VetraFi’s Privacy Policy

Last Updated August 24, 2026

VetraFi, Inc. (“VetraFi” or “we” or “us” or “Company”) respects your privacy and is committed to protecting it through our compliance with the privacy practices discussed herein.

Please note that when you open an account through VetraFi, VetraFi may collect and use your personal information as a service provider on behalf of the financial institutions with which we partner (“Bank Partners”), pursuant to the Bank Partners’ privacy notices, to facilitate the provision of banking services. Personal information processed by VetraFi in its capacity as a service provider is subject to applicable law and the Bank Partners’ privacy notices. Credit and deposit accounts opened via the VetraFi mobile application are issued by VetraFi’s Banking Partner: First Bank of the Lake, Member FDIC.

Below are Privacy Notices and Policies applicable to your VetraFi account from VetraFi, Inc.

U.S. Consumer Privacy Notice

Privacy Policy

U.S. Consumer Privacy Notice

The following U.S. Consumer Privacy Notice applies to you if you are an individual who resides in the United States and obtains financial services from VetraFi primarily for your own personal, family, or household purposes.

Rev. August 2026

VetraFi Privacy Policy

This Privacy Policy (“Policy”) has been adopted by VetraFi, Inc. (“VetraFi” or collectively “we” or “our” or “us”) to affirm its commitment to compliance with the applicable privacy provisions of the Gramm-Leach-Bliley Act (GLBA) as implemented by Regulation P (Privacy), and other applicable privacy laws and regulations. It is the policy of VetraFi to protect consumer and customer Personally Identifiable Information (PII), or any information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. Examples of PII could include, but are not limited to full name, social security number, passport number, bank account information, credit card number, or driver’s license number.

This Policy outlines the regulatory requirements and provides guidelines on VetraFi’s privacy practices, including how VetraFi collects, uses, and discloses your information. VetraFi maintains safeguards to protect the private information that has been provided by its consumers. This Policy outlines VetraFi ’s practice regarding use of PII for consumers, those consumers who become our customers, and former customers.

When you open an account through VetraFi, VetraFi may collect and use your PII as a service provider on behalf of the financial institutions with which we partner (“Bank Partners”), pursuant to the Bank Partners’ privacy notices, to facilitate the provision of banking services. PII processed by VetraFi in its capacity as a service provider is subject to applicable law and the Bank Partners’ privacy notices.

Information Collection, Use, and Sharing

See below for ways in which VetraFi may collect, use, and share information.

• Information Collection - VetraFi collects, retains, and uses information for the purpose of providing financial solutions and administering account relationships. We collect information from applications or other forms, which may include but is not limited to surveys and questionnaires. We may also collect information about transactions, information through cookies, and information we receive from consumer reporting agencies.
• Use of Information - VetraFi uses personal information in ways that align with the purposes for which it was originally requested and collected. For example, VetraFi uses information to process customer requests and transactions, provide additional information about products and services, or to evaluate financial needs. VetraFi collects and uses information to administer our business and deliver quality service. This may include advising consumers and customers about our products or services, those of our business partners, and other opportunities VetraFi believes may be of interest to our customers. VetraFi does not sell your personal data. This includes any data collected directly from you, through your use of our services, or from any third-party integrations. We do not sell, rent, trade, or otherwise exchange your personal information for monetary or other valuable consideration. If our practices ever change, we will update this Privacy Policy accordingly and provide appropriate notice.
• Information Sharing - The primary federal regulation governing the collection, use and disclosure of customer information is Regulation P. As required by Regulation P, VetraFi provides the required Notice to bank customers and consumers. The Notice is provided at account opening and as required due to changes in our privacy practices.
• Sharing with VetraFi's Third-Party Service Providers and Joint Marketers - VetraFi uses third-party service providers to assist with providing quality products and services to our customers. We may share the customer information we collect with third parties to facilitate the offering, administration, collection, and delivery of products and services under controlled circumstances designed to protect the privacy of our customers. We require third parties to comply with applicable laws and regulations as well as our requirements regarding security and confidentiality of such information.

There may also be occasions where we are legally required to disclose information about our customers, such as in response to a subpoena, to prevent fraud, or to comply with a legally permitted inquiry by a government agency or federal regulator.

