Privacy Policy

• We collect what you type into our forms, the codes we send to check your phone and email, and basic device data such as your IP address.
• We never ask for your passwords, your bank's one-time codes, or your full Social Security number by text or email.
• We do not sell your personal information. We do not share it for targeted ads. We do not use advertising pixels.
• We do not share your mobile number or text message opt-in with anyone for marketing.
• If you choose to connect a bank or card account, or to verify your identity, a company called Plaid does that for us in its own secure window.
• You can ask to see, fix or delete your information. Write to hello@businesscreditpartners.com.

Information you give us

When you join the interest list, we ask for:

• your state, first and last name, email address and mobile number;
• your time zone, and how and when you would like us to contact you;
• a credit score range you pick yourself, how long you have had credit, and about how much of your credit you use (ranges, not exact numbers);
• your goals, your experience with business credit, whether you are in another credit partner program, and whether you plan a major loan soon;
• any notes you choose to write. Our form blocks notes that look like a Social Security number or an account number.

When you check a box, we record that you agreed and when: to be contacted, to receive texts, and that you read our notices about credit reports and personal guarantees.

When we check your phone or email, we send you a one-time code. We keep a scrambled version of the code (not the code itself) for up to 30 days, and a record that your phone or email was confirmed.

If you are invited to the partner portal, we keep your name, email, mobile number, state, your account status, and where you are in the program (for example, consultation date and agreement status).

When you talk with us, we keep the emails and texts you send us and notes from calls and consultations.

If you become a partner, we keep the agreements you sign, copies of applications you submit (you give us these copies), statements, permissions, fee records and tax forms such as a W-9.

Account information, only if you connect an account

In the portal you can choose to connect the bank and card accounts of the business you are an officer of. Plaid Inc. ("Plaid") runs that connection. You sign in to your bank inside Plaid's window. We never see or store your bank password.

Through Plaid we receive, for each account you connect: the bank's name, the account name and type, the last 4 digits, balances, credit limit, statement balance and date, minimum payment, due date, last payment, whether a payment is overdue, and transactions (up to 180 days back when you first connect, then new ones). We also store a connection key from Plaid. It is encrypted, and we delete it when you disconnect.

Identity check, only if we offer it and you start it

If we ask you to verify your identity, Plaid collects your government ID, a photo or short video of your face, your Social Security number, date of birth and address inside Plaid's window, on our behalf. We receive the result (for example, passed, failed or needs review), the result of each step, and a reference number. We do not receive or store your Social Security number, date of birth or images. Plaid stores them for us, encrypted, under our instructions. See section 10 for face scans and how long they are kept.

Your credit report, only with your separate written permission

We never look at your credit report without your separate, signed permission. If you sign it, we receive a copy of your 3-bureau credit report through the credit monitoring service you enroll in. We use it only for the purpose written in that permission: deciding whether to offer you the credit partner role. Only the people named in the permission see it, and every view is logged.

Information collected automatically

• Device and log data: your IP address, browser and device type, the page you sent a form from, and the date and time.
• Security logs: sign-ins, portal page views and every change our staff make to portal records. We use these to keep accounts safe and to show who did what.
• Cookies: the portal uses one cookie, `bcp_session`, to keep you signed in. It lasts up to 12 hours and is needed for the portal to work. The public site sets no cookies today.
• Saved form answers: if you start the interest form, your answers are saved in your own browser so you can finish later. They stay on your device until you submit. You can clear them with "Clear saved answers." We never save your checkbox choices this way.
• Analytics: We may use a site analytics tool to count visits and see where people get stuck. It masks what you type, does not record your screen on our forms or in the portal, and turns off when your browser sends a Global Privacy Control signal.

We do not use advertising cookies or pixels, and we do not let ad networks collect information about you on our Site.

Information from other companies

• Plaid, for connected accounts and identity checks (sections 2.2 and 2.3).
• The credit monitoring service, for your credit report, only with your written permission (section 2.4). If you enroll through our link, the service may also tell us that you enrolled.

• Passwords for your bank, cards, credit monitoring or email.
• One-time codes your bank sends you.
• Your Social Security number, ID images or credit reports by text or email.
• A credit privacy number (CPN) or any number used in place of a Social Security number.

If you send us any of these by mistake, we delete them and tell you.

We use information to:

1. run the interest list and contact you the way you asked;
2. check your phone number and email address;
3. decide, with you, whether a consultation and the credit partner role may fit you;
4. prepare, sign and keep agreements, notices and records;
5. run the portal: show accounts, payments, alerts, documents and fees;
6. keep the Site and your account secure, and stop fraud, spam and abuse;
7. meet legal and tax duties, answer lawful requests, and enforce our terms;
8. improve the Site, using totals and trends that do not identify you.

People on our team make decisions about the program. We do not use automated tools to make decisions about you that have legal or similar effects.

We do not use your personal information to train artificial intelligence models.

We share information only as described here.

Companies that help us run the Site and the program. They work for us under contracts that limit how they use your information:

• website hosting and security network providers;
• our database host;
• our email delivery provider;
• our text message provider (for codes and confirmations);
• our customer records system, which holds your interest form answers;
• Plaid, for account connections and identity checks;
• ;
• our attorneys, accountants and auditors.

Lenders and card issuers. Only for an application that you review and submit yourself, or that you tell us in writing to share.

Companies in our group that run the program. This includes the business you would serve as an officer of. Your agreement names each company.

The credit monitoring service. You deal with this service directly under its own terms. We may receive a referral fee from it when you enroll through our link. We do not sell your information to it.

