Privacy Policy

Last updated: October 27, 2025

Spend Inc. (hereinafter "Spend") and its affiliates provide customers with a Card Issuing API and other services, including access to the Spend Website. We collectively refer to our services as the Spend Services. We, and us mean Spend when used in this privacy policy. Information that can be used to identify you personally is Personal Data. Please read this Privacy Policy carefully because it describes how we use, share and protect your Personal Data. This Privacy Policy also outlines your rights and how to contact us about our privacy practices with respect to the Spend Data (defined below).

Data security is very important. Please contact us immediately if you have reason to believe that your Spend account credentials have been compromised or that your Personal Data has been accessed without your permission.

1. Overview

You must have a Spend Account to use the Spend Services. You provide Personal Data to us if you open a Spend Account. A third-party Platform, such as a website or mobile application provider, provides us with your Personal Data if you need to create a Spend Account to use the Platform's service. Spend is not responsible for the Platform's use of your Personal Data and we encourage you to review the Platform's privacy policy to learn about their data practices. Spend is not a bank. The Spend Services allow you to create and access the Card Services, including the card payment services provided by our partner banks.

2. Personal Data Spend Collects

We collect Personal Data when you visit our Website, when you create an Spend Account, and when you access the Spend Services. You may also choose to submit Personal Data (a) in response to marketing or other communications; (b) through social media or online forums; (c) through participation in an offer, program, or promotion; or (d) in connection with an actual or potential business relationship with us. We may collect Personal Data directly from you, including Personal Data about your:

Identity Verification: social security number, full name, postal address, telephone number, government issued identification, and other information necessary to verify your identity.
Spend Account: email address and account login credentials.
Credit and Risk: your credit score, credit history from a credit reporting service, social media information, and other data we need to comply with risk management requirements.
Platform Service: Personal Data provided to us if you access your Spend Account through a Platform.
Financial Information: account number with the Bank, transaction history, tax returns, and payment card information.
Employment: occupation, information about your employer, and income details (such as source of income, approximate annual income and how frequently you are paid).
Voice Recordings: transcripts of conversations between you and us.
Biometrics: identity verification features that may be available by us or through third parties, such as your facial image.
Geographic location: information about your physical location that you provide or that we extrapolate from electronic cues, such as your IP address.
Other: other information you choose to provide us about yourself during interactions with you about the Spend Services.

3. Data Technology Used by Spend

Our Website uses cookies and other technologies to function effectively. These technologies record information about your use of our Website, including:

Browser and device data, such as IP address, device type, operating system and internet browser type, screen resolution, operating system name and version, device manufacturer and model, language, plug-ins, add-ons and the language version of the Website you are visiting.
Usage data, such as time spent on the Website, pages visited, links clicked, language preferences, and the pages that led or referred you to our Website.

We do not:

Collect information about your online activities on websites and connected devices over time and across third-party websites, devices, apps and other online features and services.

4. How Spend Uses Your Personal Data

We will not use, share, rent or sell your Personal Data for interest-based advertising. We use your Personal Data to:

Provide the Spend Services.
Verify your identity.
Help you access the Card Services.
Create and manage your Spend Account and Card account.
Comply with regulatory and other legal requirements and requests.
Facilitate our own business activities, such as to improve our services, develop new services, respond to customer support inquiries and conduct general analysis related to activities such as security, decision making, administrative, and reporting.
We may send you marketing communications about Spend products and services, invite you to participate in our events or surveys, or otherwise communicate with you for marketing purposes that you previously agreed to receive.

5. How Spend Discloses Personal Data

Spend shares Personal Data with our third-party service providers that we engage to provide services on our behalf. These services include website hosting, data analysis, information technology and related infrastructure, customer service, identity verification, credit services, email delivery, and auditing services. These service providers may need to access Personal Data to perform their services. We authorize service providers to use or disclose the Personal Data only as necessary to perform services on our behalf or comply with legal requirements. We require service providers to contractually commit to protect the security and confidentiality of Personal Data they process for us.

We share your Personal Data with Platforms and their use of your Personal Data is described in their privacy notice and in their terms of service with you.
We disclose Personal Data as we believe necessary: (i) to comply with applicable law; (ii) to enforce our contractual rights; (iii) to protect the rights, privacy, safety, and property of Spend, you, or others; and (iv) to respond to requests from courts, law enforcement agencies, regulatory agencies, and other public and government authorities, which may include authorities outside your country of residence.
In the event that we enter into, or intend to enter into, a transaction that alters the structure of our business, such as a reorganization, merger, sale, joint venture, assignment, transfer, change of control, or other disposition of all or any portion of our business, assets or stock, we may share Personal Data with third parties in connection with such transaction. Any other entity which purchases all or part of our business will have the right to continue to use your Personal Data, but only in the manner set out in this Privacy Policy unless you agree otherwise.

