COVIANCE CONSUMER PRIVACY POLICY

1. Scope of This Policy

This Privacy Policy ("Policy") describes how Coviance handles information in connection with your use of our online loan application website and our online document upload website (together, the "Platform"), each of which Coviance operates on behalf of the financial institution through which you accessed the Platform (your "Financial Institution"). The application and document upload experiences may appear as separate websites or steps, but this single Policy governs both. Capitalized terms used in this Policy are defined in Section 2.

This Policy covers:

Your use of the online loan application and the separate document upload site (the mechanics of the Platform, not your Financial Information you submit through it; see Section 2)
Your Platform account (if you create one) and login credentials, including if the same account or session carries over between the application and document upload sites
Your use of the websites themselves (pages visited, technical/device data, cookies; see Section 9)
Support communications between you and Coviance

If you are applying jointly with a co-borrower, this Policy applies equally to each co-borrower's information, and each reference to "you" below includes any co-borrower on the application.

This Policy does not cover how your Financial Information (including credit report data) is used or shared. Coviance stores and processes your Financial Information, including credit report data described in Sections 3, 6, 8, and 14, solely as a processor acting on behalf of your Financial Institution and never for Coviance's own independent purposes. That information, and how it is used and shared, is governed by your Financial Institution's own privacy notice, which is available directly from your Financial Institution. Your Financial Institution owns and is responsible for that information.

If anything in this Policy appears to conflict with your Financial Institution's notice regarding your application information, your Financial Institution's notice controls.

2. Key Terms

It would be helpful to start by explaining some key terms used in this Policy:

"Coviance," "we," "us," or "our" means Coviance, the operator of the Platform.
"Financial Institution" means the bank, credit union, or other financial institution through which you accessed the Platform, and which owns and is responsible for your Financial Information.
"Platform" means, together, the online loan application website and the online document upload website described in Section 1, regardless of whether they appear as separate sites or steps.
"Financial Information" means the information collected as part of your loan application, including but not limited to your income, assets, liabilities, employment information, Social Security number, bank account and routing numbers, credit report data, and any documents you upload to support your application (for example, pay stubs, tax returns, bank statements, and proof of identity or residence).
"Account Information" means the information associated with a Platform account, including your name, email address, and password.
"You" or "your" means the applicant, and, where you are applying jointly, each co-borrower on the application (see Section 3).

3. Information We Collect

Account Information. If you create a Platform account: your name, mobile number, email address, and a password (stored in hashed form; Coviance never stores or can view your plaintext password).
Usage and device information. Automatically collected when you use the Platform: IP address, browser and device type, pages viewed, timestamps, and similar diagnostic/session data.
Cookies and other electronic technologies. Used for session management, security, and, where applicable, analytics. See Section 9 for details.
Support communications. If you contact Coviance support, we collect the content of that communication and information needed to resolve your request.
Information from third parties. Verification data from employers, income or asset verification vendors, or identity-verification vendors, used to confirm information you provide. See Section 4 for more on how this information reaches us.
Financial Information. Coviance stores your Financial Information (as defined in Section 2) and uploaded documents on its own systems as a processor on behalf of your Financial Institution. Depending on your Financial Institution's configuration, this information may also be transmitted to your Financial Institution's own loan origination system or core system; that transmission is in addition to, not instead of, Coviance's own storage. See Section 1 and Section 8.

Co-Borrowers and Joint Applicants

If you are using the Platform to apply jointly with another person for a loan or other financial services product, you and your co-applicant may be required to provide information using a single application or you may have the option to use multiple individual account(s). When using a single application, the joint applicants will have access to all information supplied by each other to complete that application. Such joint applicants will have the ability to view, print, transmit, save, and/or edit the information. Access may continue for as long as the joint applicants utilize the single account in connection with the application process. While Coviance takes reasonable efforts to keep Financial Information separate between joint applicants, all types of joint applicants should expect that certain Financial Information may be disclosed between both applicants. The type of personal information disclosed between joint applicants may depend on the practices of your Financial Institution.

