Chapter Financial Services Privacy Policy

1. Scope and Relationship to Our Other Policies

This Policy governs personal information we collect in connection with our financial products and services. Because we provide these products together with our Bank Partner, the personal and financial information you provide to obtain or use a deposit account or debit card is handled in accordance with this Policy and applicable financial privacy laws, including the Gramm-Leach-Bliley Act (“GLBA”).

This Policy supplements, and does not replace, the general Chapter Privacy Policy that applies to our other Services. Where you use our Medicare advisory, insurance agency, or technology Services, those activities continue to be governed by our general Privacy Policy and, where applicable, our Consumer Health Data Privacy Policy and other supplemental notices. If there is a conflict between this Policy and our general Privacy Policy with respect to our financial products, this Policy controls for those products.

The Services may contain links to, or be linked from, other websites and applications that we do not control. We are not responsible for the privacy practices of those third parties, and we encourage you to read their privacy policies.

2. How We Collect Information About You

Chapter collects information about you when you voluntarily provide it to us through the Services, including when you open or fund a deposit account, activate or use a debit card, arrange for the deposit of Social Security or other benefit payments, or link your Chapter account with other financial institutions, service providers, websites, or apps. We also collect information through your communications with us by email, phone, chat, or mail, automatically from the devices you use to access the Services, and from third parties such as our Bank Partner, payment networks, and identity-verification and benefit-payment sources.

3. What Information We Collect About You

3.1 Information You Provide

We collect the following categories of information about you when you provide them in connection with our financial products or when you communicate with us:

• Identification Information, such as your name, email address, phone number, Social Security number, date of birth, residential and mailing address, photograph, and information related to your passport, driver’s license, or other government-issued identification.
• Financial Information, such as your bank account and payment card numbers, deposit account and debit card details, account balances, and information about funding sources linked to your account.
• Benefit and Payment Information, such as information needed to receive Social Security checks, Supplemental Security Income, and other government or third-party benefit payments into your deposit account, including the identity of the paying agency or party, payment amounts, and payment schedules.
• Transaction Information, such as when and where transactions occur, the names of the transacting parties, a description of the transactions, the payment or transfer amounts, and the devices and payment methods used to complete the transactions when you use the Services to deposit funds or to make, accept, or request payments.
• Other Information that you voluntarily provide to us, including actions you perform on the Services and third-party information to which you give us access.

3.2 Information We Collect From Your Use of the Services

We collect information about you and the devices you use to access the Services, such as your computer, mobile phone, or tablet. The information we collect includes:

• Device Information: information about your device, including your hardware model, operating system and version, device name, unique device identifier, mobile network information, and information about the device’s interaction with the Services.
• Internet or Other Electronic Network Activity Information: information about how you use and interact with the Services, including your access time, browser type and language, country and language settings, IP address, internet service provider domain, the pages you visit, content you view, features you use, the date and time of your use, your search terms, and the website you visited before using the Services.
• Geolocation Information: the location of your device, including your IP address, device language, and the location of your network provider. This may include precise geolocation information.
• Inferences drawn from any of the information we collect to create a profile about you that may reflect, for example, your preferences, characteristics, and behavior, including for account-security purposes or to enhance the Services.

3.3 Information We Collect From Other Sources

We may obtain information about you from other sources, including our Bank Partner; payment processors and payment networks; identity-verification vendors; consumer reporting agencies and fraud-prevention services; government agencies and benefit-paying parties in connection with the deposit of Social Security and other benefit payments; external banks and data aggregators when you link an account; and our affiliates, service providers, and business partners.