6. Your Rights and Choices

You have choices regarding the Personal Data we collect from you:

You may review, correct, or update your Personal Data in your Spend Account or by emailing us.
Depending on local laws based on your location, you may have the following rights with respect to your Personal Data:
- The right to request confirmation of whether Spend processes Personal Data relating to you, and if so, to request a copy of that Personal Data;
- The right to request that Spend rectify or update any of your Personal Data that is inaccurate, incomplete or outdated;
- The right to request that Spend erase your Personal Data in certain circumstances provided by law;
- The right to request that Spend restrict the use of your Personal Data in certain circumstances, such as while Spend considers another request that you have submitted (including a request that Spend make an update to your Personal Data);
- The right to request that Spend export to another company, where technically feasible, your Personal Data that we hold in order to provide Services to you; and
- Where the processing of your Personal Data is based on your previously given consent, you have the right to withdraw your consent at any time. You may also have the right to object to the processing of your Personal Data on grounds relating to your particular situation.

You may request the removal of the Personal Data we maintain by emailing us. Your Spend account and the corresponding Personal Data will be removed from the Spend database within 30 days after that request, unless we are required to comply with a longer retention period. If you have created an Spend account through a Platform, please contact the Platform directly with questions about your rights with respect to Personal Data.

7. Security and Retention

We maintain organizational, technical, and administrative measures designed to protect Personal Data against unauthorized access, destruction, loss, alteration, or misuse. Your Personal Data is only accessible to a limited number of personnel who need access to the information to perform their duties.

In general, we retain your Personal Data as long as we provide the services to you. We may retain Personal Data after we stop providing services to you, even if you close your Spend account, in order to comply with our legal obligations. We may also retain Personal Data to comply with our tax, accounting, and financial reporting obligations. Where we retain data, we do so in accordance with any limitation periods and records retention obligations that are imposed by applicable law.

8. International Data Transfers

Spend services are currently not available outside the United States of America. You may choose to share your Personal Data with us if you have visited our website and are in a country that has different data protection rules than the United States of America. We ask that you not share your Personal Data with us, but will take measures to ensure that your Personal Data remains protected in compliance with the standards described in this Privacy Policy.

9. Use by Minors

The Spend Services are not directed for use by individuals under the age of 13.

10. Updates To this Privacy Policy and Notifications

We are always finding ways to improve the Spend Services. Our services are dynamic, and we often introduce new features, which may require the collection of new information. If we collect materially different Personal Data or materially change how we collect, use or share your Personal Data, we will notify you and may also modify this Privacy Policy. The "Last Updated" designation at the top of this Privacy Policy indicates when this Privacy Policy was last revised. Any changes are effective when we post the revised Privacy Policy on the Spend website. We may provide you with disclosures and alerts regarding this Privacy Policy or Personal Data collected by posting them on our Website and, if you are a direct Spend account holder, by contacting you through your Spend Dashboard, email address, and/or the physical address listed in your Spend account.

11. California Residents

This section provides additional details about the Personal Data we collect about California consumers as well as the rights of California consumers under the California Consumer Privacy Act (CCPA).

a. How We Collect, Use, and Disclose your Personal Information.

Section 2 of this Privacy Policy describes the Personal Data we may have collected over the last 12 months, including the categories of sources of that information. We collect this information for the purposes described in Section 4 of this Privacy Policy. We share this information as described in Section 5 of this Privacy Policy. Spend uses cookies as described in Section 3.

b. Your CCPA Rights and Choices.

As a California consumer and subject to certain limitations under the CCPA, you have choices regarding our use and disclosure of your personal information:

Exercising the right to know. You may request, up to twice in a 12-month period, the following information about the Personal Data we have collected about you during the previous 12 months:
- the categories and specific pieces of Personal Data we have collected about you;
- the categories of sources from which we collected the Personal Data;
- the business or commercial purpose for which we collected the Personal Data;
- the categories of third parties with whom we shared the Personal Data; and
- the categories of Personal Data about you that we disclosed for a business purpose, and the categories of third parties to whom we disclosed that information for a business purpose.
Exercising the right to delete. You may request that we delete the Personal Data we have collected from you, subject to certain limitations under applicable law.
Exercising the right to opt-out from a sale. You may request to opt out of any "sale" of your Personal Data that may take place. As described in Section 3(c) of this Privacy Policy, we do not use, share, rent or sell the Personal Data of our customers for interest-based advertising. We do not sell or rent the Personal Data of our customers or visitors to our Website.
Non-discrimination. The CCPA provides that you may not be discriminated against for exercising these rights.

To submit a request to exercise any of the rights described above, you may contact us. We may need to verify your identity before responding to your request, such as verifying that the email address from which you send the request matches the email address that we have on file.

12. How to Contact Us

If you have any questions or complaints about this Privacy Policy, please contact us.