Privacy Policy

Last updated May 2023

This privacy policy (this "Privacy Policy") explains how Personal Information (as such term is defined below) is collected, used, stored, and disclosed by Squash Cards, LLC. ("Squash," "we," "us," and "our"). This Privacy Policy applies to consumer users (individually referred to as "you") of our websites, applications, and other online services to which this Privacy Policy is posted (collectively, our "Services"). Squash is the controller and is responsible for the Services and your Personal Information. This Privacy Policy is part of our Terms of Use. By accessing or using our Services, you agree to this Privacy Policy and our Terms of Use. The provisions contained in this Privacy Policy supersede all previous notices and statements regarding our privacy practices with respect to our Services. If you do not agree to every provision of this Privacy Policy and our Terms of Use, you may not access or use our Services. The term “Personal Information” as used in this Privacy Policy shall mean (a) any information that enables us to identify you, directly or indirectly, by reference to an identifier such as your name, identification number, location data, online identifier or one or more factors specific to you, or (b) where applicable, any "nonpublic personal information" as defined under the Gramm-Leach-Bliley Act.

Application of this Privacy Policy

This Privacy Policy applies to your use of (regardless of means of access) our Services. You may access or use our Services through a desktop, laptop, mobile phone, tablet, or other consumer electronic device (each, a "Device").

Information We Collect

Information You Provide Us

In general, you can visit squash.cards or open our mobile application without telling us who you are or revealing any information about yourself. When you

submit an inquiry via our Services or register for a Squash account, we will collect Personal Information from you, which may include your name, email address, mobile phone number, banking and liabilities information, and date of birth. In addition, we will collect a password from you that will be stored as a 256 bit encrypted string on our servers. By providing your Personal Information to us, you expressly agree to our collection, use, storage, and disclosure of such information as described in this Privacy Policy.

Information About Your Transactions

We collect Personal Information about your transactions with us and others, as well as other information associated with your transactions such as amount received, amount paid for products or services, account balance, merchant information, Device Information and Log Information.

Information From Third Parties

We also collect Personal Information about you from other companies. For instance, we may receive Personal Information about you from affiliates, consumer reporting agencies, product marketing companies, transaction data providers and other third parties (such as those that assist with fraud prevention and AML compliance).

Information Automatically Collected

We (or our service providers acting on our behalf) may collect information about your use of our Services. This information may include Personal Information as well as statistical information that does not identify you ("Analytics"). Some Analytics may be correlated with Personal Information. When Analytics are, directly or indirectly, associated or combined with Personal Information, such Analytics will be considered Personal Information for purposes of this Privacy Policy. Information that we automatically collect in connection with your access or use of our Services may include:

Device Information: We may collect Device-specific information (such as hardware model, operating system version, unique Device identifiers, and mobile network Information, including your mobile phone number). We may associate your Device identifiers or mobile phone number with your Squash account. Log Information: We may record or log information from your Devices, their software, and your activity accessing or using our Services. This information may include: The Device's Internet Protocol ("IP") addressIdentification numbers associated with your DevicesDevice event information, such as crashes, system activity, and hardware settingsLocation preferencesDate and time stamps of transactionsSystem configuration informationOther interactions with our Services Information on Your Device: We may collect Personal Information contained on your Device (for instance your geolocation data) where you give us explicit permission to do so.

Information Collected Through Cookies and Similar Technologies

We use cookies to personalize our Services for you and to collect and aggregate information about usage of our Services.The cookies assign random, unique numbers to your Devices to enable our systems to recognize your Devices and to allow us to see how you use our Services. Additional general information about cookies and how they work is available at www.allaboutcookies.org.

What Are Cookies?

Cookies are small files containing a string of characters that we may store on your computer or mobile device when you access the Services. When you access the Services again, the cookies allow us to recognize your browser. Cookies may store your preferences and other information but cannot read data off your hard disk or read cookie files created by other sites. Cookies set by a website owner (in this case, Squash) are called “first party cookies.”- Cookies set by parties other than the website owner are called “third party cookies”. Third party cookies enable us to provide third party features or functionality through the Site (i.e., advertising, social media functions and analytics).

The Cookies We Use

Cookies make the use of our Services easier by, among other things, saving your preferences. We may also use cookies to deliver content tailored to your interests. Our cookies may enable us to relate your use of the Services to Personal Information that you previously provided. The information that we collect with cookies allows us to statistically analyze usage of the Services, and to improve and customize our content and other offerings. However, we only disclose information collected with cookies to third parties on an aggregated basis without the use of any information that personally identifies you.

Web Beacons

As well as cookies, we use other technologies to recognize and track your use of our Services. A web beacon (also known as a “tracking pixel” or “clear GIF”) is a clear graphic image (typically a one-pixel tag) that is delivered through a web browser or HTML e-mail, typically in conjunction with a cookie. Web beacons allows us, for example, to monitor how users move from one page within our websites to another, to track access to our communications, to understand whether users have come to our websites from an online advertisement displayed on a third-party website, to measure how ads have been viewed and to improve site performance.

