Upstart Network, Inc. and its affiliates ("UNI"), and, if applicable, Upstart Network Trust (collectively, "Upstart", "we", "us", "our") are committed to your privacy and security online. This policy describes the ways we collect, use, share and protect your personal information in connection with your use of www.upstart.com and any of its subdomains (the "Site") and the products and services offered on the Site by UNI, Upstart Network Trust and other third parties that UNI has partnered with. Information is collected through the Site by UNI in its capacity (i) as servicer and administrator to Upstart Network Trust and certain other third party loan purchasers on whose behalf it is acting, (ii) as an agent of Cross River Bank ("CRB") for whom we act as marketer and servicer of the loan program, and (iii) to request conditional loan offers from third party licensed lenders and banks, including CRB, that we have partnered with (each a “Creditor”), and apply for and, if approved, obtain a loan from a Creditor who provides you with an offer ("Referral Services").

By accessing, using our Service, or registering on the Site, you signify that you have read, understood and agree to our collection, storage, use and disclosure of your personal information as described in this Privacy Policy.

What Information we collect

The types of personal information we collect depends on the products and services you use. The information includes:

• Your contact information such as your name, address, phone, and email;
• Your date of birth, social security number, your credit history, credit scores and other information provided by consumer reporting agencies, your payment history and other information about you we access to verify your identity and manage risk;
• Information about your education, such as your degree, SAT scores, your college, your major(s), and your grades including your college transcript, and your personal interests;
• Information so we can process your payments such as your bank account numbers and bank account credentials;
• Information about your employer, current income, assets and certain expenses, including with respect to your current employment, employment offers, bank account credentials and transaction information, tax returns, W-2, brokerage statements, and pay stubs;
• Information about you when you visit the Site, including information submitted by you or our other customers when interacting with the Site’s features and using its online communication features.

In addition, when you visit the Site or use the products and services available on the Site we automatically collect certain information from your computer, mobile phone or other access device. Log file information is automatically reported by your browser or mobile device each time you access the Site. When you use the Site, our servers automatically record certain log file information. These server logs may include anonymous information such as your web request, Internet Protocol ("IP") address, browser type, referring / exit pages and URLs, number of clicks and how you interact with links on the Site, domain names, landing pages, pages viewed, and other such information. When you use the Site, we may also employ clear gifs (also known as web beacons) which are used to anonymously track the online usage patterns of our users. In addition, we may also use clear gifs in HTML-based emails sent to our users to track which emails are opened and which links are clicked by recipients. The information allows for more accurate reporting and improvement of the Site.

Third-party advertisers may use cookies on the Site for the purposes of targeted behavioral advertising. Although you may not opt out of receiving online advertisements generally, you may control the collection of data by third party advertisers on our Site used for targeted advertising during your visits to other websites. To opt-out of this data collection for targeted advertising on other sites, visit the Network Advertising Initiative.

Please note that Upstart only provides its services and offerings to consumers based in the United States and therefore, is not subject to the General Data Protection Regulation (GDPR).

Information we receive from third parties

We may receive information about you from third parties, including information we request on your behalf from credit reporting agencies such as TransUnion, Equifax, and/or Experian. We may also work with different third party data partners to supplement information we collect directly from you for fraud or identity verification purposes. We may also receive information about you if you access the Site through a third-party connection or log-in, such as LinkedIn or a referral partner, or otherwise link an account to the Site, that third party may pass certain information about you and your use of its service to us. This information could include the user ID associated with your account (for example, your LinkedIn UID), an access token necessary to access that service, any information that you have permitted the third party to share with us, and any information you have made public in connection with that service. You should always review and, if necessary, adjust your privacy settings on third-party websites and services before linking them to the Site. You may also unlink your third party account from the Site by adjusting your settings on the third party service. If you unlink your third party account, we will remove the information collected about you in connection with that service.

How we collect information

We collect information about you:

• From you when you register on the Site, use the Site, apply for a loan or to be a investor, and from your transactions, including your security purchases, repayments, account funding and withdrawals, and your communications with us; and
• From third parties such as credit bureaus, identity verification services and other public records or websites.

Why we collect information

We collect this information from or about you in order to:

• provide you and other customers with access to the products and services offered through the Site,
• improve our insights so we can tailor our content and provide you with offer recommendations and/or insights that are most relevant to you,
• provide notices and other information to you about, or in connection with, these products and services,
• provide customer support,
• protect against fraud, fulfill legal requirements and enforce our agreements, and
• provide, maintain, develop and improve our services, your experience, and to protect Upstart and its users.

What information we share on the Site, with other Upstart users, investors, and Creditors

If you request a loan offer on the Site through the Referral Services, if you select a loan offer, we will share with the Creditor whose loan offer you select all your information, including your personally identifiable, financial, and credit information, to these Creditors. We may also share this information with a Creditor if they decline to pre-approve you for a loan. If you request a loan offer directly from CRB, your information is automatically shared with CRB at the time of your initial loan inquiry even if they decline to make a loan offer.