4. How We Use Your Information

We use your information to provide, maintain, and improve the Services, and as otherwise disclosed to you, including to:

• establish and manage your Chapter account and your deposit account with our Bank Partner;
• receive, process, and post Social Security checks and other benefit and incoming payments to your deposit account;
• issue, activate, service, and process transactions on your debit card;
• process and fulfill transactions and transfers;
• determine your eligibility for, and administer your participation in, the Services;
• collect funds as authorized in connection with your account;
• perform accounting, auditing, and other internal functions;
• provide member support and perform related quality assurance, testing, and training;
• use machine learning, artificial intelligence, and risk modeling;
• research and develop new products and services;
• communicate with you about your account and about opportunities, products, services, promotions, surveys, and rewards offered by us and select partners;
• verify your identity and comply with customer-identification, anti-money-laundering, and sanctions-screening obligations;
• investigate, detect, prevent, recover from, or report fraud, security incidents, and other potentially prohibited, malicious, or illegal activity, including to initiate chargebacks on your behalf;
• protect your, our, or our other customers’ rights and property;
• identify and fix errors that impair how the Services function;
• comply with applicable laws, regulations, legal requirements, industry standards, and Chapter policies;
• respond to lawful requests for information from the government or to valid legal process; and
• exercise our rights and remedies and defend against legal claims.

Aggregate Data

We may anonymize and aggregate data collected through the Services so that it does not allow a third party to easily identify a specific individual. We may use such data for any lawful purpose.

5. How We Share Your Information

We may share your information with the following categories of third parties:

• our Bank Partner, financial institutions, payment networks, payment card associations, consumer reporting agencies, and other entities necessary to provide deposit accounts and debit cards;
• government agencies and benefit-paying parties as necessary to receive, verify, reconcile, or return Social Security and other benefit payments;
• merchants, such as when you initiate a purchase with your debit card;
• vendors, such as those who help us with customer service, dispute processing, fraud prevention, identity verification, and data management and analysis;
• advertising partners who help us run our advertising campaigns, analyze our site, and track metrics on our behalf or in connection with the Services;
• companies affiliated with Chapter; and
• others with your consent.

When we share personal information with our Bank Partner in connection with banking services, we do so as their service provider, and our Bank Partner’s privacy practices are governed by its own privacy policy, which we encourage you to review. We are not responsible for our Bank Partner’s privacy practices or policies.

In addition, if we are involved in a merger, acquisition, financing due diligence, reorganization, bankruptcy, receivership, sale of company assets, transition of service to another provider, or other corporate change, your information may be sold or transferred as part of, or in preparation for, such a transaction as permitted by law and/or contract. We cannot control how such entities may use or disclose such information.

We may also share your information if we believe that disclosure is reasonably necessary (i) to comply with any applicable law, regulation, legal process, or governmental request (for example, from creditors, tax authorities, or law enforcement agencies, or in response to a garnishment, levy, or lien notice); (ii) to establish, exercise, or defend our legal rights; (iii) to enforce or comply with our terms or other applicable agreements or policies; (iv) to protect our or our customers’ rights or property, or the security or integrity of the Services; (v) for an investigation of suspected or actual illegal activity; or (vi) to protect us, users of the Services, or the public from harm, fraud, or potentially prohibited or illegal activity.

We do not rent, sell, or share your information with other people or non-affiliated companies for their own marketing purposes unless we have your permission.

6. Links to Third-Party Services and Features

The Services may provide links to other online services and may include third-party features such as apps, tools, widgets, and plug-ins. These online services and third-party features may operate independently from us, and their privacy practices are subject to their own privacy disclosures, which we advise you to review. We are not responsible for the privacy practices of any linked online services or third-party features that are not owned or controlled by Chapter.

If you elect to use an account-linking feature in the Services, the provider of that feature may collect your information from financial institutions. By using such a service, you acknowledge and agree that the provider will collect and use your personal information in accordance with its own privacy policy, and that Chapter may use your personal information obtained through that provider for any legally permissible purpose described in this Policy.

7. Security of Your Information

We take reasonable measures, including administrative, technical, and physical safeguards, to protect your information from loss, theft, misuse, and unauthorized access, disclosure, alteration, and destruction. Nevertheless, the internet is not a 100% secure environment, and we cannot guarantee absolute security of the transmission or storage of your information. We do not accept liability for unintentional disclosure.

To help us protect your personal data, we request that you use a strong password to protect your phone and accounts, never share your password with anyone, and avoid using the same password across other sites or accounts.

