Privacy Policy and U.S. State Privacy Notice

4. Privacy Policy and U.S. State Privacy Notice

4.1 Scope and our role

This Privacy Policy explains how OFNDS Corp. collects, uses, discloses, retains, and protects personal information through the Platform and Financial Deep Clean. It also describes privacy choices and rights.

This Policy applies when OFNDS determines why and how personal information is processed. An independent provider may separately control information it collects under its own agreement, such as a payment processor, bank-data connector, identity-verification provider, tax professional, consumer-report provider, financial institution, lender, adviser, bookkeeper, or debt-relief provider. Review that provider's privacy notice before authorizing it.

4.2 Personal information we collect

Depending on how you interact with us, we may collect:

• Contact and account information: name, email, telephone number, mailing address, username, account identifiers, and communication preferences.

• Identity and eligibility information: date of birth, age confirmation, Social Security number or Individual Taxpayer Identification Number, government-issued identification details and images, signature, verification result, and fraud-prevention signals submitted through ShareFile for review by the authorized tax professional. OFNDS does not place these materials in its Lovable or Supabase application database.

• Financial information: financial-institution and account names, account type, balances, transaction history, income, expenses, transfers, platform payouts, payment information, and 12 months of bank statements you upload through ShareFile. OFNDS does not currently connect to your bank account or receive online-banking credentials.

• Tax information: high-level IRS account findings supplied by the authorized tax professional, filing status, tax forms and periods, balances, notices, deadlines, and signed authorizations. OFNDS does not receive the underlying IRS transcripts.

• Credit and debt information: information contained in a credit report you obtain and upload, creditor and collector names, account type, balance, payment status, collections, and debt-related documents. During the beta, OFNDS does not obtain a consumer report from a consumer reporting agency or intermediary.

• Business information: entity name, jurisdiction, registration status, employer identification number when required, business records, bookkeeping status, and business-contact information.

• Purchase and commercial information: products viewed or purchased, amount paid, transaction status, referrals, and customer-support history. Payment-card numbers are generally collected directly by the payment processor rather than stored by OFNDS.

• Waitlist and product-interest information: creator or business type, United States location status, approximate transaction activity, anticipated opening-deposit amount, banking-product preferences, investment-service interest, financial goals, and other responses submitted for future product planning or a customer-requested referral.

• Documents and communications: files, intake answers, emails, support requests, call or meeting information, and content you choose to provide.

• Device and online activity: IP address, browser and device type, operating system, referring URLs, pages viewed, timestamps, cookie or similar identifiers, and security logs.

• Derived information: estimates, categories, trends, flags, report content, and recommendations inferred from the information above.

Some of this information is considered sensitive personal information under state law, including government identifiers, account credentials, financial-account information, precise location if collected, and information that may reveal sex life or sexual orientation. OFNDS uses sensitive information only as reasonably necessary to provide a requested service, verify identity, prevent fraud, maintain security, comply with law, or establish and defend legal claims. OFNDS does not use sensitive information to infer characteristics for advertising.

4.3 Sources

We collect information:

• directly from you, including through intake, uploads, communications, and signed forms;

• automatically from the Platform and security technologies;

• from payment, document, electronic-signature, email, and hosting providers;

• from Jessica Benitez Martinez, CPA, through BM Advisory & Co., when you execute a valid Form 8821 authorization;

• from public business registries and other lawful public records;

• from referral or professional partners when you direct or authorize the disclosure.

4.4 Why we use information

We use personal information to:

• provide, personalize, and deliver the service you request;

• verify identity, age, authority, and eligibility;

• process payments and prevent fraud;

• obtain records that you specifically authorize;

• organize data and produce the Financial Deep Clean;

• communicate about intake, signatures, delivery, support, and security;

• maintain, troubleshoot, audit, and improve the Platform;

• enforce agreements and protect users, providers, OFNDS, and the public;

• comply with tax, accounting, legal, regulatory, and records obligations;

• send marketing where permitted and honor opt-outs;

• create aggregated or deidentified information that is not reasonably linkable to an individual.

We do not use tax transcripts, government identification, Social Security numbers, consumer reports, or bank-transaction data for targeted advertising.

