Stash Privacy Notice

Last Updated: {{PRIVACY_EFFECTIVE_DATE}}

This Privacy Notice applies to the processing of personal information by Stash Group LLC (“Stash,” “we,” “us,” or “our”) in connection with the Stash mobile application, the stashrips.com website, and related services (collectively, the “Services,” as defined in our Terms of Service, available at {{TERMS_URL}} (the “Terms”)). The Services are offered only to individuals who have reached the Minimum Age and who reside in and are located in the United States outside the Excluded Jurisdictions listed in Schedule A to the Terms. Capitalized terms used but not defined in this Privacy Notice have the meanings given in the Terms.

1. UPDATES TO THIS PRIVACY NOTICE

2. PERSONAL INFORMATION WE COLLECT

3. HOW WE USE PERSONAL INFORMATION

4. HOW WE DISCLOSE PERSONAL INFORMATION

5. SALE AND SHARING; SENSITIVE PERSONAL INFORMATION

6. YOUR PRIVACY CHOICES AND RIGHTS

7. SUPPLEMENTAL STATE PRIVACY DISCLOSURES

8. RETENTION OF PERSONAL INFORMATION

9. SECURITY OF PERSONAL INFORMATION

10. MINIMUM AGE AND CHILDREN’S PERSONAL INFORMATION

11. THIRD-PARTY WEBSITES/APPLICATIONS

12. CONTACT US

1. UPDATES TO THIS PRIVACY NOTICE

We may update this Privacy Notice from time to time in our sole discretion. If we do, we’ll let you know by posting the updated Privacy Notice on our website and in the App, and/or we may also send other communications.

2. PERSONAL INFORMATION WE COLLECT

We collect personal information that you provide to us, personal information we collect automatically when you use the Services, and personal information from third-party sources, as described below.

A. Personal Information You Provide to Us Directly

We may collect personal information that you provide to us.

• Account Information. We collect personal information in connection with the creation and administration of your Account, including your mobile phone number, date of birth, email address, shipping address, profile name and photo, and other information you store with your Account.

• Identity Verification Information. Before your first withdrawal of Sale Proceeds or your first request to ship a Card, and at other times described in Section 4(d) of the Terms, we and our identity verification providers collect information to complete Identity Verification, such as your name, address, date of birth, and the last four digits of your Social Security number and, if that information cannot be verified, your full Social Security number and a selfie, or an image of your government-issued identity document and a selfie or liveness check.

• Purchases and Transactions. We collect information about your purchases of Platform Credit, Pack purchases, Allocations, your Collection, Buybacks (including Automatic Buybacks), your balances, withdrawals, shipping requests, and Account statements. Purchases of Platform Credit and withdrawals of Sale Proceeds are processed by our regulated payments intermediary, Coinflow (as defined in the Terms), and its financial services provider, including when you use Apple Pay, Google Pay, or ACH bank transfer. We receive information associated with your payment method and payout account, such as your billing details, the issuing country of your payment card, and your payout account details.

• Tax Information. Where required by law, we collect tax information, such as your taxpayer identification number, to issue tax forms.

• Rewards and Referral Information. If you participate in an Offer, we collect information about your progress toward and claims of rewards, your Referral Link, and information about Accounts created through it and whether they meet the qualifying criteria.

• Purchase Limits and Responsible Purchasing Information. We collect information about the purchase limits that apply to your Account. We also collect the deposit, purchase, and time limits you set, your session activity used to display session reminders, and any self-exclusion request and its period.

• Your Communications with Us. We, and our service providers, may collect the information you communicate to us, such as through email, text message, or other support channels we offer.

B. Personal Information Collected Automatically

We may collect personal information automatically when you use the Services.

• Location Information. Each time you access the Services, we collect information about your location to determine whether you are in an Excluded Jurisdiction. We derive this information from your IP address and other network information, using a third-party geolocation service, together with tools designed to detect virtual private networks and proxies. The App does not collect your device’s GPS location.

• Device Information. We may collect personal information about your device, such as your Internet protocol (IP) address, user settings, unique device identifiers, browser or device information, whether your device has been jailbroken or modified, and Internet service provider, including to perform duplicate-account and device checks.

• Usage Information. We may collect personal information about your use of the Services, such as the pages and features you use, the Packs you view and purchase, and the time and duration of your sessions.

• Cookie Notice (and Other Technologies). We use cookies, software development kits, and similar technologies (“Technologies”) that are necessary to operate and secure the Services, such as to keep you signed in and to detect fraud. We and our third-party partners may also use Technologies for analytics, to understand how you interact with the Services, and to deliver and measure advertising tailored to your interests.

See “Your Privacy Choices and Rights” below to understand your choices regarding these Technologies.