Text Messages

If you provide a mobile number, Coviance may send you text messages on behalf of your Financial Institution, for example, verification codes, application status updates, or document requests. By providing your mobile number and opting in where prompted, you consent to receive these messages, which may be sent using automated technology. Message and data rates may apply. You can opt out of non-essential text messages at any time by replying STOP, though you may still receive messages necessary to complete your application (such as one-time verification codes) if you have an active application in progress. As with email, these messages will identify your Financial Institution and will not communicate an approval, denial, rate, or loan term decision. That communication comes from your Financial Institution directly.

Identity Verification

As part of completing your application, you may be asked to upload a photo or scan of a government-issued ID (such as a driver's license or passport) and a live photo or short video of yourself (a "selfie") to verify your identity. Coviance uses a third-party identity verification vendor to perform this verification. That vendor uses facial recognition and liveness detection technology to compare your selfie to the photo on your ID and to confirm that your selfie was captured from a live person, rather than a photo, video, or other spoof. This process involves the collection of biometric identifiers and biometric information, including data derived from facial geometry, by our identity verification vendor, not by Coviance. Your ID image and selfie are transmitted to and processed by our identity verification vendor on its own systems for this purpose; Coviance receives the verification result but does not itself perform the facial matching. Our identity verification vendor obtains your explicit consent directly before performing this verification, in accordance with its own consent process and privacy policy. Biometric data collected during this process is retained by our identity verification vendor in accordance with its own retention practices, as described in its privacy notice presented to you at the time of verification. If you decline to provide consent, you will be offered an alternative method to verify your identity.

4. How We Collect Information

We collect information in the following ways:

Directly from you. Information you type or upload, such as account registration details, application responses, uploaded documents, and anything you send us through support.
Automatically, through your use of the Platform. Technical and usage data collected via cookies and other electronic technologies as you navigate the application and document upload sites (see Section 9).
From your Financial Institution. If you are an existing member, your Financial Institution may provide us with information to pre-fill or verify parts of your application. Your Financial Institution remains responsible for the accuracy and permitted use of any information it provides to us.
From vendors acting on our behalf. For example, an identity verification vendor or credit reporting agency engaged to support the application process may return information to the Platform as part of completing your application.

5. How We Use Your Information

We use the information above to:

Operate, maintain, and secure the Platform
Authenticate your account and maintain your session
Provide support and respond to your requests
Diagnose technical issues and improve Platform performance
Detect, prevent, and respond to fraud, abuse, or security incidents
Comply with legal obligations

We do not use your Account Information or usage information to market Coviance's own products or services to you, and we do not sell this information to third parties.

6. Who We Share Your Information With

We share information:

With your Financial Institution, since the Platform is operated on their behalf and they are entitled to information about applicants and accountholders using their branded instance of the Platform
With service providers (subprocessors) who support the Platform's infrastructure, for example, cloud hosting, email delivery, and analytics providers, under confidentiality and security obligations consistent with this Policy
With vendors that provide settlement services, verification services, or credit reporting, such as title, escrow, appraisal, or closing-related vendors, identity/income/employment verification vendors, and credit reporting agencies, at the direction of, and as instructed by, your Financial Institution to complete your application or transaction
As required by law, such as in response to a valid legal request
In connection with a business transfer (merger, acquisition, or sale of assets), in which case affected users would be notified

Your Financial Institution determines which of these vendors are used for your application; Coviance shares information with them as directed by your Financial Institution, in the same capacity as a processor acting on your Financial Institution's behalf. Coviance retains a copy of this information on its own systems in all cases; depending on your Financial Institution's configuration, some information (such as credit report data) may also be transmitted to your Financial Institution's own systems in addition to being retained by Coviance; see Section 8.

We do not share your information with other Coviance customers (other financial institutions) or use it to benefit any Platform instance other than the one through which you applied.

7. Personal Information We Sold or Disclosed for a Business Purpose

In the preceding 12 months, we have not sold any personal information collected through the Platform.