Targeting Advertising

Please note that third parties (including, for example, advertising networks and providers of external services like web traffic analysis services) use cookies, over which we have no control. These cookies are likely to be analytical/performance cookies or targeting cookies. These companies may use information about your visits to this and other websites in order to provide relevant advertisements about goods and service that you may be interested in. They may also employ technology that is used to measure the effectiveness of advertisements.

Changes to our Cookie Policy

Subject to applicable law, we may revise this Cookie Policy at any time and in our sole discretion. When we revise this Cookie Policy, we will post the revised version via our Services and will update the date at the top of this Cookie Policy. The revised Cookie Policy will be effective upon posting via our Services, unless otherwise set forth therein or as otherwise required by applicable law.

Do-Not-Track Signals

Do Not Track ("DNT") is an optional browser setting that allows you to express your preferences regarding tracking by advertisers and other third parties. We do not use technology that recognizes DNT signals from your web browser.

How We Use Information

We will use your Personal Information to operate our website and mobile application and provide our Services, including: To respond to your questions, provide related customer services and to administer your Squash account; to authenticate your access to your Squash account; to create a connection between your Squash account and checking or liability account; to create payments to merchants on your behalf; to create payments to Squash on your behalf; to action your withdraw requests; to communicate with you about your Squash account and the Services;We may use Analytics as described elsewhere in this Privacy Policy and for research and commercial purposes, such as to improve our Services, performance and functionality.We may use Personal Information for the purposes described elsewhere in this Privacy Policy and internally for our general commercial purposes in line with our legitimate interests, including, among other things:to detect and prevent fraud or other abuse of our Services; to notify you of any changes to our Services; to monitor and protect the security of our information, systems and network; or to ensure that content is presented most effectively for you and your Device. To enforce our Terms of Use, we may use Personal Information for the purposes described elsewhere in this Privacy Policy and where you have provided your consent if required under the applicable law; to offer or improve our products and services; or to assess your needs and interests in order to better tailor offers and/or advertising We may use your email address to respond to your inquiries and to provide you information about our Services. We will generally ask for your consent to receive promotional emails in line with the applicable law when you first provide your Personal Information. You may elect not to receive promotional emails from us either by "unsubscribing" to an email you receive from us or by contacting us as indicated below. If you unsubscribe from receiving emails from us, we may still send you non-promotional emails, such as emails about your Squash account or

our ongoing business relations, unless you withdraw your consent to receive electronic communications as provided in our Terms of Use.

How We Share Information

We do not share your Personal Information with: (1) other financial companies for joint marketing purposes or (2) any third parties so they can market to you. We may share your Personal Information with (a) our affiliates for their everyday business purposes (e.g., information related to your transactions and experiences but not your creditworthiness) and (b) unaffiliated third parties: (1) if you request or authorize it; (2) if the information is provided to help complete a transaction for you; (3) if the information is provided to: (a) comply with applicable laws, rules, regulations, governmental and quasi-governmental requests, court orders, or subpoenas; (b) enforce our Terms of Use or other agreements; or (c) protect our rights, property, or safety or the rights, property, or safety of our users or others (e.g., to a consumer reporting agency for fraud protection, etc.); (4) if the disclosure is done as part of a purchase, transfer, or sale of services or assets (e.g., in the event that substantially all of our assets are acquired by another party, your Personal Information may be one of the transferred assets); (5) if the information is provided to our third-party service providers to perform functions on our behalf (e.g., analyzing data, providing marketing assistance, providing customer service, processing orders, etc.); (6) for our everyday business purposes; or (7) as permitted by applicable law or otherwise described in this Privacy Policy. When you are no longer our customer, we continue to share your information as described in this Privacy Policy. We transfer your Personal Information to trusted third parties who provide sufficient guarantees in respect of the technical and organizational security measures governing the processing to be carried out and who can demonstrate a commitment to compliance with those measures. Our third-party service providers will only be permitted to use Personal Information for an intended purpose and in accordance with our instructions.We may disclose Analytics with third parties as described elsewhere in this Privacy Policy and for our commercial purposes. We currently share data with partner

banks, data processors, data providers, external secure cloud databases and cybersecurity applications. We are headquartered in the United States of America. Your Personal Information will be accessed by us or transferred to us in the US and will be accessed by our US-based employees. If you visit our websites or use our Services from outside the US, be aware that your Personal Information will be transferred to, stored, and processed in the US where our servers are located, and our central database is operated. By visiting our websites or using our Services, you consent to this transfer of your Personal Information.

Opt-Out Rights

If you do not wish to receive offers or other notices from us in the future, you can "opt out" by contacting us as indicated at the end of this Privacy Policy or by following the "unsubscribe" instructions in any communication you receive from us. Please be aware that you are not able to opt out of receiving communications about your Squash account or related transactions with us.

