Privacy Policy

About This Policy

Lilypay, Inc. ("Lilypay," "Company," "we," "us," or "our") provides financing for funeral, burial, and memorial expenses, and related fundraising tools, through www.lilypay.co and our applications (together, the "Services"). This Privacy Policy ("Policy") explains how we collect, use, share, retain, and protect information about you.

Because Lilypay is a financial institution, our handling of your nonpublic personal financial information is also governed by the Gramm-Leach-Bliley Act ("GLBA"). Our GLBA Privacy Notice appears in Section 10 below. Where this Policy and the GLBA Privacy Notice differ with respect to financial information, the GLBA Privacy Notice controls.

By using the Services, you acknowledge the data practices described in this Policy.

1. Information We Collect

1.1 Information you provide to us

• Identity and contact information: first and last name, mailing address, email address, phone number, date of birth, and Social Security number or taxpayer identification number.
• Application information: the funeral home or provider you are working with, the goods and services being financed, the amount requested, and income and monthly debt-obligation information.
• Payment information: bank account and routing numbers, debit or credit card information, and payment method preferences.
• Fundraiser content: obituary or life-story text, photographs, and other content you post to a fundraiser.
• Communications: the content of emails, chats, and support calls with us, which may be recorded or transcribed.

1.2 Information we obtain from your financial institution through Plaid

When you connect a bank account, we receive, through Plaid Inc. ("Plaid"), depending on the permissions you grant:

• account and routing numbers, account type, and account status
• current and available account balances
• the account holder name, address, phone number, and email associated with the account
• transaction history and derived account attributes used for identity verification, account validation, fraud prevention, and assessment of your ability to repay

We do not receive, view, or store your financial institution login credentials. See Section 4.

1.3 Information we obtain from consumer reporting agencies and verification services

• consumer credit reports and credit scores
• identity verification and identity-fraud screening results
• bank-account and payment-risk attributes
• watchlist and sanctions screening results

1.4 Information collected automatically

IP address, device and browser identifiers, operating system, referring URL, pages viewed, time and duration of visits, and interactions with the Services, collected through cookies and similar technologies. See Section 6.

1.5 Information from partners

Where a funeral home or other partner ("Partner") refers you to us, we receive the Partner's identity, the transaction being financed, and the fact and status of your referral. Partners do not provide us with your credit report data, and we do not provide your credit report data or the financial account data we obtain through Plaid to Partners. See Section 5 for the information Partners can see about applications they referred.

2. Management of Personal Data for Text Messaging

If you actively opt in through Lilypay's unchecked text-message consent checkbox, Lilypay may use your mobile phone number to send requested application links, incomplete-application reminders, financing application status updates, account and payment reminders, and customer-support responses. Message frequency varies. Message and data rates may apply. Reply STOP to opt out or HELP for help. Consent is optional and is not a condition of applying for or receiving credit.

Lilypay does not sell, rent, or share mobile phone numbers with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties, except with vendors that support delivery of the messaging service, such as platform providers and telecommunications carriers. Those vendors may use the information only to provide the messaging service. This exclusion does not apply where disclosure is required by law.

3. How We Use Information

We use the information we collect to:

• evaluate your application, verify your identity, and make credit decisions
• validate your bank account, detect and prevent fraud, and manage risk
• originate, fund, service, and collect your loan, including initiating payments you authorize
• operate and deliver the fundraising features and process donations
• communicate with you about your application, account, and the Services, and respond to your inquiries
• fulfill our obligations and enforce our rights under our agreements with you, including billing and collection
• comply with legal and regulatory obligations, including the Bank Secrecy Act, anti-money-laundering and sanctions requirements, the Fair Credit Reporting Act, and the Equal Credit Opportunity Act
• furnish information about your account to consumer reporting agencies
• secure, maintain, analyze, and improve the Services
• inform you about other products or services offered by Lilypay, subject to your choices in Section 8

We do not sell your personal information. We do not share your personal information with third parties for those third parties' own marketing purposes.

4. Bank Account Connections and Plaid

We use Plaid Inc. ("Plaid") to gather your data from financial institutions. By using our Services, you grant Lilypay and Plaid the right, power, and authority to act on your behalf to access and transmit your personal and financial information from the relevant financial institution.