4.5 When we disclose information

We may disclose relevant information to:

• Service providers and processors that host the Platform, secure uploads, support identity review, process payments, provide electronic signatures, deliver communications, support customers, analyze security, or perform work for OFNDS under contractual restrictions.

• Independent professional or regulated providers that you affirmatively select or authorize, such as the named tax professional, consumer-report provider, bank, lender, investment professional, bookkeeper, formation provider, or debt-relief provider. Their own notices and agreements control their independent use.

• Government authorities, courts, and parties to legal proceedings when required by law or reasonably necessary to protect rights, safety, security, and integrity.

• Transaction counterparties and advisers in connection with a proposed or completed financing, merger, reorganization, sale, or transfer, subject to appropriate confidentiality and legal protections.

• Others at your direction or with your consent.

OFNDS does not sell Social Security numbers, government-ID images, tax records, consumer reports, bank credentials, or bank-transaction data. OFNDS does not share personal information for cross-context behavioral advertising and does not knowingly sell or share the personal information of anyone under 18.

OFNDS does not currently transfer Financial Deep Clean profiles to debt-relief, banking, lending, or investment providers. If you later ask OFNDS to introduce you to an optional third-party service, OFNDS may disclose only the limited contact, commercial, or service information listed in a separate referral consent and may receive compensation. Because some state laws define a "sale" broadly to include transfers for valuable consideration, OFNDS will treat a compensated referral as a potential sale where applicable, provide the required notice and opt-out right, and obtain affirmative consent before transferring information. OFNDS will not condition the Financial Deep Clean on agreeing to an optional referral.

4.6 Provider Schedule

The following providers support the current beta. Providers for future services must be added before they receive customer information.

4.7 Data retention

OFNDS retains information only as long as reasonably necessary for the disclosed purpose, taking into account the service relationship, customer requests, security, dispute prevention, tax and accounting obligations, provider requirements, and applicable law.

Unless a longer period is legally required or necessary for an active dispute:

• unsubmitted intake data is deleted after 30 days of inactivity;

• identity documents, secondary verification documents, bank statements, and uploaded credit reports are scheduled for deletion from OFNDS-controlled ShareFile storage within 30 days after the final report is delivered, unless they remain necessary for an active correction, dispute, legal obligation, or customer-authorized follow-up service;

• ShareFile upload links and files are configured to expire no later than 180 days after upload as an outer limit. The 180-day expiration is a backstop and does not replace the earlier deletion schedule after report delivery;

• OFNDS does not place uploaded bank statements, credit reports, government identification, or IRS transcripts in its Lovable or Supabase application database;

• tax authorizations, consent records, service agreements, final reports, payment records, and records needed for legal compliance may be retained for up to seven years after the engagement;

• security logs may be retained for up to two years;

• marketing records are retained until opt-out plus a suppression record needed to honor the opt-out.

The actual system must be configured to follow these periods. Backup copies may persist temporarily until overwritten under the normal backup cycle.

4.8 Security

OFNDS uses administrative, technical, and physical safeguards designed for the sensitivity of the information involved, including access controls, encryption in transit, encryption at rest where supported, multifactor authentication for privileged access, vendor review, audit logging, least-privilege access, and secure deletion procedures. No system is perfectly secure, and OFNDS cannot guarantee that unauthorized access will never occur.

Do not transmit sensitive documents through ordinary email, SMS, social media, or unsecured forms. If you believe information was exposed or sent to the wrong place, contact security@onlyfnds.com promptly.

4.9 Financial information during the beta

OFNDS does not currently connect to your financial accounts. You obtain 12 months of statements directly from your financial institution and upload them through ShareFile. OFNDS does not request or need your online-banking username, password, PIN, full debit-card number, or authority to move money. A future bank-data connection will require separate notice, applicable provider terms, and affirmative customer action before activation.

4.10 Cookies and analytics

OFNDS may use essential cookies for security, sessions, checkout, and preferences. Nonessential analytics or advertising technologies will not load until the user receives any consent or opt-out mechanism required by applicable law. The site will accurately identify each nonessential provider and provide a "Privacy Choices" control if such technologies are used.

