:

• Right to Know: You may request disclosure of the categories and specific pieces of personal information we have collected about you, the categories of sources, the business purpose for collecting, and the categories of third parties with whom we share it.
• Right to Delete: You may request deletion of personal information we have collected, subject to certain exceptions (e.g., legal obligations, ongoing transactions).
• Right to Correct: You may request correction of inaccurate personal information.
• Right to Opt-Out of Sale/Sharing: We do not sell personal information. We do not share personal information for cross-context behavioral advertising.
• Non-Discrimination: We will not discriminate against you for exercising any CCPA rights.

Residents of Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, and other states with comprehensive privacy laws may have similar rights. Contact us to exercise any applicable rights.

Note: To the extent Vestr is subject to the GLBA, certain CCPA provisions may not apply to NPI collected, processed, sold, or disclosed pursuant to the GLBA and Regulation P.

We implement industry-standard safeguards to protect your information:

• Encryption: All data in transit is encrypted using TLS 1.2 or higher. Sensitive data at rest is encrypted using AES-256.
• Access Controls: Role-based access ensures employees and partners access only the information necessary for their functions.
• Infrastructure: Hosted on SOC 2 Type II-compliant cloud infrastructure with regular penetration testing and vulnerability assessments.
• Monitoring: Continuous monitoring, intrusion detection, and audit logging of all access to sensitive information.
• Vendor Management: Third-party service providers are contractually bound to maintain equivalent security standards and undergo regular assessment.
• Plaid Security: Bank data retrieved via Plaid is transmitted using end-to-end encryption. Vestr does not store your bank login credentials.

We retain personal information only as long as necessary to fulfill the purposes described in this Policy, or as required by law:

• Active Accounts: For the duration of your account relationship plus 7 years
• Applications: 7 years from the date of decision, consistent with financial record-keeping requirements
• TCPA Consent Records: Minimum 5 years from the date of consent
• Tax Credit Records: 10 years, consistent with IRS statute of limitations for amended returns
• Usage & Analytics Data: 26 months (anonymized after this period)

Upon expiration of the retention period, information is securely deleted or irreversibly anonymized.

Our Services are not directed at individuals under 18 years of age. We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a child under 18, we will promptly delete such information.

Our Services are primarily operated from the United States. If you access our Services from outside the United States, your information may be transferred to, stored, and processed in the United States where our servers are located. By using our Services, you consent to such transfer. For Canadian users, see Section 11 regarding PIPEDA cross-border transfer protections.

Depending on your jurisdiction, you may have the right to:

• Access and obtain a copy of your personal information
• Correct inaccurate personal information
• Request deletion of your personal information
• Opt out of marketing communications
• Withdraw consent for data processing (where consent is the legal basis)
• Opt out of automated decision-making
• Lodge a complaint with a supervisory authority

To exercise any of these rights, contact us at inquire@vestr.finance. We will respond to verifiable requests within 30 days (or 45 days with notice of extension, as permitted by applicable law).

Our website does not currently respond to "Do Not Track" (DNT) browser signals, as there is no uniform standard for DNT compliance. However, you may opt out of certain tracking as described in this Policy and through your browser settings.

Our Services may contain links to third-party websites, including those of our lending partners, Plaid, and other service providers. This Privacy Policy does not apply to third-party websites or services. We encourage you to review the privacy policies of any third-party site you visit.

We may update this Privacy Policy from time to time. Material changes will be communicated by posting the revised Policy on our website with a new "Last Updated" date and, where required by law, by providing direct notice via email or in-platform notification. Your continued use of our Services after a change constitutes acceptance of the revised Policy.