C. Personal Information Collected from Third Parties

We may collect personal information about you from third parties, including:

• Identity Verification and Sanctions Screening Providers. Coinflow and any other identity verification provider we use, such as Footprint, and our sanctions screening provider, {{SANCTIONS_SCREENING_PROVIDER}}, provide us with verification results and screening results.

• Payments Intermediary. Coinflow provides us with payment, withdrawal, and transfer status, billing details, the issuing country of your payment card, the status of any verification Coinflow requires, and information about reversed or disputed payments.

• Location and Fraud-Prevention Providers. Our geolocation provider provides us with the location associated with your IP address and an assessment of whether you appear to be using a virtual private network or proxy.

• Suppliers and Fulfillment Partners. The suppliers and marketplaces from which we source Cards, and shipping carriers, provide us with information about the sourcing, shipment, and delivery of Cards allocated to you.

3. HOW WE USE PERSONAL INFORMATION

We use personal information for a variety of business purposes, including to provide the Services, to verify eligibility and comply with law, to apply purchase limits, and for administrative purposes, as described below.

A. Provide the Services

We use personal information to fulfill our contract with you and provide the Services, such as:

• Creating and managing your Account and processing purchases of Platform Credit;

• Selling Packs, making and recording Allocations, and displaying the Reveal;

• Maintaining your Collection and displaying the Holding Period deadline for each Card;

• Processing Buybacks and Automatic Buybacks, crediting Sale Proceeds, processing withdrawals, and preparing Account statements;

• Sourcing and shipping Cards, and providing the credits described in the Terms for Cards that cannot be sourced or are lost;

• Administering rewards and referral Offers;

• Answering requests for support; and

• Communicating with you about your Account and transactions.

B. Eligibility, Compliance, and Integrity

We use personal information to determine whether you may use the Services and to protect their integrity, such as:

• Confirming at registration that you have reached the Minimum Age, and completing Identity Verification and additional verification;

• Verifying your location each time you access the Services and enforcing the Excluded Jurisdictions;

• Screening Account holders against sanctions lists and monitoring transactions for money laundering and fraud;

• Applying limits to purchases, Buybacks, and withdrawals, performing duplicate-account and device checks, and reviewing high-value withdrawals and shipments;

• Retaining records of the Pack Disclosure and Probability Table in effect for each purchase and of each Allocation;

• Issuing tax forms where required; and

• Carrying out activities that are required to comply with our legal obligations and enforcing our agreements and policies.

C. Purchase Limits and Responsible Purchasing Tools

We use personal information to apply the purchase limits that apply to your Account.

D. Administrative Purposes

We use personal information for various administrative purposes, such as:

• Detecting security incidents, protecting against malicious, deceptive, fraudulent or illegal activity, and prosecuting those responsible for that activity;

• Debugging to identify and repair errors with the Services;

• Improving, upgrading, or enhancing the Services;

• Creating de-identified and/or aggregated information. If we create or receive de-identified information, we will not attempt to reidentify such information, unless permitted by, or required to comply with, applicable laws;

• Ensuring internal quality control and safety; and

• Authenticating and verifying individual identities, including requests to exercise your rights under this Privacy Notice.

E. Marketing

We may use personal information to provide you with marketing communications as permitted by applicable law. We send marketing text messages only with your separate consent, which you may withdraw at any time.

F. With Your Consent or Direction

We may use personal information for other purposes that are clearly disclosed to you at the time you provide personal information, with your consent, or as otherwise directed by you.

4. HOW WE DISCLOSE PERSONAL INFORMATION

We disclose personal information to third parties for a variety of business purposes, including to provide the Services, to protect us or others, or in the event of a major business transaction such as a merger, sale, or asset transfer, as described below.

A. Disclosures to Provide the Services

We may disclose personal information to the categories of third parties described below.

• Service Providers. We may disclose personal information to third-party service providers that assist us with the provision of the Services, such as providers of hosting, customer service, IT support, and related services.

• Payments Intermediary. We disclose personal information to Coinflow and its financial services provider to process purchases of Platform Credit and withdrawals of Sale Proceeds, to hold and transfer funds, and to conduct the identity verification, sanctions screening, and anti-money-laundering monitoring those regulated parties require, and to Apple or Google when you use Apple Pay or Google Pay. Coinflow’s processing of personal information for its own legal and regulatory purposes is subject to Coinflow’s privacy policy, available at {{COINFLOW_PRIVACY_POLICY_URL}}.

• Identity Verification and Sanctions Screening Providers. We disclose personal information to Coinflow, to any other identity verification provider we use, such as Footprint, and to {{SANCTIONS_SCREENING_PROVIDER}} to complete Identity Verification and sanctions screening.

• Location and Fraud-Prevention Providers. We disclose your IP address and related network information to our geolocation and fraud-prevention providers to verify your location and detect the use of virtual private networks and proxies.