Browser "Do Not Track" signals are not uniformly defined. Where legally required, OFNDS will recognize opt-out preference signals such as Global Privacy Control for sale, sharing, or targeted advertising. OFNDS does not share personal information for cross-context behavioral advertising, and its website configuration must remain consistent with that statement.

4.11 Your choices and privacy rights

You may unsubscribe from marketing email, decline optional data connections, or request closure of your account. Depending on your state and subject to legal exceptions, you may have rights to:

• confirm whether OFNDS processes your personal information;

• access or obtain a portable copy;

• correct inaccuracies;

• delete information;

• opt out of sale, targeted advertising, or qualifying profiling;

• limit certain uses or disclosures of sensitive personal information;

• appeal a denial of a privacy request;

• receive equal service and pricing without unlawful discrimination for exercising a right.

Submit requests to legal@onlyfnds.com with the subject "Privacy Request." Include your name, account email, state of residence, and the right requested. Do not email an SSN, ID image, bank statement, tax record, or credit report. OFNDS may use a secure method to verify identity and authority. An authorized agent may submit a request where permitted, subject to verification of the authorization.

OFNDS will respond within the period required by applicable law. If OFNDS denies a request, the response will explain the basis and any available appeal method. To appeal, email legal@onlyfnds.com with the subject "Privacy Appeal" within 30 days after the decision.

4.12 California notice

This section supplements the Policy for California residents. Even if OFNDS does not currently meet the statutory thresholds for every California Consumer Privacy Act obligation, it uses this section to describe its practices and will honor applicable rights.

The categories collected during the preceding 12 months may include identifiers; customer-record information; protected-classification information only if voluntarily provided or inferred from documents; commercial information; internet or electronic-network activity; professional or employment-related information; audio, electronic, or visual information; sensitive personal information; and inferences. The specific examples, sources, business purposes, and recipient categories are described in Sections 4.2 through 4.6.

OFNDS does not sell sensitive personal information and does not share personal information for cross-context behavioral advertising. A compensated, customer-requested referral involving limited contact, commercial, or service information may be treated as a sale under a broad state-law definition; the notice, optional consent, and opt-out process are described in Sections 4.5 and 4.11. OFNDS does not use or disclose sensitive personal information for purposes other than providing requested services, security, fraud prevention, legal compliance, and other purposes permitted without a right to limit. OFNDS does not knowingly sell or share information of consumers under 16.

California residents may request to know the categories, sources, purposes, recipient categories, and specific pieces of personal information collected; request deletion or correction; request portability; opt out of sale or sharing if those practices begin; limit nonessential use of sensitive information if such use begins; and exercise rights without discriminatory treatment. OFNDS will not disclose an SSN, account password, full financial-account number, or similarly restricted data in response to an access request, but may confirm collection.

Requests may be submitted using the method in Section 4.11. Because OFNDS operates online, it designates the monitored email address and the website privacy-request form as request methods. Metrics or disclosures required for high-volume request recipients will be posted if the applicable threshold is met.

4.13 Florida and other U.S. state rights

Residents of Florida and other states with applicable privacy laws may exercise the rights described in Section 4.11 where those laws apply. Where required, OFNDS will obtain consent before processing sensitive data, honor recognized opt-out signals, provide required appeals, and conduct assessments for processing that presents a heightened risk. OFNDS does not conduct targeted advertising, sale of personal data, or qualifying profiling using Financial Deep Clean data during the current beta.

4.14 Adult-only platform and children's privacy

OFNDS does not offer the Platform or services to anyone under 18 and does not knowingly collect personal information from a child under 13 or another minor. If an intake response or date of birth shows that a person is under 18, OFNDS will stop the intake and delete the submitted information, subject only to a minimal suppression or security record where lawful and necessary. A parent or guardian who believes a minor submitted information may contact legal@onlyfnds.com with the subject "Minor Data Removal." Do not send the child's sensitive information by email.

4.15 Changes and contact

OFNDS may update this Policy prospectively. Material changes will be posted with a new effective date and, where required, notice or consent will be provided before the change applies. OFNDS Corp., 2040 Millburn Avenue, Suite 102-728, Maplewood, NJ 07040. Privacy and legal requests: legal@onlyfnds.com. Security incidents: security@onlyfnds.com. Customer support: info@onlyfnds.com.