Sharing with VetraFi Affiliates

• Fair Credit Reporting Act (FCRA) permits VetraFi to share customer transaction information (i.e., number of monthly deposits made) and experience information (such as account balance) as well as information obtained from our customers.
• Fair and Accurate Credit Transactions Act (FACTA) Section 214 provides consumers with the ability to limit the circumstances by which an affiliated institution may use certain information received from another affiliate to market to the consumer.

VetraFi does not have affiliates and does not share customer information with affiliates

Information We Get from Others

We may also collect information from other sources. These sources include but are not limited to the following:

• Banks and Financial Institutions: You may choose to link a bank account to add money to an account, receive a direct deposit, or other related services. When you link a bank account we receive financial information related to that account, including your account balance, and may also receive transaction history and information about the account owner. The amount of information we receive depends on your financial institution's own privacy policy. We use third-party bank account verification providers, such as Plaid Inc. (“Plaid”), to connect your VetraFi’s Account with your bank account(s). Plaid’s use of your personal information is governed by Plaid’s Privacy Policy.
• Service Providers and Linked Account Data: We use third-party service providers to perform services for us, including to help us process and authorize your payments and to facilitate ownership of account transfers. By using our Services, you are authorizing us and our third-party service provider(s) to take actions on our behalf such as debiting your account using your selected payment method when you initiate such action.
• Credit Reference Agencies: We use these services that may provide information related to your credit file, such as your credit score, credit inquiries, and payment history.
• Social Media: When you interact with our Services through social media networks, we may receive information about you that you permit the social media network to share. The data we receive is dependent upon your privacy settings within the social media network.
• Job Applicant-related Third Parties: we may receive personal information from job applicant-related third parties, such as job application platforms, your current employer, references, background check providers and recruiters.
• Publicly Available Sources: We may also collect personal information from publicly available sources to, for example, contact you if we are otherwise unable to reach you, or, to send advertising or promotional materials or to personalize our Services.

Information Automatically Collected.

Some information is automatically collected. This includes but may not be limited to the following:

• Information about you and your computer or mobile device such as your hardware model, operating system info, unique device identifier, mobile network information, device performance information, and information about the device’s interaction with our Services. Note that the VetraFi may periodically recollect this information in order to stay up to date. You can review and change permissions for some information the VetraFi App has access to in your device privacy settings.
• Transaction data, when you use our Services, including if you give us access to collect your financial data from your other accounts, for example payments into and out of such accounts including the date, time, amount, merchant or beneficiary details, or ATMs associated with the transaction.
• Usage data, including the electronic path you take to our Services, through our Services and when exiting our Services, as well as your activity information on our services.
• Location information. We collect your IP address and device information for fraud prevention and account security. We also use your IP address, for marketing and advertising purposes, as described in the "Third-Party Online Advertising & Cookies" section of this Policy. You can withdraw your consent at any time by disabling location permission for the VetraFi App within your device settings. We may use third-party providers to help provide location-based services through mobile systems and we may make information available to such providers to enable them to provide their location-based services, provided that such third-party providers may use the information only in accordance with this Privacy Policy.

Sharing Personal Information

We may share personal information with third-party service providers and business partners (including Bank Partners in our capacity as a service provider), that perform services on our behalf or help us provide the VetraFi App and related services, such as risk detection and prevention, payment processing, customer support, communications, and other similar functions. We do not have affiliates or subsidiaries and we do not share customer information with affiliates or subsidiaries

We may also be required to share personal information in the event of a corporate restructuring (e.g., merger, sale, joint venture, or other disposition) or when we deem it necessary or appropriate to:

• Comply with applicable laws, including disclosing information to fraud prevention agencies
• Comply with lawful requests and legal process, including to respond to requests from public and government authorities to meet national security or law enforcement requirements
• Enforce our Privacy Policy
• Protect the rights, privacy, safety, or property of you, VetraFi, or others

In the event of a sale or change in ownership, you will be notified in advance and given the opportunity to take any of the following actions:

• Securely download or transfer your data - You may request a copy of your financial or account related transaction in a secure, readable format before the transaction takes place.
• Delete or dispose of your information - You may choose to request that we permanently delete your data, subject to legal and regulatory retention guidelines.
• Review the acquiring company’s privacy policy - We will provide you with access to the new owner or entity's privacy policy so you can confirm that their practices align with the standards set in this policy especially regarding data protection.
• Close your account - If you do not agree with the new ownership or their privacy practices, you may choose to close your account at any time prior to your transfer.