• Suppliers, Marketplaces, and Fulfillment Partners. We disclose personal information to the suppliers and marketplaces from which we source Cards, and to shipping carriers and insurers, as needed to source, insure, ship, and deliver Cards, including your name and shipping address.

• Auditors and Professional Advisors. We disclose personal information to our auditors and to our legal, accounting, and other professional advisors.

• Other Users. Your profile name and photo, and other information you choose to make available through the Services, may be visible to other users of the Services.

• Advertising Partners. We may disclose personal information to third-party advertising partners. These partners may set Technologies on the Services to collect information about your activities and your device, such as your IP address, device identifiers, and pages or features viewed, and may use this information, together with information collected from other services, to deliver advertising tailored to your interests (commonly called “interest-based” or “targeted” advertising) and to measure its effectiveness.

B. Disclosures to Protect Us or Others

We may access, preserve, and disclose any information we store associated with you to external parties if we, in good faith, believe doing so is required or appropriate to: comply with law enforcement or national security requests and legal process, such as a court order or subpoena; respond to inquiries from government and regulatory authorities; protect your, our, or others’ rights, property, or safety; enforce our policies or contracts; collect amounts owed to us; or assist with an investigation or prosecution of suspected or actual illegal activity.

C. Disclosure in the Event of Merger, Sale, or Other Asset Transfers

If we are involved in a merger, acquisition, financing, reorganization, bankruptcy, receivership, purchase or sale of assets, transition of service to another provider, or other similar corporate transaction, your personal information may be disclosed, sold, or transferred as part of such a transaction.

5. SALE AND SHARING; SENSITIVE PERSONAL INFORMATION

Sale and Sharing. We do not sell personal information for money. However, our disclosure of personal information to advertising partners, as described in Section 4(A), may constitute a “sale” or “sharing” of personal information, or processing for targeted advertising, under applicable state privacy laws. We do not knowingly sell or share the personal information of consumers under sixteen (16) years of age.

Opt-Out Mechanics. To the extent we sell personal information, share personal information for cross-context behavioral advertising, or process personal information for targeted advertising, you may opt out by clicking the “Your Privacy Choices” link in the footer of our website or in the App settings, or by contacting us as described in “Contact Us” below. We will treat an opt-out preference signal, such as Global Privacy Control, as a valid request to opt out of the sale and sharing of personal information and of targeted advertising for the browser or device that sends it, and, if known, for your Account, as required by applicable law.

Sensitive Personal Information. We process the following categories of sensitive personal information: your Social Security number (in full or the last four digits) and other information collected through Identity Verification, including any image of a government-issued identity document and any biometric information derived from a selfie or liveness check; Account log-in credentials; and financial account, payment card, and payout account information processed in connection with purchases of Platform Credit and withdrawals of Sale Proceeds. We do not collect precise geolocation. We use and disclose sensitive personal information only to provide the Services, verify your identity and eligibility, prevent fraud, secure the Services, and comply with law. Where applicable law requires your consent to process sensitive personal information, we obtain it before processing, unless an exception under that law applies.

6. YOUR PRIVACY CHOICES AND RIGHTS

Your Privacy Choices. The privacy choices you may have about your personal information are described below.

• Email Communications. If you receive an unwanted email from us, you can use the unsubscribe functionality found at the bottom of the email to opt out of receiving future emails. Note that you will continue to receive transaction-related emails. We may also send you certain non-promotional communications regarding us and the Services, and you will not be able to opt out of those communications (e.g., communications regarding the Services, Holding Period deadlines, withdrawals, or updates to this Privacy Notice).

• Text Messages. You may opt out of marketing text messages at any time by replying STOP or by adjusting your Account settings. We will continue to send you one-time codes and other transaction-related text messages.

• Push Notifications. You may turn off push notifications through your device settings.

• Cookies. You may stop or restrict the placement of Technologies on your device or remove them by adjusting your preferences as your browser or device permits. However, if you adjust your preferences, the Services may not work properly.

Your Privacy Rights. Depending on your state of residence, including if you reside in California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia, and subject to the conditions and exceptions in applicable law, you may have the right to:

• Confirm Whether We Are Processing Your Personal Information;

• Request Access to or Portability of Your Personal Information, including the categories of personal information we collect, the sources, the purposes, and the categories of third parties to which we disclose it;

• Request Correction of Your Personal Information;

• Request Deletion of Your Personal Information;

• Opt Out of the sale of personal information, the sharing of personal information for cross-context behavioral advertising, targeted advertising, and profiling in furtherance of decisions that produce legal or similarly significant effects;

• Limit or Withdraw Consent to our processing of sensitive personal information, where applicable law provides that right;

• Obtain a List of Third Parties to which we have disclosed personal information, where applicable law provides that right; and

• Not Be Discriminated or Retaliated Against for exercising any of these rights.