When you sign your promissory note, your loans will automatically be allocated to one of two investment channels based on a random allocation methodology determined by us:

• The first allows investors on the Upstart site to purchase loans through Upstart Network Trust. We share some of your information with investors. This is limited to your loan terms, repayment history and loan status, income at the time of loan origination, what you intended to use your loan proceeds for, and your credit score within a 10 point range.
• The second allows investors to purchase 100% of your loan directly from us. We provide information about you included in your application, including personally identifiable, financial, and credit information, and your loan terms to these investors in advance of their purchase of your loan. As the servicer of your loan we will also share information we obtain in servicing your loan, including about your repayments, to these investors, who become the creditor, or any subsequent purchaser of your loan.

If you have an income share agreement, we will share your name and information about your repayment history with investors in your income share agreement.

What information we share with third parties

All financial companies need to share customers’ personal information to run their everyday business. We may share your personal information with:

• Creditors who you request a conditional loan offers from.
• Trustees overseeing Upstart Network Trust, including Bankers Trust Company, not in its individual capacity but solely as indenture trustee, and Wilmington Savings Fund Society, FSB d/b/a Christiana Trust not in its individual capacity but solely as owner trustee.
• CRB if you apply for a loan from them directly and any investor who purchases 100% of your loan (but not an investor in Upstart Network Trust).
• Service providers who help with parts of our business operations such as fraud prevention, servicing, bill collection, marketing and technology services, product development, and nonaffiliated financial institutions that we partner with to market or provide the products or services to you.
• Credit bureaus to report account information, as permitted by law.
• Companies that we plan to merge with or be acquired by, or companies we plan to sell, divest or transfer all or a portion of our products and/or services to, including any back-up service provider or back-up administrator we, Upstart Network Trust or any of our investors engage in the event we stop operating.
• Law enforcement, government officials, or other third parties when (1) we are compelled to do so by a subpoena, court order or similar legal procedure, (2) we need to do so to comply with law, or (3) if we believe in good faith that the disclosure of your personal information is necessary to prevent physical harm or financial loss or to report suspected illegal activity.
• Other third parties but only if you consent or direct us to do so.

Upstart will not sell or rent any of your personal information to third parties for their marketing purposes and only shares your personal information with third parties as described above.

Information that has been made anonymous so that it does not identify a specific user is not considered personal information. Federal and state laws allow you to restrict the sharing of your personal information in certain instances such as sharing your information so that third parties can market to you. However, because we will not share your information in these instances, there is no need for you to opt-out from the information we share.

How we protect your information and use cookies

We protect your personal information from unauthorized access and use by maintaining physical, electronic and procedural safeguards in compliance with applicable law. These measures include computer safeguards and secured files and buildings. We authorize our employees to get your information only when they need it to do their work, and we require companies that work for us to protect your information.

When you access the Site or content or use the products or services available through the Site, we (or companies we work with) may place small data files called cookies or pixel tags on your computer or other device. We use these technologies to recognize you as a customer; customize our services, content and advertising; collect information about your computer or other access device to mitigate risk; help prevent fraud; and improve our products and services. 
You are free to decline our cookies if your browser or browser add-on permits, but doing so may interfere with your use of the Site. The help legal section of most browsers or browser add-ons provides instructions on blocking, deleting or disabling cookies. However, certain partners may collect incoming IP addresses in connection with your visits to our Site, for example, to avoid double counting the number of new members who joined as a result of an advertising campaign.

In the event that any of your information that we control is compromised as a result of a breach of security, we will take reasonable steps to investigate the situation and, where appropriate, notify you and take other steps in accordance with any applicable laws and regulations.

Upon termination or deactivation of your Upstart account on the Site, we may retain your profile information and user content and information for backup, archival, or audit purposes.

Links to or from other websites and services

We are not responsible for the practices employed by websites or services linked to or from the Site, including any information or content they contain. Please remember that when you use a link to go from the Site to another website, our Privacy Policy does not apply to those third-party websites or services. Your browsing and interaction on any third-party website or service, including those that have a link or advertisement on the Site, are subject to that third party’s own rules and policies. In addition, you agree that we are not responsible and we do not control over any third-parties that you authorize to access your user content. If you are using a third-party website or service (like LinkedIn) and you allow such a third-party access to your user content, you do so at your own risk.

How you can access or change your personal information

You can review and edit some of your personal information at any time by logging into the Site.

Children’s privacy

We do not knowingly collect or solicit any information from anyone under the age of 13 or knowingly allow such persons to register as users. The Site and its content are not directed at children under the age of 13. If we learn that we have collected personal information from a child under age 13, we will delete that information as quickly as possible. If you believe that we might have any information from a child under 13, please contact us at privacy@upstart.com.

Changes to our Privacy Policy

We may amend this policy from time to time to reflect the changes in our business and practices, and so you should review this page periodically. The revised version will be effective at the time we post it. If we make a material change we will notify you of the changes by posting a Policy Update and update the ‘last modified’ date at the bottom of this page.

How you can contact us

If you have questions or concerns regarding this policy, you should contact us by emailing us at privacy@upstart.com, by calling us at (650) 204-1000 during our operating hours 9:00 AM PST to 5:00 PM PST, Monday through Friday, or by writing to us via regular mail at Upstart Network, Inc., P.O. Box 1503, San Carlos, CA 94070.

Privacy Notice

This privacy policy was last modified on July 11, 2018.