You agree that your personal and financial information will be transferred, stored, and processed by Plaid in accordance with the Plaid End User Privacy Policy, available at https://plaid.com/legal/#end-user-privacy-policy, and you acknowledge and agree that your information will be treated in accordance with that policy. Plaid's privacy policy, and not this Policy, governs Plaid's collection and use of information Plaid collects from or about you.

Plaid is an independent third party and is not our agent with respect to its own data practices.

Your credentials. When you connect an account, you enter your financial institution username and password directly into Plaid's interface. Lilypay never receives, views, or stores your financial institution login credentials.

Managing and revoking access. You may review the data you have shared and revoke access at any time through Plaid Portal at https://my.plaid.com/. You may request deletion of data Plaid holds about you at https://my.plaid.com/data-subject-request-form. You may also contact us at support@lilypay.co and we will disconnect the account from your Lilypay profile so that it is no longer used.

What revocation does and does not do. Revoking Plaid's access may prevent us from processing your application, validating your account, or initiating scheduled payments, and does not cancel or reduce your obligation to repay any loan. Information we have already received through Plaid remains in our records and remains subject to this Policy and to the retention periods in Section 7, which are in many cases required by law and cannot be shortened at your request.

5. How We Share Information

We share information with the following categories of recipients:

• Service providers performing services on our behalf — including our loan servicer, payment processors, data connectivity providers (Plaid), cloud hosting and infrastructure providers, identity verification and fraud prevention vendors, communications and messaging vendors, document and e-signature vendors, and analytics providers. Each is contractually restricted to using the information only to perform services for us and is required to maintain its confidentiality.
• Consumer reporting agencies, to which we furnish information about your account, including payment history, as permitted by the Fair Credit Reporting Act.
• Purchasers, investors, and lenders to whom we sell, assign, pledge, or finance loans or loan participations, and their servicers, auditors, and advisors.
• Funeral home and other Partners who referred you, who can see information about the applications they referred — including your name and contact information, the name of the deceased, the amount requested, and application status, and, for funded loans, the loan terms and payment schedule. Partners never receive your credit report data or the financial account data we obtain through Plaid.
• Regulators, law enforcement, and courts, in response to lawful requests, subpoenas, or other legal process, and to comply with applicable law.
• Professional advisors — our attorneys, accountants, and auditors — under obligations of confidentiality.
• Parties to a corporate transaction, in connection with a merger, acquisition, financing, reorganization, or sale of all or part of our business or assets.

The sharing described above excludes mobile information used for text-message marketing or promotion and text messaging originator opt-in data and consent, subject only to the limited messaging-vendor and legal-disclosure exceptions stated in Section 2.

We may also disclose your personal information without notice if required to do so by law or in the good faith belief that such action is necessary to: (a) conform to legal requirements or comply with legal process served on us; (b) protect and defend our rights or property; or (c) act under exigent circumstances to protect the personal safety of users of the Services or the public.

We do not sell or rent our customer lists.

6. Cookies and Tracking Technologies

We use the following categories of technologies:

• Strictly necessary — required to operate the Services, authenticate you, and secure your session. These cannot be disabled.
• Functional — remember your preferences and application progress.
• Analytics — help us understand how the Services are used so we can improve them. We use Google Analytics for this purpose; Google may set its own cookies and process usage data in accordance with its policies.

We also use Google reCAPTCHA on certain forms to detect fraud and automated abuse; reCAPTCHA is provided by Google and is subject to Google's privacy policy and terms. We do not use advertising or retargeting pixels, and we do not use the Services to build cross-context behavioral advertising profiles about you or to permit third parties to do so.

You can control cookies through your browser settings. Blocking strictly necessary cookies may prevent parts of the Services from functioning.

Opt-out preference signals. Because we do not sell your personal information and do not use it for cross-context behavioral advertising, browser-based opt-out preference signals, such as the Global Privacy Control (GPC), do not change how we handle your information.

7. How Long We Keep Information

We retain personal information for as long as necessary to provide the Services and to satisfy our legal, regulatory, contractual, and recordkeeping obligations. Our principal retention periods are:

When information is no longer required, we delete it or irreversibly de-identify it in accordance with our data retention schedule. Where a legal retention obligation applies, we will retain the information for the required period even if you request deletion.