Exercising Your Rights. To exercise any of these rights, please submit a request through the privacy settings in the App or by contacting us as described in “Contact Us” below. We will verify your request by matching the information you provide with the information we maintain, which may include asking you to sign in to your Account. You may designate an authorized agent to submit a request on your behalf, and we may require the agent to provide proof of authorization and you to verify your identity directly with us. We will respond within the time required by applicable law. We may deny a request, in whole or in part, where applicable law permits, including where we must retain personal information to comply with our legal obligations or to maintain the records described in Section 8, and we will explain the reason for any denial.

Appeals. If we deny your request, you may appeal our decision by contacting us as described in “Contact Us” below with the subject line “Privacy Request Appeal”. We will respond to your appeal within the time required by applicable law. If we deny your appeal, you may contact the attorney general of your state of residence.

Notice of Financial Incentive. Our referral Offers provide the reward described in the applicable Offer when an individual creates an Account through your Referral Link and completes the qualifying activity described in Section 12 of the Terms, which involves our collection of personal information about you and the referred individual. You opt in by sharing your Referral Link and may withdraw at any time by ceasing to share it. We estimate the value of the personal information involved as approximately equal to the value of the reward provided, which we calculate in good faith based on the expenses we incur in operating the referral program and the revenue we reasonably expect to derive from referred Accounts.

7. SUPPLEMENTAL STATE PRIVACY DISCLOSURES

The following table describes the categories of personal information we collect, as defined under California law and similar state laws, and the categories of third parties to which we disclose each category for a business purpose. The sources of each category, and the purposes for which we use it, are described in Sections 2 and 3. The categories of personal information, if any, that we have sold or shared in the preceding twelve (12) months are: identifiers and internet or other electronic network activity information.

8. RETENTION OF PERSONAL INFORMATION

We retain personal information for as long as needed to provide the Services, to comply with our legal obligations, to resolve disputes, and to enforce our agreements. The criteria we use to determine retention periods include the nature of the personal information, the purposes for which we process it, and the legal and regulatory requirements that apply to it. In particular:

• Identity Verification information and sanctions screening results are retained for five (5) years after your Account is closed, or longer if required by law;

• records of purchases of Platform Credit, Pack purchases, Allocations, the Pack Disclosure and Probability Table in effect for each purchase, Buybacks, withdrawals, and shipments are retained for seven (7) years after the relevant transaction, or longer if required by law;

• location information is retained for as long as your Account remains open and for up to five (5) years after it is closed, to demonstrate our compliance with the Excluded Jurisdictions;

• tax information is retained for seven (7) years after the end of the tax year to which it relates; and

• other personal information is retained for as long as your Account remains open and for a reasonable period thereafter, unless a longer period is required or permitted by law.

9. SECURITY OF PERSONAL INFORMATION

We use reasonable technical, organizational, and physical safeguards designed to protect personal information from unauthorized access, use, disclosure, alteration, and destruction. No method of transmitting or storing information is completely secure, and we cannot guarantee the security of personal information. You are responsible for keeping your Account credentials, and access to the mobile phone number and device you use to sign in, confidential.

10. MINIMUM AGE AND CHILDREN’S PERSONAL INFORMATION

The Services are not directed to minors and are available only to individuals who have reached the Minimum Age, which is eighteen (18) years of age, nineteen (19) years of age for residents of Alabama and Nebraska, twenty-one (21) years of age for residents of Mississippi, and, where higher, the age of majority in the individual’s state of residence. We require each user to enter a date of birth at registration, and we verify age through Identity Verification before a user’s first withdrawal or shipment request. We do not knowingly collect personal information from anyone under the Minimum Age, other than as necessary to determine that the individual is not eligible to use the Services. If we learn that an Account belongs to someone under the Minimum Age, we will close the Account and delete the associated personal information, except as we are required to retain it by law.

If you are a parent or guardian and believe your child has provided personal information to us in violation of applicable law, you may contact us as described in “Contact Us” below.

11. THIRD-PARTY WEBSITES/APPLICATIONS

The Services may contain links to other websites/applications and other websites/applications may reference or link to our Services. These third-party services are not controlled by us. We encourage our users to read the privacy policies of each website and application with which they interact. We do not endorse, screen, or approve, and are not responsible for, the privacy practices or content of such other websites or applications. Providing personal information to third-party websites or applications is at your own risk.

12. CONTACT US

Stash is the controller of the personal information we process under this Privacy Notice.

If you have any questions about our privacy practices or this Privacy Notice, or to exercise your rights as detailed in this Privacy Notice, please contact us at {{PRIVACY_CONTACT_EMAIL}} or write to us at Stash Group LLC, {{PRIVACY_MAILING_ADDRESS}}.