Accessing Your Information

You must notify us of any change in your Personal Information by updating your Squash account profile through our Services. Any changes will affect only future uses of your Personal Information. Subject to applicable law, which might, from time to time, oblige us to store your Personal Information for a certain period of time, we will respect your wishes to correct inaccurate information. Otherwise, we will hold your Personal Information for as long as we believe it will help us achieve our objectives as detailed in this Privacy Policy. You can ask us whether we are storing your Personal Information and you can ask to receive a copy of that Personal Information. Before sending you any Personal Information, we will ask you to provide proof of your identity. If you are not able to provide proof of your identity, we reserve the right to refuse to send you any Personal Information. We will respond as quickly as we can to your requests for details of Personal Information we hold about you.

Information You Share Socially

Our Services may allow you to connect and share your actions, comments, content, and information publicly or with friends. We are not responsible for maintaining the confidentiality of any information you share publicly or with friends. Our Services may also allow you to connect with us on, share on, and use third- party websites, applications, and services. Please be mindful of your personal privacy needs and the privacy needs of others, as you choose whom to connect with and what to share and make public. We cannot control the privacy or security of information you choose to make public or share with others. We also do not control the privacy practices of third parties. Please contact those sites and services directly if you want to learn about their privacy practices.

Security

We have, and require our third-party service providers that receive Personal Information from us to have, a comprehensive written information security program that contains administrative, technical, and physical safeguards for our respective physical facilities and in our respective computer systems, databases, and communications networks that are reasonably designed to protect information contained within such systems from loss, misuse, or alteration. When your bank account information is transmitted via our Services, it will be protected by encryption technology, such as Secure Sockets Layer (SSL). No method of electronic transmission or storage is 100% secure. Therefore, we cannot guarantee absolute security of your Personal Information. You also play a role in protecting your Personal Information. Please safeguard your username and password for your Squash account and do not share them with others. If we receive instructions using your Squash account login information, we will consider that you have authorized the instructions. You agree to notify us immediately of any unauthorized use of your Squash account or any other breach of security. We reserve the right, in our sole discretion, to refuse to provide our Services, terminate Squash accounts, and to remove or edit content.

Protecting Children's Privacy

Our Services are not directed, or intended to be attractive, to children under the age of 18. We do not knowingly collect Personal Information from children under the age of 18. If you are under the age of 18, do not use our Services or submit any information to us.

Links to Third-Party Websites

When you use our Services, you may be directed to other websites that are beyond our control. We may also allow third-party websites or applications to link to our Services. We are not responsible for the privacy practices of any third parties or the content of linked websites, but we do encourage you to read the applicable privacy policies and terms and conditions of such parties and websites. This Privacy Policy only applies to our Services.

European Residents

If you are based in the EU, we will only process your Personal Information for a purpose described in the Privacy Policy if (1) you have provided your consent (which can be withdrawn at any time), (2) the processing is necessary for the performance of a contract we are about to enter into or have entered into with you, (3) we are required by law, or (4) the processing is necessary for the purposes of our legitimate commercial interests (except where such interests are overridden by your rights and interests). If you are based in the EU, in certain circumstances you have rights under data protection laws in relation to Personal Information we hold about you— specifically: Request access to your Personal Information. You may have the right to request access to any Personal Information we hold about you as well as related information, including the purposes for processing the Personal Information, the recipients or categories of recipients with whom the Personal Information has been shared, where possible, the period for which the Personal Information will be stored, the source of the Personal Information, and the existence of any automated decision making.Request correction of your Personal Information. You

may have the right to obtain the rectification of any inaccurate Personal Information we hold about you.Request erasure of your Personal Information. We are happy to delete records relating to you as per your request, however, like other businesses there will be certain records which we are required to keep pursuant to legal obligations we have (such as Anti-Money Laundering laws).Request restriction of processing your Personal Information. You may have the right to prevent or restrict processing of your Personal Information. However, this may lead to disabling of some or all of Squash services.Request transfer of your Personal Information. You may have the right to request transfer of Personal Information directly to a third party where this is technically feasible. Where you believe that we have not complied with our obligation under this Privacy Policy or European data protection law, you have the right to make a complaint to an EU Data Protection Authority.

Changes to our Privacy Policy

Subject to applicable law, we may revise this Privacy Policy at any time and in our sole discretion. When we revise this Privacy Policy, we will post the revised version via our Services and will update the date at the top of this Privacy Policy. The revised Privacy Policy will be effective upon posting via our Services, unless otherwise set forth therein or as otherwise required by applicable law. You are free to decide whether or not to accept a revised version of this Privacy Policy, but accepting this Privacy Policy, as revised, is required for you to continue accessing or using our Services. If you do not agree to the terms of this Privacy Policy or any revised version of this Privacy Policy, your sole recourse is to terminate your access and use of our Services. Except as otherwise expressly stated by us, your access and use of our Services is subject to the version of this Privacy Policy in effect at the time of access or use.

Contacting Us

If you have any questions regarding this Privacy Policy, or if you wish to ask us to delete, correct, or show you your Personal Information as provided above, please contact us at support@squash.cards, or Squash Cards, LLC., 47 Turner St, Salem, MA 01970