8. Your Choices

• Marketing email: unsubscribe using the link in any marketing email, or contact support@lilypay.co.
• Marketing and program text messages: reply STOP, STOPALL, UNSUBSCRIBE, CANCEL, END, or QUIT. See Section 2.
• Account and servicing communications: you may revoke consent as described in our Terms of Service. Some communications are required by law and will continue.
• Bank connections: disconnect at any time via Plaid Portal (https://my.plaid.com/) or by contacting us. See Section 4.
• GLBA sharing limits: see the GLBA Privacy Notice in Section 10.
• State privacy rights: see Section 11.
• Access and correction: contact support@lilypay.co to request access to or correction of information we hold about you.

9. How We Protect Information

We maintain administrative, technical, and physical safeguards designed to protect the security, confidentiality, and integrity of your information. These include:

• encryption of personal information in transit and at rest using modern, industry-standard cryptography
• role-based access controls limiting access to personnel with a legitimate business need
• multi-factor authentication for administrative and production system access
• continuous monitoring and logging of systems for unauthorized access, with review of security events
• timely remediation of identified vulnerabilities
• vendor security diligence and contractual security obligations for service providers who handle personal information
• a documented written information security program and incident response plan, tested periodically
• security awareness training for personnel

These safeguards are designed to meet the requirements of the GLBA Safeguards Rule, 16 C.F.R. Part 314, and applicable state data security laws. No method of transmission over the internet or method of electronic storage is completely secure, and we cannot guarantee absolute security.

Breach notification. If we determine that your personal information has been involved in a security incident requiring notification, we will notify you and applicable regulators as required by law.

10. GLBA Privacy Notice

FACTS — WHAT DOES LILYPAY, INC. DO WITH YOUR PERSONAL INFORMATION?

Why? Financial companies choose how they share your personal information. Federal law gives consumers the right to limit some but not all sharing. Federal law also requires us to tell you how we collect, share, and protect your personal information. Please read this notice carefully to understand what we do.

What? The types of personal information we collect and share depend on the product or service you have with us. This information can include:

• Social Security number and income
• account balances and payment history
• credit history and credit scores

How? All financial companies need to share customers' personal information to run their everyday business. In the section below, we list the reasons financial companies can share their customers' personal information; the reasons Lilypay chooses to share; and whether you can limit this sharing.

Questions? Call (833) 773-5459 or go to www.lilypay.co.

Who we are

Who is providing this notice? Lilypay, Inc.

What we do

How does Lilypay protect my personal information? To protect your personal information from unauthorized access and use, we use security measures that comply with federal law. These measures include computer safeguards, encryption, access controls, and secured files and buildings. We restrict access to personal information to employees and service providers who need it to provide products or services to you.

How does Lilypay collect my personal information? We collect your personal information, for example, when you apply for a loan or financing, give us your contact information, provide account information or connect a bank account, or use your account. We also collect your personal information from others, such as credit bureaus or other companies.

Why can't I limit all sharing? Federal law gives you the right to limit only:

• sharing for affiliates' everyday business purposes — information about your creditworthiness
• affiliates from using your information to market to you
• sharing for nonaffiliates to market to you

State laws and individual companies may give you additional rights to limit sharing. See "Other important information" below.

Definitions

• Affiliates — Companies related by common ownership or control. They can be financial and nonfinancial companies. Lilypay, Inc. has no affiliates.
• Nonaffiliates — Companies not related by common ownership or control. They can be financial and nonfinancial companies. Nonaffiliates we share with can include our loan servicer, payment processors, data connectivity providers, consumer reporting agencies, and purchasers of loans.
• Joint marketing — A formal agreement between nonaffiliated financial companies that together market financial products or services to you. Lilypay, Inc. does not jointly market.

Other important information

For California residents: We will not share personal information with nonaffiliates either for them to market to you or for joint marketing, and we will limit sharing of personal information about you with our affiliates, except as permitted by California law.

For Vermont residents: We will not disclose information about your creditworthiness to our affiliates and will not disclose your personal information, contact information, or credit reports to nonaffiliates for their marketing purposes, except with your authorization.