We may also share anonymized or de-identified aggregate information (this means information that is no longer personal information because it is no longer attributable to a specific individual) with third parties to help deliver products, services, and content that are tailored to the users of the VetraFi App and for other purposes. We may also disclose personal information about an individual to certain other third parties or publicly with their consent or direction.

Third-Party Online Advertising & Cookies

• Advertising - We participate in interest-based advertising and use third-party advertising companies to serve you targeted advertisements based on your browsing history. We permit third-party online advertising networks, social media companies, and other third-party services to collect information about your use of our online services over time so that they may play or display ads on our Services, on other websites or services you may use, and on other devices you may use. Typically, though not always, the information used for interest-based advertising is collected through tracking technologies, such as cookies, web beacons, embedded scripts, and similar technology, which recognize the device you are using and collect information, including IP address (and the general location inferred from it), clickstream information, browser type, time and date you visited our webpages and the VetraFi App, AdID, and other information. We and our third-party partners use this information to make the advertisements you see online more relevant to your interests, as well as to provide advertising-related services such as reporting, attribution, analytics, and market research. We may also use services provided by third parties (such as social media platforms) to serve targeted ads to you and others on such platforms.
• Social Media Widgets and Advertising - VetraFi may use social media platforms like Instagram, Facebook, Twitter, and LinkedIn. We may display targeted advertising to you through these social media platforms. These companies have interest-based advertising programs that allow us to direct advertisements while those users are on the social media platform. These activities are governed by the privacy policies of those social media companies that provide them.
• Third Party Partners - We may use third-party analytics on our Services. For example, we use Google Analytics to better understand how you interact with our Services. The information we obtain through our Services may be disclosed to or collected directly by these third parties. To learn more, see Google Analytics.
• Cookies - We and our third-party partners may also use cookies and tracking technologies for advertising purposes. VetraFi uses various technologies to collect information, and this may include sending cookies to your computer or mobile device. “Cookies” are small text files that are stored on your device or hardware by a website. Cookies can be stored on your computer for different periods of time. Some cookies expire after a certain amount of time, or upon logging out (session cookies), others survive after your browser is closed until a defined expiration date set in the cookie (as determined by the third party placing it), and help recognize your computer when you open your browser and browse the Internet again (persistent cookies). For more details on cookies please visit All About Cookies (https://www.allaboutcookies.org/).

On most web browsers, you will find a “help” section on the toolbar. Please refer to this section for information on how to receive a notification when you are receiving a new cookie and how to turn cookies off. Please refer to this section for guidance on how to modify your web browser’s settings. Please note that if you limit the ability of websites to set cookies, you may be unable to access certain parts of the Site and you may not be able to benefit from the full functionality of the Site.

Advertising networks may use cookies to collect Personal Information. Most advertising networks offer you a way to opt out of targeted advertising. If you would like to find out more information, please visit the Network Advertising Initiative’s online resources at http://www.networkadvertising.org and follow the opt-out instructions there.

If you access the Site on your mobile device, you may not be able to control tracking technologies through the settings.

• Email Pixels - We use pixels in our email campaigns that allow us to collect your email and IP address as well as the date and time you open an email or click on any links in the email.
• Analytics - We may also use analytics tools such as Google Analytics to collect information regarding visitor behavior and visitor demographics on our Site and develop website content. For more information on how Google uses this data, go to www.google.com/policies/privacy/partners/. You can opt out of Google’s collection and Processing of data generated by your use of the Site by going to http://tools.google.com/dlpage/gaoptout.
• Online Tracking and “Do Not Track” Signals - We and our third party service providers, including Facebook, may use cookies, pixels, or other tracking technologies to collect information about your browsing activities over time and across different websites following your use of the Site and use that information to send targeted advertisements. Our Site currently does not respond to “Do Not Track” (“DNT”) signals and operates as described in this Privacy Policy whether or not a DNT signal is received. If we do respond to DNT signals in the future, we will update this Privacy Policy to describe how we do so.