For legal reasons. When the law requires it, to answer a valid legal request, to protect the rights, property or safety of people or BCP, or to respond to a lender's review with true records you know about.

If our business changes hands. If we merge, sell or reorganize, your information may move to the new owner, who must follow this policy for the information we collected.

With your consent. For any other purpose you agree to.

What we do not do:

• We do not sell your personal information.
• We do not share it for targeted or cross-site advertising.
• We do not give it to other companies for their own marketing.
• We do not share mobile phone numbers, text message opt-in data or consent with any third party or affiliate for marketing or promotional purposes. We share them only with the provider that delivers our texts.

We text only one-time codes and the confirmations you ask for, from (949) 777-6893. Message frequency varies. Message and data rates may apply. Reply STOP to stop texts or HELP for help. See our SMS Terms. Section 5 explains that we never share your mobile information for marketing.

These choices are open to everyone, wherever you live.

• See your information. Ask for a copy of the personal information we hold about you.
• Fix it. Ask us to correct information that is wrong.
• Delete it. Ask us to delete your information. See the limits below.
• Stop texts. Reply STOP to any text, or tell us any other way.
• Stop emails. Use the unsubscribe link in any non-required email, or write to us.
• Withdraw a credit report permission. Write to us. This stops new imports. We then delete the report as your permission says.
• Disconnect an account. In the portal, open Connections and choose Disconnect. You can also manage connections at Plaid's own portal, my.plaid.com.
• Close portal access. Write to us.

Limits. We may keep some records when the law requires it, or when we need them for an agreement you signed, a dispute, security, or to prove what you agreed to. We always keep a short do-not-text record of your number if you opt out, so we never text you again by mistake. Deleting information from our systems does not change anything you owe a lender.

How to ask. Email hello@businesscreditpartners.com with the subject "Privacy request." We will confirm your request by sending a code to the email or phone we have on file. You may use an authorized agent if you give that person signed permission and we can confirm your identity. We will answer within 45 days. If we need more time, we will tell you why, and we will finish within another 45 days.

Appeals. If we say no to a request, you can reply to appeal. A different person will review it and answer within 45 days.

We will not treat you differently for using any of these choices.

California law gives California residents privacy rights, and some of those rights, under the California Consumer Privacy Act (CCPA), apply only to companies above certain size limits. Based on our current size and practices, we do not believe the CCPA applies to us today. Even so, we offer California residents the choices in section 7, and the following:

• Right to know and access what we collect, use and disclose (sections 2 and 5 and the table below).
• Right to delete and right to correct (section 7).
• Right to opt out of sale or sharing. We do not sell or share personal information, so there is nothing to opt out of. We treat a Global Privacy Control signal as an opt-out request anyway (section 11).
• Right to limit the use of sensitive personal information. We use sensitive information (such as identity check results and account information) only to provide the program you asked for, to keep it secure, and to meet legal duties.
• No discrimination for using any right.

Categories we collect, where they come from, and who receives them

How long we keep each category: see section 12.

Shine the Light. We do not share personal information with other companies for their direct marketing.

Do Not Track. See section 11.

Several states, including Colorado, Connecticut, Delaware, Montana, Nevada, Oregon, Texas, Virginia and others, have privacy laws. Where one applies to us, you may use the rights in section 7 and the appeal process.

Nevada. We do not sell covered information as Nevada law defines it. You can still send a request that we not sell your information to hello@businesscreditpartners.com, which is our designated request address.

If you complete an identity check, Plaid may use your ID photo and a photo or video of your face to create a scan of your facial features, to confirm the ID is yours and that you are a real person. This scan may count as biometric information in some states.

• Plaid creates and stores it for us, encrypted. We never receive it.
• It is used only to verify your identity and prevent fraud.
• We instruct Plaid to delete your ID images, face images and any face scan within 30 days after the check is complete, and in all cases no later than 3 years after your last contact with us, unless the law requires a longer hold.
• Read Plaid's Biometric Policy and Release.

• Global Privacy Control (GPC). If your browser sends a GPC signal, we treat it as a request to opt out of any sale or sharing of your information, and we turn off optional analytics for that browser. We do not sell or share information in any case.
• Do Not Track. Browsers' "Do Not Track" setting has no agreed meaning, so we do not respond to it differently. We do not track you across other websites, and we do not allow other companies to collect information about your activity across websites when you use our Site. Plaid collects device data inside its own window to keep connections secure, under its own privacy policy.

We may keep information longer if the law requires it or if a legal claim or investigation is pending.

• Every page and connection uses encryption in transit (HTTPS).
• Connection keys from Plaid are encrypted when stored.
• The portal needs two codes to sign in: one by email and one by text.
• Only named team members can see partner records, and we log every view and change.
• We limit how many codes can be requested, and we block forms that look like spam.

No system is perfectly secure. If a breach affects your information, we will tell you as the law requires.

We will never ask for your passwords or for codes your bank sends you. If someone asks for these in our name, do not share them. Tell us at hello@businesscreditpartners.com.

The Site and the program are only for adults 18 and older. We do not knowingly collect information from anyone under 18. If we learn we have, we delete it. If you think a child has given us information, write to us.

We are based in the United States and store information in the United States. The Site is meant for people in the United States.

When we change this policy, we post the new version here with a new "Last updated" date. If a change is important, we will also tell you by email or in the portal before it takes effect, when we can. Changes do not apply to information we collected before, unless you agree.

• Email: hello@businesscreditpartners.com
• Mail: our mailing address, available on request at hello@businesscreditpartners.com

The Business Credit Partners team