In the preceding 12 months, we have disclosed for a business purpose to one or more third parties the following categories of information described in Section 3:

Account Information (name, email address)
Usage and device information (IP address, browser and device type, pages viewed)
Cookies and other electronic technologies (see Section 9)

We have disclosed these categories to the following categories of recipients:

Your Financial Institution
Service providers who support the Platform's infrastructure, as described in Section 6

We have not disclosed your Financial Information for a business purpose; that information is held and used by Coviance solely as a processor on behalf of your Financial Institution, and any disclosure of it, including to vendors that provide settlement services, verification services, or credit reporting (see Section 6), is governed by your Financial Institution's own privacy notice.

8. How Long Your Personal Information Will Be Kept

We will keep your Account Information and usage information while you have an active Platform account or while we are providing services on your Financial Institution's behalf. After that, we will keep it for as long as necessary to:

Respond to any questions, complaints, or claims made by you or on your behalf
Show that we treated you fairly
Keep records required by law

We will not retain your information for longer than necessary for the purposes set out in this Policy. Different retention periods may apply to different types of information.

We may keep an anonymized form of your information, which no longer identifies you, where we have a legitimate and lawful interest in doing so.

If your application is denied, withdrawn, or left incomplete, we keep your Financial Information consistent with your Financial Institution's recordkeeping obligations, after which it is securely deleted unless a longer period is required by law. If your loan is approved, we keep your Financial Information for as long as the loan is active, and thereafter as needed to satisfy your Financial Institution's own recordkeeping obligations. This applies regardless of whether your Financial Institution has also configured the Platform to transmit Financial Information to its own loan origination or core system; Coviance's retention of the copy it holds is governed by this Section 8, while any copy also held by your Financial Institution is governed by your Financial Institution's own recordkeeping practices. You may request deletion of your account as described in Section 13.

9. Cookies and Other Electronic Technologies

What Are Cookies and Other Electronic Technologies?

Cookies are small text files used to store small pieces of information. We use cookies and other electronic technologies to ensure that the Platform functions properly, enhance security, provide a better user experience, and analyze performance to identify what works and where improvements are needed.

Cookie Banner and Consent

When you first visit the Platform, you'll see a cookie banner that allows you to accept or decline certain types of cookies. You can manage your cookie preferences at any time by clicking the cookie settings link in our website footer.

Types of Cookies We Use

Necessary Cookies - Required to enable the basic features of the Platform, such as providing secure log-in or adjusting your consent preferences. These cookies do not store any personally identifiable data.
Functional - Help perform certain functionalities like remembering preferences.
Analytics Cookies - Used to understand how visitors interact with the Platform. These cookies help provide information on metrics such as the number of visitors, bounce rate, traffic source, etc.
Performance Cookies - Used to understand and analyze the key performance indexes of the Platform which helps in delivering a better user experience for the visitors.

Cookie Duration

We use both session cookies (expire when you close your browser) and persistent cookies (remain until deleted or expired).

Your Choices

You can manage your cookie preferences through our cookie banner settings available in the website footer, configure your browser to refuse or delete cookies, or use opt-out tools:

Google Analytics Opt-out: https://tools.google.com/dlpage/gaoptout
Network Advertising Initiative: www.networkadvertising.org/choices
Digital Advertising Alliance: www.aboutads.info/choices

10. Automated Decision-Making

Coviance's Platform does not itself make lending decisions. Any use of automated tools or models in evaluating your application is part of your Financial Institution's underwriting process and is governed by your Financial Institution's own disclosures, not by Coviance. If you have questions about how a decision on your application was reached, contact your Financial Institution directly.

11. Compliance with Privacy Laws

Coviance complies with the data protection and privacy laws to which it is subject. You should familiarize yourself with those laws, including any exceptions which may apply under them. You should also be aware that privacy laws in various jurisdictions may change from time to time. Except to the extent expressly stated otherwise in this Privacy Policy, Coviance accepts no obligations with respect to the handling of personal information other than those mandated by law.