Control Over Your Information

You always have the ability to control the way your information is used. Below are some ways to manage your information with VetraFi.

Please note that these choices apply only to the information we process, and not to any information processed by our Bank Partners. The privacy practices of our Bank Partners are subject to their privacy notices, which we suggest you review.

• Updating your Information - Once you have registered for an Account, you may be able to update or correct your profile information details and preferences by accessing your account settings through the VetraFi App, or by contacting us at support@vetrafi.com or write to us at: VetraFi, Inc., 300 3rd Street Ste #919 San Francisco, CA 94107
• Deactivating your Account - We do not delete information about you upon deactivation of your Account. Although your deactivated status is reflected promptly in our user databases, we may retain the information you submit for a variety of purposes, including legal compliance, backups and archiving, prevention of fraud and abuse, and analytics. You may request to delete your data at any time, including after deactivation. We are required to retain certain information to comply with certain laws and regulations, however we will delete any data we are not required to retain. Upon deactivation, you will no longer receive emails from VetraFi and links to third-party financial accounts and services will automatically terminate. If you have a money transfer transaction pending at the time you deactivate your account, your link to this service from VetraFi will terminate but your pending transfer will continue to completion and your bank account will remain open.
• Correcting Credit Reports - Information related to your creditworthiness is maintained by the credit bureaus. If you find that there is an error or you want to dispute the information found in your credit report, please contact the credit reporting bureaus: Experian, Transunion, and Equifax or directly with the furnisher of the information, as permitted by applicable law.
• Opting-Out of Certain Online Ads - To learn more about interest-based advertising and how you may be able to opt-out of some of this advertising, you can visit the Digital Advertising Alliance (DAA) and/or the Network Advertising Initiative’s (NAI) at www.aboutads.info/choices or http://www.networkadvertising.org/choices/. You may also be able to limit interest-based advertising through the settings menu on your mobile device by selecting “limit ad tracking” (iOS) or “opt-out of interest-based ads” (Android). You may also be able to opt-out of some — but not all — interest-based advertising served by mobile ad networks by visiting http://youradchoices.com/appchoices and downloading the mobile AppChoices app. Please note: When you opt out of receiving interest-based advertisements, this does not mean you will no longer see advertisements from us. It means that the online ads that you see from DAA program participants should not be based on your interests. We are not responsible for the effectiveness of, or compliance with, any third-parties’ opt-out options or programs or the accuracy of their statements. In addition, third parties may still use cookies to collect information about your use of our online services, including for analytics and fraud prevention as well as any other purpose permitted under the DAA’s Principles.
• GLBA-Covered Data - Our U.S. Consumer Privacy Notice provides information about how you can limit your sharing options for our financial services and GLBA-covered data, if applicable.

Data Deletion Requests - You may request the deletion of your personal information that is collected or maintained by us. Please note that certain personal information we collect, process, or disclose is governed by the Gramm-Leach-Bliley Act (GLBA), and is therefore exempt from deletion requests. For personal information not covered by these laws, your rights for data deletion apply. In some instances, we may not be able to honor your request. For example, we will not honor your request if we cannot verify your identity, if we cannot verify that you have the authority to make a request on behalf of another individual or where an exception applies. We will advise you in our response if we are unable to honor your request. Eligible personal information subject to a deletion request will be securely deleted within 45 days, unless the information is exempt from deletion or we are required or permitted to retain it under applicable law, including the Gramm-Leach-Bliley Act (GLBA), or another legal exception applies. Data and records retained pursuant to such requirements will be securely destroyed or disposed of when they are no longer required. For more information about your state privacy laws, please contact our customer service at +1 877 269 4195 or support@vetrafi.com.‬‬‬

California Privacy Rights (CCPA/CPRA)

This section applies to California residents and supplements the information contained in this Privacy Policy.

Under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, the “CCPA”), California residents have specific rights regarding their personal information, subject to certain limitations and exemptions.

GLBA Exemption

Much of the personal information we collect in providing financial products and services is subject to the Gramm-Leach-Bliley Act and is therefore exempt from certain provisions of the CCPA. This section applies only to personal information that is not otherwise exempt under applicable law.