If you suspect a website or app is pretending to be Chapter (also known as “spoofing”), do not enter your information. Instead, contact us using the information provided below.

8. Protection of Social Security Numbers and Government Benefit Information

It is our policy to protect the confidentiality of Social Security numbers (“SSNs”) and government benefit information from misuse and improper disclosure by maintaining and enforcing physical, electronic, and procedural safeguards. We prohibit the unlawful disclosure of SSNs and limit access to SSNs to personnel who need access in order to perform their job functions. We do not disclose SSNs to third parties except where required or permitted by law or as necessary to provide the Services you have requested, such as to verify your identity, to receive or reconcile Social Security and other benefit payments, and to establish and service your deposit account and debit card with our Bank Partner.

Funds deposited into your account, including Social Security and other benefit payments, are subject to applicable federal and state protections. We handle benefit payments in accordance with applicable law, including rules governing the treatment of federal benefit payments in connection with garnishment and similar legal process.

9. Limiting the Use of Your Information

9.1 Marketing Communications

We may provide you with information and offers we think may be of interest to you regarding the Services or third-party products and services. We will send promotional text messages only with your consent. You may choose not to receive promotional communications from us by following the “unsubscribe” link at the bottom of promotional emails, by replying “STOP” to promotional texts, or by turning off push notifications on your device. We may still send you non-promotional communications, such as messages about your account.

iOS and Android operating systems provide options to reset advertising identifiers, and you may change your preferences on your device. If you live in a state that offers sale, share, or targeted-advertising opt-outs, you can make that change by submitting a request using the contact information below.

9.2 Device and Location Information

On your mobile device, you can manage how you share certain device data by changing your privacy and security settings. You may stop our collection of location information at any time by changing the preferences on your mobile device or by uninstalling the Chapter mobile app. If you do so, some features of our app may no longer function.

9.3 Cookies and Analytics

Chapter may use cookies and other online tracking technologies, such as pixel tags and web beacons, to collect data on your online and mobile device activity, depending on your browser settings. Cookies are small text files placed on your device to track browsing activity; a web beacon is a small snippet of code that represents a graphic image on a website or in an email.

You may use your browser settings to delete or reject cookies. If you choose to delete or reject cookies, this could affect certain Services, and settings and preferences controlled by those cookies may be deleted and may need to be recreated. Some browsers offer “Do Not Track” (DNT) features; because there is no common understanding of how to interpret DNT signals, our websites do not currently respond to them.

Chapter may also use analytics providers, such as Google Analytics, to gather statistics on site usage. We have no control over these providers’ data collection, and we encourage you to review their privacy policies. You can opt out of Google Analytics at https://tools.google.com/dlpage/gaoptout.

9.4 Opt Out of Third-Party Marketing

Chapter may disclose personal information to third parties for them to market directly to you. You may choose not to have your personal information shared with third parties for this purpose by opting out. To submit an opt-out request, please email one.privacy@chapter.com with the subject line “Opt Out of Third-Party Information Sharing.”

10. Children’s Privacy

The Services are not directed to children, and we do not knowingly solicit or collect personal information from children. You must be at least 18 years old, or otherwise have the legal authority and capacity to enter into a deposit account agreement, to use our financial products. If you believe we may have been provided with personal information regarding a child, please contact us, and we will take appropriate steps to delete that information unless we are legally required to retain it.

11. Data Retention

We will retain your account and associated information as necessary to provide you with the Services. Even after you close your account, we may retain copies of information about you and any transactions or Services in which you participated for a period of time consistent with applicable law, applicable statutes of limitation, and our recordkeeping obligations as a provider of financial products. We retain such information as we reasonably believe necessary to comply with applicable laws, regulations, legal processes, or governmental requests; to detect or prevent fraud; to collect fees owed; to resolve disputes; to address problems with the Services; to assist with investigations; to enforce our agreements and policies; or to take any other actions consistent with applicable law. Actual retention periods can vary based on the type of data and the context in which it was collected.