12. State-Specific Privacy Rights

If you are a resident of California, Colorado, Connecticut, Virginia, Utah, or another state with a comprehensive consumer privacy law, you may have some or all of the following rights with respect to the account and usage information described in Section 3 (this generally does not include (a) your Financial Information, which is separately governed by your Financial Institution's GLBA privacy notice or (b) your biometric data, which is separately governed by the identity verification vendor's privacy policy):

Right to know/access: the categories and specific pieces of personal information we have collected about you
Right to correct: inaccurate personal information we hold about you
Right to delete: your personal information, subject to certain exceptions (e.g., information we're required to retain by law)
Right to opt out: of the "sale" or "sharing" of personal information, and of certain targeted advertising or profiling. Coviance does not sell personal information for monetary consideration; if any analytics cookies in use constitute a "share" under applicable law, an opt-out mechanism is provided via cookie preference tool. Where required, we also recognize the Global Privacy Control (GPC) browser signal as a valid opt-out request.
Right to non-discrimination: for exercising any of these rights
Right to appeal: a denied rights request, generally by contacting by emailing privacy@coviance.com with the subject line "Rights Request Appeal," including your name, the original request, and the reason you believe it was wrongly decided. We will respond within 45 days of receiving your appeal, or as required by applicable state law. If your appeal is denied, we will explain why in writing.

13. How to Exercise Your Rights

Account deletion: you may request deletion of your Platform account. Note that deleting your account does not delete your loan application record held by your Financial Institution, which remains subject to your Financial Institution's retention obligations.
Financial Information requests (access, correction, deletion related to your loan application itself): should be directed to your Financial Institution, as described in its privacy notice.

If you would like to exercise any of your rights as described in this Privacy Policy, please:

Call us, toll-free, at 855-525-6730; or
Email us at privacy@coviance.com.

If you choose to contact directly by phone or email, you will need to provide us with:

Enough information to identify you;
Proof of your identity and address; and
A description of what right you want to exercise and the information to which your request relates.

We are not obligated to make a data access or data portability disclosure if we cannot verify that the person making the request is the person about whom we collected information, or is someone authorized to act on such person's behalf.

Any information we collect from you to verify your identity in connection with your request will be used solely for the purposes of verification.

14. Keeping Your Information Secure

Coviance maintains administrative, technical, and physical safeguards designed to protect your information, including encryption in transit and at rest, access controls, and monitoring. No system is completely secure, and we encourage you to use a strong, unique password and to safeguard your login credentials. Where your Financial Institution has configured the Platform to also transmit Financial Information to its own loan origination or core system, the security of that information once received by your Financial Institution is additionally governed by your Financial Institution's own security program; this does not reduce Coviance's own security obligations for the copy it retains.

15. Third Party Websites

The Platform may contain links to your Financial Institution's own website or other third-party sites not operated by Coviance. This Policy does not apply to those sites, and we encourage you to review the privacy policy of any third-party site you visit.

16. Children's Online Privacy

The Platform is not intended for children under the age of 18. We do not intentionally or knowingly collect information from children under the age of 18 and we request that individuals under the age of 18 do not submit any information on the Platform. If we learn that we have received identifying information from a user under the age of 18, we will delete this information.

17. Changes to this Statement

Coviance may from time to time and without prior notice revise this Privacy Policy. Any changes will be effective immediately when the revised Policy is posted on the Platform unless stated otherwise. We will not, however, use your information in a manner materially different than what was stated in the Privacy Policy posted on the Platform at the time your information was collected unless we receive your consent.

18. Contacting Us

If you have any questions about this Privacy Policy, you can contact us by mail, email, or phone:

Coviance

3001 Westown Parkway #200

West Des Moines, IA 50265

privacy@coviance.com

855-525-6730

For questions about your loan application, your information as held by your Financial Institution, or the status of your application, contact your Financial Institution directly, using the contact information it has provided to you.

Updated: 07/28/2026