For Nevada residents: We are providing this notice under Nevada state law. You may be placed on our internal Do Not Call list by calling (833) 773-5459. Nevada law requires that we also provide you with the following contact information: Bureau of Consumer Protection, Office of the Nevada Attorney General, 100 N. Carson St., Carson City, NV 89701; phone (775) 684-1100; email BCPINFO@ag.state.nv.us.

For North Dakota residents: We will not disclose personal information about you to nonaffiliates for their marketing purposes without your authorization.

11. State Privacy Rights

Much of the information we collect about you is nonpublic personal information subject to the Gramm-Leach-Bliley Act and described in Section 10. Information subject to the GLBA is exempt from most state consumer privacy laws. The rights described below apply to personal information we hold that is not subject to the GLBA — for example, information collected from visitors to our marketing website who do not apply for financing, fundraiser and donor information not tied to a credit application, and job applicant information.

11.1 California residents

Under the California Consumer Privacy Act, as amended by the California Privacy Rights Act, you have the right to:

• know what personal information we collect, use, disclose, and sell or share, and the categories of sources and recipients
• access a copy of the personal information we hold about you
• delete personal information we have collected from you, subject to exceptions
• correct inaccurate personal information
• opt out of the sale or sharing of personal information for cross-context behavioral advertising
• limit the use and disclosure of sensitive personal information
• not receive discriminatory or retaliatory treatment for exercising these rights

We do not sell personal information and we do not share personal information for cross-context behavioral advertising.

Sensitive personal information. We collect Social Security numbers and financial account information, which are "sensitive personal information" under California law. We use and disclose this information only for the purposes permitted under Cal. Civ. Code § 1798.121(a) — to provide the Services you request, prevent fraud, ensure security, and comply with law — and not to infer characteristics about you. As a result, the right to limit does not apply.

Notice of financial incentive. We do not offer financial incentives in exchange for personal information.

11.2 Residents of other states

Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and other states with comprehensive consumer privacy laws may have rights to access, correct, delete, and obtain a portable copy of their personal information, and to opt out of targeted advertising, sale, and certain profiling.

Lilypay is a financial institution subject to the Gramm-Leach-Bliley Act and is exempt from these laws in most states. Where an exemption does not apply, we honor the rights those laws provide.

11.3 How to exercise your rights

Submit a request by emailing support@lilypay.co with the subject line "Privacy Request," or by calling (833) 773-5459.

Verification. We will verify your identity before responding, generally by matching information you provide against information already in our records. For requests involving sensitive information, we may require additional verification. We will not use information collected for verification for any other purpose.

Authorized agents. You may designate an authorized agent to submit a request on your behalf. We will require written proof of authorization and may require you to verify your own identity directly.

Timing. We will confirm receipt within 10 business days and respond within 45 calendar days, with one 45-day extension where permitted and with notice to you.

Appeals. If we decline your request, you may appeal by emailing support@lilypay.co with the subject line "Privacy Appeal." We will respond within 60 days with our decision and reasoning. If your appeal is denied, you may contact your state attorney general.

12. Children's Privacy

The Services are intended for adults. You must be at least 18 years old to apply for or obtain financing, or to connect a financial account. We do not knowingly collect personal information from children under the age of 13. If we learn we have collected personal information from a child under 13, we will delete it. If you believe a child has provided us personal information, contact us at support@lilypay.co.

13. Data Storage and Third-Party Hosting

We store data on servers operated by third-party cloud hosting providers with whom we have contracted and who are bound by written security and confidentiality obligations. Our data is stored in the United States. The Services are intended for users located in the United States.

14. Changes to This Policy

We reserve the right to modify this Policy. For material changes, we will notify you by email to the primary address in your account, by placing a prominent notice on our website, or by other reasonable means, and we will update the "Last Updated" date above. Material changes to how we share nonpublic personal financial information will be preceded by a revised GLBA Privacy Notice as required by law. Continued use of the Services after modifications take effect constitutes acceptance of the modified Policy.

15. Contact Information

We welcome your questions or comments regarding this Policy. If you believe we have not adhered to this Policy, please contact us:

You may also submit a complaint about a consumer financial product or service to the Consumer Financial Protection Bureau at consumerfinance.gov/complaint or (855) 411-2372.