12. Changes to Our Policy and Practices

We may amend this Policy from time to time by posting a revised version and updating the “Last Updated” date above. The revised version will be effective on the date listed. We will provide you with reasonable prior notice of material changes in how we use your information, which may include notification in our app or website or by email. If you disagree with these changes, you may close your account at any time. If you continue to use the Services, you consent to the amended Policy.

13. Contact Information

If you have any questions or concerns about this Policy or the use of your information, or to modify or update any information we have received, please contact us at one.privacy@chapter.com or:

Chapter Technologies, LLC

19 Union Square West, 12th Floor

New York, NY 10003

California Notice at Collection

We may collect (and may have collected during the 12-month period prior to the effective date of this California Notice at Collection (“California Notice”)) the following categories of personal information about you:

• Identifiers, such as a real name, postal address, unique personal identifiers, online identifier, IP address, email address, account name, Social Security number, driver’s license number, passport number, and other similar identifiers;
• Additional data subject to Cal. Civ. Code § 1798.80, such as signature, physical characteristics or description, state identification card number, education, bank account number, credit card number, debit card number, and other financial information;
• Commercial information, including records of personal property and products or services obtained or considered;
• Internet or other electronic network activity information, including browsing and search history and information regarding your interaction with websites, applications, or advertisements;
• Sensory information, such as audio, electronic, visual, and similar information;
• Professional or employment-related information;
• Inferences drawn from the above to create a profile reflecting your preferences, characteristics, and behavior; and
• Sensitive personal information, including government identifiers such as Social Security number, driver’s license, state identification card, or passport number; account log-in or financial account, debit card, or credit card numbers in combination with any required security or access code or credentials; precise geolocation data; characteristics of protected classifications; and biometric information for the purpose of uniquely identifying an individual.

Notice of Use of Personal Information

We may use your personal information for the purposes described in this Policy and for business purposes permitted under the California Consumer Privacy Act (“CCPA”), including performing services, auditing related to current interactions, short-term transient use, detecting and protecting against security incidents and fraud, debugging, internal research and development, and maintaining the quality and safety of our Services.

Application of the CCPA and the GLBA

Many of the products and services we offer are financial. The CCPA does not apply to personal information collected, processed, sold, or disclosed pursuant to the Gramm-Leach-Bliley Act (“GLBA”) and its implementing regulations. Personally identifiable financial information that our Bank Partner and we collect to provide deposit accounts, debit cards, and related financial services is generally subject to the GLBA rather than the CCPA. Where the CCPA applies to other personal information we collect, the rights described below are available to California residents.

California Privacy Rights

Subject to the GLBA exception described above and other exceptions under applicable law, California residents may have the following rights:

• Access. The right to request, twice in a 12-month period, that we disclose the personal information we have collected about you and information about our collection, use, disclosure, or sale of that information.
• Correction. The right to request that we correct inaccurate personal information, subject to certain exceptions.
• Deletion. The right to request that we delete your personal information, subject to certain exceptions.
• Opt-Out of Selling or Sharing. The right to opt out of the sale or sharing of your personal information for cross-context behavioral advertising.
• Shine the Light. The right to request a list of certain categories of personal information we disclosed to third parties for their direct marketing purposes during the preceding calendar year and the identity of those third parties.
• Opt-Out of Joint Marketing. The right to opt out of joint marketing with other financial institutions.
• Appeal. The right to appeal a decision to refuse to act on a privacy request.
• Non-Discrimination. The right not to be discriminated against for exercising any of your privacy rights.

To help protect your privacy and maintain security, we will take steps to verify your identity before granting access to your personal information or complying with a request (except for a request to opt out of sales or sharing). We may require you to provide information such as your name, date of birth, the last four digits of your Social Security number, the email and physical addresses associated with your account, one or more recent transactions, and the last four digits of one or more Chapter-branded cards associated with your account. We may decline a request where we cannot verify your identity, where the request is unreasonable or excessive, or where otherwise permitted by applicable law.

To exercise any of these rights, please contact us at one.privacy@chapter.com or at the address listed in the Contact Information section above.