Your California Privacy Rights

Subject to verification and legal limitations, California residents may have the right to:

Right to Know / Access

Request disclosure of:

• Categories of personal information collected
• Specific pieces of personal information
• Categories of sources
• Business or commercial purposes for collection
• Categories of third parties with whom information is shared

Right to Delete

Request deletion of personal information we maintain, subject to legal exceptions.

Right to Correct

Request correction of inaccurate personal information.

Right to Limit Use of Sensitive Personal Information

Request limits on certain uses of sensitive personal information, where applicable.

Right to Opt-Out of Sale or Sharing

We do not sell or share personal information for cross-context behavioral advertising.

Right to Non-Discrimination

You will not receive discriminatory treatment for exercising your privacy rights.

Verification & Limitations

We must verify your identity before processing requests. In some cases, we may decline a request where an exception applies, including where disclosure would create security risks or interfere with legal obligations.

For security reasons, we will not disclose highly sensitive data such as full Social Security numbers, financial account credentials, or government identification numbers.

How to Exercise Your Rights

California residents may submit a request by:

• Email: support@vetrafi.com
• Phone: +1 877 269 4195

Authorized agents may submit requests on your behalf, subject to verification.

Vermont Privacy Rights

If you are a Vermont resident, Vermont law provides additional protections regarding the sharing of financial information. Consistent with Vermont law, we do not share your personal financial information with certain affiliated or non-affiliated third parties except as permitted by law.

Additional State Privacy Rights

Certain U.S. state privacy laws may provide residents with rights regarding personal information that is not otherwise subject to federal financial privacy laws, including the Gramm-Leach-Bliley Act (GLBA).

As a provider of financial products and services, much of the personal information we collect, use, and disclose is governed by GLBA and related federal regulations. Information subject to these laws is generally exempt from many state comprehensive privacy statutes.

However, to the extent we collect personal information that is not covered by GLBA or other applicable exemptions, residents of certain states may have rights under their state privacy laws, which can include the right to:

• Request access to personal information
• Request correction of inaccurate information
• Request deletion of personal information
• Opt out of certain uses or disclosures of personal information
• Appeal our decision regarding a privacy request

These rights are subject to verification, legal limitations, and applicable exemptions.

If you believe you are entitled to exercise privacy rights under your state’s laws, you may submit a request by:

• Email: support@vetrafi.com
• Phone: +1 877 269 4195

We will review your request in accordance with applicable law.

Children’s Privacy (COPPA)

We do not knowingly collect personal information from children under the age of 13. Our services are not directed to children under 13. If we learn that we have collected personal information from a child under 13 without appropriate consent, we will delete that information. If you believe a child has provided us with personal information, please contact us using the information above.

Privacy Notices

We provide customers with privacy notices explaining how we collect, use, protect, and share personal information. These notices are provided at account opening, when required by law, and when our privacy practices materially change.

Reporting Unauthorized Disclosure of Personal Information

The trust of our customers is VetraFi’s most valuable asset. When an unauthorized disclosure of PII occurs, how VetraFi responds and communicates to customers and regulatory agencies can be the difference between a potential compliance penalty or action lawsuit and an opportunity to reinforce our commitment to care.

The negative impact of an information breach can create reputational risk and cause noncompliance with laws and regulations. Incidents may include any situation in which customer personal, financial or health information or records (whether in paper, electronic, or other form that is maintained by or on behalf of VetraFi) may potentially be lost, misdirected, or in any way accessed by unauthorized individuals or parties. VetraFi’s unaffiliated third-party service providers are instructed to report all unauthorized access to, and disclosure of, any customer information.

Changes to Our Privacy Policy

We may update our privacy policy from time to time. The date the privacy policy was last revised is identified at the bottom of the page. If we make material changes to how we treat our users' personal information, we will post the new privacy policy on this page. You are responsible for periodically visiting this privacy policy to check for any changes. Depending on your preferences and permissions, you may also receive notifications of changes to this privacy policy by email, device notifications, or an in-App alert the first time you use the App after we make the change. You are responsible for ensuring we have an up-to-date active and deliverable email address for you so that we may provide such updates to you.

Contact Information

For questions, concerns, comments, or complaints about this privacy policy and/or our privacy practices or to obtain a copy of this Privacy Policy in alternative format, contact us at +1 877 269 4195 or support@vetrafi.com.‬‬‬